Revert "Merge branch 'bbooker-platform-2365' into 'master'"

This reverts merge request !66 (merged)

rego/pss_apparmor/policy.rego

+package pss_apparmor
+
+apparmor_keys[containerName] = key {
+	containerName := containers[_].name
+	key := sprintf("%s/%s", ["container.apparmor.security.beta.kubernetes.io", containerName])
+}
+
+custom_apparmor_containers[containerName] {
+	key := apparmor_keys[containerName]
+	annotation := annotations[_]
+	val = annotation[key]
+	val != "runtime/default"
+	not startswith(val, "localhost/")
+}
+
+violation[msg] {
+	failedContainer := custom_apparmor_containers[_]
+
+	msg := format(sprintf("Container '%s' of %s '%s' should specify an AppArmor profile", [failedContainer, kind, name]))
+}
+
+################### LIBRARY ###################
+
+default is_gatekeeper = true
+
+object = input.review.object {
+	is_gatekeeper
+}
+
+format(msg) = gatekeeper_format {
+	is_gatekeeper
+	gatekeeper_format = {"msg": msg}
+}
+
+name = object.metadata.name
+
+kind = object.kind
+
+is_pod {
+	kind = "Pod"
+}
+
+is_cronjob {
+	kind = "CronJob"
+}
+
+default is_controller = false
+
+is_controller {
+	kind = "Deployment"
+}
+
+is_controller {
+	kind = "StatefulSet"
+}
+
+is_controller {
+	kind = "DaemonSet"
+}
+
+is_controller {
+	kind = "ReplicaSet"
+}
+
+is_controller {
+	kind = "ReplicationController"
+}
+
+is_controller {
+	kind = "Job"
+}
+
+pod_containers(pod) = all_containers {
+	keys = {"containers", "initContainers"}
+	all_containers = [c | keys[k]; c = pod.spec[k][_]]
+}
+
+containers[container] {
+	pods[pod]
+	all_containers = pod_containers(pod)
+	container = all_containers[_]
+}
+
+containers[container] {
+	all_containers = pod_containers(object)
+	container = all_containers[_]
+}
+
+annotations[annotation] {
+	pods[pod]
+	annotation = pod.metadata.annotations
+}
+
+pods[pod] {
+	is_pod
+	pod = object
+}
+
+pods[pod] {
+	is_controller
+	pod = object.spec.template
+}
+
+pods[pod] {
+	is_cronjob
+	pod = object.spec.jobTemplate.spec.template
+}
+
+has_field(obj, field) {
+	obj[field]
+}