mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-31 03:45:17 +00:00
removed extra changes
This commit is contained in:
parent
4cc4ef7cee
commit
5efbfe80c9
3 changed files with 26 additions and 18 deletions
|
@ -46,8 +46,8 @@ spec:
|
||||||
- name: "*"
|
- name: "*"
|
||||||
resources:
|
resources:
|
||||||
limits:
|
limits:
|
||||||
# '?' requires 1 alphanumeric character and '*' means that there can be 0 or more characters.
|
# '?' requires 1 alphanumeric character and '*' means that there can be 0 or more characters.
|
||||||
# Using them togther e.g. '?*' requires at least one character.
|
# Using them together e.g. '?*' requires at least one character.
|
||||||
memory: "?*"
|
memory: "?*"
|
||||||
cpu: "?*"
|
cpu: "?*"
|
||||||
requests:
|
requests:
|
||||||
|
|
|
@ -47,7 +47,8 @@ spec :
|
||||||
rules:
|
rules:
|
||||||
- name: "Remove unwanted label"
|
- name: "Remove unwanted label"
|
||||||
resource:
|
resource:
|
||||||
kind: Secret
|
kinds:
|
||||||
|
- Secret
|
||||||
mutate:
|
mutate:
|
||||||
patches:
|
patches:
|
||||||
- path: "/metadata/labels/purpose"
|
- path: "/metadata/labels/purpose"
|
||||||
|
@ -71,7 +72,8 @@ spec :
|
||||||
rules:
|
rules:
|
||||||
- name: "Set hard memory limit to 2Gi"
|
- name: "Set hard memory limit to 2Gi"
|
||||||
resource:
|
resource:
|
||||||
kind: Pod
|
kinds:
|
||||||
|
- Pod
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
memory: high
|
memory: high
|
||||||
|
@ -80,7 +82,7 @@ spec :
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
# the wildcard * will match all containers in the list
|
# the wildcard * will match all containers in the list
|
||||||
- name: *
|
- (name): "*"
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
memory: "10Gi"
|
memory: "10Gi"
|
||||||
|
@ -94,37 +96,41 @@ spec :
|
||||||
Applying overlays to a list type without is fairly straightforward: new items will be added to the list, unless they already ecist. For example, the next overlay will add IP "192.168.10.172" to all addresses in all Endpoints:
|
Applying overlays to a list type without is fairly straightforward: new items will be added to the list, unless they already ecist. For example, the next overlay will add IP "192.168.10.172" to all addresses in all Endpoints:
|
||||||
|
|
||||||
````yaml
|
````yaml
|
||||||
apiVersion: policy.nirmata.io/v1alpha1
|
apiVersion: kyverno.io/v1alpha1
|
||||||
kind: Policy
|
kind: Policy
|
||||||
metadata:
|
metadata:
|
||||||
name: policy-endpoints
|
name: policy-endpoints
|
||||||
spec:
|
spec:
|
||||||
rules:
|
rules:
|
||||||
- resource:
|
- name: "Add IP to subsets"
|
||||||
kind : Endpoints
|
resource:
|
||||||
|
kinds :
|
||||||
|
- Endpoints
|
||||||
mutate:
|
mutate:
|
||||||
overlay:
|
overlay:
|
||||||
subsets:
|
subsets:
|
||||||
- addresses:
|
- addresses:
|
||||||
- ip: 192.168.10.172
|
- ip: 192.168.42.172
|
||||||
````
|
````
|
||||||
|
|
||||||
|
|
||||||
### Conditional logic using anchors
|
### Conditional logic using anchors
|
||||||
|
|
||||||
An **anchor** field, marked by parentheses, allows conditional processing of configurations. Processing stops when the anchor value does not match. Once processing stops, any child elements or any remaining siblings in a list, will not be processed.
|
An **anchor** field, marked by parentheses, allows conditional processing of configurations. Processing stops when the anchor value does not match. Once processing stops, any child elements or any remaining siblings in a list, will not be processed.
|
||||||
|
|
||||||
For example, this overlay will add or replace the value 6443 for the port field, for all ports with a name value that starts with "secure":
|
For example, this overlay will add or replace the value 6443 for the port field, for all ports with a name value that starts with "secure":
|
||||||
|
|
||||||
````yaml
|
````yaml
|
||||||
apiVersion : policy.nirmata.io/v1alpha1
|
apiVersion: kyverno.io/v1alpha1
|
||||||
kind : Policy
|
kind : Policy
|
||||||
metadata :
|
metadata :
|
||||||
name : policy-set-port
|
name : policy-set-port
|
||||||
spec :
|
spec :
|
||||||
rules:
|
rules:
|
||||||
- resource:
|
- name: "Set port"
|
||||||
kind : Endpoints
|
resource:
|
||||||
|
kinds :
|
||||||
|
- Endpoints
|
||||||
mutate:
|
mutate:
|
||||||
overlay:
|
overlay:
|
||||||
subsets:
|
subsets:
|
||||||
|
@ -145,18 +151,20 @@ A variation of an anchor, is to add a field value if it is not already defined.
|
||||||
For example, this overlay will set the port to 6443, if a port is not already defined:
|
For example, this overlay will set the port to 6443, if a port is not already defined:
|
||||||
|
|
||||||
````yaml
|
````yaml
|
||||||
apiVersion : policy.nirmata.io/v1alpha1
|
apiVersion: kyverno.io/v1alpha1
|
||||||
kind : Policy
|
kind : Policy
|
||||||
metadata :
|
metadata :
|
||||||
name : policy-set-port
|
name : policy-set-port
|
||||||
spec :
|
spec :
|
||||||
rules:
|
rules:
|
||||||
- resource:
|
- name: "Set port"
|
||||||
kind : Endpoints
|
resource:
|
||||||
|
kinds :
|
||||||
|
- Endpoints
|
||||||
mutate:
|
mutate:
|
||||||
overlay:
|
overlay:
|
||||||
subsets:
|
subsets:
|
||||||
- ports:
|
- (ports):
|
||||||
+(port): 6443
|
+(port): 6443
|
||||||
````
|
````
|
||||||
|
|
||||||
|
|
|
@ -46,7 +46,7 @@ metadata :
|
||||||
name : policy-endpoints
|
name : policy-endpoints
|
||||||
spec :
|
spec :
|
||||||
rules:
|
rules:
|
||||||
- name:
|
- name: ""
|
||||||
resource:
|
resource:
|
||||||
kinds:
|
kinds:
|
||||||
- Endpoints
|
- Endpoints
|
||||||
|
|
Loading…
Add table
Reference in a new issue