Enforcing Ingress policies

So far in this chapter, we’ve built policies that are self-contained. When checking whether an image is coming from a pre-authorized registry, the only data we needed was from the policy and the containers. This is often not enough information to make a policy decision. In this section, we’ll work on building a policy that relies on other objects in your cluster to make policy decisions.

Before diving into the implementation, let’s talk about the use case. It’s common to limit which namespaces can have Ingress objects. If a namespace hosts a workload that doesn’t require any inbound access, why allow an Ingress object at all? You may think you can enforce this using RBAC by limiting what tenants are allowed to deploy using a Role and RoleBinding, but this has some limitations:

• The admin and edit ClusterRoles are default aggregate ClusterRoles, so you would need to create a new ClusterRole that enumerates...