[BLOCKED] CIS 7: Enable workload identity

policies/templates/gcp_gke_enable_workload_identity_v1.yaml

@@ -0,0 +1,67 @@
+# Copyright 2019 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+apiVersion: templates.gatekeeper.sh/v1alpha1
+kind: ConstraintTemplate
+metadata:
+  name: gcp-gke-enable-workload-identity-v1
+spec:
+  crd:
+    spec:
+      names:
+        kind: GCPGKEEnableWorkloadIdentityConstraintV1
+        plural: gcpgkeenableworkloadidentityconstraintsv1
+      validation:
+        openAPIV3Schema:
+          properties: {}
+  targets:
+    validation.gcp.forsetisecurity.org:
+      rego: | #INLINE("validator/gke_enable_workload_identity.rego")
+             #
+             # Copyright 2019 Google LLC
+             #
+             # Licensed under the Apache License, Version 2.0 (the "License");
+             # you may not use this file except in compliance with the License.
+             # You may obtain a copy of the License at
+             #
+             #      http://www.apache.org/licenses/LICENSE-2.0
+             #
+             # Unless required by applicable law or agreed to in writing, software
+             # distributed under the License is distributed on an "AS IS" BASIS,
+             # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+             # See the License for the specific language governing permissions and
+             # limitations under the License.
+             #
+
+             package templates.gcp.GCPGKEEnableWorkloadIdentityConstraintV1
+
+             import data.validator.gcp.lib as lib
+
+             deny[{
+             	"msg": message,
+             	"details": metadata,
+             }] {
+             	constraint := input.constraint
+             	asset := input.asset
+             	asset.asset_type == "container.googleapis.com/Cluster"
+
+             	cluster := asset.resource.data
+             	identity_namespace := lib.get_default(lib.get_default(cluster, "workloadIdentityConfig", {}), "identityNamespace", null)
+             	identity_namespace == null
+
+             	message := sprintf("Kubernetes workload identity not enabled in cluster %v.", [asset.name])
+             	metadata := {"resource": asset.name}
+             }
+             #ENDINLINE