add kyverno cluster policy

charts/kubeflow/dip/cluster-policy.yaml

@@ -0,0 +1,86 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: generate-notebook-resources
+spec:
+  admission: true
+  background: true
+  emitWarning: false
+  rules:
+    - generate:
+        apiVersion: v1
+        data:
+          metadata:
+            labels:
+              statefulset: '{{request.object.metadata.name}}'
+          spec:
+            clusterIP: None
+            selector:
+              statefulset: '{{request.object.metadata.name}}'
+        kind: Service
+        name: '{{request.object.metadata.name}}-headless'
+        namespace: '{{request.object.metadata.namespace}}'
+        synchronize: true
+      match:
+        resources:
+          kinds:
+            - Notebook
+      name: generate-notebook-headless-service
+      skipBackgroundRequests: true
+    - generate:
+        apiVersion: networking.istio.io/v1alpha3
+        data:
+          metadata:
+            labels:
+              statefulset: '{{request.object.metadata.name}}'
+          spec:
+            hosts:
+              - >-
+                {{request.object.metadata.name}}-headless.{{request.object.metadata.namespace}}.svc.cluster.local
+            http:
+              - route:
+                  - destination:
+                      host: >-
+                        {{request.object.metadata.name}}-headless.{{request.object.metadata.namespace}}.svc.cluster.local
+                      subset: '{{request.object.metadata.name}}-0'
+                    weight: 100
+        kind: VirtualService
+        name: notebook-{{request.object.metadata.name}}-headless-service
+        namespace: '{{request.object.metadata.namespace}}'
+        synchronize: true
+      match:
+        resources:
+          kinds:
+            - Notebook
+      name: generate-notebook-headless-virtualservice
+      skipBackgroundRequests: true
+    - generate:
+        apiVersion: security.istio.io/v1beta1
+        data:
+          metadata:
+            labels:
+              statefulset: '{{request.object.metadata.name}}'
+          spec:
+            rules:
+              - from:
+                  - source:
+                      principals:
+                        - >-
+                          cluster.local/ns/{{request.object.metadata.namespace}}/sa/default-editor
+              - to:
+                  - operation:
+                      ports: []
+            selector:
+              matchLabels:
+                statefulset: '{{request.object.metadata.name}}'
+        kind: AuthorizationPolicy
+        name: '{{request.object.metadata.name}}-spark-communication'
+        namespace: '{{request.object.metadata.namespace}}'
+        synchronize: true
+      match:
+        resources:
+          kinds:
+            - Notebook
+      name: generate-notebook-spark-authpolicy
+      skipBackgroundRequests: true
+  validationFailureAction: Audit

charts/kubeflow/kustomization.yaml

@@ -93,6 +93,9 @@ resources:
 # Ingress
 - ingress.yaml
 
+# dip
+- dip/cluster-policy.yaml
+
 # Pod Security Standards
 # https://kubernetes.io/docs/concepts/security/pod-security-standards/
 # Uncomment to enable baseline level standards