mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
fix: Result not correct when testing a mutate rule and foreach with add anchor (#8375)
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
parent
d4951476b2
commit
aeb5e01c60
6 changed files with 146 additions and 0 deletions
|
@ -0,0 +1,45 @@
|
|||
apiVersion : kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: add-default-resources
|
||||
annotations:
|
||||
policies.kyverno.io/title: Add Default Resources
|
||||
policies.kyverno.io/category: Other
|
||||
policies.kyverno.io/severity: medium
|
||||
kyverno.io/kyverno-version: 1.10.0-alpha.2
|
||||
policies.kyverno.io/minversion: 1.7.0
|
||||
kyverno.io/kubernetes-version: "1.26"
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/description: >-
|
||||
Pods which don't specify at least resource requests are assigned a QoS class
|
||||
of BestEffort which can hog resources for other Pods on Nodes. At a minimum,
|
||||
all Pods should specify resource requests in order to be labeled as the QoS
|
||||
class Burstable. This sample mutates any container in a Pod which doesn't
|
||||
specify memory or cpu requests to apply some sane defaults.
|
||||
spec:
|
||||
background: false
|
||||
rules:
|
||||
- name: add-default-requests
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
preconditions:
|
||||
any:
|
||||
- key: "{{request.operation || 'BACKGROUND'}}"
|
||||
operator: AnyIn
|
||||
value:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
mutate:
|
||||
foreach:
|
||||
- list: "request.object.spec.containers[]"
|
||||
patchStrategicMerge:
|
||||
spec:
|
||||
containers:
|
||||
- (name): "{{element.name}}"
|
||||
resources:
|
||||
requests:
|
||||
+(memory): "100Mi"
|
||||
+(cpu): "100m"
|
24
test/cli/test-mutate/add-default-resources/kyverno-test.yaml
Normal file
24
test/cli/test-mutate/add-default-resources/kyverno-test.yaml
Normal file
|
@ -0,0 +1,24 @@
|
|||
name: add-default-resources
|
||||
policies:
|
||||
- add-default-resources.yaml
|
||||
resources:
|
||||
- resource.yaml
|
||||
results:
|
||||
- policy: add-default-resources
|
||||
rule: add-default-requests
|
||||
resource: nginx-demo1
|
||||
patchedResource: patchedResource1.yaml
|
||||
kind: Pod
|
||||
result: pass
|
||||
- policy: add-default-resources
|
||||
rule: add-default-requests
|
||||
resource: nginx-demo2
|
||||
patchedResource: patchedResource2.yaml
|
||||
kind: Pod
|
||||
result: skip
|
||||
- policy: add-default-resources
|
||||
rule: add-default-requests
|
||||
resource: nginx-demo3
|
||||
patchedResource: patchedResource3.yaml
|
||||
kind: Pod
|
||||
result: pass
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: nginx-demo1
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:1.14.2
|
||||
resources:
|
||||
requests:
|
||||
memory: "100Mi"
|
||||
cpu: "100m"
|
|
@ -0,0 +1,12 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: nginx-demo2
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:latest
|
||||
resources:
|
||||
requests:
|
||||
memory: "200Mi"
|
||||
cpu: "200m"
|
|
@ -0,0 +1,18 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: nginx-demo3
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:latest
|
||||
resources:
|
||||
requests:
|
||||
memory: "200Mi"
|
||||
cpu: "100m"
|
||||
- name: busybox
|
||||
image: busybox:latest
|
||||
resources:
|
||||
requests:
|
||||
memory: "100Mi"
|
||||
cpu: "100m"
|
35
test/cli/test-mutate/add-default-resources/resource.yaml
Normal file
35
test/cli/test-mutate/add-default-resources/resource.yaml
Normal file
|
@ -0,0 +1,35 @@
|
|||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: nginx-demo1
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:1.14.2
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: nginx-demo2
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:latest
|
||||
resources:
|
||||
requests:
|
||||
memory: "200Mi"
|
||||
cpu: "200m"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: nginx-demo3
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:latest
|
||||
resources:
|
||||
requests:
|
||||
memory: "200Mi"
|
||||
- name: busybox
|
||||
image: busybox:latest
|
Loading…
Reference in a new issue