[Sample] Different forms of hosts in ingresses

[RelativeSure]

[Sample] Different forms of hosts in ingresses

[chipzoller]

This'll probably do it:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-ingress
spec:
  validationFailureAction: Enforce
  background: false
  rules:
  - name: validate-host
    match:
      any:
      - resources:
          kinds:
          - Ingress
    validate:
      message: "Hosts must be either *.k8s-prod01.test.internal OR *.example.com"
      pattern:
        spec:
          rules:
          - host: "*.k8s-prod01.test.internal | *.example.com"

[chipzoller]

I'm not understanding from your examples what it is you want to achieve here. Can you explain? Multiple examples also help.

[RelativeSure]

I'm not understanding from your examples what it is you want to achieve here. Can you explain? Multiple examples also help.

Sorry, I am not good at explaining things.

We have a customer who has two different domains in one ingress resource.
One of the domains has to have a subdomain with the cluster name and can specify their host under that cluster name subdomain. We need to restrict by having them to use the cluster name as the first subdomain.
The bold text is required with that host.
Example: project-app-nginx.k8s-prod01.test.internal

The other domain is free to use with whatever subdomain. Bold text is required
project-app-nginx.example.com

[chipzoller]

Why not use a glob so that all host fields must follow the pattern *.cluster_01.example.com?

[RelativeSure]

Sadly that's not possible. It's two different domains with each of them having different requirements. They have to follow these.

k8s-prod01.test.internal
example.com

[chipzoller]

Ok, I'm still confused. You're now using different domain examples from what you showed in the initial message. I'm still trying to determine what hosts are "good" and what are "bad". If that's the only deciding factor, perhaps you can give me several examples of good and bad hosts with a short explanation of why.

[RelativeSure]

It's just comments about two different domains which has to follow the guideline.

Good:
project-app01.k8s-prod01.test.internal
nginx01.k8s-prod01.test.internal
project-app01.example.com
nginx01.example.com

Bad:
project-app02.test.internal
nginx02.test.internal

[chipzoller]

Ok so it looks like a rule should allow hosts to match only *.k8s-prod01.test.internal OR *.example.com. Is that correct?

[RelativeSure]

Yes exactly!
I apologize profusely for having a hard time explaining myself and thank you for taking your time understanding.