add kyverno policies

Signed-off-by: gwg313 <gwg313@pm.me>

platform/kyverno/policies/40-generate/generate-namespace-network-baseline.yaml

@@ -0,0 +1,83 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: generate-namespace-network-baseline
+  annotations:
+    policies.kyverno.io/title: Generate Namespace Network Baseline
+    policies.kyverno.io/category: Network Security
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/description: >-
+      Automatically provisions a baseline CiliumNetworkPolicy
+      with default deny ingress and controlled DNS egress.
+    argocd.argoproj.io/sync-options: Force=true,Replace=true
+
+spec:
+  background: true
+
+  rules:
+    - name: generate-baseline-cnp
+
+      match:
+        any:
+          - resources:
+              kinds:
+                - Namespace
+
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - default
+                - kube-system
+                - kube-public
+                - kube-node-lease
+                - kyverno
+                - argocd
+                - cert-manager
+                - monitoring
+                - cilium-secrets
+                - cilium-ingress
+                - sealed-secrets
+                - tekton-pipelines
+                - tekton-pipelines-resolvers
+                - pipelines-as-code
+
+      generate:
+        synchronize: true
+
+        apiVersion: cilium.io/v2
+        kind: CiliumNetworkPolicy
+
+        name: baseline-network-security
+        namespace: "{{ request.object.metadata.name }}"
+
+        data:
+          metadata:
+            labels:
+              security-tier: baseline
+
+          spec:
+            endpointSelector: {}
+
+            policyTypes:
+              - Ingress
+              - Egress
+
+            ingress: []
+
+            egress:
+              - toEndpoints:
+                  - matchLabels:
+                      k8s:io.kubernetes.pod.namespace: kube-system
+                      k8s-app: kube-dns
+
+                toPorts:
+                  - ports:
+                      - port: "53"
+                        protocol: UDP
+                      - port: "53"
+                        protocol: TCP
+
+                    rules:
+                      dns:
+                        - matchPattern: "*"

platform/kyverno/policies/40-generate/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - generate-namespace-network-baseline.yaml
+
+commonLabels:
+  app.kubernetes.io/part-of: kyverno-policies
+  policy-tier: generate
+
+commonAnnotations:
+  argocd.argoproj.io/sync-wave: "3"