Updated examples

examples/Validate/check_cpu_memory.yaml

@@ -6,33 +6,33 @@ spec:
   rules:
   - name: check-defined
     resource:
-      kinds: 
+      kinds:
       - Deployment
     validate:
-      message: "Resource requests and limits are required for CPU and memory"
+      message: "Resource limits are required for CPU and memory"
-      pattern:
-      spec:
-        containers:
-        - name: "*"
-          resources:
-            limits:
-              memory: "?"
-              cpu: "?"
-            requests:
-              memory: "?"
-              cpu: "?"
-  - name: check-memory-in-range
-    resource:
-      kinds: 
-      - Deployment
-    validate:
-      message: "Memory request cannot be greater than 10Gi"
       pattern:
         spec:
-          containers:
+          template:
-          - name: "*"
+            spec:
-            resources:
+              containers:
-              requests:
+              - name: "*"
-                # If the value contains logical operator, the integer after it will be checked. No numeric characters will be a part of pattern.
+                resources:
-                # The OR operator can combine the patterns with logical expressions and text patterns.
+                  limits:
-                memory: "<10Gi|<1024Mi"
+                    memory: "*"
+                    cpu: "*"
+
+  - name: check-cpu
+    resource:
+      kinds:
+      - Deployment
+    validate:
+      message: "CPU request should be 4"
+      pattern:
+        spec:
+          template:
+            spec:
+              containers:
+              - name: "*"
+                resources:
+                  requests:
+                    cpu: "4"

examples/Validate/check_hostpath.yaml

@@ -6,11 +6,13 @@ spec:
   rules:
   - name: check-host-path
     resource:
-      kinds: 
+      kinds:
       - Pod
     validate:
-      message: "Host path volumes are not allowed"
+      message: "Host path should be /var/log"
       pattern:
-        volumes:
+        spec:
-        - name: "*"
+          volumes:
-          hostPath: null
+          - (name): log
+            hostPath:
+              path: /var/log

examples/Validate/check_image_version.yaml

@@ -5,13 +5,15 @@ metadata:
 spec:
   rules:
   - name: image-pull-policy
-    message: "Image tag ':latest' requires imagePullPolicy 'Always'"
     resource:
-      kinds: 
+      kinds:
       - Deployment
-    overlay:
+    validate:
-      template:
+      message: "Image tag ':latest' requires imagePullPolicy 'Always'"
+      pattern:
         spec:
-          containers:              
+          template:
-            - image: "(*:latest)"       # select images which end with :latest            
+            spec:
-              imagePullPolicy: "Always" # ensure that the imagePullPolicy is "Always"
+              containers:
+              - (image): "*latest"       # select images which end with :latest
+                imagePullPolicy: Always   # ensure that the imagePullPolicy is "Always"

examples/Validate/check_nodeport.yaml

@@ -6,10 +6,10 @@ spec:
   rules:
   - name: check-host-path
     resource:
-      kinds: 
+      kinds:
       - Service
     validate:
-      message: "Node port services are not allowed"
+      message: "Only NodePort type is allowed"
       pattern:
         spec:
-          type: "!NodePort"
+          type: "NodePort"

examples/Validate/check_not_root.yaml

@@ -6,7 +6,10 @@ spec :
   rules:
     - name: check-non-root
       resource:
-        kind: Deployment, StatefuleSet, DaemonSet
+        kinds:
+        - Deployment
+        - StatefuleSet
+        - DaemonSet
       validate:
         message: "Root user is not allowed"
         pattern:
@@ -14,4 +17,4 @@ spec :
             template:
               spec:
                 securityContext:
-                  runAsNotRoot: true
+                  runAsNonRoot: true

examples/Validate/check_probe_exists.yaml

@@ -1,30 +1,36 @@
 apiVersion : kyverno.io/v1alpha1
-kind: Policy
+kind : Policy
-metadata:
+metadata :
   name: check-probe-exists
 spec:
   rules:
   - name: check-liveness-probe-exists
     resource:
-      kinds: 
+      kinds :
       - StatefulSet
     validate:
       message: "a livenessProbe is required"
       pattern:
-        containers:
+        spec:
-          # In this case every object in containers list will be checked for pattern
+          template:
-          - name: "*"
+            spec:
-            livenessProbe:
+              containers:
-              periodSeconds: "?"
+                # In this case every object in containers list will be checked for pattern
-  - resource:
+              - name: "*"
-      kinds: 
+                livenessProbe:
-      - Deployment
+                  periodSeconds: ">0"
-    name: check-readinessprobe-exists
+  - name: check-readiness-probe-exists
+    resource:
+      kinds :
+      - StatefulSet
     validate:
       message: "a readinessProbe is required"
       pattern:
-        containers:
+        spec:
-          # In this case every object in containers list will be checked for pattern
+          template:
-          - name: "*"
+            spec:
-            readinessProbe:
+              containers:
-              periodSeconds: "?"
+                # In this case every object in containers list will be checked for pattern
+              - name: "*"
+                readinessProbe:
+                  periodSeconds: ">0"

examples/Validate/check_probe_intervals.yaml

@@ -1,30 +1,36 @@
 apiVersion : kyverno.io/v1alpha1
-kind: Policy
+kind : Policy
-metadata:
+metadata :
   name: check-probe-intervals
 spec:
   rules:
   - name: check-probe-intervals
     resource:
-      kinds: 
+      kinds :
       - Deployment
     validate:
       message: "livenessProbe must be > 10s"
       pattern:
-        containers:
+        spec:
-          # In this case every object in containers list will be checked for pattern
+          template:
-          - name: "*"
+            spec:
-            livenessProbe:
+              containers:
-              periodSeconds: ">10"
+                # In this case every object in containers list will be checked for pattern
-  - resource:
+                - name: "*"
-      kinds: 
+                  livenessProbe:
+                    periodSeconds: ">10"
+  - name: check-probe-intervals
+    resource:
+      kinds :
       - Deployment
-    name: check-readinessprobe-intervals
     validate:
+      message: "readinessProbe must be > 10s"
       pattern:
-        message: "readinessProbe must be > 10s"    
+        spec:
-        containers:
+          template:
-          # In this case every object in containers list will be checked for pattern
+            spec:
-          - name: "*"
+              containers:
-            readinessProbe:
+                # In this case every object in containers list will be checked for pattern
-              periodSeconds: ">10"
+                - name: "*"
+                  readinessProbe:
+                    periodSeconds: ">10"

examples/Validate/check_whitelist_registries.yaml

@@ -5,15 +5,17 @@ metadata:
 spec:
   rules:
   - name: check-whitelist-registries
-    message: "Registry is not allowed"
     resource:
-      kinds: 
+      kinds:
       - Deployment
+      - StatefulSet
     validate:
+      message: "Registry is not allowed"
       pattern:
-        template:
+        spec:
-          spec:
+          template:
-            containers:
+            spec:
-              # Checks if the image path starts with "https://private.registry.io" OR "https://hub.docker.io/nirmata/*"
+              containers:
-              # If some property contains operator | as a normal part of its value, it should be escaped by backslash: "\|".
+              - name: "*"
-              image: https://private.registry.io* | https://hub.docker.io/nirmata/*
+                # Checks if the image path starts with "https://hub.docker.io/nirmata/*"
+                image: https://hub.docker.io/nirmata/*

examples/mutate/overlay/policy_set_imagePullPolicy.yaml

@@ -14,7 +14,6 @@ spec:
           template:
             spec:
               containers:
-                # match images which end with :latest   
+                # set the imagePullPolicy to "Always"
-                - (image): "*:latest"
+                - (imagePullPolicy): "IfNotPresent"
-                  # set the imagePullPolicy to "Always"
+                  imagePullPolicy: "Always"
-                  imagePullPolicy: "Always"

test/ConfigMap/policy-CM.yaml

@@ -6,17 +6,27 @@ spec :
   rules:
     - name: pCM1
       resource:
-        kinds : 
+        kinds :
         - ConfigMap
         name: "game-config"
       mutate:
+        overlay:
+          data:
+            char.properties: |
+              Name=Ellen Ripley
+              Race=human
         patches:
+        - path: "/data/ship.properties"
+          op: add
+          value: |
+            type=starship
+            owner=utany.corp
         - path : "/data/newKey"
           op : add
           value : newValue
     - name: pCM2
       resource:
-        kinds : 
+        kinds :
         - ConfigMap
         name: "game-config"
       mutate:
@@ -28,7 +38,7 @@ spec :
           value : "data is replaced"
     - name: pCM3
       resource:
-        kinds : 
+        kinds :
         - ConfigMap
         name: "game-config"
       mutate:
@@ -43,7 +53,7 @@ spec :
             game.properties: "*enemies=aliens*"
     - name: pCM4
       resource:
-        kinds : 
+        kinds :
         - ConfigMap
         name: "game-config"
       validate:

test/Job/job.yaml

@@ -6,8 +6,15 @@ spec:
   template:
     spec:
       containers:
+      - name: piv0
+        image: perl
+        command: ["perl"]
+          ports: dsvd12
       - name: pi
         image: perl
         command: ["perl"]
+      - name: piv1
+        image: perl
+        command: ["perl"]
       restartPolicy: Never
   backoffLimit: 4

test/Job/policy-job.yaml

@@ -6,10 +6,22 @@ spec :
   rules:
     - name: job1
       resource:
-        kinds: 
+        kinds:
         - Job
         name: pi
       mutate:
+        overlay:
+          metadata:
+            labels:
+              isOverlayed: "true"
+          spec:
+            template:
+              spec:
+                containers:
+                  - name: "pi1"
+                    image: "vasylev.perl"
+                  - name: "pi2"
+                    image: "maxov.perl"
         patches:
         - path : "/spec/template/spec/containers/0/command"
           op : add
@@ -24,3 +36,18 @@ spec :
             template:
               spec:
                 restartPolicy: Never
+    - name: job2
+      resource:
+        kinds:
+        - Job
+        name: pi
+      mutate:
+        overlay:
+          spec:
+            template:
+              spec:
+                containers:
+                - (name): piv0
+                  ports:
+                  - containerPort: 80
+                    protocol: TCP

test/PodTemplate/PodTemplate.yaml

@@ -13,6 +13,6 @@ template:
       ports:
       - containerPort: 80
         protocol: TCP
-  restartPolicy: Always
+  restartPolicy: Never
   terminationGracePeriodSeconds: 30
   dnsPolicy: ClusterFirst

test/PodTemplate/policy-PodTemplate.yaml

@@ -6,12 +6,16 @@ spec:
   rules:
     - name: podtemplate1
       resource:
-        kinds : 
+        kinds :
         - PodTemplate
         selector:
           matchLabels:
             originalLabel: isHere
       mutate:
+        overlay:
+          template:
+            spec:
+              restartPolicy: Always
         patches:
         - path: "/metadata/labels/app"
           op : replace
@@ -23,11 +27,11 @@ spec:
           op : replace
           value : mongodb
       validate:
-        message: "Port 80 is not for redis"
+        message: "Port 80 is only allowed"
         pattern:
           template:
             spec:
               containers:
-                - name: "!redis"
+                - name: "*"
                   ports:
                   - containerPort: 80