23 lines
920 B
YAML
23 lines
920 B
YAML
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicy
|
|
metadata:
|
|
name: "demo-policy.example.com"
|
|
spec:
|
|
failurePolicy: Fail
|
|
matchConstraints:
|
|
resourceRules:
|
|
- apiGroups: ["*"]
|
|
apiVersions: ["*"]
|
|
operations: ["CREATE", "UPDATE"]
|
|
resources: ["*"]
|
|
matchConditions:
|
|
- name: 'exclude-leases' # Each match condition must have a unique name
|
|
expression: '!(request.resource.group == "coordination.k8s.io" && request.resource.resource == "leases")' # Match non-lease resources.
|
|
- name: 'exclude-kubelet-requests'
|
|
expression: '!("system:nodes" in request.userInfo.groups)' # Match requests made by non-node users.
|
|
- name: 'rbac' # Skip RBAC requests.
|
|
expression: 'request.resource.group != "rbac.authorization.k8s.io"'
|
|
validations:
|
|
- expression: "!object.metadata.name.contains('demo') || object.metadata.namespace == 'demo'"
|
|
|