kyverno

clusterpolicy-pod.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: conditional-mutate-pod
spec:
  admission: true
  background: false
  validationFailureAction: Audit
  rules:
  - name: conditional-mutate-cpu-requests
    match:
      any:
      - resources:
          kinds:
          - Pod
          operations:
          - CREATE
          - UPDATE
          namespaceSelector:
            matchExpressions:
            - key: prodsuite
              operator: Exists
    mutate:
      foreach:
      - list: "request.object.spec.containers"
        patchesJson6902: |-
          - op: replace
            path: /spec/containers/{{ elementIndex }}/resources/requests/cpu
            value: "100m"
        preconditions:
          all:
          - key: "{{ element.name }}"
            operator: NotEquals
            value: "istio-proxy"
          - key: "{{ element.resources.requests.cpu }}"
            operator: GreaterThan
            value: "100m"
  - name: conditional-mutate-timezone
    match:
      any:
      - resources:
          kinds:
          - Pod
          operations:
          - CREATE
          - UPDATE
          namespaceSelector:
            matchExpressions:
            - key: prodsuite
              operator: Exists
    mutate:
      foreach:
      - list: "request.object.spec.containers"
        patchesJson6902: |-
          - op: add
            path: /spec/containers/{{ elementIndex }}/env/-
            value:
              name: TZ
              value: "Asia/Taipei"
        preconditions:
          all:
          - key: "{{ element.name }}"
            operator: NotEquals
            value: "istio-proxy"
          - key: TZ
            operator: AnyNotIn
            value: "{{ element.env[].name || '' }}"

clusterpolicy-replicaset.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: conditional-mutate-replicaset
spec:
  admission: true
  background: false
  validationFailureAction: Audit
  rules:
  - name: conditional-mutate-replicaset-replicas
    match:
      any:
      - resources:
          kinds:
          - ReplicaSet
          - ReplicaSet/scale
          operations:
          - CREATE
          - UPDATE
          namespaceSelector:
            matchExpressions:
            - key: prodsuite
              operator: Exists
    preconditions:
      all:
      - key: "{{ request.object.spec.replicas }}"
        operator: GreaterThan
        value: 2
    mutate:
      patchesJson6902: |-
        - op: replace
          path: /spec/replicas
          value: 2

install.sh

kubectl create -f https://github.com/kyverno/kyverno/releases/download/v1.11.5/install.yaml

ghcr.io/kyverno/kyverno:v1.11.5
ghcr.io/kyverno/kyvernopre:v1.11.5

kyverno-configmap.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: config
    app.kubernetes.io/instance: kyverno
    app.kubernetes.io/part-of: kyverno
    app.kubernetes.io/version: v1.11.5
  name: kyverno
  namespace: kyverno
data:
  defaultRegistry: docker.io
  enableDefaultRegistryMutation: "false"
  excludeGroups: system:nodes
  generateSuccessEvents: "false"
  resourceFilters: '[*/*,kyverno,*] [Event,*,*] [*/*,kube-system,*] [*/*,kube-public,*]
    [*/*,kube-node-lease,*] [Node,*,*] [Node/*,*,*] [APIService,*,*] [APIService/*,*,*]
    [TokenReview,*,*] [SubjectAccessReview,*,*] [SelfSubjectAccessReview,*,*] [Binding,*,*]
    [Pod/binding,*,*] [AdmissionReport,*,*] [AdmissionReport/*,*,*] [ClusterAdmissionReport,*,*]
    [ClusterAdmissionReport/*,*,*] [BackgroundScanReport,*,*] [BackgroundScanReport/*,*,*]
    [ClusterBackgroundScanReport,*,*] [ClusterBackgroundScanReport/*,*,*] [ClusterRole,*,kyverno:admission-controller]
    [ClusterRole,*,kyverno:admission-controller:core] [ClusterRole,*,kyverno:admission-controller:additional]
    [ClusterRole,*,kyverno:background-controller] [ClusterRole,*,kyverno:background-controller:core]
    [ClusterRole,*,kyverno:background-controller:additional] [ClusterRole,*,kyverno:cleanup-controller]
    [ClusterRole,*,kyverno:cleanup-controller:core] [ClusterRole,*,kyverno:cleanup-controller:additional]
    [ClusterRole,*,kyverno:reports-controller] [ClusterRole,*,kyverno:reports-controller:core]
    [ClusterRole,*,kyverno:reports-controller:additional] [ClusterRoleBinding,*,kyverno:admission-controller]
    [ClusterRoleBinding,*,kyverno:background-controller] [ClusterRoleBinding,*,kyverno:cleanup-controller]
    [ClusterRoleBinding,*,kyverno:reports-controller] [ServiceAccount,kyverno,kyverno-admission-controller]
    [ServiceAccount/*,kyverno,kyverno-admission-controller] [ServiceAccount,kyverno,kyverno-background-controller]
    [ServiceAccount/*,kyverno,kyverno-background-controller] [ServiceAccount,kyverno,kyverno-cleanup-controller]
    [ServiceAccount/*,kyverno,kyverno-cleanup-controller] [ServiceAccount,kyverno,kyverno-reports-controller]
    [ServiceAccount/*,kyverno,kyverno-reports-controller] [Role,kyverno,kyverno:admission-controller]
    [Role,kyverno,kyverno:background-controller] [Role,kyverno,kyverno:cleanup-controller]
    [Role,kyverno,kyverno:reports-controller] [RoleBinding,kyverno,kyverno:admission-controller]
    [RoleBinding,kyverno,kyverno:background-controller] [RoleBinding,kyverno,kyverno:cleanup-controller]
    [RoleBinding,kyverno,kyverno:reports-controller] [ConfigMap,kyverno,kyverno] [ConfigMap,kyverno,kyverno-metrics]
    [Deployment,kyverno,kyverno-admission-controller] [Deployment/*,kyverno,kyverno-admission-controller]
    [Deployment,kyverno,kyverno-background-controller] [Deployment/*,kyverno,kyverno-background-controller]
    [Deployment,kyverno,kyverno-cleanup-controller] [Deployment/*,kyverno,kyverno-cleanup-controller]
    [Deployment,kyverno,kyverno-reports-controller] [Deployment/*,kyverno,kyverno-reports-controller]
    [Pod,kyverno,kyverno-admission-controller-*] [Pod/*,kyverno,kyverno-admission-controller-*]
    [Pod,kyverno,kyverno-background-controller-*] [Pod/*,kyverno,kyverno-background-controller-*]
    [Pod,kyverno,kyverno-cleanup-controller-*] [Pod/*,kyverno,kyverno-cleanup-controller-*]
    [Pod,kyverno,kyverno-reports-controller-*] [Pod/*,kyverno,kyverno-reports-controller-*]
    [Job,kyverno,kyverno-hook-pre-delete] [Job/*,kyverno,kyverno-hook-pre-delete]
    [NetworkPolicy,kyverno,kyverno-admission-controller] [NetworkPolicy/*,kyverno,kyverno-admission-controller]
    [NetworkPolicy,kyverno,kyverno-background-controller] [NetworkPolicy/*,kyverno,kyverno-background-controller]
    [NetworkPolicy,kyverno,kyverno-cleanup-controller] [NetworkPolicy/*,kyverno,kyverno-cleanup-controller]
    [NetworkPolicy,kyverno,kyverno-reports-controller] [NetworkPolicy/*,kyverno,kyverno-reports-controller]
    [PodDisruptionBudget,kyverno,kyverno-admission-controller] [PodDisruptionBudget/*,kyverno,kyverno-admission-controller]
    [PodDisruptionBudget,kyverno,kyverno-background-controller] [PodDisruptionBudget/*,kyverno,kyverno-background-controller]
    [PodDisruptionBudget,kyverno,kyverno-cleanup-controller] [PodDisruptionBudget/*,kyverno,kyverno-cleanup-controller]
    [PodDisruptionBudget,kyverno,kyverno-reports-controller] [PodDisruptionBudget/*,kyverno,kyverno-reports-controller]
    [Service,kyverno,kyverno-svc] [Service/*,kyverno,kyverno-svc] [Service,kyverno,kyverno-svc-metrics]
    [Service/*,kyverno,kyverno-svc-metrics] [Service,kyverno,kyverno-background-controller-metrics]
    [Service/*,kyverno,kyverno-background-controller-metrics] [Service,kyverno,kyverno-cleanup-controller]
    [Service/*,kyverno,kyverno-cleanup-controller] [Service,kyverno,kyverno-cleanup-controller-metrics]
    [Service/*,kyverno,kyverno-cleanup-controller-metrics] [Service,kyverno,kyverno-reports-controller-metrics]
    [Service/*,kyverno,kyverno-reports-controller-metrics] [ServiceMonitor,kyverno,kyverno-admission-controller]
    [ServiceMonitor,kyverno,kyverno-background-controller] [ServiceMonitor,kyverno,kyverno-cleanup-controller]
    [ServiceMonitor,kyverno,kyverno-reports-controller] [Secret,kyverno,kyverno-svc.kyverno.svc.*]
    [Secret,kyverno,kyverno-cleanup-controller.kyverno.svc.*]'
  webhooks: '[{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kyverno"]}]}}]'

platform.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: platform-ns
---
apiVersion: v1
kind: Pod
metadata:
  name: platform-pod
  namespace: platform-ns
spec:
  containers:
  - name: main-container
    image: nginx
    resources:
      requests:
        cpu: "200m"
  - name: test-container
    image: nginx
    resources:
      requests:
        cpu: "50m"
  - name: istio-proxy
    image: nginx
    resources:
      requests:
        cpu: "150m"
  initContainers:
  - name: init-example
    image: busybox
    resources:
      requests:
        cpu: "50m"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: platform-deployment
  namespace: platform-ns
spec:
  replicas: 2
  selector:
    matchLabels:
      app: platform-app
  template:
    metadata:
      labels:
        app: platform-app
    spec:
      containers:
      - name: main-container
        image: nginx
        resources:
          requests:
            cpu: "200m"
      - name: test-container
        image: nginx
        resources:
          requests:
            cpu: "50m"
      - name: istio-proxy
        image: nginx
        resources:
          requests:
            cpu: "150m"
      initContainers:
      - name: init-example
        image: busybox
        resources:
          requests:
            cpu: "50m"
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: platform-cronjob
  namespace: platform-ns
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 1
  successfulJobsHistoryLimit: 1
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        metadata:
          name: platform-pod
        spec:
          containers:
          - name: main-container
            image: nginx
            resources:
              requests:
                cpu: "200m"
          - name: test-container
            image: nginx
            resources:
              requests:
                cpu: "50m"
          - name: istio-proxy
            image: nginx
            resources:
              requests:
                cpu: "150m"
          initContainers:
          - name: init-example
            image: busybox
            resources:
              requests:
                cpu: "50m"
          restartPolicy: Never

user.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: user-ns
  labels:
    prodsuite: bar
---
apiVersion: v1
kind: Pod
metadata:
  name: user-pod
  namespace: user-ns
spec:
  containers:
  - name: main-container
    image: nginx
    resources:
      requests:
        cpu: "200m"
  - name: test-container
    image: nginx
    resources:
      requests:
        cpu: "50m"
  - name: istio-proxy
    image: nginx
    resources:
      requests:
        cpu: "150m"
  initContainers:
  - name: init-example
    image: busybox
    resources:
      requests:
        cpu: "50m"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-deployment
  namespace: user-ns
spec:
  replicas: 2
  selector:
    matchLabels:
      app: user-app
  template:
    metadata:
      labels:
        app: user-app
    spec:
      containers:
      - name: main-container
        image: nginx
        resources:
          requests:
            cpu: "200m"
      - name: test-container
        image: nginx
        resources:
          requests:
            cpu: "50m"
      - name: istio-proxy
        image: nginx
        resources:
          requests:
            cpu: "150m"
      initContainers:
      - name: init-example
        image: busybox
        resources:
          requests:
            cpu: "50m"
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: user-cronjob
  namespace: user-ns
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 1
  successfulJobsHistoryLimit: 1
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        metadata:
          name: user-pod
        spec:
          containers:
          - name: main-container
            image: nginx
            resources:
              requests:
                cpu: "200m"
          - name: test-container
            image: nginx
            resources:
              requests:
                cpu: "50m"
          - name: istio-proxy
            image: nginx
            resources:
              requests:
                cpu: "150m"
          initContainers:
          - name: init-example
            image: busybox
            resources:
              requests:
                cpu: "50m"
          restartPolicy: Never