apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  annotations:
    argocd.argoproj.io/compare-options: IgnoreExtraneous
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
    policy.open-cluster-management.io/standards: NIST SP 800-53
  resourceVersion: '7609522'
  name: bry-tam-policies-prod.gp-valid-apidepreication
  uid: b8afb33d-6a83-44de-9412-8e3b2befdcad
  creationTimestamp: '2023-12-11T00:26:36Z'
  generation: 1
  managedFields:
    - apiVersion: policy.open-cluster-management.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:argocd.argoproj.io/tracking-id': {}
      manager: argocd-controller
      operation: Apply
      time: '2023-12-11T00:24:08Z'
    - apiVersion: policy.open-cluster-management.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:status':
          'f:placement': {}
          'f:status': {}
      manager: governance-policy-propagator
      operation: Update
      subresource: status
      time: '2023-12-10T19:26:01Z'
    - apiVersion: policy.open-cluster-management.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            .: {}
            'f:argocd.argoproj.io/compare-options': {}
            'f:policy.open-cluster-management.io/categories': {}
            'f:policy.open-cluster-management.io/controls': {}
            'f:policy.open-cluster-management.io/standards': {}
          'f:labels':
            .: {}
            'f:policy.open-cluster-management.io/cluster-name': {}
            'f:policy.open-cluster-management.io/cluster-namespace': {}
            'f:policy.open-cluster-management.io/root-policy': {}
        'f:spec':
          .: {}
          'f:copyPolicyMetadata': {}
          'f:dependencies': {}
          'f:disabled': {}
          'f:policy-templates': {}
          'f:remediationAction': {}
      manager: governance-policy-propagator
      operation: Update
      time: '2023-12-11T00:26:36Z'
    - apiVersion: policy.open-cluster-management.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:status':
          .: {}
          'f:compliant': {}
          'f:details': {}
      manager: governance-policy-framework-addon
      operation: Update
      subresource: status
      time: '2023-12-11T00:26:37Z'
    - apiVersion: policy.open-cluster-management.io/v1
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:finalizers':
            .: {}
            'v:"policy.open-cluster-management.io/cleanup-cluster-scoped-policies"': {}
      manager: governance-policy-framework-addon
      operation: Update
      time: '2023-12-11T00:26:39Z'
  namespace: local-cluster
  finalizers:
    - policy.open-cluster-management.io/cleanup-cluster-scoped-policies
  labels:
    policy.open-cluster-management.io/cluster-name: local-cluster
    policy.open-cluster-management.io/cluster-namespace: local-cluster
    policy.open-cluster-management.io/root-policy: bry-tam-policies-prod.gp-valid-apidepreication
spec:
  copyPolicyMetadata: false
  dependencies:
    - apiVersion: policy.open-cluster-management.io/v1
      compliance: Compliant
      kind: Policy
      name: bry-tam-policies-prod.gatekeeper-instance
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: templates.gatekeeper.sh/v1beta1
        kind: ConstraintTemplate
        metadata:
          annotations:
            description: >-
              Verifies deprecated Kubernetes APIs to ensure all the API versions
              are up to date. This template does not apply to audit as audit
              looks at the resources which are already present in the cluster
              with non-deprecated API versions.
            metadata.gatekeeper.sh/title: Verify deprecated APIs
            metadata.gatekeeper.sh/version: 1.0.0
          name: verifydeprecatedapi
        spec:
          crd:
            spec:
              names:
                kind: VerifyDeprecatedAPI
              validation:
                openAPIV3Schema:
                  properties:
                    k8sVersion:
                      description: kubernetes version
                      type: number
                    kvs:
                      description: Deprecated api versions and corresponding kinds
                      items:
                        properties:
                          deprecatedAPI:
                            description: deprecated api
                            example: flowcontrol.apiserver.k8s.io/v1beta2
                            type: string
                          kinds:
                            description: impacted list of kinds
                            example: '["FlowSchema", "PriorityLevelConfiguration"]'
                            items:
                              type: string
                            type: array
                          targetAPI:
                            description: target api
                            example: flowcontrol.apiserver.k8s.io/v1beta3
                            type: string
                        type: object
                      type: array
                  type: object
          evaluationInterval:
            compliant: 30s
            noncompliant: 30s
          pruneObjectBehavior: None
          targets:
            - rego: |
                package verifydeprecatedapi

                violation[{"msg": msg}] {
                  kvs := input.parameters.kvs[_]
                  kvs.deprecatedAPI == input.review.object.apiVersion
                  k := kvs.kinds[_]
                  k == input.review.object.kind
                  msg := get_message(input.review.object.kind, input.review.object.apiVersion, input.parameters.k8sVersion, kvs.targetAPI)
                }

                get_message(kind, apiVersion, k8sVersion, targetAPI) = msg {
                  not match(targetAPI)
                  msg := sprintf("API %v for %v is deprecated in Kubernetes version %v, please use %v instead", [kind, apiVersion, k8sVersion, targetAPI])
                }

                get_message(kind, apiVersion, k8sVersion, targetAPI) = msg {
                  match(targetAPI)
                  msg := sprintf("API %v for %v is deprecated in Kubernetes version %v, please see Kubernetes API deprecation guide", [kind, apiVersion, k8sVersion])
                }

                match(api) {
                  api == "None"
                }
              target: admission.k8s.gatekeeper.sh
    - extraDependencies:
        - apiVersion: templates.gatekeeper.sh/v1beta1
          compliance: Compliant
          kind: ConstraintTemplate
          name: verifydeprecatedapi
      objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: verifydeprecatedapi-1.16
        spec:
          evaluationInterval:
            compliant: 30s
            noncompliant: 30s
          object-templates-raw: >-
            {{- if (semverCompare "^1.16" (fromClusterClaim
            "kubeversion.open-cluster-management.io")) }}

            - complianceType: musthave
              objectDefinition:
                apiVersion: constraints.gatekeeper.sh/v1beta1
                kind: VerifyDeprecatedAPI
                metadata:
                  name: verify-1.16
                spec:
                  match:
                    kinds:
                      - apiGroups: ["apps"]
                        kinds: ["Deployment", "ReplicaSet", "StatefulSet", "DaemonSet"]
                      - apiGroups: ["extensions"]
                        kinds: ["PodSecurityPolicy", "ReplicaSet", "Deployment", "DaemonSet", "NetworkPolicy"]
                  parameters:
                    kvs: 
                      - deprecatedAPI: "apps/v1beta1"
                        kinds: ["Deployment", "ReplicaSet", "StatefulSet"]
                        targetAPI: "apps/v1"
                      - deprecatedAPI: "extensions/v1beta1"
                        kinds: ["ReplicaSet", "Deployment", "DaemonSet"]
                        targetAPI: "apps/v1"
                      - deprecatedAPI: "extensions/v1beta1"
                        kinds: ["PodSecurityPolicy"]
                        targetAPI: "policy/v1beta1"
                      - deprecatedAPI: "apps/v1beta2"
                        kinds: ["ReplicaSet", "StatefulSet", "Deployment", "DaemonSet"]
                        targetAPI: "apps/v1"
                      - deprecatedAPI: "extensions/v1beta1"
                        kinds: ["NetworkPolicy"]
                        targetAPI: "networking.k8s.io/v1"
                    k8sVersion: 1.16
            {{- end }}
          pruneObjectBehavior: None
          remediationAction: enforce
          severity: high
    - extraDependencies:
        - apiVersion: policy.open-cluster-management.io/v1
          compliance: Compliant
          kind: ConfigurationPolicy
          name: verifydeprecatedapi
      objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: verifydeprecatedapi-1.22
        spec:
          evaluationInterval:
            compliant: 30s
            noncompliant: 30s
          object-templates-raw: >-
            {{- if (semverCompare "^1.22" (fromClusterClaim
            "kubeversion.open-cluster-management.io")) }}

            - complianceType: musthave
              objectDefinition:
                apiVersion: constraints.gatekeeper.sh/v1beta1
                kind: VerifyDeprecatedAPI
                metadata:
                  name: verify-1.22
                spec:
                  match:
                    kinds:
                      - apiGroups: ["admissionregistration.k8s.io"]
                        kinds: ["MutatingWebhookConfiguration", "ValidatingWebhookConfiguration"]
                      - apiGroups: ["apiextensions.k8s.io"]
                        kinds: ["CustomResourceDefinition"]
                      - apiGroups: [apiregistration.k8s.io"]
                        kinds: ["APIService"]
                      - apiGroups: ["authentication.k8s.io"]
                        kinds: ["TokenReview"]
                      - apiGroups: ["authorization.k8s.io"]
                        kinds: ["SubjectAccessReview"]
                      - apiGroups: ["certificates.k8s.io"]
                        kinds: ["CertificateSigningRequest"]
                      - apiGroups: ["coordination.k8s.io"]
                        kinds: ["Lease"]
                      - apiGroups: ["extensions", "networking.k8s.io"]
                        kinds: ["Ingress"]
                      - apiGroups: ["networking.k8s.io"]
                        kinds: ["IngressClass"]
                      - apiGroups: ["rbac.authorization.k8s.io"]
                        kinds: ["ClusterRole", "ClusterRoleBinding", "Role", "RoleBinding"]
                      - apiGroups: ["scheduling.k8s.io/v1beta1"]
                        kinds: ["PriorityClass"]
                      - apiGroups: ["storage.k8s.io/v1beta1"]
                        kinds: ["CSIDriver", "CSINode", "StorageClass", "VolumeAttachment"]
                  parameters:
                    kvs: 
                      - deprecatedAPI: "admissionregistration.k8s.io/v1beta1"
                        kinds: ["MutatingWebhookConfiguration", "ValidatingWebhookConfiguration"]
                        targetAPI: "admissionregistration.k8s.io/v1"
                      - deprecatedAPI: "apiextensions.k8s.io/v1beta1"
                        kinds: ["CustomResourceDefinition"]
                        targetAPI: "apiextensions.k8s.io/v1"
                      - deprecatedAPI: "apiregistration.k8s.io/v1beta1"
                        kinds: ["APIService"]
                        targetAPI: "apiregistration.k8s.io/v1"
                      - deprecatedAPI: "authentication.k8s.io/v1beta1"
                        kinds: ["TokenReview"]
                        targetAPI: "authentication.k8s.io/v1"
                      - deprecatedAPI: "authorization.k8s.io/v1beta1"
                        kinds: ["SubjectAccessReview"]
                        targetAPI: "authorization.k8s.io/v1"
                      - deprecatedAPI: "certificates.k8s.io/v1beta1"
                        kinds: ["CertificateSigningRequest"]
                        targetAPI: "certificates.k8s.io/v1"
                      - deprecatedAPI: "coordination.k8s.io/v1beta1"
                        kinds: ["Lease"]
                        targetAPI: "coordination.k8s.io/v1"
                      - deprecatedAPI: "extensions/v1beta1"
                        kinds: ["Ingress"]
                        targetAPI: "networking.k8s.io/v1"
                      - deprecatedAPI: "networking.k8s.io/v1beta1"
                        kinds: ["Ingress", "IngressClass"]
                        targetAPI: "networking.k8s.io/v1"
                      - deprecatedAPI: "rbac.authorization.k8s.io/v1beta1"
                        kinds: ["ClusterRole", "ClusterRoleBinding", "Role", "RoleBinding"]
                        targetAPI: "rbac.authorization.k8s.io/v1"
                      - deprecatedAPI: "scheduling.k8s.io/v1beta1"
                        kinds: ["PriorityClass"]
                        targetAPI: "scheduling.k8s.io/v1"
                      - deprecatedAPI: "storage.k8s.io/v1beta1"
                        kinds: ["CSIDriver", "CSINode", "StorageClass", "VolumeAttachment"]
                        targetAPI: "storage.k8s.io/v1"
                    k8sVersion: 1.22

            {{- end }}
          pruneObjectBehavior: None
          remediationAction: enforce
          severity: high
    - extraDependencies:
        - apiVersion: policy.open-cluster-management.io/v1
          compliance: Compliant
          kind: ConfigurationPolicy
          name: verifydeprecatedapi
      objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: verifydeprecatedapi-1.25
        spec:
          evaluationInterval:
            compliant: 30s
            noncompliant: 30s
          object-templates-raw: >-
            {{- if (semverCompare "^1.25" (fromClusterClaim
            "kubeversion.open-cluster-management.io")) }}

            - complianceType: musthave
              objectDefinition:
                apiVersion: constraints.gatekeeper.sh/v1beta1
                kind: VerifyDeprecatedAPI
                metadata:
                  name: verify-1.25
                spec:
                  match:
                    kinds:
                      - apiGroups: ["batch"]
                        kinds: ["CronJob"]
                      - apiGroups: ["discovery.k8s.io"]
                        kinds: ["EndpointSlice"]
                      - apiGroups: ["events.k8s.io"]
                        kinds: ["Event"]
                      - apiGroups: ["autoscaling"]
                        kinds: ["HorizontalPodAutoscaler"]
                      - apiGroups: ["policy"]
                        kinds: ["PodDisruptionBudget", "PodSecurityPolicy"]
                  parameters:
                    kvs: 
                      - deprecatedAPI: "batch/v1beta1"
                        kinds: ["CronJob"]
                        targetAPI: "batch/v1"
                      - deprecatedAPI: "discovery.k8s.io/v1beta1"
                        kinds: ["EndpointSlice"]
                        targetAPI: "discovery.k8s.io/v1"
                      - deprecatedAPI: "events.k8s.io/v1beta1"
                        kinds: ["Event"]
                        targetAPI: "events.k8s.io/v1"
                      - deprecatedAPI: "autoscaling/v2beta1"
                        kinds: ["HorizontalPodAutoscaler"]
                        targetAPI: "autoscaling/v2"
                      - deprecatedAPI: "policy/v1beta1"
                        kinds: ["PodDisruptionBudget"]
                        targetAPI: "policy/v1"
                      - deprecatedAPI: "policy/v1beta1"
                        kinds: ["PodSecurityPolicy"]
                        targetAPI: "None"
                      - deprecatedAPI: "node.k8s.io/v1beta1"
                        kinds: ["RuntimeClass"]
                        targetAPI: "node.k8s.io/v1"
                    k8sVersion: 1.25

            {{- end }}
          pruneObjectBehavior: None
          remediationAction: enforce
          severity: high
    - extraDependencies:
        - apiVersion: policy.open-cluster-management.io/v1
          compliance: Compliant
          kind: ConfigurationPolicy
          name: verifydeprecatedapi
      objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: verifydeprecatedapi-1.26
        spec:
          evaluationInterval:
            compliant: 30s
            noncompliant: 30s
          object-templates-raw: >-
            {{- if (semverCompare "^1.26" (fromClusterClaim
            "kubeversion.open-cluster-management.io")) }}

            - complianceType: musthave
              objectDefinition:
                apiVersion: constraints.gatekeeper.sh/v1beta1
                kind: VerifyDeprecatedAPI
                metadata:
                  name: verify-1.26
                spec:
                  match:
                    kinds:
                      - apiGroups: ["flowcontrol.apiserver.k8s.io"]
                        kinds: ["FlowSchema", "PriorityLevelConfiguration"]
                      - apiGroups: ["autoscaling"]
                        kinds: ["HorizontalPodAutoscaler"]
                  parameters:
                    kvs: 
                      - deprecatedAPI: "flowcontrol.apiserver.k8s.io/v1beta1"
                        kinds: ["FlowSchema", "PriorityLevelConfiguration"]
                        targetAPI: "flowcontrol.apiserver.k8s.io/v1beta3"
                      - deprecatedAPI: "autoscaling/v2beta2"
                        kinds: ["HorizontalPodAutoscaler"]
                        targetAPI: "autoscaling/v2"
                    k8sVersion: 1.26
            {{- end }}
          pruneObjectBehavior: None
          remediationAction: enforce
          severity: high
    - extraDependencies:
        - apiVersion: policy.open-cluster-management.io/v1
          compliance: Compliant
          kind: ConfigurationPolicy
          name: verifydeprecatedapi
      objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: verifydeprecatedapi-1.27
        spec:
          evaluationInterval:
            compliant: 30s
            noncompliant: 30s
          object-templates-raw: >-
            {{- if (semverCompare "^1.27" (fromClusterClaim
            "kubeversion.open-cluster-management.io")) }}

            - complianceType: musthave
              objectDefinition:
                apiVersion: constraints.gatekeeper.sh/v1beta1
                kind: VerifyDeprecatedAPI
                metadata:
                  name: verify-1.27
                spec:
                  match:
                    kinds:
                      - apiGroups: ["storage.k8s.io"]
                        kinds: ["CSIStorageCapacity"]
                  parameters:
                    kvs: 
                      - deprecatedAPI: "storage.k8s.io/v1beta1"
                        kinds: ["CSIStorageCapacity"]
                        targetAPI: "storage.k8s.io/v1"
                    k8sVersion: 1.27
            {{- end }}
          pruneObjectBehavior: None
          remediationAction: enforce
          severity: high
    - extraDependencies:
        - apiVersion: policy.open-cluster-management.io/v1
          compliance: Compliant
          kind: ConfigurationPolicy
          name: verifydeprecatedapi
      objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: verifydeprecatedapi-1.29
        spec:
          evaluationInterval:
            compliant: 30s
            noncompliant: 30s
          object-templates-raw: >-
            {{- if (semverCompare "^1.29" (fromClusterClaim
            "kubeversion.open-cluster-management.io")) }}

            - complianceType: musthave
              objectDefinition:
                apiVersion: constraints.gatekeeper.sh/v1beta1
                kind: VerifyDeprecatedAPI
                metadata:
                  name: verify-1.29
                spec:
                  match:
                    kinds:
                      - apiGroups: ["flowcontrol.apiserver.k8s.io"]
                        kinds: ["FlowSchema", "PriorityLevelConfiguration"]
                  parameters:
                    kvs: 
                      - deprecatedAPI: "flowcontrol.apiserver.k8s.io/v1beta2"
                        kinds: ["FlowSchema", "PriorityLevelConfiguration"]
                        targetAPI: "flowcontrol.apiserver.k8s.io/v1beta3"
                    k8sVersion: 1.29
            {{- end }}
          pruneObjectBehavior: None
          remediationAction: enforce
          severity: high
  remediationAction: enforce
status:
  compliant: Pending
  details:
    - compliant: Compliant
      history:
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f5adbf74567
          lastTimestamp: '2023-12-11T00:26:36Z'
          message: >-
            Compliant; ConstraintTemplate verifydeprecatedapi was created
            successfully
      templateMeta:
        creationTimestamp: null
        name: verifydeprecatedapi
    - compliant: Pending
      history:
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f5ade64805f
          lastTimestamp: '2023-12-11T00:26:36Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConstraintTemplate verifydeprecatedapi)
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f0107e5f847
          lastTimestamp: '2023-12-11T00:20:10Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConstraintTemplate verifydeprecatedapi)
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9ebe023955c7
          lastTimestamp: '2023-12-11T00:15:23Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
      templateMeta:
        creationTimestamp: null
        name: verifydeprecatedapi-1.16
    - compliant: Pending
      history:
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f5ae1503e35
          lastTimestamp: '2023-12-11T00:26:36Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9ebe0e1d5a61
          lastTimestamp: '2023-12-11T00:15:23Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
      templateMeta:
        creationTimestamp: null
        name: verifydeprecatedapi-1.22
    - compliant: Pending
      history:
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f5ae493f137
          lastTimestamp: '2023-12-11T00:26:36Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9ebe1a0d732f
          lastTimestamp: '2023-12-11T00:15:23Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
      templateMeta:
        creationTimestamp: null
        name: verifydeprecatedapi-1.25
    - compliant: Pending
      history:
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f5ae79a4e48
          lastTimestamp: '2023-12-11T00:26:36Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9ebe26093108
          lastTimestamp: '2023-12-11T00:15:23Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
      templateMeta:
        creationTimestamp: null
        name: verifydeprecatedapi-1.26
    - compliant: Pending
      history:
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f5ae8e72af1
          lastTimestamp: '2023-12-11T00:26:36Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9ebe31efa629
          lastTimestamp: '2023-12-11T00:15:23Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
      templateMeta:
        creationTimestamp: null
        name: verifydeprecatedapi-1.27
    - compliant: Pending
      history:
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9f5af4f0c83a
          lastTimestamp: '2023-12-11T00:26:37Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
        - eventName: bry-tam-policies-prod.gp-valid-apidepreication.179f9ebe3dd52b96
          lastTimestamp: '2023-12-11T00:15:24Z'
          message: >-
            Pending; Dependencies were not satisfied: 1 is still pending
            (ConfigurationPolicy verifydeprecatedapi)
      templateMeta:
        creationTimestamp: null
        name: verifydeprecatedapi-1.29
