apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
  annotations:
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/description: >-
      The ':latest' tag is mutable and can lead to unexpected errors if the
      image changes. A best practice is to use an immutable tag that maps to
      a specific version of an application pod.
spec:
  validationFailureAction: audit
  rules:
  - name: require-image-tag
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "An image tag is required."
      pattern:
        spec:
          containers:
          - image: "*:*"
  - name: validate-image-tag
    match:
      resources:
        kinds:
        - Pod
        namespaces:
        - test
    validate:
      message: "Using a mutable image tag e.g. 'latest' is not allowed."
      pattern:
        spec:
          containers:
          - image: "!*:latest"
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: duration-test
  namespace: kyverno
spec:
  background: true
  validationFailureAction: enforce
  rules:
  - name: greater-than
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Pod lifetime exceeds limit of 8h"
      deny:
        conditions:
        - key: "{{ request.object.metadata.annotations.\"pod.kubernetes.io/lifetime\" }}"
          operator: GreaterThan
          value: "8h"
  - name: less-than
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Pod lifetime under limit of 8h"
      deny:
        conditions:
        - key: "{{ request.object.metadata.annotations.\"pod.kubernetes.io/lifetime\" }}"
          operator: LessThan
          value: "8h"
  - name: greater-equal-than
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Pod lifetime exceeds limit of 8h"
      deny:
        conditions:
        - key: "{{ request.object.metadata.annotations.\"pod.kubernetes.io/lifetime\" }}"
          operator: GreaterThanOrEquals
          value: "8h"
  - name: less-equal-than
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "Pod lifetime under limit of 8h"
      deny:
        conditions:
        - key: "{{ request.object.metadata.annotations.\"pod.kubernetes.io/lifetime\" }}"
          operator: LessThanOrEquals
          value: "8h"


---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-pod-counts
  annotations:
    policies.kyverno.io/title: Restrict Pod Count per Node
    policies.kyverno.io/category: Sample
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/minversion: 1.3.2
    policies.kyverno.io/description: >-
      Sometimes Kubernetes Nodes may have a maximum number of Pods they can accommodate due to
      resources outside CPU and memory such as licensing, or in some
      development cases. This policy restricts Pod count on a Node named `minikube` to be no more than 10.
    # pod-policies.kyverno.io/autogen-controllers: None
spec:
  validationFailureAction: audit
  background: false
  rules:
    - name: restrict-pod-count
      match:
        resources:
          kinds:
            - Pod
      context:
        - name: podcounts
          apiCall:
            urlPath: "/api/v1/pods"
            jmesPath: "items[?spec.nodeName=='minikube'] | length(@)"
      preconditions:
        - key: "{{ request.operation }}"
          operator: Equals
          value: "CREATE"
      validate:
        message: "A maximum of 10 Pods are allowed on the Node `minikube`"
        deny:
          conditions:
            - key: "{{ podcounts }}"
              operator: GreaterThan
              value: 10