diff --git a/demo/generate/namespace.yaml b/demo/generate/namespace.yaml new file mode 100644 index 0000000000..474a73e038 --- /dev/null +++ b/demo/generate/namespace.yaml @@ -0,0 +1,4 @@ +kind: Namespace +apiVersion: v1 +metadata: + name: "demo" \ No newline at end of file diff --git a/demo/generate/policy.yaml b/demo/generate/policy.yaml new file mode 100644 index 0000000000..3bcc08ecd2 --- /dev/null +++ b/demo/generate/policy.yaml @@ -0,0 +1,25 @@ +apiVersion: kyverno.io/v1alpha1 +kind: Policy +metadata: + name: "default" +spec: + rules: + - name: "deny-all-ingress-traffic" + resource: + kinds: + - Namespace + name: "*" + generate: + kind: NetworkPolicy + name: deny-all-traffic + data: + spec: + podSelector: + matchLabels: {} + matchExpressions: [] + policyTypes: + - Ingress + metadata: + annotations: {} + labels: + policyname: "default" \ No newline at end of file diff --git a/demo/mutate_patch/ep.yaml b/demo/mutate_patch/ep.yaml new file mode 100644 index 0000000000..958d931482 --- /dev/null +++ b/demo/mutate_patch/ep.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Endpoints +metadata: + name: test-endpoint + labels: + label : test +subsets: +- addresses: + - ip: 192.168.10.171 + ports: + - name: secure-connection + port: 443 + protocol: TCP diff --git a/demo/mutate_patch/policy_patch.yaml b/demo/mutate_patch/policy_patch.yaml new file mode 100644 index 0000000000..a1663bfb2d --- /dev/null +++ b/demo/mutate_patch/policy_patch.yaml @@ -0,0 +1,23 @@ +apiVersion : kyverno.io/v1alpha1 +kind : Policy +metadata : + name : policy-endpoints +spec : + rules: + - name: pEP + resource: + kinds : + - Endpoints + selector: + matchLabels: + label : test + mutate: + patches: + # add a new label + - path: "metadata/labels/isMutate" + op: add + value: true + # replace port + - path : "/subsets/0/ports/0/port" + op : replace + value: 9663 \ No newline at end of file diff --git a/demo/qos/policy_qos.yaml b/demo/qos/policy_qos.yaml new file mode 100644 index 0000000000..065cf4c16f --- /dev/null +++ b/demo/qos/policy_qos.yaml @@ -0,0 +1,40 @@ +apiVersion : kyverno.io/v1alpha1 +kind: Policy +metadata: + name: policy-qos +spec: + rules: + - name: add-memory-limit + resource: + kinds: + - Deployment + mutate: + overlay: + spec: + template: + spec: + containers: + # the wildcard * will match all containers in the list + - (name): "*" + resources: + limits: + # add memory limit if it is not exist + "+(memory)": "300Mi" + - name: check-cpu-memory-limits + resource: + kinds: + - Pod + validate: + message: "Resource limits are required for CPU and memory" + pattern: + spec: + template: + spec: + containers: + # match all contianers + - (name): "*" + resources: + limits: + # cpu and memory is required despite of the value + memory: "?*" + cpu: "?*" \ No newline at end of file diff --git a/demo/qos/qos.yaml b/demo/qos/qos.yaml new file mode 100644 index 0000000000..adae7c303e --- /dev/null +++ b/demo/qos/qos.yaml @@ -0,0 +1,28 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: qos-demo + # labels: + # app: nginx +spec: + replicas: 1 + selector: + matchLabels: + app: nginx + template: + metadata: + labels: + app: nginx + spec: + containers: + - name: nginx + image: nginx:latest + resources: + limits: + cpu: "50m" + - name: ghost + image: ghost:latest + resources: + limits: + cpu: "50m" + memory: "500Mi" diff --git a/demo/security_context/busybox.yaml b/demo/security_context/busybox.yaml new file mode 100644 index 0000000000..5f841bd194 --- /dev/null +++ b/demo/security_context/busybox.yaml @@ -0,0 +1,26 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: psp-demo + labels: + app.type: prod +spec: + replicas: 1 + selector: + matchLabels: + app: nginx + template: + metadata: + labels: + app: nginx + spec: + volumes: + - name: sec-ctx-vol + emptyDir: {} + containers: + - name: sec-ctx-demo + image: busybox + command: [ "sh", "-c", "sleep 1h" ] + volumeMounts: + - name: sec-ctx-vol + mountPath: /data/demo \ No newline at end of file diff --git a/demo/security_context/policy.yaml b/demo/security_context/policy.yaml new file mode 100644 index 0000000000..ff47ce9908 --- /dev/null +++ b/demo/security_context/policy.yaml @@ -0,0 +1,21 @@ +apiVersion : kyverno.io/v1alpha1 +kind: Policy +metadata: + name: policy-security-context +spec: + rules: + - name: set-userID + resource: + kinds: + - Deployment + selector : + matchLabels: + app.type: prod + mutate: + overlay: + spec: + template: + spec: + securityContext: + runAsUser: 1000 + fsGroup: 2000 \ No newline at end of file