apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-openshift-deprecated-apis
  annotations:
    policies.kyverno.io/title: Disallow deprecated APIs
    policies.kyverno.io/category: OpenShift
    policies.kyverno.io/severity: medium
    kyverno.io/kyverno-version: 1.6.0
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: "1.20"
    policies.kyverno.io/subject: ClusterRole,ClusterRoleBinding,Role,RoleBinding,RBAC
    policies.kyverno.io/description: >-
      OpenShift APIs are sometimes deprecated and removed after a few releases.
      As a best practice, older API versions should be replaced with newer versions.
      This policy validates for APIs that are deprecated or scheduled for removal.
      Note that checking for some of these resources may require modifying the Kyverno
      ConfigMap to remove filters.
spec:
  validationFailureAction: enforce
  failurePolicy: Ignore
  background: false
  rules:
  - name: check-deprecated-apis
    match:
      any:
      - resources:
          kinds:
          - authorization.openshift.io/v1/ClusterRole
          - authorization.openshift.io/v1/ClusterRoleBinding
          - authorization.openshift.io/v1/Role
          - authorization.openshift.io/v1/RoleBinding
    validate:
      message: >-
                {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated.
      deny: {}