56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: add-production-annotations
|
|
annotations:
|
|
policies.kyverno.io/title: "Добавление лейблов по условию"
|
|
policies.kyverno.io/category: Governance
|
|
policies.kyverno.io/severity: low
|
|
policies.kyverno.io/subject: Deployment,StatefulSet,DaemonSet
|
|
policies.kyverno.io/description: >-
|
|
1. По условию добавляет стандартные лейблы к workload ресурсам
|
|
2. По названию образа добавляет дополнительные переменные
|
|
spec:
|
|
rules:
|
|
- name: add-production-annotations
|
|
match:
|
|
resources:
|
|
kinds:
|
|
- Deployment
|
|
preconditions:
|
|
any:
|
|
- key: "{{ request.object.metadata.namespace }}"
|
|
operator: In
|
|
value:
|
|
- production
|
|
- prod
|
|
mutate:
|
|
patchStrategicMerge:
|
|
metadata:
|
|
annotations:
|
|
monitoring.company.com/enabled: "true"
|
|
alerting.company.com/oncall: "team-platform"
|
|
# Более сложный пример с зависимостью по образу
|
|
- name: add-java-opts
|
|
match:
|
|
resources:
|
|
kinds:
|
|
- Pod
|
|
mutate:
|
|
foreach:
|
|
- list: "request.object.spec.containers"
|
|
preconditions:
|
|
any:
|
|
- key: "{{ regex_match('openjdk-v1', element.image) }}"
|
|
operator: Equals
|
|
value: true
|
|
- key: "{{ regex_match('eclipse-v1', element.image) }}"
|
|
operator: Equals
|
|
value: true
|
|
patchStrategicMerge:
|
|
spec:
|
|
containers:
|
|
- name: "{{ element.name }}"
|
|
env:
|
|
- name: JAVA_OPTS
|
|
value: "-XX:+UseContainerSupport -XX:MaxRAMPercentage=75.0" |