apiVersion: v1
kind: Namespace
metadata:
  name: overdeck-factory
  labels:
    overdeck.dev/factory-admission: enabled
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: overdeck-factory-runner
  namespace: overdeck-factory
automountServiceAccountToken: false
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: overdeck-factory-job-shape
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["batch"]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["jobs"]
  validations:
    - expression: >-
        object.metadata.namespace == 'overdeck-factory' &&
        object.metadata.name.matches('^factory-[0-9a-f]{16}$') &&
        object.metadata.labels['app.kubernetes.io/name'] == 'overdeck-factory' &&
        object.metadata.labels['overdeck.dev/factory-job'] == object.metadata.name
      message: Factory Job identity is not approved
    - expression: >-
        object.spec.backoffLimit == 0 &&
        object.spec.activeDeadlineSeconds >= 60 && object.spec.activeDeadlineSeconds <= 86400 &&
        object.spec.template.spec.restartPolicy == 'Never' &&
        object.spec.template.spec.serviceAccountName == 'overdeck-factory-runner' &&
        object.spec.template.spec.automountServiceAccountToken == false &&
        size(object.spec.template.spec.imagePullSecrets) == 1 &&
        object.spec.template.spec.imagePullSecrets[0].name == 'overdeck-ghcr-pull'
      message: Factory Job execution policy is not approved
    - expression: >-
        object.spec.template.spec.securityContext.runAsNonRoot == true &&
        object.spec.template.spec.securityContext.runAsUser == 1000 &&
        object.spec.template.spec.securityContext.runAsGroup == 1000 &&
        object.spec.template.spec.securityContext.fsGroup == 1000 &&
        object.spec.template.spec.securityContext.seccompProfile.type == 'RuntimeDefault'
      message: Factory pod security context is not restricted
    - expression: >-
        size(object.spec.template.spec.initContainers) == 1 &&
        object.spec.template.spec.initContainers[0].name == 'prepare-home' &&
        object.spec.template.spec.initContainers[0].image == 'ghcr.io/alexcodeplace/overdeck-agent-sandbox@sha256:4b682407c1312da46f2c0f1d863dead53dffc45e811d9406881decd8cf015c24' &&
        object.spec.template.spec.initContainers[0].command == ['/bin/mkdir'] &&
        object.spec.template.spec.initContainers[0].args == ['-p', '/home/factory/.pi/agent'] &&
        object.spec.template.spec.initContainers[0].securityContext.allowPrivilegeEscalation == false &&
        object.spec.template.spec.initContainers[0].securityContext.readOnlyRootFilesystem == true &&
        object.spec.template.spec.initContainers[0].securityContext.capabilities.drop == ['ALL']
      message: Factory init container is not approved
    - expression: >-
        size(object.spec.template.spec.containers) == 1 &&
        object.spec.template.spec.containers[0].name == 'factory' &&
        object.spec.template.spec.containers[0].image == 'ghcr.io/alexcodeplace/overdeck-agent-sandbox@sha256:4b682407c1312da46f2c0f1d863dead53dffc45e811d9406881decd8cf015c24' &&
        object.spec.template.spec.containers[0].image.matches('^ghcr\\.io/alexcodeplace/overdeck-agent-sandbox@sha256:[0-9a-f]{64}$') &&
        object.spec.template.spec.containers[0].command == ['/usr/local/bin/factory-kubernetes-worker'] &&
        object.spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation == false &&
        object.spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem == true &&
        object.spec.template.spec.containers[0].securityContext.capabilities.drop == ['ALL']
      message: Factory workload container is not approved
    - expression: >-
        size(object.spec.template.spec.volumes) == 4 &&
        object.spec.template.spec.volumes.exists(v, v.name == 'workspace' && has(v.emptyDir)) &&
        object.spec.template.spec.volumes.exists(v, v.name == 'home' && has(v.emptyDir)) &&
        object.spec.template.spec.volumes.exists(v, v.name == 'tmp' && has(v.emptyDir)) &&
        object.spec.template.spec.volumes.exists(v, v.name == 'credentials' && v.secret.secretName == 'overdeck-factory-credentials' && v.secret.defaultMode == 288)
      message: Factory Job volumes are not approved
    - expression: >-
        size(object.spec.template.spec.containers[0].volumeMounts) == 6 &&
        object.spec.template.spec.containers[0].volumeMounts.exists(m, m.name == 'workspace' && m.mountPath == '/workspace') &&
        object.spec.template.spec.containers[0].volumeMounts.exists(m, m.name == 'home' && m.mountPath == '/home/factory') &&
        object.spec.template.spec.containers[0].volumeMounts.exists(m, m.name == 'tmp' && m.mountPath == '/tmp') &&
        object.spec.template.spec.containers[0].volumeMounts.exists(m, m.name == 'credentials' && m.mountPath == '/home/factory/.netrc' && m.subPath == 'git-netrc' && m.readOnly == true) &&
        object.spec.template.spec.containers[0].volumeMounts.exists(m, m.name == 'credentials' && m.mountPath == '/home/factory/.pi/agent/auth.json' && m.subPath == 'pi-auth.json' && m.readOnly == true) &&
        object.spec.template.spec.containers[0].volumeMounts.exists(m, m.name == 'credentials' && m.mountPath == '/home/factory/.pi/agent/models.json' && m.subPath == 'pi-models.json' && m.readOnly == true)
      message: Factory credential mounts are not approved
    - expression: >-
        size(object.spec.template.spec.containers[0].env) == 8 &&
        object.spec.template.spec.containers[0].env.all(e, e.name in [
          'FACTORY_REPO_URL', 'FACTORY_EXECUTION_REF', 'FACTORY_RESULT_REF',
          'FACTORY_INVOCATION_JSON', 'FACTORY_DATA_DIR', 'FACTORY_DB_PATH',
          'PI_AUTH_PATH', 'PI_MODELS_PATH'
        ]) &&
        object.spec.template.spec.containers[0].env.exists(e, e.name == 'FACTORY_REPO_URL' && e.value == 'https://github.com/alexcodeplace/overdeck.git') &&
        object.spec.template.spec.containers[0].env.exists(e, e.name == 'FACTORY_EXECUTION_REF' && e.value.matches('^refs/heads/factory-exec/[0-9a-f]{24}$')) &&
        object.spec.template.spec.containers[0].env.exists(e, e.name == 'FACTORY_RESULT_REF' && e.value.matches('^refs/heads/factory-result/[0-9a-f]{24}$'))
      message: Factory Job environment is not approved
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: overdeck-factory-job-shape
spec:
  policyName: overdeck-factory-job-shape
  validationActions: [Deny, Audit]
  matchResources:
    namespaceSelector:
      matchLabels:
        overdeck.dev/factory-admission: enabled
