mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-31 03:45:17 +00:00
fix: Result not correct when testing a mutate rule and foreach with add anchor (#8375)
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
parent
d4951476b2
commit
aeb5e01c60
6 changed files with 146 additions and 0 deletions
|
@ -0,0 +1,45 @@
|
||||||
|
apiVersion : kyverno.io/v1
|
||||||
|
kind: ClusterPolicy
|
||||||
|
metadata:
|
||||||
|
name: add-default-resources
|
||||||
|
annotations:
|
||||||
|
policies.kyverno.io/title: Add Default Resources
|
||||||
|
policies.kyverno.io/category: Other
|
||||||
|
policies.kyverno.io/severity: medium
|
||||||
|
kyverno.io/kyverno-version: 1.10.0-alpha.2
|
||||||
|
policies.kyverno.io/minversion: 1.7.0
|
||||||
|
kyverno.io/kubernetes-version: "1.26"
|
||||||
|
policies.kyverno.io/subject: Pod
|
||||||
|
policies.kyverno.io/description: >-
|
||||||
|
Pods which don't specify at least resource requests are assigned a QoS class
|
||||||
|
of BestEffort which can hog resources for other Pods on Nodes. At a minimum,
|
||||||
|
all Pods should specify resource requests in order to be labeled as the QoS
|
||||||
|
class Burstable. This sample mutates any container in a Pod which doesn't
|
||||||
|
specify memory or cpu requests to apply some sane defaults.
|
||||||
|
spec:
|
||||||
|
background: false
|
||||||
|
rules:
|
||||||
|
- name: add-default-requests
|
||||||
|
match:
|
||||||
|
any:
|
||||||
|
- resources:
|
||||||
|
kinds:
|
||||||
|
- Pod
|
||||||
|
preconditions:
|
||||||
|
any:
|
||||||
|
- key: "{{request.operation || 'BACKGROUND'}}"
|
||||||
|
operator: AnyIn
|
||||||
|
value:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
mutate:
|
||||||
|
foreach:
|
||||||
|
- list: "request.object.spec.containers[]"
|
||||||
|
patchStrategicMerge:
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- (name): "{{element.name}}"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
+(memory): "100Mi"
|
||||||
|
+(cpu): "100m"
|
24
test/cli/test-mutate/add-default-resources/kyverno-test.yaml
Normal file
24
test/cli/test-mutate/add-default-resources/kyverno-test.yaml
Normal file
|
@ -0,0 +1,24 @@
|
||||||
|
name: add-default-resources
|
||||||
|
policies:
|
||||||
|
- add-default-resources.yaml
|
||||||
|
resources:
|
||||||
|
- resource.yaml
|
||||||
|
results:
|
||||||
|
- policy: add-default-resources
|
||||||
|
rule: add-default-requests
|
||||||
|
resource: nginx-demo1
|
||||||
|
patchedResource: patchedResource1.yaml
|
||||||
|
kind: Pod
|
||||||
|
result: pass
|
||||||
|
- policy: add-default-resources
|
||||||
|
rule: add-default-requests
|
||||||
|
resource: nginx-demo2
|
||||||
|
patchedResource: patchedResource2.yaml
|
||||||
|
kind: Pod
|
||||||
|
result: skip
|
||||||
|
- policy: add-default-resources
|
||||||
|
rule: add-default-requests
|
||||||
|
resource: nginx-demo3
|
||||||
|
patchedResource: patchedResource3.yaml
|
||||||
|
kind: Pod
|
||||||
|
result: pass
|
|
@ -0,0 +1,12 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: nginx-demo1
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx:1.14.2
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "100Mi"
|
||||||
|
cpu: "100m"
|
|
@ -0,0 +1,12 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: nginx-demo2
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx:latest
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "200Mi"
|
||||||
|
cpu: "200m"
|
|
@ -0,0 +1,18 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: nginx-demo3
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx:latest
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "200Mi"
|
||||||
|
cpu: "100m"
|
||||||
|
- name: busybox
|
||||||
|
image: busybox:latest
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "100Mi"
|
||||||
|
cpu: "100m"
|
35
test/cli/test-mutate/add-default-resources/resource.yaml
Normal file
35
test/cli/test-mutate/add-default-resources/resource.yaml
Normal file
|
@ -0,0 +1,35 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: nginx-demo1
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx:1.14.2
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: nginx-demo2
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx:latest
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "200Mi"
|
||||||
|
cpu: "200m"
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: nginx-demo3
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: nginx
|
||||||
|
image: nginx:latest
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "200Mi"
|
||||||
|
- name: busybox
|
||||||
|
image: busybox:latest
|
Loading…
Add table
Reference in a new issue