Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/kyverno/overlays/policies/check-openshift-deprecated-apis.yaml

@@ -0,0 +1,36 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: check-openshift-deprecated-apis
+  annotations:
+    policies.kyverno.io/title: Disallow deprecated APIs
+    policies.kyverno.io/category: OpenShift
+    policies.kyverno.io/severity: medium
+    kyverno.io/kyverno-version: 1.6.0
+    policies.kyverno.io/minversion: 1.6.0
+    kyverno.io/kubernetes-version: "1.20"
+    policies.kyverno.io/subject: ClusterRole,ClusterRoleBinding,Role,RoleBinding,RBAC
+    policies.kyverno.io/description: >-
+      OpenShift APIs are sometimes deprecated and removed after a few releases.
+      As a best practice, older API versions should be replaced with newer versions.
+      This policy validates for APIs that are deprecated or scheduled for removal.
+      Note that checking for some of these resources may require modifying the Kyverno
+      ConfigMap to remove filters.
+spec:
+  validationFailureAction: enforce
+  failurePolicy: Ignore
+  background: false
+  rules:
+  - name: check-deprecated-apis
+    match:
+      any:
+      - resources:
+          kinds:
+          - authorization.openshift.io/v1/ClusterRole
+          - authorization.openshift.io/v1/ClusterRoleBinding
+          - authorization.openshift.io/v1/Role
+          - authorization.openshift.io/v1/RoleBinding
+    validate:
+      message: >-
+                {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated.
+      deny: {}