acdl/platform/abac/token-vend.policy

{
  "apiVersion": "json.kyverno.io/v1alpha1",
  "kind": "ValidatingPolicy",
  "metadata": {
    "name": "token-vend",
    "annotations": {
      "nova.cloudinit.dev/severity": "critical",
      "title.policy.kyverno.io": "Token vend ABAC authorization (REQ-339, C-5.1, C-6.1)"
    }
  },
  "spec": {
    "rules": [
      {
        "name": "owner-matches",
        "assert": {
          "all": [
            {
              "check": {
                "(target_resource.owner == subject.owner)": true
              }
            }
          ]
        }
      },
      {
        "name": "role-env-match",
        "assert": {
          "all": [
            {
              "check": {
                "((subject.role == 'developer' && environment == 'dev') || (subject.role == 'sre' && contains(['qa','prod','dr'], environment)))": true
              }
            }
          ]
        }
      },
      {
        "name": "requested-claims-present",
        "assert": {
          "all": [
            {
              "check": {
                "(length(requested_claims) > `0`)": true
              }
            }
          ]
        }
      }
    ]
  }
}