mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 18:38:40 +00:00
Code Activity

Ensure preconditions are present with default values (#4046)

Browse source 
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
This commit is contained in:
treydock 2022-05-31 16:39:06 -04:00 • committed by GitHub
parent 566eae7d94
commit ee46e9ed19
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
charts/kyverno-policies/Chart.yaml
View file

@ -27,3 +27,5 @@ annotations:
description: Support for artifacthub.io/changes annotation
- kind: fixed
description: Fix Kyverno version check when image tag contains registry port number
- kind: fixed
description: Ensure preconditions are present with default values

22
charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml
View file

@ -35,7 +35,9 @@ spec:
exclude:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with merge (index .Values "policyPreconditions" "require-drop-all") (index .Values "policyPreconditions" $name) }}
{{- $preconditions1 := merge (index .Values "policyPreconditions" "require-drop-all") (index .Values "policyPreconditions" $name) }}
{{- if $preconditions1 }}
{{- with $preconditions1 }}
preconditions:
{{- if .all }}
all:
@ -47,6 +49,13 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
{{- else }}
preconditions:
all:
- key: "{{`{{ request.operation }}`}}"
operator: NotEquals
value: DELETE
{{- end }}
validate:
message: >-
Containers must drop `ALL` capabilities.
@ -68,7 +77,9 @@ spec:
exclude:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with merge (index .Values "policyPreconditions" "adding-capabilities-strict") (index .Values "policyPreconditions" $name) }}
{{- $preconditions2 := merge (index .Values "policyPreconditions" "adding-capabilities-strict") (index .Values "policyPreconditions" $name) }}
{{- if $preconditions2 }}
{{- with $preconditions2 }}
preconditions:
{{- if .all }}
all:
@ -80,6 +91,13 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
{{- else }}
preconditions:
all:
- key: "{{`{{ request.operation }}`}}"
operator: NotEquals
value: DELETE
{{- end }}
validate:
message: >-
Any capabilities added other than NET_BIND_SERVICE are disallowed.