diff --git a/03-mutation/01-basics/pre-conditions.yaml b/03-mutation/01-basics/pre-conditions.yaml index eaa1693..396e6ad 100644 --- a/03-mutation/01-basics/pre-conditions.yaml +++ b/03-mutation/01-basics/pre-conditions.yaml @@ -43,10 +43,10 @@ spec: any: - key: "{{ element.image }}" operator: Contains - value: "openjdk" + value: "openjdk-v1" - key: "{{ element.image }}" operator: Contains - value: "eclipse-temurin" + value: "eclipse-v1" patchStrategicMerge: spec: containers: diff --git a/03-mutation/03-advanced/README.md b/03-mutation/03-advanced/README.md index 859cbb1..0f76e75 100644 --- a/03-mutation/03-advanced/README.md +++ b/03-mutation/03-advanced/README.md @@ -1,5 +1,15 @@ # Урок 3.3 — Продвинутые техники мутации и переменные +## Источники переменных + +Kyverno поддерживает несколько источников переменных: + +1. **Данные запроса** — `request.object`, `request.operation`, `request.userInfo` +2. **Данные из API** — через `context.apiCall` +3. **Данные из ConfigMap** — через `context.configMap` +4. **Глобальные переменные** — через `context.globalReference` +5. **Генерируемые данные** — `{{ random('[0-9]{6}') }}`, `{{ time_now() }}` + ## Файлы | Файл | Описание | diff --git a/03-mutation/03-advanced/add-creator-audit-annotation.yaml b/03-mutation/03-advanced/add-creator-audit-annotation.yaml index d630436..96061db 100644 --- a/03-mutation/03-advanced/add-creator-audit-annotation.yaml +++ b/03-mutation/03-advanced/add-creator-audit-annotation.yaml @@ -32,3 +32,20 @@ spec: audit.company.com/created-at: "{{ time_now_utc() }}" audit.company.com/user-groups: >- {{ request.userInfo.groups | join(', ', @) }} + + - name: set-environment-labels + match: + resources: + kinds: + - Pod + context: + - name: namespaceConfig + apiCall: + urlPath: "/api/v1/namespaces/{{ request.object.metadata.namespace }}" + jmesPath: "metadata.labels" + mutate: + patchStrategicMerge: + metadata: + labels: + +(environment): "{{ namespaceConfig.environment || 'unknown' }}" + +(team): "{{ namespaceConfig.team || 'platform' }}" \ No newline at end of file