init

2026-04-09 20:14:24 +07:00
parent 34fbdd1412
commit 815bc94a3d
6 changed files with 22 additions and 0 deletions
--- a/02-validation/01-resource-validation/5.
+++ b/02-validation/01-resource-validation/5.
@@ -0,0 +1,46 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-standard-labels
+  annotations:
+    policies.kyverno.io/title: "Обязательные стандартные лейблы"
+    policies.kyverno.io/category: Governance
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Deployment,StatefulSet,DaemonSet
+    policies.kyverno.io/description: >-
+      Требует наличия стандартных лейблов у workload ресурсов.
+      Лейблы используются для мониторинга, алертинга и распределения затрат.
+      Допустимые значения environment: dev | staging | production
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+  - name: check-required-labels
+    match:
+      resources:
+        kinds:
+        - Deployment
+        - StatefulSet
+        - DaemonSet
+    exclude:
+      resources:
+        namespaces:
+        - kube-system
+        - kyverno
+    validate:
+      message: >-
+        Ресурс '{{ request.object.metadata.name }}' должен иметь лейблы:
+          app, version, team, environment (dev|staging|production)
+        Пример:
+          labels:
+            app: my-service
+            version: "1.0.0"
+            team: payments
+            environment: production
+      pattern:
+        metadata:
+          labels:
+            app: "?*"
+            version: "?*"
+            team: "?*"
+            environment: "^(dev|staging|production)$"