mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-05 07:26:55 +00:00
* new samples; updates * typos * add policy to restrict LoadBalancer * correct sample numbering * fix typos
1.2 KiB
1.2 KiB
Require certain labels
In many cases, you may require that at least a certain number of labels are assigned to each Pod from a select list of approved labels. This sample policy demonstrates the anyPattern
option in a policy by requiring any of the two possible labels defined within. A pod must either have the label app.kubernetes.io/name
or app.kubernetes.io/component
defined. If you would rather validate that all Pods have multiple labels in an AND fashion rather than OR, check out the require_labels example.
Policy YAML
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-certain-labels
spec:
validationFailureAction: audit
rules:
- name: validate-certain-labels
match:
resources:
kinds:
- Pod
validate:
message: "The label `app.kubernetes.io/name` or `app.kubernetes.io/component` is required."
anyPattern:
- metadata:
labels:
app.kubernetes.io/name: "?*"
- metadata:
labels:
app.kubernetes.io/component: "?*"