Skip to content

Instantly share code, notes, and snippets.

@rjferguson21
Last active November 2, 2022 16:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rjferguson21/5b0f74db3706693085042d5bdcd3dc03 to your computer and use it in GitHub Desktop.
Save rjferguson21/5b0f74db3706693085042d5bdcd3dc03 to your computer and use it in GitHub Desktop.
kyverno pattern vs anyPattern
name: policy-test
policies:
- policy.yaml
resources:
- resource.yaml
results:
- policy: policy-test
rule: policy-test
resource: mypod
kind: Pod
result: skip
- policy: policy-test
rule: policy-test-any
resource: mypod
kind: Pod
result: skip
Executing policy-test...
applying 1 policy to 1 resource...
Note : The resource field is being deprecated in 1.8.0 release. Please provide the resources under the resources parameter as an array in the results field
│───│─────────────│─────────────────│────────────│────────│
│ # │ POLICY │ RULE │ RESOURCE │ RESULT │
│───│─────────────│─────────────────│────────────│────────│
│ 1 │ policy-test │ policy-test │ /Pod/mypod │ Pass │
│ 2 │ policy-test │ policy-test-any │ /Pod/mypod │ Fail │
│───│─────────────│─────────────────│────────────│────────│
Test Summary: 1 tests passed and 1 tests failed
Aggregated Failed Test Cases :
│───│─────────────│─────────────────│────────────│────────│
│ # │ POLICY │ RULE │ RESOURCE │ RESULT │
│───│─────────────│─────────────────│────────────│────────│
│ 2 │ policy-test │ policy-test-any │ /Pod/mypod │ Fail │
│───│─────────────│─────────────────│────────────│────────│
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: policy-test
spec:
rules:
- name: policy-test
match:
any:
- resources:
kinds:
- Pod
validate:
message: >-
runAsGroup test
pattern:
spec:
=(initContainers):
- (name): "!istio-init"
securityContext:
runAsGroup: ">0"
- name: policy-test-any
match:
any:
- resources:
kinds:
- Pod
validate:
message: >-
runAsGroup test
anyPattern:
- spec:
=(initContainers):
- (name): "!istio-init"
securityContext:
runAsGroup: ">0"
apiVersion: v1
kind: Pod
metadata:
labels:
app: busybox
name: mypod
spec:
initContainers:
- name: istio-init
image: tempimagename
securityContext:
runAsGroup: 0
containers:
- name: busybox
image: someothernonexistentimage
securityContext:
runAsGroup: 1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment