changed examples for next release

examples/mutate/overlay/set_image_pull_policy.yaml

@@ -14,6 +14,6 @@ spec:
           template:
             spec:
               containers:
-                # set the imagePullPolicy to "Always"
-                - (imagePullPolicy): "IfNotPresent"
+                # if the image tag is latest, set the imagePullPolicy to Always
+                - (image): "*:latest"
                   imagePullPolicy: "Always"

examples/validate/check_cpu_memory.yaml

@@ -15,18 +15,18 @@ spec:
           template:
             spec:
               containers:
-              - name: "*"
+              - name: "?*"
                 resources:
                   limits:
-                    memory: "*"
-                    cpu: "*"
+                    memory: "?*"
+                    cpu: "?*"
 
   - name: check-cpu
     resource:
       kinds:
       - Deployment
     validate:
-      message: "CPU request should be 4"
+      message: "CPU request should be less than 4"
       pattern:
         spec:
           template:
@@ -35,4 +35,4 @@ spec:
               - name: "*"
                 resources:
                   requests:
-                    cpu: "4"
+                    cpu: "<4"

examples/validate/check_hostpath.yaml

@@ -9,10 +9,10 @@ spec:
       kinds:
       - Pod
     validate:
-      message: "Host path should be /var/log"
+      message: "Host path is not allowed"
       pattern:
         spec:
           volumes:
-          - (name): log
+          - name: "*"
             hostPath:
-              path: /var/log
+              path: ""

examples/validate/check_image_version.yaml

@@ -15,5 +15,7 @@ spec:
           template:
             spec:
               containers:
-              - (image): "*latest"       # select images which end with :latest
-                imagePullPolicy: Always   # ensure that the imagePullPolicy is "Always"
+              # select images which end with :latest
+              - (image): "*latest"
+                # require that the imagePullPolicy is "Always"  
+                imagePullPolicy: Always

examples/validate/check_nodeport.yaml

@@ -1,15 +1,15 @@
 apiVersion : kyverno.io/v1alpha1
 kind: Policy
 metadata:
-  name: check-host-path
+  name: check-node-port
 spec:
   rules:
-  - name: check-host-path
+  - name: check-node-port
     resource:
       kinds:
       - Service
     validate:
-      message: "Only NodePort type is allowed"
+      message: "NodePort type is not allowed"
       pattern:
         spec:
-          type: "NodePort"
+          type: "!NodePort"

examples/validate/check_probe_exists.yaml

@@ -15,7 +15,6 @@ spec:
           template:
             spec:
               containers:
-                # In this case every object in containers list will be checked for pattern
               - name: "*"
                 livenessProbe:
                   periodSeconds: ">0"
@@ -30,7 +29,6 @@ spec:
           template:
             spec:
               containers:
-                # In this case every object in containers list will be checked for pattern
               - name: "*"
                 readinessProbe:
                   periodSeconds: ">0"

examples/validate/check_probe_intervals.yaml

@@ -15,7 +15,6 @@ spec:
           template:
             spec:
               containers:
-                # In this case every object in containers list will be checked for pattern
                 - name: "*"
                   livenessProbe:
                     periodSeconds: ">10"
@@ -30,7 +29,6 @@ spec:
           template:
             spec:
               containers:
-                # In this case every object in containers list will be checked for pattern
                 - name: "*"
                   readinessProbe:
                     periodSeconds: ">10"

examples/validate/check_whitelist_registries.yaml

@@ -17,5 +17,5 @@ spec:
             spec:
               containers:
               - name: "*"
-                # Checks if the image path starts with "https://hub.docker.io/nirmata/*"
-                image: https://hub.docker.io/nirmata/*
+                # Check allowed registries
+                image: "*/nirmata/* | https://private.registry.io/*"