Kyvernoポリシーエンジン分析: 検証、変形、生成ルールの深層分析

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-run-as-non-root
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-security-context
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: 'Containers must run as non-root'
        pattern:
          spec:
            containers:
              - securityContext:
                  runAsNonRoot: true

rules:
  - name: deny-latest-tag
    validate:
      deny:
        conditions:
          any:
            - key: '{{ request.object.spec.containers[].image }}'
              operator: AnyIn
              value: ['*:latest']

rules:
  - name: check-replica-count
    validate:
      cel:
        expressions:
          - expression: 'object.spec.replicas >= 2'
            message: 'Deployment must have at least 2 replicas'

rules:
  - name: add-sidecar
    mutate:
      patchStrategicMerge:
        spec:
          template:
            spec:
              containers:
                - name: log-collector
                  image: fluentbit:latest

rules:
  - name: add-annotation
    mutate:
      patchesJson6902: |-
        - op: add
          path: /metadata/annotations/modified-by
          value: kyverno

rules:
  - name: generate-default-limitrange
    generate:
      apiVersion: v1
      kind: LimitRange
      name: default-limits
      namespace: '{{ request.object.metadata.name }}'
      synchronize: true
      data:
        spec:
          limits:
            - default:
                cpu: 500m
                memory: 512Mi
              type: Container

rules:
  - name: clone-configmap
    generate:
      apiVersion: v1
      kind: ConfigMap
      name: shared-config
      namespace: '{{ request.object.metadata.name }}'
      clone:
        namespace: default
        name: template-configmap

context:
  - name: namespaceInfo
    apiCall:
      urlPath: '/api/v1/namespaces/{{ request.namespace }}'
  - name: allowedRegistries
    configMap:
      name: allowed-registries
      namespace: kyverno