feat(cel): add ValidatingPolicy for aws-node IRSA + tests

aws-cel/require-aws-node-irsa/policy.yaml

@@ -0,0 +1,29 @@
+apiVersion: policies.kyverno.io/v1alpha1
+kind: ValidatingPolicy
+metadata:
+  name: require-aws-node-irsa
+  annotations:
+    policies.kyverno.io/title: Require aws-node DaemonSet use IRSA
+    policies.kyverno.io/category: AWS, EKS Best Practices
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: DaemonSet
+    policies.kyverno.io/description: >-
+      Ensure the aws-node DaemonSet in kube-system does not use the "aws-node"
+      ServiceAccount (migrate to an IRSA-specific SA instead).
+spec:
+  validationActions:
+    - Audit
+  matchConstraints:
+    resourceRules:
+      - apiGroups:   ["apps"]
+        apiVersions: ["v1"]
+        operations:  ["CREATE","UPDATE"]
+        resources:   ["daemonsets"]
+  matchConditions:
+    - name: in-kube-system
+      expression: object.metadata.namespace == "kube-system"
+    - name: is-aws-node
+      expression: object.metadata.name == "aws-node"
+  validations:
+    - message: Update the aws-node DaemonSet to use IRSA (do not use "aws-node" ServiceAccount).
+      expression: object.spec.template.spec.serviceAccountName != "aws-node"

aws-cel/require-aws-node-irsa/tests/fail/ds.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: aws-node
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      app: aws-node
+  template:
+    metadata:
+      labels:
+        app: aws-node
+    spec:
+      serviceAccountName: aws-node
+      containers:
+        - name: c
+          image: registry.k8s.io/pause

aws-cel/require-aws-node-irsa/tests/fail/kyverno-test.yaml

@@ -0,0 +1,15 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: require-aws-node-irsa-fail
+policies:
+  - ../../policy.yaml
+resources:
+  - ds.yaml
+results:
+  - isValidatingPolicy: true
+    kind: DaemonSet
+    policy: require-aws-node-irsa
+    resources:
+      - aws-node
+    result: fail

aws-cel/require-aws-node-irsa/tests/pass/ds.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: aws-node
+  namespace: kube-system
+spec:
+  selector:
+    matchLabels:
+      app: aws-node
+  template:
+    metadata:
+      labels:
+        app: aws-node
+    spec:
+      serviceAccountName: aws-node-irsa
+      containers:
+        - name: c
+          image: registry.k8s.io/pause

aws-cel/require-aws-node-irsa/tests/pass/kyverno-test.yaml

@@ -0,0 +1,15 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: require-aws-node-irsa-pass
+policies:
+  - ../../policy.yaml
+resources:
+  - ds.yaml
+results:
+  - isValidatingPolicy: true
+    kind: DaemonSet
+    policy: require-aws-node-irsa
+    resources:
+      - aws-node
+    result: pass