mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity

Merge pull request #584 from nirmata/371_omitempty

Browse source 
add anchors for omitempty tag
This commit is contained in:
shuting 2020-01-02 11:17:31 -08:00 committed by GitHub
commit 2d022d457a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 25 additions and 35 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
samples/DisallowBindMounts.md
View file

@ -22,6 +22,6 @@ spec:
message: "Host path volumes are not allowed"
pattern:
spec:
volumes:
=(volumes):
- X(hostPath): null
````

25
samples/DisallowPrivilegedContainers.md
View file

@ -22,15 +22,13 @@ spec:
- Pod
validate:
message: "Privileged mode is not allowed. Set privileged to false"
anyPattern:
- spec:
securityContext:
privileged: false
- spec:
pattern:
spec:
containers:
- name: "*"
securityContext:
privileged: false
- =(securityContext):
# https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5707-L5711
# k8s default to false
=(privileged): false
- name: validate-allowPrivilegeEscalation
match:
resources:
@ -38,13 +36,10 @@ spec:
- Pod
validate:
message: "Privileged mode is not allowed. Set allowPrivilegeEscalation to false"
anyPattern:
- spec:
securityContext:
allowPrivilegeEscalation: false
- spec:
pattern:
spec:
containers:
- name: "*"
securityContext:
- securityContext:
# https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5754
allowPrivilegeEscalation: false
````

3
samples/DisallowRootUser.md
View file

@ -30,7 +30,6 @@ spec:
runAsNonRoot: true
- spec:
containers:
- name: "*"
securityContext:
- securityContext:
runAsNonRoot: true
````

25
samples/best_practices/disallow_privileged.yaml
View file

@ -18,15 +18,13 @@ spec:
- Pod
validate:
message: "Privileged mode is not allowed. Set privileged to false"
anyPattern:
- spec:
securityContext:
privileged: false
- spec:
pattern:
spec:
containers:
- name: "*"
securityContext:
privileged: false
- =(securityContext):
# https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5707-L5711
# k8s default to false
=(privileged): false
- name: validate-allowPrivilegeEscalation
match:
resources:
@ -34,13 +32,10 @@ spec:
- Pod
validate:
message: "Privileged mode is not allowed. Set allowPrivilegeEscalation to false"
anyPattern:
- spec:
securityContext:
allowPrivilegeEscalation: false
- spec:
pattern:
spec:
containers:
- name: "*"
securityContext:
- securityContext:
# https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5754
allowPrivilegeEscalation: false

5
samples/best_practices/disallow_root_user.yaml
View file

@ -20,9 +20,10 @@ spec:
anyPattern:
- spec:
securityContext:
# https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L3165
runAsNonRoot: true
- spec:
containers:
- name: "*"
securityContext:
- securityContext:
# https://github.com/kubernetes/api/blob/7dc09db16fb8ff2eee16c65dc066c85ab3abb7ce/core/v1/types.go#L5742
runAsNonRoot: true