mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-24 08:36:46 +00:00
637f756994
* chore: remove unused code Signed-off-by: ShutingZhao <shuting@nirmata.com> * feat: support json in CLI apply command Signed-off-by: ShutingZhao <shuting@nirmata.com> * chore: remove not used validation expressions Signed-off-by: ShutingZhao <shuting@nirmata.com> * chore: update codegen docs Signed-off-by: ShutingZhao <shuting@nirmata.com> * chore: add unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> --------- Signed-off-by: ShutingZhao <shuting@nirmata.com>
40 lines
No EOL
1 KiB
YAML
40 lines
No EOL
1 KiB
YAML
apiVersion: policies.kyverno.io/v1alpha1
|
|
kind: ValidatingPolicy
|
|
metadata:
|
|
name: check-dockerfile-disallow-curl
|
|
spec:
|
|
evaluation:
|
|
mode: JSON
|
|
validations:
|
|
- message: "curl is not allowed"
|
|
expression: >-
|
|
!object.Stages.exists(s,
|
|
s.Commands.exists(c,
|
|
has(c.CmdLine) && c.CmdLine.exists(cmd, string(cmd).contains('curl'))
|
|
)
|
|
)
|
|
---
|
|
apiVersion: policies.kyverno.io/v1alpha1
|
|
kind: ValidatingPolicy
|
|
metadata:
|
|
name: check-dockerfile-disallow-wget
|
|
spec:
|
|
evaluation:
|
|
mode: JSON
|
|
validations:
|
|
- message: "wget is not allowed"
|
|
expression: >-
|
|
!object.Stages.exists(s,
|
|
s.Commands.exists(c,
|
|
has(c.CmdLine) && c.CmdLine.exists(cmd, string(cmd).contains('wget'))
|
|
)
|
|
)
|
|
- message: "HTTP calls are not allowed"
|
|
expression: >-
|
|
!object.Stages.exists(s,
|
|
s.Commands.exists(c,
|
|
c.Args.exists(a,
|
|
a.Value.contains('http://') || a.Value.contains('https://')
|
|
)
|
|
)
|
|
) |