helm repo add --force-update kyverno https://kyverno.github.io/kyverno
helm repo update kyverno
helm pull kyverno/kyverno --version 3.2.7

#仿照ado中的配置稍作调整

helm upgrade -i kyverno -n kyverno --create-namespace . -f values.yaml

export DIRECTORY="$(System.DefaultWorkingDirectory)/${{parameters.folder}}"
kubectl apply -f $DIRECTORY/external/kyverno/policies/common --recursive

if test -d "$DIRECTORY/external/kyverno/policies/${{parameters.region}}"; then
  kubectl apply -f $DIRECTORY/external/kyverno/policies/${{parameters.region}} --recursive
fi

helm repo add --force-update policy-reporter https://kyverno.github.io/policy-reporter
helm repo update policy-reporter
helm pull policy-reporter/policy-reporter --version 2.24.2

kubectl create ns policy-reporter

tee certificate-policy-reporter.yaml <<'EOF'
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: cert-policy-reporter
  namespace: policy-reporter
spec:
  secretName: policy-reporter-tls-cert-secret
  privateKey:
    rotationPolicy: Always
  commonName: kyverno.hanxux.local
  dnsNames:
    - kyverno.hanxux.local
  usages:
    - digital signature
    - key encipherment
    - server auth
  issuerRef:
    name: selfsigned
    kind: ClusterIssuer
EOF

# Settings for the Policy Reporter UI subchart (see subchart's values.yaml)
ui:
  enabled: true
  create: true
  plugins:
    kyverno: true
  resources:
    limits:
      memory: 256Mi
      cpu: 300m
    requests:
      memory: 50Mi
      cpu: 100m
  ingress:
    enabled: true
    ingressClassName: nginx-default
    annotations:
      nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.oauth2-proxy.svc.cluster.local/oauth2/auth"
      nginx.ingress.kubernetes.io/auth-signin: "https://oauth2proxy.hanxux.local/oauth2/start?rd=https%3A%2F%2Fkyverno.hanxux.local"
    hosts:
    - host: kyverno.hanxux.local
      paths:
      - path: /
        pathType: Prefix
    tls:
      - secretName: policy-reporter-tls-cert-secret
        hosts:
          - kyverno.hanxux.local

helm upgrade -i policy-reporter -n policy-reporter . -f values.yaml

cat disallow_any_repo.yaml <<'EOF'
apiVersion: kyverno.io/v1
kind: ClusterPolicy # 该策略的类型为ClusterPolicy，意思是在集群范围内部署
metadata:
  name: check-images
spec:
  validationFailureAction: Enforce #阻止任何不符合规则的请求。与之相对的是Audit，会将审计信息发送给审计工具，而不阻止。
  background: false
  rules:
  - name: check-registry
    match:
      any:
      - resources: #只检查app-namespace中的pod
          kinds:
          - Pod
          namespaces:
          - app-namespace

    preconditions:
      any:
      - key: "{{request.operation}}" #检查请求是否非删除操作，非删除操作的话才继续后续评估。
        operator: NotEquals
        value: DELETE
    validate:
      message: "unknown registry other than harbor"
      foreach:
      - list: "request.object.spec.initContainers"
        pattern:
          image: "registry.local.harbor/*"
      - list: "request.object.spec.containers"
        pattern:
          image: "registry.local.harbor/*"
EOF

variables.allowedRepos.exists(repo,
  c.image.startsWith("artifactory.example.com/" + repo + "/")
)

{{- if .Values.kyvernoPolicy }}
{{- if .Values.kyvernoPolicy.targetNamespaces }}
---
apiVersion: policies.kyverno.io/v1
kind: MutatingPolicy
metadata:
  name: mutate-image-registry-cn
spec:
  # Kyverno 宕机时不阻塞 Pod 创建，Pod 会使用原始 .com 路径作为 fallback
  failurePolicy: Ignore
  matchConstraints:
    # 单一 Policy + In 操作符，避免多 policy 的 webhook selector 冲突
    namespaceSelector:
      matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: In
          values:
          {{- range .Values.kyvernoPolicy.targetNamespaces }}
            - {{ . }}
          {{- end }}
    resourceRules:
      - apiGroups: ['']
        apiVersions: ['v1']
        operations: ['CREATE', 'UPDATE']
        resources: ['pods']
  # 仓库白名单：仅替换有 Smart Remote 配置的仓库
  variables:
    - name: allowedRepos
      expression: >-
        [{{- range $i, $repo := .Values.kyvernoPolicy.allowedRepos -}}
        {{ if $i }}, {{ end }}"{{ $repo }}"
        {{- end }}]
  mutations:
    # 替换 containers 中的镜像路径
    - patchType: JSONPatch
      jsonPatch:
        expression: |
          object.spec.containers.map(c,
            c.image.startsWith("artifactory.example.com/") &&
            variables.allowedRepos.exists(repo,
              c.image.startsWith("artifactory.example.com/" + repo + "/")) ?
            JSONPatch{
              op: "replace",
              path: "/spec/containers/" + string(object.spec.containers.indexOf(c)) + "/image",
              value: c.image.replace("artifactory.example.com", "artifactory.example.cn")
            } : null
          ).filter(p, p != null)
    # 替换 initContainers 中的镜像路径（需先判断是否存在）
    - patchType: JSONPatch
      jsonPatch:
        expression: |
          has(object.spec.initContainers) ?
          object.spec.initContainers.map(c,
            c.image.startsWith("artifactory.example.com/") &&
            variables.allowedRepos.exists(repo,
              c.image.startsWith("artifactory.example.com/" + repo + "/")) ?
            JSONPatch{
              op: "replace",
              path: "/spec/initContainers/" + string(object.spec.initContainers.indexOf(c)) + "/image",
              value: c.image.replace("artifactory.example.com", "artifactory.example.cn")
            } : null
          ).filter(p, p != null)
          : []
{{- end }}
{{- end }}

kyvernoPolicy:
  # 分阶段 rollout：先基础设施，再业务 namespace
  targetNamespaces:
    - tools

  # 仅替换有 Smart Remote 缓存的仓库，跳过无缓存的（如 docker-local-sandbox）
  allowedRepos:
    - my-dockerhub-docker-remote
    - my-ghcr-docker-remote
    - my-quay-docker-remote

# 检查 policy 状态（READY 应为 true）
kubectl get mutatingpolicy
# NAME                       AGE   READY
# mutate-image-registry-cn   1m    true

# 检查 webhook selector 是否正确包含所有目标 namespace
kubectl get mutatingwebhookconfiguration kyverno-resource-mutating-webhook-cfg \
  -o jsonpath='{.webhooks[0].namespaceSelector}' | jq .

# dry-run 测试：目标 namespace 中的白名单 repo（应被替换）
kubectl run test -n tools \
  --image=artifactory.example.com/my-dockerhub-docker-remote/datadog/agent:7.68.3 \
  --dry-run=server -o jsonpath='{.spec.containers[0].image}'
# 输出: artifactory.example.cn/my-dockerhub-docker-remote/datadog/agent:7.68.3

# dry-run 测试：目标 namespace 中的非白名单 repo（不应被替换）
kubectl run test -n tools \
  --image=artifactory.example.com/my-docker-local-sandbox/some-image:latest \
  --dry-run=server -o jsonpath='{.spec.containers[0].image}'
# 输出: artifactory.example.com/my-docker-local-sandbox/some-image:latest

# dry-run 测试：非目标 namespace（不应被替换）
kubectl run test -n default \
  --image=artifactory.example.com/my-dockerhub-docker-remote/datadog/agent:7.68.3 \
  --dry-run=server -o jsonpath='{.spec.containers[0].image}'
# 输出: artifactory.example.com/my-dockerhub-docker-remote/datadog/agent:7.68.3

# rollout restart 后检查 Pod 镜像是否已替换
kubectl rollout restart deployment -n tools
kubectl get pods -n tools \
  -o jsonpath='{range .items[*]}{.metadata.name}: {.spec.containers[*].image}{"\n"}{end}'