<p>With Kubernetes, in a multi-tenant env., controlled by RBAC, when creating a new Ingress cname, I would like to force cname format like:</p>
<p><code>${service}.${namespace}.${cluster}.kube.infra</code></p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ${servce}
spec:
  tls:
    - hosts:
        - ${service}.${namespace}.${cluster}.kube.infra
      secretName: conso-elasticsearch-ssl
  rules:
    - host: ${service}.${namespace}.${cluster}.kube.infra
      http:
        paths:
          - path: /
            backend:
              serviceName: ${service}
              servicePort: 9200
</code></pre>
<p>Is it possible?</p>

Thomas Decaux
<p>You can do by it by writing a <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook" rel="nofollow noreferrer">validating admission webhook</a> which validates the ingress yaml and rejects it if the cname format is not as per the way you want. A better way to is to use Open Policy agent(OPA) and write <a href="https://www.openpolicyagent.org/docs/latest/policy-language/" rel="nofollow noreferrer">rego policy</a>. <a href="https://www.openpolicyagent.org/docs/latest/kubernetes-tutorial/" rel="nofollow noreferrer">Here</a> is a guide on how to perform policy driven validation of ingress using OPA.</p>
<pre><code>package kubernetes.admission

import data.kubernetes.namespaces

operations = {&quot;CREATE&quot;, &quot;UPDATE&quot;}

deny[msg] {
    input.request.kind.kind == &quot;Ingress&quot;
    operations[input.request.operation]
    host := input.request.object.spec.rules[_].host
    not fqdn_matches_any(host, valid_ingress_hosts)
    msg := sprintf(&quot;invalid ingress host %q&quot;, [host])
}

valid_ingress_hosts = {
    // valid hosts
}

fqdn_matches_any(str, patterns) {
    fqdn_matches(str, patterns[_])
}

fqdn_matches(str, pattern) {
    // validation logic
}

fqdn_matches(str, pattern) {
    not contains(pattern, &quot;*&quot;)
    str == pattern
}
</code></pre>
