1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00

fix: Result not correct when testing a mutate rule and foreach with add anchor (#8375)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2023-09-13 15:25:29 +02:00 committed by GitHub
parent d4951476b2
commit aeb5e01c60
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 146 additions and 0 deletions

View file

@ -0,0 +1,45 @@
apiVersion : kyverno.io/v1
kind: ClusterPolicy
metadata:
name: add-default-resources
annotations:
policies.kyverno.io/title: Add Default Resources
policies.kyverno.io/category: Other
policies.kyverno.io/severity: medium
kyverno.io/kyverno-version: 1.10.0-alpha.2
policies.kyverno.io/minversion: 1.7.0
kyverno.io/kubernetes-version: "1.26"
policies.kyverno.io/subject: Pod
policies.kyverno.io/description: >-
Pods which don't specify at least resource requests are assigned a QoS class
of BestEffort which can hog resources for other Pods on Nodes. At a minimum,
all Pods should specify resource requests in order to be labeled as the QoS
class Burstable. This sample mutates any container in a Pod which doesn't
specify memory or cpu requests to apply some sane defaults.
spec:
background: false
rules:
- name: add-default-requests
match:
any:
- resources:
kinds:
- Pod
preconditions:
any:
- key: "{{request.operation || 'BACKGROUND'}}"
operator: AnyIn
value:
- CREATE
- UPDATE
mutate:
foreach:
- list: "request.object.spec.containers[]"
patchStrategicMerge:
spec:
containers:
- (name): "{{element.name}}"
resources:
requests:
+(memory): "100Mi"
+(cpu): "100m"

View file

@ -0,0 +1,24 @@
name: add-default-resources
policies:
- add-default-resources.yaml
resources:
- resource.yaml
results:
- policy: add-default-resources
rule: add-default-requests
resource: nginx-demo1
patchedResource: patchedResource1.yaml
kind: Pod
result: pass
- policy: add-default-resources
rule: add-default-requests
resource: nginx-demo2
patchedResource: patchedResource2.yaml
kind: Pod
result: skip
- policy: add-default-resources
rule: add-default-requests
resource: nginx-demo3
patchedResource: patchedResource3.yaml
kind: Pod
result: pass

View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo1
spec:
containers:
- name: nginx
image: nginx:1.14.2
resources:
requests:
memory: "100Mi"
cpu: "100m"

View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo2
spec:
containers:
- name: nginx
image: nginx:latest
resources:
requests:
memory: "200Mi"
cpu: "200m"

View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo3
spec:
containers:
- name: nginx
image: nginx:latest
resources:
requests:
memory: "200Mi"
cpu: "100m"
- name: busybox
image: busybox:latest
resources:
requests:
memory: "100Mi"
cpu: "100m"

View file

@ -0,0 +1,35 @@
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo1
spec:
containers:
- name: nginx
image: nginx:1.14.2
---
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo2
spec:
containers:
- name: nginx
image: nginx:latest
resources:
requests:
memory: "200Mi"
cpu: "200m"
---
apiVersion: v1
kind: Pod
metadata:
name: nginx-demo3
spec:
containers:
- name: nginx
image: nginx:latest
resources:
requests:
memory: "200Mi"
- name: busybox
image: busybox:latest