Policy Resource

kind: Policy
apiVersion: fleet.cattle.io/v1alpha1
metadata:
  # Any name can be used here. Multiple Policy objects in the same namespace
  # are aggregated. See "Aggregation" below.
  name: tenant-policy
  namespace: project1

# When true, every GitRepo, HelmOp, and Bundle in this namespace must have a
# non-empty serviceAccount after any defaulting has been applied. Empty
# service accounts are rejected with a status condition on the offending
# resource.
requireServiceAccount: true

# When non-empty, restricts the set of service accounts that GitRepo, HelmOp,
# and Bundle resources may reference. The check applies to the top-level
# spec.serviceAccount and to every per-target serviceAccount on Bundles.
allowedServiceAccounts:
  - tenant-1-deployer

# Since Fleet v0.16.1. When true, Helm may create the target namespace on
# downstream clusters.
# Only has an effect together with requireServiceAccount: true, which
# disables namespace creation by default so that tenant service accounts do
# not need the cluster-scoped namespaces create verb. Set it to true only if
# namespace creation is secured by other means.
allowNamespaceCreation: false

# GitRepo-specific defaults and restrictions. Applied only by the GitRepo
# reconciler, before the top-level checks run.
gitRepo:
  # Applied to GitRepo objects whose spec.serviceAccount is empty.
  defaultServiceAccount: tenant-1-deployer

  # Applied to GitRepo objects whose spec.clientSecretName is empty.
  defaultClientSecretName: tenant-1-git-credentials

  # When non-empty, restricts the set of clientSecretName values GitRepos
  # may reference.
  allowedClientSecretNames:
    - tenant-1-git-credentials

  # Regex patterns. A GitRepo's spec.repo must match at least one entry.
  # The controller anchors every pattern as ^(?:<pattern>)$, so explicit
  # ^ and $ anchors are not required.
  allowedRepoPatterns:
    - https://github\.com/tenant-1/.*

# HelmOp-specific defaults and restrictions. Applied only by the HelmOp
# reconciler, before the top-level checks run.
helmOp:
  # Applied to HelmOp objects whose spec.serviceAccount is empty.
  defaultServiceAccount: tenant-1-deployer

  # Applied to HelmOp objects whose spec.helmSecretName is empty.
  defaultHelmSecretName: tenant-1-helm-credentials

  # When non-empty, restricts the set of credential secret names HelmOps
  # may reference.
  allowedHelmSecretNames:
    - tenant-1-helm-credentials

  # Regex patterns. A HelmOp's spec.helm.repo must match at least one entry.
  # The controller anchors every pattern as ^(?:<pattern>)$, so explicit
  # ^ and $ anchors are not required.
  allowedHelmRepoPatterns:
    - https://charts\.tenant-1\.example\.com/.*

  # Regex patterns. A HelmOp's spec.helm.chart must match at least one entry.
  allowedChartPatterns:
    - tenant-1/.*