init

2026-04-13 12:37:09 +07:00
parent 815bc94a3d
commit dce89d417f
4 changed files with 134 additions and 0 deletions
@@ -0,0 +1,56 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-production-annotations
+  annotations:
+    policies.kyverno.io/title: "Добавление лейблов по условию"
+    policies.kyverno.io/category: Governance
+    policies.kyverno.io/severity: low
+    policies.kyverno.io/subject: Deployment,StatefulSet,DaemonSet
+    policies.kyverno.io/description: >-
+      1. По условию добавляет стандартные лейблы к workload ресурсам
+      2. По названию образа добавляет дополнительные переменные
+spec:
+  rules:
+  - name: add-production-annotations
+    match:
+      resources:
+        kinds:
+        - Deployment
+    preconditions:
+      any:
+      - key: "{{ request.object.metadata.namespace }}"
+        operator: In
+        value:
+        - production
+        - prod
+    mutate:
+      patchStrategicMerge:
+        metadata:
+          annotations:
+            monitoring.company.com/enabled: "true"
+            alerting.company.com/oncall: "team-platform"
+  # Более сложный пример с зависимостью по образу
+  - name: add-java-opts
+    match:
+      resources:
+        kinds:
+        - Pod
+    mutate:
+      foreach:
+      - list: "request.object.spec.containers"
+        preconditions:
+          any:
+          - key: "{{ element.image }}"
+            operator: Contains
+            value: "openjdk"
+          - key: "{{ element.image }}"
+            operator: Contains
+            value: "eclipse-temurin"
+        patchStrategicMerge:
+          spec:
+            containers:
+            - name: "{{ element.name }}"
+              env:
+              - name: JAVA_OPTS
+                value: "-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0"