☰

使用 Kyverno 策略要求数组项

tag-icon • tag-icon kyverno
使用 Kyverno 策略要求数组项

尝试创建需要特定数组值的 Kyverno 策略。他们提供了标签等“地图”的示例，但我没有看到任何关于数组的具体内容。

以下是示例Application资源：

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: authentication
  namespace: openshift-gitops
spec:
  destination:
    server: 'https://kubernetes.default.svc'
  project: cluster-config
  source:
    path: cluster-config/authentication
    repoURL: 'https://example.com/scm/gitops/openshift-prod-cluster.git'
    targetRevision: master
  syncPolicy:
    automated:
      selfHeal: true
    retry:
      backoff:
        duration: 15s
        factor: 2
        maxDuration: 5m
      limit: 15
    syncOptions:
      - ServerSideApply=true
      - Validate=false
      - FailOnSharedResource=true

这是我最近的尝试，但是这两条规则对于每个应用程序都失败了：

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-server-side-sync
  annotations:
    policies.kyverno.io/title: Use Server-Side Sync
    policies.kyverno.io/category: Argo
    policies.kyverno.io/severity: low
    policies.kyverno.io/subject: Application
    kyverno.io/kyverno-version: 1.6.0
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/description: >-
      By default, Argo CD executes `kubectl apply` operation to apply the configuration stored in Git. 
      This is a client side operation that relies on `kubectl.kubernetes.io/last-applied-configuration` annotation to 
      store the previous resource state. However, using server-side sync avoids issues with `kubectl.kubernetes.io/last-applied-configuration`
      growing so large that it breaks standard syncing, and allows patching of existing cluster resources that are not fully
      managed by Argo. Certain patch yamls may not be "valid" according to their resource definition and will need client-side
      validation to be disabled in order to work. (`kube-api` will still perform server-side validation of the patched resource before applying the change.)
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: enable-server-side-sync
      match:
        any:
          - resources:
              kinds:
                - Application
      validate:
        message: >-
          Server-side sync option must be enabled.
        pattern:
          - spec:
              syncPolicy:
                ^(syncOptions):
                - ServerSideApply: true
    - name: disable-client-side-validation
      match:
        any:
          - resources:
              kinds:
                - Application
      validate:
        message: >-
          client-side validation must be disabled
        pattern:
          - spec:
              syncPolicy:
                syncOptions:
                  - Validate=false

那么要求数组值的最佳方法是什么？

答案1

不幸的是，存在锚目前不支持字符串数组，仅支持对象数组。我创建了一个增强功能来添加此功能。目前，您可以使用带有简单 JMESPath 表达式的拒绝语句来检查您的字符串是否存在。

apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
  name: require-server-side-sync
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: enable-server-side-sync
      match:
        any:
          - resources:
              kinds:
                - Application
      validate:
        message: Server-side sync option must be enabled.
        deny:
          conditions:
            all:
            - key: ServerSideApply=true
              operator: AnyNotIn
              value: "{{ request.object.spec.syncPolicy.syncOptions[] }}"
    - name: disable-client-side-validation
      match:
        any:
          - resources:
              kinds:
                - Application
      validate:
        message: client-side validation must be disabled
        deny:
          conditions:
            all:
            - key: Validate=false
              operator: AnyNotIn
              value: "{{ request.object.spec.syncPolicy.syncOptions[] }}"

相关内容