Skip to content

Instantly share code, notes, and snippets.

@deanpeterson
Created October 4, 2022 17:49
Show Gist options
  • Save deanpeterson/009dd9b33e8342062873101f0855527d to your computer and use it in GitHub Desktop.
Save deanpeterson/009dd9b33e8342062873101f0855527d to your computer and use it in GitHub Desktop.
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-kyverno-add-quota
namespace: grc-policies
annotations:
policy.open-cluster-management.io/categories: CM Configuration Management
policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
policy.open-cluster-management.io/standards: NIST SP 800-53
creationTimestamp: 2022-10-04T16:54:39Z
generation: 6
managedFields:
resourceVersion: "1862677"
uid: fc32d711-f000-4577-ae63-5a7a280c9893
spec:
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: policy-kyverno-add-quota
spec:
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: add-ns-quota
annotations:
policies.kyverno.io/category: Multi-Tenancy
policies.kyverno.io/description: "To better control the number of resources that
can be created in a given Namespace and provide default
resource consumption limits for Pods, ResourceQuota and
LimitRange resources are recommended. This policy will
generate ResourceQuota and LimitRange resources when a new
Namespace is created. "
policies.kyverno.io/subject: ResourceQuota, LimitRange
policies.kyverno.io/title: Add Quota
spec:
generateExistingOnPolicyUpdate: true
rules:
- name: generate-resourcequota
generate:
name: default-resourcequota
data:
spec:
hard:
limits.cpu: "3"
limits.memory: 16Gi
requests.cpu: "3"
requests.memory: 16Gi
kind: ResourceQuota
synchronize: true
match:
resources:
namespaces:
- test10
- name: generate-limitrange
generate:
name: default-limitrange
data:
spec:
limits:
- default:
cpu: 500m
memory: 2Gi
defaultRequest:
cpu: 200m
memory: 256Mi
type: Container
kind: LimitRange
synchronize: true
match:
resources:
namespaces:
- test10
remediationAction: enforce
severity: low
remediationAction: enforce
status:
compliant: Compliant
placement:
- placementBinding: policy-kyverno-add-quota-placement
placementRule: policy-kyverno-add-quota-placement
status:
- clustername: cluster-2
clusternamespace: cluster-2
compliant: Compliant
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
name: policy-kyverno-add-quota-placement
namespace: grc-policies
annotations:
open-cluster-management.io/user-group: c3lzdGVtOmF1dGhlbnRpY2F0ZWQ6b2F1dGgsc3lzdGVtOmF1dGhlbnRpY2F0ZWQ=
open-cluster-management.io/user-identity: YWRtaW4=
creationTimestamp: 2022-10-04T16:54:39Z
generation: 1
resourceVersion: "1780193"
uid: 81d919b3-e742-41bf-b05a-52d480898300
spec:
clusterConditions:
- status: "True"
type: ManagedClusterConditionAvailable
clusterSelector:
matchExpressions:
- key: clusterID
operator: In
values:
- 4df59757-9a7b-4b93-af0e-2262c9aca3e7
status:
decisions:
- clusterName: cluster-2
clusterNamespace: cluster-2
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: policy-kyverno-add-quota-placement
namespace: grc-policies
creationTimestamp: 2022-10-04T16:54:39Z
generation: 1
resourceVersion: "1780190"
uid: ad819fce-f918-4607-bf89-3f3c1adb9157
placementRef:
name: policy-kyverno-add-quota-placement
apiGroup: apps.open-cluster-management.io
kind: PlacementRule
subjects:
- name: policy-kyverno-add-quota
apiGroup: policy.open-cluster-management.io
kind: Policy
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment