1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-05 23:46:56 +00:00
kyverno/test/best_practices/add_ns_quota.yaml

65 lines
1.5 KiB
YAML
Raw Permalink Normal View History

---
2019-11-13 13:56:20 -08:00
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
2019-10-11 18:57:16 -07:00
annotations:
2019-11-11 18:21:16 -08:00
policies.kyverno.io/category: Workload Isolation
policies.kyverno.io/description: To limit the number of objects, as well as the
total amount of compute that may be consumed by a single namespace, create a
default resource quota for each namespace.
name: add-ns-quota
spec:
admission: true
background: true
rules:
- exclude:
any:
- resources:
namespaces:
- kube-system
- default
- kube-public
- kyverno
generate:
apiVersion: v1
2019-10-24 12:37:52 -05:00
data:
spec:
hard:
limits.cpu: "4"
limits.memory: 16Gi
requests.cpu: "4"
requests.memory: 16Gi
kind: ResourceQuota
name: default-resourcequota
namespace: '{{request.object.metadata.name}}'
synchronize: true
match:
any:
- resources:
kinds:
- Namespace
name: generate-resourcequota
- generate:
apiVersion: v1
data:
spec:
limits:
- default:
cpu: 500m
memory: 1Gi
defaultRequest:
cpu: 200m
memory: 256Mi
type: Container
kind: LimitRange
name: default-limitrange
namespace: '{{request.object.metadata.name}}'
synchronize: true
match:
any:
- resources:
kinds:
- Namespace
name: generate-limitrange
validationFailureAction: Audit