create kustomizations for every policy group

argo-cel/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./application-field-validation/application-field-validation.yaml
+  - ./application-prevent-default-project/application-prevent-default-project.yaml
+  - ./application-prevent-updates-project/application-prevent-updates-project.yaml
+  - ./applicationset-name-matches-project/applicationset-name-matches-project.yaml
+  - ./appproject-clusterresourceblacklist/appproject-clusterresourceblacklist.yaml

argo/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./application-field-validation/application-field-validation.yaml
+  - ./application-prevent-default-project/application-prevent-default-project.yaml
+  - ./application-prevent-updates-project/application-prevent-updates-project.yaml
+  - ./applicationset-name-matches-project/applicationset-name-matches-project.yaml
+  - ./appproject-clusterresourceblacklist/appproject-clusterresourceblacklist.yaml
+  - ./argo-cluster-generation-from-rancher-capi/argo-cluster-generation-from-rancher-capi.yaml

aws-cel/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./require-encryption-aws-loadbalancers/require-encryption-aws-loadbalancers.yaml

aws/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./require-aws-node-irsa/require-aws-node-irsa.yaml
+  - ./require-encryption-aws-loadbalancers/require-encryption-aws-loadbalancers.yaml

best-practices-cel/kustomization.yaml

@@ -0,0 +1,21 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./check-deprecated-apis/check-deprecated-apis.yaml
+  - ./disallow-cri-sock-mount/disallow-cri-sock-mount.yaml
+  - ./disallow-default-namespace/disallow-default-namespace.yaml
+  - ./disallow-empty-ingress-host/disallow-empty-ingress-host.yaml
+  - ./disallow-helm-tiller/disallow-helm-tiller.yaml
+  - ./disallow-latest-tag/disallow-latest-tag.yaml
+  - ./require-drop-all/require-drop-all.yaml
+  - ./require-drop-cap-net-raw/require-drop-cap-net-raw.yaml
+  - ./require-labels/require-labels.yaml
+  - ./require-pod-requests-limits/require-pod-requests-limits.yaml
+  - ./require-probes/require-probes.yaml
+  - ./require-ro-rootfs/require-ro-rootfs.yaml
+  - ./restrict-image-registries/restrict-image-registries.yaml
+  - ./restrict-node-port/restrict-node-port.yaml
+  - ./restrict-service-external-ips/restrict-service-external-ips.yaml

best-practices/kustomization.yaml

@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./add-network-policy/add-network-policy.yaml
+  - ./add-networkpolicy-dns/add-networkpolicy-dns.yaml
+  - ./add-ns-quota/add-ns-quota.yaml
+  - ./add-rolebinding/add-rolebinding.yaml
+  - ./add-safe-to-evict/add-safe-to-evict.yaml
+  - ./check-deprecated-apis/check-deprecated-apis.yaml
+  - ./disallow-cri-sock-mount/disallow-cri-sock-mount.yaml
+  - ./disallow-default-namespace/disallow-default-namespace.yaml
+  - ./disallow-empty-ingress-host/disallow-empty-ingress-host.yaml
+  - ./disallow-helm-tiller/disallow-helm-tiller.yaml
+  - ./disallow-latest-tag/disallow-latest-tag.yaml
+  - ./require-drop-all/require-drop-all.yaml
+  - ./require-drop-cap-net-raw/require-drop-cap-net-raw.yaml
+  - ./require-labels/require-labels.yaml
+  - ./require-pod-requests-limits/require-pod-requests-limits.yaml
+  - ./require-probes/require-probes.yaml
+  - ./require-ro-rootfs/require-ro-rootfs.yaml
+  - ./restrict-image-registries/restrict-image-registries.yaml
+  - ./restrict-node-port/restrict-node-port.yaml
+  - ./restrict-service-external-ips/restrict-service-external-ips.yaml

castai/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./add-castai-removal-disabled/add-castai-removal-disabled.yaml

cert-manager/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./limit-dnsnames/limit-dnsnames.yaml
+  - ./limit-duration/limit-duration.yaml
+  - ./restrict-issuer/restrict-issuer.yaml

cleanup/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./cleanup-bare-pods/cleanup-bare-pods.yaml
+  - ./cleanup-empty-replicasets/cleanup-empty-replicasets.yaml

consul-cel/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./enforce-min-tls-version/enforce-min-tls-version.yaml

consul/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./enforce-min-tls-version/enforce-min-tls-version.yaml

external-secret-operator/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./add-external-secret-prefix/add-external-secret-prefix.yaml

flux-cel/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./verify-flux-sources/verify-flux-sources.yaml
+  - ./verify-git-repositories/verify-git-repositories.yaml

flux/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./generate-flux-multi-tenant-resources/generate-flux-multi-tenant-resources.yaml
+  - ./verify-flux-images/verify-flux-images.yaml
+  - ./verify-flux-sources/verify-flux-sources.yaml
+  - ./verify-git-repositories/verify-git-repositories.yaml

gen-kustomization.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -xeuo pipefail
+for dir in ./*/; do
+    dir=${dir%*/}
+  if [[ -d "${dir}" && ! -L "${dir}" ]]; then
+    pushd "${dir}"
+    if [ ! -f ./kustomization.yaml ]; then
+      cat << 'EOF' > ./kustomization.yaml
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+EOF
+      ls -d */ -1 | sed 's/\(.*\)\//  - .\/\1\/\1.yaml/' >> ./kustomization.yaml
+    fi
+    popd
+  fi
+done

istio-cel/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./enforce-sidecar-injection-namespace/enforce-sidecar-injection-namespace.yaml
+  - ./enforce-strict-mtls/enforce-strict-mtls.yaml
+  - ./prevent-disabling-injection-pods/prevent-disabling-injection-pods.yaml

istio/kustomization.yaml

@@ -0,0 +1,18 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./add-ambient-mode-namespace/add-ambient-mode-namespace.yaml
+  - ./add-sidecar-injection-namespace/add-sidecar-injection-namespace.yaml
+  - ./create-authorizationpolicy/create-authorizationpolicy.yaml
+  - ./enforce-ambient-mode-namespace/enforce-ambient-mode-namespace.yaml
+  - ./enforce-sidecar-injection-namespace/enforce-sidecar-injection-namespace.yaml
+  - ./enforce-strict-mtls/enforce-strict-mtls.yaml
+  - ./enforce-tls-hosts-host-subnets/enforce-tls-hosts-host-subnets.yaml
+  - ./prevent-disabling-injection-pods/prevent-disabling-injection-pods.yaml
+  - ./require-authorizationpolicy/require-authorizationpolicy.yaml
+  - ./restrict-virtual-service-wildcard/restrict-virtual-service-wildcard.yaml
+  - ./service-mesh-disallow-capabilities/service-mesh-disallow-capabilities.yaml
+  - ./service-mesh-require-run-as-nonroot/service-mesh-require-run-as-nonroot.yaml

karpenter/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./add-karpenter-daemonset-priority-class/add-karpenter-daemonset-priority-class.yaml
+  - ./add-karpenter-donot-evict/add-karpenter-donot-evict.yaml
+  - ./add-karpenter-nodeselector/add-karpenter-nodeselector.yaml
+  - ./set-karpenter-non-cpu-limits/set-karpenter-non-cpu-limits.yaml

kasten-cel/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./k10-data-protection-by-label/k10-data-protection-by-label.yaml
+  - ./k10-hourly-rpo/k10-hourly-rpo.yaml
+  - ./k10-validate-ns-by-preset-label/k10-validate-ns-by-preset-label.yaml

kasten/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./kasten-3-2-1-backup/kasten-3-2-1-backup.yaml
+  - ./kasten-data-protection-by-label/kasten-data-protection-by-label.yaml
+  - ./kasten-generate-example-backup-policy/kasten-generate-example-backup-policy.yaml
+  - ./kasten-generate-policy-by-preset-label/kasten-generate-policy-by-preset-label.yaml
+  - ./kasten-hourly-rpo/kasten-hourly-rpo.yaml
+  - ./kasten-immutable-location-profile/kasten-immutable-location-profile.yaml
+  - ./kasten-minimum-retention/kasten-minimum-retention.yaml
+  - ./kasten-validate-ns-by-preset-label/kasten-validate-ns-by-preset-label.yaml

kubecost-cel/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./require-kubecost-labels/require-kubecost-labels.yaml

kubecost/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./enable-kubecost-continuous-rightsizing/enable-kubecost-continuous-rightsizing.yaml
+  - ./kubecost-proactive-cost-control/kubecost-proactive-cost-control.yaml
+  - ./require-kubecost-labels/require-kubecost-labels.yaml

kubeops/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./config-syncer-secret-generation-from-rancher-capi/config-syncer-secret-generation-from-rancher-capi.yaml

kubevirt/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./add-services/add-services.yaml
+  - ./enforce-instancetype/enforce-instancetype.yaml

linkerd-cel/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./prevent-linkerd-pod-injection-override/prevent-linkerd-pod-injection-override.yaml
+  - ./prevent-linkerd-port-skipping/prevent-linkerd-port-skipping.yaml
+  - ./require-linkerd-mesh-injection/require-linkerd-mesh-injection.yaml

linkerd/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./add-linkerd-mesh-injection/add-linkerd-mesh-injection.yaml
+  - ./add-linkerd-policy-annotation/add-linkerd-policy-annotation.yaml
+  - ./check-linkerd-authorizationpolicy/check-linkerd-authorizationpolicy.yaml
+  - ./prevent-linkerd-pod-injection-override/prevent-linkerd-pod-injection-override.yaml
+  - ./prevent-linkerd-port-skipping/prevent-linkerd-port-skipping.yaml
+  - ./require-linkerd-mesh-injection/require-linkerd-mesh-injection.yaml
+  - ./require-linkerd-server/require-linkerd-server.yaml

nginx-ingress-cel/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./disallow-ingress-nginx-custom-snippets/disallow-ingress-nginx-custom-snippets.yaml
+  - ./restrict-annotations/restrict-annotations.yaml
+  - ./restrict-ingress-paths/restrict-ingress-paths.yaml

nginx-ingress/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./disallow-ingress-nginx-custom-snippets/disallow-ingress-nginx-custom-snippets.yaml
+  - ./restrict-annotations/restrict-annotations.yaml
+  - ./restrict-ingress-paths/restrict-ingress-paths.yaml

openshift-cel/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./check-routes/check-routes.yaml
+  - ./disallow-deprecated-apis/disallow-deprecated-apis.yaml
+  - ./disallow-jenkins-pipeline-strategy/disallow-jenkins-pipeline-strategy.yaml
+  - ./disallow-security-context-constraint-anyuid/disallow-security-context-constraint-anyuid.yaml
+  - ./enforce-etcd-encryption/enforce-etcd-encryption.yaml

openshift/kustomization.yaml

@@ -0,0 +1,15 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./check-routes/check-routes.yaml
+  - ./disallow-deprecated-apis/disallow-deprecated-apis.yaml
+  - ./disallow-jenkins-pipeline-strategy/disallow-jenkins-pipeline-strategy.yaml
+  - ./disallow-security-context-constraint-anyuid/disallow-security-context-constraint-anyuid.yaml
+  - ./disallow-self-provisioner-binding/disallow-self-provisioner-binding.yaml
+  - ./enforce-etcd-encryption/enforce-etcd-encryption.yaml
+  - ./inject-infrastructurename/inject-infrastructurename.yaml
+  - ./team-validate-ns-name/team-validate-ns-name.yaml
+  - ./unique-routes/unique-routes.yaml