Created
October 4, 2022 17:49
-
-
Save deanpeterson/009dd9b33e8342062873101f0855527d to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
apiVersion: policy.open-cluster-management.io/v1 | |
kind: Policy | |
metadata: | |
name: policy-kyverno-add-quota | |
namespace: grc-policies | |
annotations: | |
policy.open-cluster-management.io/categories: CM Configuration Management | |
policy.open-cluster-management.io/controls: CM-2 Baseline Configuration | |
policy.open-cluster-management.io/standards: NIST SP 800-53 | |
creationTimestamp: 2022-10-04T16:54:39Z | |
generation: 6 | |
managedFields: | |
resourceVersion: "1862677" | |
uid: fc32d711-f000-4577-ae63-5a7a280c9893 | |
spec: | |
disabled: false | |
policy-templates: | |
- objectDefinition: | |
apiVersion: policy.open-cluster-management.io/v1 | |
kind: ConfigurationPolicy | |
metadata: | |
name: policy-kyverno-add-quota | |
spec: | |
object-templates: | |
- complianceType: musthave | |
objectDefinition: | |
apiVersion: kyverno.io/v1 | |
kind: ClusterPolicy | |
metadata: | |
name: add-ns-quota | |
annotations: | |
policies.kyverno.io/category: Multi-Tenancy | |
policies.kyverno.io/description: "To better control the number of resources that | |
can be created in a given Namespace and provide default | |
resource consumption limits for Pods, ResourceQuota and | |
LimitRange resources are recommended. This policy will | |
generate ResourceQuota and LimitRange resources when a new | |
Namespace is created. " | |
policies.kyverno.io/subject: ResourceQuota, LimitRange | |
policies.kyverno.io/title: Add Quota | |
spec: | |
generateExistingOnPolicyUpdate: true | |
rules: | |
- name: generate-resourcequota | |
generate: | |
name: default-resourcequota | |
data: | |
spec: | |
hard: | |
limits.cpu: "3" | |
limits.memory: 16Gi | |
requests.cpu: "3" | |
requests.memory: 16Gi | |
kind: ResourceQuota | |
synchronize: true | |
match: | |
resources: | |
namespaces: | |
- test10 | |
- name: generate-limitrange | |
generate: | |
name: default-limitrange | |
data: | |
spec: | |
limits: | |
- default: | |
cpu: 500m | |
memory: 2Gi | |
defaultRequest: | |
cpu: 200m | |
memory: 256Mi | |
type: Container | |
kind: LimitRange | |
synchronize: true | |
match: | |
resources: | |
namespaces: | |
- test10 | |
remediationAction: enforce | |
severity: low | |
remediationAction: enforce | |
status: | |
compliant: Compliant | |
placement: | |
- placementBinding: policy-kyverno-add-quota-placement | |
placementRule: policy-kyverno-add-quota-placement | |
status: | |
- clustername: cluster-2 | |
clusternamespace: cluster-2 | |
compliant: Compliant | |
--- | |
apiVersion: apps.open-cluster-management.io/v1 | |
kind: PlacementRule | |
metadata: | |
name: policy-kyverno-add-quota-placement | |
namespace: grc-policies | |
annotations: | |
open-cluster-management.io/user-group: c3lzdGVtOmF1dGhlbnRpY2F0ZWQ6b2F1dGgsc3lzdGVtOmF1dGhlbnRpY2F0ZWQ= | |
open-cluster-management.io/user-identity: YWRtaW4= | |
creationTimestamp: 2022-10-04T16:54:39Z | |
generation: 1 | |
resourceVersion: "1780193" | |
uid: 81d919b3-e742-41bf-b05a-52d480898300 | |
spec: | |
clusterConditions: | |
- status: "True" | |
type: ManagedClusterConditionAvailable | |
clusterSelector: | |
matchExpressions: | |
- key: clusterID | |
operator: In | |
values: | |
- 4df59757-9a7b-4b93-af0e-2262c9aca3e7 | |
status: | |
decisions: | |
- clusterName: cluster-2 | |
clusterNamespace: cluster-2 | |
--- | |
apiVersion: policy.open-cluster-management.io/v1 | |
kind: PlacementBinding | |
metadata: | |
name: policy-kyverno-add-quota-placement | |
namespace: grc-policies | |
creationTimestamp: 2022-10-04T16:54:39Z | |
generation: 1 | |
resourceVersion: "1780190" | |
uid: ad819fce-f918-4607-bf89-3f3c1adb9157 | |
placementRef: | |
name: policy-kyverno-add-quota-placement | |
apiGroup: apps.open-cluster-management.io | |
kind: PlacementRule | |
subjects: | |
- name: policy-kyverno-add-quota | |
apiGroup: policy.open-cluster-management.io | |
kind: Policy |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment