update policy yaml

examples/cli/policy_deployment.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: add-label
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Deployment
+          kinds : 
-        selector :
+          - Deployment
-          matchLabels :
+          selector :
-            cli: test
+            matchLabels :
+              cli: test
       mutate:
         patches:
         - path: /metadata/labels/isMutated
@@ -20,12 +21,13 @@ spec :
           op: replace
           value: "nginx_is_mutated" 
     - name: check-image
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Deployment
+          kinds : 
-        selector :
+          - Deployment
-          matchLabels :
+          selector :
-            cli: test
+            matchLabels :
+              cli: test
       validate:
         message: "The imagePullPolicy must be Always when using image nginx"
         pattern:

examples/demo/1_image_pull_policy/policy.yaml

@@ -5,15 +5,17 @@ metadata:
 spec:
   rules:
   - name: image-pull-policy
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
-      # - StatefulSet
+        - Deployment
-      # name: "my-deployment"
+    exclude:
-      # selector :
+      resources:
-      #   matchLabels:
+       name: nginx-deployment1
-      #     app.type: prod
+       selector :
-      # namespace: "my-namespace"
+        matchLabels:
+          app: nginx1
+       namespace: "default"
     mutate:
       overlay:
         spec:

examples/demo/2_allowed_registry/policy.yaml

@@ -5,11 +5,12 @@ metadata:
 spec:
   rules:
   - name: check-registries
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
-      - StatefulSet
+        - Deployment
-      namespace: default
+        - StatefulSet
+        namespace: default
     validate:
       message: "Registry is not allowed"
       pattern:

examples/demo/3_network_policy/policy.yaml

@@ -5,22 +5,19 @@ metadata:
 spec:
   rules:
   - name: "deny-ingress-traffic"
-    resource: 
+    match:
-      kinds:
+      resources: 
-       - Namespace
+        kinds:
-      name: "devtest"
+        - Namespace
+        name: "devtest"
     generate: 
       kind: NetworkPolicy
       name: deny-ingress-traffic
       data:
         spec:
-        podSelector:
+          policyTypes: 
-          matchLabels: {}
+          - Ingress
-          matchExpressions: []
-        policyTypes: 
-        - Ingress
         metadata:
-          annotations: {}
           labels:
             policyname: "default"
       # kind: ConfigMap

examples/demo/4_non_root/policy.yaml

@@ -5,12 +5,13 @@ metadata:
 spec:
   rules:
   - name: validate-runAsNonRoot
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
-      selector :
+        - Deployment
-        matchLabels:
+        selector :
-          app.type: prod
+          matchLabels:
+            app.type: prod
     validate:
       message: "security context 'runAsNonRoot' shoud be set to true"
       pattern:

examples/demo/5_health_check/policy.yaml

@@ -5,9 +5,10 @@ metadata :
 spec:
   rules:
   - name: check-readinessProbe-exists
-    resource:
+    match:
-      kinds :
+      resources:
-      - Pod
+        kinds :
+        - Pod
     validate:
       message: "readinessProbe is required"
       pattern:
@@ -17,9 +18,10 @@ spec:
             readinessProbe:
               successThreshold: ">1"
   - name: check-livenessProbe-exists
-    resource:
+    match:    
-      kinds :
+      resources:
-      - Pod
+        kinds :
+        - Pod
     validate:
       message: "livenessProbe is required"
       pattern:

examples/demo/6_qos/policy_qos.yaml

@@ -3,12 +3,13 @@ kind: Policy
 metadata:
   name: policy-qos
 spec:
-  validationFailureAction: "audit"
+#  validationFailureAction: "audit"
   rules:
     - name: add-memory-limit
-      resource:
+      match:
-        kinds:
+        resources:
-        - Deployment
+          kinds:
+          - Deployment
       mutate:
         overlay:
           spec:
@@ -21,10 +22,12 @@ spec:
                       limits:
                         # add memory limit if it is not exist
                         "+(memory)": "300Mi"  
+                        "+(cpu)": "100"
     - name: check-cpu-memory-limits
-      resource:
+      match:
-        kinds:
+        resources:
-        - Deployment
+          kinds:
+          - Deployment
       validate:
         message: "Resource limits are required for CPU and memory"
         pattern:

examples/demo/7_container_security_context/policy.yaml

@@ -5,12 +5,13 @@ metadata:
 spec:
   rules:
   - name: validate-user-privilege
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
-      selector :
+        - Deployment
-        matchLabels:
+        selector :
-          app.type: prod
+          matchLabels:
+            app.type: prod
     validate:
       message: "validate container security contexts"
       pattern:

examples/generate/policy_basic.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: "Basic clone config generator for all namespaces"
-      resource:
+      match:
-        kinds: 
+        resources:
-        - Namespace
+          kinds: 
-      selector:
+          - Namespace
-        matchLabels:
+        selector:
-          LabelForSelector : "namespace2"
+          matchLabels:
+            LabelForSelector : "namespace2"
       generate:
         kind: ConfigMap
         name: default-config
@@ -18,12 +19,13 @@ spec :
           namespace: default
           name: config-template
     - name: "Basic config generator for all namespaces"
-      resource:
+      match:
-        kinds: 
+        resources:
-        - Namespace
+          kinds: 
-      selector:
+          - Namespace
-        matchLabels:
+        selector:
-          LabelForSelector : "namespace2"
+          matchLabels:
+            LabelForSelector : "namespace2"
       generate:
         kind: Secret
         name: mongo-creds

examples/generate/policy_generate.yaml

@@ -5,12 +5,13 @@ metadata:
 spec:
   rules:
   - name: "copy-comfigmap"
-    resource :
+    match:
-      kinds : 
+      resources:
-      - Namespace
+        kinds : 
-      selector:
+        - Namespace
-        matchLabels:
+        selector:
-          LabelForSelector : "namespace2"
+          matchLabels:
+            LabelForSelector : "namespace2"
     generate :
       kind: ConfigMap
       name : copied-cm
@@ -18,12 +19,13 @@ spec:
         namespace : default
         name : game-config
   - name: "zk-kafka-address"
-    resource: 
+    match:
-      kinds:
+      resources: 
-       - Namespace
+        kinds:
-      selector:
+        - Namespace
-       matchExpressions:
+        selector:
-        - {key: LabelForSelector, operator: In, values: [namespace2]}
+        matchExpressions:
+          - {key: LabelForSelector, operator: In, values: [namespace2]}
     generate: 
       kind: ConfigMap
       name: zk-kafka-address

examples/generate/policy_networkPolicy.yaml

@@ -5,10 +5,11 @@ metadata:
 spec:
   rules:
   - name: "deny-all-traffic"
-    resource: 
+    match:
-      kinds:
+      resources: 
-       - Namespace
+        kinds:
-      name: "*"
+        - Namespace
+        name: "*"
     generate: 
       kind: NetworkPolicy
       name: deny-all-traffic

examples/mutate/overlay/policy_imagePullPolicy.yaml

@@ -5,9 +5,10 @@ metadata:
 spec:
   rules:
   - name: set-image-pull-policy
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
+        - Deployment
     mutate:
       overlay:
         spec:

examples/mutate/patches/policy_endpoints.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: pEP
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Endpoints
+          kinds : 
-        selector:
+          - Endpoints
-          matchLabels:
+          selector:
-            label : test
+            matchLabels:
+              label : test
       mutate:
         patches:
           - path : "/subsets/0/ports/0/port"

examples/validate/check_cpu_memory.yaml

@@ -5,9 +5,10 @@ metadata:
 spec:
   rules:
   - name: check-defined
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
+        - Deployment
     validate:
       message: "Resource limits are required for CPU and memory"
       pattern:
@@ -22,9 +23,10 @@ spec:
                     cpu: "?*"
 
   - name: check-cpu
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
+        - Deployment
     validate:
       message: "CPU request should be less than 4"
       pattern:

examples/validate/check_hostpath.yaml

@@ -5,9 +5,10 @@ metadata:
 spec:
   rules:
   - name: check-host-path
-    resource:
+    match:
-      kinds:
+      resources:
-      - Pod
+        kinds:
+        - Pod
     validate:
       message: "Host path is not allowed"
       pattern:

examples/validate/check_image_version.yaml

@@ -5,9 +5,10 @@ metadata:
 spec:
   rules:
   - name: image-pull-policy
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
+        - Deployment
     validate:
       message: "Image tag ':latest' requires imagePullPolicy 'Always'"
       pattern:

examples/validate/check_memory_requests_same_yaml.yaml

@@ -5,14 +5,15 @@ metadata :
 spec :
   rules:
     - name: check-memory_requests_link_in_yaml
-      resource:
+      match:
-        # Kind specifies one or more resource types to match
+        resources:
-        kinds:
+          # Kind specifies one or more resource types to match
-          - Deployment
+          kinds:
-        # Name is optional and can use wildcards
+            - Deployment
-        name: "*"
+          # Name is optional and can use wildcards
-        # Selector is optional
+          name: "*"
-        selector:
+          # Selector is optional
+          selector:
       validate:
         pattern:
           spec:

examples/validate/check_memory_requests_same_yaml_relative.yaml

@@ -5,14 +5,15 @@ metadata :
 spec :
   rules:
     - name: check-memory_requests_link_in_yaml_relative
-      resource:
+      match:
-        # Kind specifies one or more resource types to match
+        resources:
-        kinds:
+          # Kind specifies one or more resource types to match
-          - Deployment
+          kinds:
-        # Name is optional and can use wildcards
+            - Deployment
-        name: "*"
+          # Name is optional and can use wildcards
-        # Selector is optional
+          name: "*"
-        selector:
+          # Selector is optional
+          selector:
       validate:
         pattern:
           spec:

examples/validate/check_nodeport.yaml

@@ -5,9 +5,10 @@ metadata:
 spec:
   rules:
   - name: check-node-port
-    resource:
+    match:
-      kinds:
+      resources:
-      - Service
+        kinds:
+        - Service
     validate:
       message: "NodePort type is not allowed"
       pattern:

examples/validate/check_not_root.yaml

@@ -5,11 +5,12 @@ metadata :
 spec :
   rules:
     - name: check-non-root
-      resource:
+      match:
-        kinds:
+        resources:
-        - Deployment
+          kinds:
-        - StatefuleSet
+          - Deployment
-        - DaemonSet
+          - StatefuleSet
+          - DaemonSet
       validate:
         message: "Root user is not allowed"
         pattern:

examples/validate/check_probe_exists.yaml

@@ -5,9 +5,10 @@ metadata :
 spec:
   rules:
   - name: check-liveness-probe-exists
-    resource:
+    match:
-      kinds :
+      resources:
-      - StatefulSet
+        kinds :
+        - StatefulSet
     validate:
       message: "a livenessProbe is required"
       pattern:
@@ -19,9 +20,10 @@ spec:
                 livenessProbe:
                   periodSeconds: ">0"
   - name: check-readiness-probe-exists
-    resource:
+    match:
-      kinds :
+      resources:
-      - StatefulSet
+        kinds :
+        - StatefulSet
     validate:
       message: "a readinessProbe is required"
       pattern:

examples/validate/check_probe_intervals.yaml

@@ -5,9 +5,10 @@ metadata :
 spec:
   rules:
   - name: check-probe-intervals
-    resource:
+    match:
-      kinds :
+      resources:
-      - Deployment
+        kinds :
+        - Deployment
     validate:
       message: "livenessProbe must be > 10s"
       pattern:
@@ -19,9 +20,10 @@ spec:
                   livenessProbe:
                     periodSeconds: ">10"
   - name: check-probe-intervals
-    resource:
+    match:
-      kinds :
+      resources:
-      - Deployment
+        kinds :
+        - Deployment
     validate:
       message: "readinessProbe must be > 10s"
       pattern:

examples/validate/check_registries.yaml

@@ -5,10 +5,11 @@ metadata:
 spec:
   rules:
   - name: check-registries
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
-      - StatefulSet
+        - Deployment
+        - StatefulSet
     validate:
       message: "Registry is not allowed"
       pattern:

test/ConfigMap/policy-CM.yaml

@@ -5,10 +5,11 @@ metadata :
 spec :
   rules:
     - name: pCM1
-      resource:
+      match:
-        kinds :
+        resources:
-        - ConfigMap
+          kinds :
-        name: "game-config"
+          - ConfigMap
+          name: "game-config"
       mutate:
         overlay:
           data:
@@ -25,10 +26,11 @@ spec :
           op : add
           value : newValue
     - name: pCM2
-      resource:
+      match:
-        kinds :
+        resources:
-        - ConfigMap
+          kinds :
-        name: "game-config"
+          - ConfigMap
+          name: "game-config"
       mutate:
         patches:
         - path : "/data/secretData"
@@ -37,10 +39,11 @@ spec :
           op : replace
           value : "data is replaced"
     - name: pCM3
-      resource:
+      match:
-        kinds :
+        resources:
-        - ConfigMap
+          kinds :
-        name: "game-config"
+          - ConfigMap
+          name: "game-config"
       mutate:
         patches:
         - path : "/data/secretData"
@@ -52,10 +55,11 @@ spec :
           data:
             game.properties: "*enemies=aliens*"
     - name: pCM4
-      resource:
+      match:
-        kinds :
+        resources:
-        - ConfigMap
+          kinds :
-        name: "game-config"
+          - ConfigMap
+          name: "game-config"
       validate:
         message: "This CM data is broken because it does not have ui.properties"
         pattern:

test/ConfigMapGenerator-SecretGenerator/policy-cm-test.yaml

@@ -5,12 +5,13 @@ metadata :
 spec:
   rules:
   - name: "copyCM"
-    resource :
+    match:
-      kinds : 
+      resources:
-      - Namespace
+        kinds : 
-      selector:
+        - Namespace
-        matchLabels:
+        selector:
-          LabelForSelector : "namespace2"
+          matchLabels:
+            LabelForSelector : "namespace2"
     generate :
       kind: ConfigMap
       name : copied-cm

test/ConfigMapGenerator-SecretGenerator/policy-namespace-patch-cmgCG-sgCG.yaml

@@ -10,12 +10,13 @@ metadata :
 spec :
   rules:
   - name: "patchNamespace2"
-    resource :
+    match:
-      kinds : 
+      resources:
-      - Namespace
+        kinds : 
-      selector:
+        - Namespace
-        matchLabels:
+        selector:
-          LabelForSelector : "namespace2"
+          matchLabels:
+            LabelForSelector : "namespace2"
     mutate:
       patches:
         - path: "/metadata/labels/isMutatedByPolicy"
@@ -23,12 +24,13 @@ spec :
           value: "true"
 
   - name: "copyCM"
-    resource :
+    match:
-      kinds : 
+      resources:
-      - Namespace
+        kinds : 
-      selector:
+        - Namespace
-        matchLabels:
+        selector:
-          LabelForSelector : "namespace2"
+          matchLabels:
+            LabelForSelector : "namespace2"
     generate :
       kind: ConfigMap
       name : copied-cm
@@ -37,12 +39,13 @@ spec :
         name : game-config
        
   - name: "generateCM"
-    resource :
+    match:
-      kinds : 
+      resources:
-      - Namespace
+        kinds : 
-      selector:
+        - Namespace
-        matchLabels:
+        selector:
-          LabelForSelector : "namespace2"
+          matchLabels:
+            LabelForSelector : "namespace2"
     generate :
       kind: ConfigMap
       name : generated-cm
@@ -56,10 +59,11 @@ spec :
             rsa.public.key=42
   
   - name: "generateSecret"
-    resource :
+    match:
-      kinds : 
+      resources:
-      - Namespace
+        kinds : 
-      name: ns2
+        - Namespace
+        name: ns2
     generate :
       kind: Secret
       name : generated-secrets
@@ -73,10 +77,11 @@ spec :
           foo2=bar2
 
   - name: "copySecret"
-    resource :
+    match:
-      kinds : 
+      resources:
-      - Namespace
+        kinds : 
-      name: ns2
+        - Namespace
+        name: ns2
     generate :
       kind: Secret
       name : copied-secrets

test/CronJob/policy-cronjob-wldcrd.yaml

@@ -5,10 +5,11 @@ metadata:
 spec:
   rules:
     - name: pCJ
-      resource:
+      match:
-        kinds : 
+        resources:
-        - CronJob
+          kinds : 
-        name: "?ell*"
+          - CronJob
+          name: "?ell*"
       mutate:
         patches:
           - path: "/metadata/labels/isMutated"

test/DaemonSet/policy-daemonset.yaml

@@ -5,10 +5,11 @@ metadata:
 spec:
   rules:
     - name: "Patch and Volume validation"
-      resource:
+      match:
-        kinds:
+        resources:
-        - DaemonSet
+          kinds:
-        name: fluentd-elasticsearch
+          - DaemonSet
+          name: fluentd-elasticsearch
       mutate:
         patches:
         - path: "/metadata/labels/isMutated"

test/Deployment/policy-deployment-any.yaml

@@ -5,9 +5,10 @@ metadata :
 spec :
   rules:
     - name: "First policy v2"
-      resource:
+      match:
-        kinds :
+        resources:
-        - Deployment
+          kinds :
+          - Deployment
       mutate:
         patches:
         - path: /metadata/labels/isMutated
@@ -16,7 +17,6 @@ spec :
         - path: /metadata/labels/app
           op: replace
           value: "nginx_is_mutated"
-
       validate:
         message: "Because I like only mutated resources"
         pattern:

test/Endpoint/policy-endpoints.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: pEP
-      resource:
+      match:
-        kinds :
+        resources:
-        - Endpoints
+          kinds :
-        selector:
+          - Endpoints
-          matchLabels:
+          selector:
-            label : test
+            matchLabels:
+              label : test
       mutate:
         patches:
           - path : "/subsets/0/ports/0/port"

test/HorizontalPodAutoscaler/policy-hpa.yaml

@@ -5,12 +5,13 @@ metadata:
 spec :
   rules:
     - name: hpa1
-      resource:
+      match:
-        kinds : 
+        resources:
-        - HorizontalPodAutoscaler
+          kinds : 
-        selector:
+          - HorizontalPodAutoscaler
-          matchLabels:
+          selector:
-            originalLabel: isHere
+            matchLabels:
+              originalLabel: isHere
       mutate:
         patches:
         - path: "/metadata/labels/isMutated"

test/Ingress/policy-ingress.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: ingress1
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Ingress
+          kinds : 
-        selector:
+          - Ingress
-          matchLabels:
+          selector:
-            originalLabel: isHere
+            matchLabels:
+              originalLabel: isHere
       mutate:
         patches:
         - path: "/metadata/labels/isMutated"

test/Job/policy-job.yaml

@@ -5,10 +5,11 @@ metadata:
 spec :
   rules:
     - name: job2
-      resource:
+      match:
-        kinds:
+        resources:
-        - Job
+          kinds:
-        name: pi
+          - Job
+          name: pi
       mutate:
         overlay:
           spec:
@@ -20,10 +21,11 @@ spec :
                   - containerPort: 80
                     protocol: TCP    
     - name: job1
-      resource:
+      match:
-        kinds:
+        resources:
-        - Job
+          kinds:
-        name: pi
+          - Job
+          name: pi
       mutate:
         overlay:
           metadata:

test/LimitRange/policy-limitrange.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: "rule"
-      resource:
+      match:
-        kinds :
+        resources:
-        - LimitRange
+          kinds :
-        selector:
+          - LimitRange
-          matchLabels:
+          selector:
-            containerSize: minimal
+            matchLabels:
+              containerSize: minimal
       mutate:
         patches:
         - path : "/spec/limits/0/default/memory"

test/Namespace/policy-namespace.yaml

@@ -6,12 +6,13 @@ metadata :
 spec :
   rules:
     - name: ns1
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Namespace
+          kinds : 
-        selector:
+          - Namespace
-          matchLabels:
+          selector:
-            LabelForSelector : "namespace"
+            matchLabels:
+              LabelForSelector : "namespace"
       mutate:
         patches:
         - path: "/metadata/labels/replaced"

test/NetworkPolicy/policy-network-policy.yaml

@@ -5,12 +5,13 @@ metadata:
 spec:
   rules:
     - name: np1
-      resource:
+      match:
-        kinds :
+        resources:
-        - NetworkPolicy
+          kinds :
-        selector:
+          - NetworkPolicy
-          matchLabels:
+          selector:
-            originalLabel: isHere
+            matchLabels:
+              originalLabel: isHere
       mutate:
         patches:
         - path: "/metadata/labels/isMutated"

test/PersistentVolumeClaim/policy-PVC.yaml

@@ -5,11 +5,12 @@ metadata:
 spec:
   rules:
     - name: pvc1
-      resource:
+      match:
-        kinds :
+        resources:
-        - PersistentVolumeClaim
+          kinds :
-        matchLabels:
+          - PersistentVolumeClaim
-            originalLabel: isHere
+          matchLabels:
+              originalLabel: isHere
       mutate:
         patches:
         - path: "/metadata/labels/originalLabel"

test/PodDisruptionBudget/policy-pdb.yaml

@@ -5,10 +5,11 @@ metadata:
 spec:
   rules:
     - name: pdb1
-      resource:
+      match:
-        kinds : 
+        resources:
-        - PodDisruptionBudget
+          kinds : 
-        name: "game-pdb"
+          - PodDisruptionBudget
+          name: "game-pdb"
       mutate:
         patches:
         - path: "/metadata/labels/isMutated"

test/PodTemplate/policy-PodTemplate.yaml

@@ -5,12 +5,13 @@ metadata:
 spec:
   rules:
     - name: podtemplate1
-      resource:
+      match:
-        kinds :
+        resources:
-        - PodTemplate
+          kinds :
-        selector:
+          - PodTemplate
-          matchLabels:
+          selector:
-            originalLabel: isHere
+            matchLabels:
+              originalLabel: isHere
       mutate:
         overlay:
           template:

test/ResourceQuota/policy-quota-validation.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: "rule1"
-      resource:
+      match:
-        kinds : 
+        resources:
-        - ResourceQuota
+          kinds : 
-        selector:
+          - ResourceQuota
-          matchLabels:
+          selector:
-            quota: low
+            matchLabels:
+              quota: low
       validate:
         message: "This RQ requests too many RAM"
         pattern:
@@ -18,12 +19,13 @@ spec :
             hard:
               memory: "8Gi|12Gi"
     - name: "rule2"
-      resource:
+      match:
-        kinds : 
+        resources:
-        - ResourceQuota
+          kinds : 
-        selector:
+          - ResourceQuota
-          matchLabels:
+          selector:
-            quota: low
+            matchLabels:
+              quota: low
       validate:
         message: "This RQ requests too many CPUs"
         pattern:
@@ -31,12 +33,13 @@ spec :
             hard:
               cpu: <3
     - name: "rule3"
-      resource:
+      match:
-        kinds : 
+        resources:
-        - ResourceQuota
+          kinds : 
-        selector:
+          - ResourceQuota
-          matchLabels:
+          selector:
-            quota: low
+            matchLabels:
+              quota: low
       validate:
         message: "This RQ requests too many PODs"
         pattern:

test/ResourceQuota/policy-quota.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: "rule"
-      resource:
+      match:
-        kinds : 
+        resources:
-        - ResourceQuota
+          kinds : 
-        selector:
+          - ResourceQuota
-          matchLabels:
+          selector:
-            quota: low
+            matchLabels:
+              quota: low
       mutate:
         patches:
         - path : "/spec/scopeSelector/matchExpressions/1"

test/Secret/policy-secret.yaml

@@ -5,10 +5,11 @@ metadata:
 spec:
   rules:
     - name: secret1
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Secret
+          kinds : 
-        name: "mysecret"
+          - Secret
+          name: "mysecret"
       mutate:
         patches:
         - path: "/metadata/labels/isMutated"

test/SecurityContext/policy.yaml

@@ -5,12 +5,13 @@ metadata:
 spec:
   rules:
   - name: set-userID
-    resource:
+    match:
-      kinds:
+      resources:
-      - Deployment
+        kinds:
-      selector :
+        - Deployment
-        matchLabels:
+        selector :
-          app.type: prod
+          matchLabels:
+            app.type: prod
     mutate:
       overlay:
         spec:

test/Service/policy-service.yaml

@@ -5,10 +5,11 @@ metadata :
 spec :
   rules:
     - name: ps1
-      resource:
+      match:
-        kinds: 
+        resources:
-        - Service
+          kinds: 
-        name: "game-service*"
+          - Service
+          name: "game-service*"
       mutate:
         patches:
         - path: "/metadata/labels/isMutated"

test/StatefulSet/policy-StatefulSet.yaml

@@ -5,12 +5,13 @@ metadata:
 spec:
   rules:
     - name: statefulset1
-      resource:
+      match:
-        kinds :
+        resources:
-        - StatefulSet
+          kinds :
-        selector:
+          - StatefulSet
-          matchLabels:
+          selector:
-            originalLabel: isHere
+            matchLabels:
+              originalLabel: isHere
       mutate:
         patches:
         - path: "/spec/template/metadata/labels/isMutated"

test/mix/policy.yaml

@@ -5,12 +5,13 @@ metadata :
 spec :
   rules:
     - name: add-label
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Deployment
+          kinds : 
-        selector :
+          - Deployment
-          matchLabels :
+          selector :
-            cli: test
+            matchLabels :
+              cli: test
       mutate:
         patches:
         - path: /metadata/labels/isMutated
@@ -25,36 +26,39 @@ spec :
                   - (image): "*nginx*"
                     imagePullPolicy: "Always"
     - name: add-label2
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Deployment
+          kinds : 
-        selector :
+          - Deployment
-          matchLabels :
+          selector :
-            cli: test
+            matchLabels :
+              cli: test
       mutate:
         patches:
         - path: /metadata/labels/app1
           op: replace
           value: "nginx_is_mutated" 
     - name: add-label3
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Deployment
+          kinds : 
-        selector :
+          - Deployment
-          matchLabels :
+          selector :
-            cli: test
+            matchLabels :
+              cli: test
       mutate:
         patches:
         - path: /metadata/labels/app2
           op: add
           value: "nginx_is_mutated2" 
     - name: check-image
-      resource:
+      match:
-        kinds : 
+        resources:
-        - Deployment
+          kinds : 
-        selector :
+          - Deployment
-          matchLabels :
+          selector :
-            cli: test
+            matchLabels :
+              cli: test
       validate:
         message: "The imagePullPolicy must be Always when using image nginx"
         pattern:
@@ -65,10 +69,11 @@ spec :
                 - (image): "*nginx*"
                   imagePullPolicy: "Always"
     - name: check-registries
-      resource:
+      match:
-        kinds:
+        resources:
-        - Deployment
+          kinds:
-        - StatefulSet
+          - Deployment
+          - StatefulSet
       validate:
         message: "Registry is not allowed"
         pattern: