1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Cloud Native Policy Management
Find a file
Yuvraj 3799b52fc8
[BUG] filterK8Resources is not correctly configured using ConfigMap (#1059)
* configmap issue fixed

* fixed e2e test

* helm template file added

* remove extra check

* string empty check removed
2020-08-19 13:46:08 +05:30
.github kyverno-cli and helm release step added in workslow (#1043) 2020-08-11 10:04:25 -07:00
api revert data loaction 2020-03-26 19:10:54 +05:30
charts/kyverno [BUG] filterK8Resources is not correctly configured using ConfigMap (#1059) 2020-08-19 13:46:08 +05:30
cmd Add go fmt (#1055) 2020-08-14 12:21:06 -07:00
definitions Supporting annotations in match/exclude (#1045) 2020-08-17 17:12:27 -07:00
documentation Supporting annotations in match/exclude (#1045) 2020-08-17 17:12:27 -07:00
pkg [BUG] filterK8Resources is not correctly configured using ConfigMap (#1059) 2020-08-19 13:46:08 +05:30
samples update policy markdowns 2020-08-18 21:44:11 -07:00
scripts e2e workflow added (#1021) 2020-08-06 11:56:31 +05:30
test Feature/e2e 575 (#1018) 2020-08-06 10:46:10 +05:30
.codeclimate.yml remove arm from goreleaser (#903) 2020-06-04 11:45:37 -07:00
.directory Implemented validation across same yaml 2019-06-20 18:21:55 +03:00
.gitignore Events fix (#1006) 2020-07-20 20:30:02 +05:30
.golangci.yml codeclimate and golangci-lint added 2020-03-24 02:01:50 +05:30
.goreleaser.yml Added version in cli (#990) 2020-07-15 02:16:03 +05:30
.krew.yaml krew yaml fixes (#1000) 2020-07-15 14:37:04 -07:00
CODE_OF_CONDUCT.md add code of conduct & contributing section 2019-06-12 09:39:37 -07:00
CONTRIBUTING.md remove extra documentation 2020-03-26 20:06:20 +05:30
go.mod Feature/e2e 575 (#1018) 2020-08-06 10:46:10 +05:30
go.sum improve CLI validation reports 2020-08-18 21:03:00 -07:00
LICENSE Create LICENSE 2019-06-05 23:00:32 -04:00
Makefile Add go fmt (#1055) 2020-08-14 12:21:06 -07:00
README.md 1040 automate release (#1044) 2020-08-12 07:54:45 -07:00

Kyverno - Kubernetes Native Policy Management

Build Status Go Report Card License: Apache-2.0

logo

Kyverno is a policy engine built for Kubernetes:

  • policies as Kubernetes resources (no new language to learn!)
  • validate, mutate, or generate any resource
  • match resources using label selectors and wildcards
  • validate and mutate using overlays (like Kustomize!)
  • generate and synchronize defaults across namespaces
  • block or report violations
  • test using kubectl

Quick Start

NOTE : Your Kubernetes cluster version must be above v1.14 which adds webhook timeouts. To check the version, enter kubectl version.

Install Kyverno:

kubectl create -f https://raw.githubusercontent.com/nirmata/kyverno/master/definitions/release/install.yaml

You can also install Kyverno using a Helm chart.

Add the policy below. It contains a single validation rule that requires that all pods have a app.kubernetes.io/name label. Kyverno supports different rule types to validate, mutate, and generate configurations. The policy attribute validationFailureAction is set to enforce to block API requests that are non-compliant (using the default value audit will report violations but not block requests.)

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: enforce
  rules:
  - name: check-for-labels
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: "label `app.kubernetes.io/name` is required"
      pattern:
        metadata:
          labels:
            app.kubernetes.io/name: "?*"

Try creating a deployment without the required label:

kubectl create deployment nginx --image=nginx

You should see an error:

Error from server: admission webhook "nirmata.kyverno.resource.validating-webhook" denied the request:

resource Deployment/default/nginx was blocked due to the following policies

require-labels:
  autogen-check-for-labels: 'Validation error: label `app.kubernetes.io/name` is required;
    Validation rule autogen-check-for-labels failed at path /spec/template/metadata/labels/app.kubernetes.io/name/'

Create a pod with the required label. For example from this YAML:

kind: "Pod"
apiVersion: "v1"
metadata:
  name: nginx
  labels:
    app.kubernetes.io/name: nginx
spec:
  containers:
  - name: "nginx"
    image: "nginx:latest"

This pod configuration complies with the policy rules, and is not blocked.

Clean up by deleting all cluster policies:

kubectl delete cpol --all

As a next step, browse the sample policies and learn about writing policies. You can test policies using the Kyverno cli. See docs for complete details.

Documentation

License

Apache License 2.0

Community

Community Meetings

To attend our next monthly community meeting join the Kyverno group. You will then be sent a meeting invite and get access to the agenda and meeting notes.

Getting Help

Contributing

Thanks for your interest in contributing!

Presentations and Articles

Alternatives

Open Policy Agent

Open Policy Agent (OPA) is a general-purpose policy engine that can be used as a Kubernetes admission controller. It supports a large set of use cases. Policies are written using Rego a custom query language.

k-rail

k-rail provides several ready to use policies for security and multi-tenancy. The policies are written in Golang. Several of the Kyverno sample policies were inspired by k-rail policies.

Polaris

Polaris validates configurations for best practices. It includes several checks across health, networking, security, etc. Checks can be assigned a severity. A dashboard reports the overall score.

External configuration management tools

Tools like Kustomize can be used to manage variations in configurations outside of clusters. There are several advantages to this approach when used to produce variations of the same base configuration. However, such solutions cannot be used to validate or enforce configurations.

Roadmap

See Milestones and Issues.