1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-05 07:26:55 +00:00
kyverno/test/best_practices/select-secrets.yaml

35 lines
876 B
YAML
Raw Normal View History

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: select-secrets
spec:
admission: true
background: false
rules:
- context:
- apiCall:
jmesPath: metadata.labels.foo
method: GET
urlPath: /api/v1/namespaces/{{request.object.metadata.namespace}}/secrets/{{request.object.spec.volumes[0].secret.secretName}}
name: volsecret
match:
any:
- resources:
kinds:
- Pod
name: select-secrets-from-volumes
preconditions:
all:
- key: '{{ request.operation }}'
operator: Equals
value: CREATE
validate:
message: The Secret named {{request.object.spec.volumes[0].secret.secretName}}
is restricted and may not be used.
pattern:
spec:
containers:
- image: registry.domain.com/*
validationFailureAction: Enforce