Deploy GitHub Pages

404.html

@@ -1176,6 +1176,19 @@
   </li>
 
         
+          
+          
+          
+
+
+
+  <li class="md-nav__item">
+    <a href="/ingress-nginx/examples/openpolicyagent/" class="md-nav__link">
+      Open Policy Agent rules
+    </a>
+  </li>
+
+        
       </ul>
     </nav>
   </li>

examples/openpolicyagent/rule.yaml

@@ -0,0 +1,14 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sBlockIngressPathType
+metadata:
+  name: implspecificisblocked
+spec:
+  match:
+    kinds:
+      - apiGroups: ["networking.k8s.io"]
+        kinds: ["Ingress"]
+  parameters:
+    namespacesExceptions:
+      - "privileged"
+    blockedTypes:
+      - "ImplementationSpecific"

examples/openpolicyagent/template.yaml

@@ -0,0 +1,40 @@
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8sblockingresspathtype
+  annotations:
+    metadata.gatekeeper.sh/title: "Block a pathType usage"
+    description: >-
+      Users should not be able to use specific pathTypes
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sBlockIngressPathType
+      validation:
+        openAPIV3Schema:
+          type: object
+          properties:
+            blockedTypes:
+              type: array
+              items: 
+                type: string 
+            namespacesExceptions:
+              type: array
+              items: 
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package K8sBlockIngressPathType
+
+        violation[{"msg": msg}] {
+          input.review.kind.kind == "Ingress"
+          ns := input.review.object.metadata.namespace
+          excemptNS := [good | excempts = input.parameters.namespacesExceptions[_] ; good = excempts == ns]
+          not any(excemptNS)
+          pathType := object.get(input.review.object.spec.rules[_].http.paths[_], "pathType", "")
+          blockedPath := [blocked | blockedTypes = input.parameters.blockedTypes[_] ; blocked = blockedTypes == pathType]
+          any(blockedPath)
+          msg := sprintf("pathType '%v' is not allowed in this namespace", [pathType])
+        }

examples/openpolicyagent/tests/should-allow-ns-except.yaml

@@ -0,0 +1,18 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  creationTimestamp: null
+  name: simple
+  namespace: privileged
+spec:
+  rules:
+  - host: foo1.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: svc1
+            port:
+              number: 8080
+        path: /bar
+        pathType: ImplementationSpecific

examples/openpolicyagent/tests/should-allow.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  creationTimestamp: null
+  name: simple
+spec:
+  rules:
+  - host: foo.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: svc1
+            port:
+              number: 8080
+        path: /bar
+        pathType: Exact

examples/openpolicyagent/tests/should-deny.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  creationTimestamp: null
+  name: simple
+spec:
+  rules:
+  - host: foo2.com
+    http:
+      paths:
+      - backend:
+          service:
+            name: svc1
+            port:
+              number: 8080
+        path: /bar
+        pathType: ImplementationSpecific

sitemap.xml

@@ -1,211 +1,215 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><url>
      <loc>https://kubernetes.github.io/ingress-nginx/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/how-it-works/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/troubleshooting/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/kubectl-plugin/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/deploy/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/deploy/baremetal/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/deploy/rbac/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/deploy/upgrade/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/deploy/hardening-guide/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/basic-usage/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/custom-template/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/log-format/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/custom-errors/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/default-backend/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/ingress-path-matching/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/external-articles/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/miscellaneous/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/monitoring/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/multiple-ingress/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/tls/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/modsecurity/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/opentracing/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/opentelemetry/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/PREREQUISITES/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/affinity/cookie/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/auth/basic/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/auth/client-certs/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/auth/external-auth/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/customization/configuration-snippets/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/customization/custom-configuration/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/customization/custom-errors/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/customization/custom-headers/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/customization/external-auth-headers/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/customization/ssl-dh-param/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/customization/sysctl/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/docker-registry/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/grpc/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/multi-tls/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/rewrite/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/static-ip/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/tls-termination/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/examples/psp/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
+     <changefreq>daily</changefreq>
+    </url><url>
+     <loc>https://kubernetes.github.io/ingress-nginx/examples/openpolicyagent/</loc>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/developer-guide/getting-started/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url><url>
      <loc>https://kubernetes.github.io/ingress-nginx/developer-guide/code-overview/</loc>
-     <lastmod>2023-05-21</lastmod>
+     <lastmod>2023-05-25</lastmod>
      <changefreq>daily</changefreq>
     </url>
 </urlset>