49 lines
2.2 KiB
YAML
49 lines
2.2 KiB
YAML
|
apiVersion: admissionregistration.k8s.io/v1
|
||
|
|
kind: ValidatingAdmissionPolicy
|
||
|
|
metadata: {name: short-election}
|
||
|
|
spec:
|
||
|
|
failurePolicy: Fail
|
||
|
|
matchConstraints:
|
||
|
|
resourceRules:
|
||
|
|
- apiGroups: [""]
|
||
|
|
apiVersions: [v1]
|
||
|
|
operations: [UPDATE]
|
||
|
|
resources: [pods]
|
||
|
|
matchConditions:
|
||
|
|
- name: tunnel-account
|
||
|
|
expression: request.userInfo.username == 'system:serviceaccount:short:tunnel'
|
||
|
|
variables:
|
||
|
|
- name: labels
|
||
|
|
expression: "has(object.metadata.labels) ? object.metadata.labels : {}"
|
||
|
|
- name: oldLabels
|
||
|
|
expression: "has(oldObject.metadata.labels) ? oldObject.metadata.labels : {}"
|
||
|
|
validations:
|
||
|
|
- expression: >-
|
||
|
|
oldObject.metadata.namespace == 'short' &&
|
||
|
|
oldObject.spec.serviceAccountName == 'tunnel' &&
|
||
|
|
'app.kubernetes.io/name' in variables.oldLabels &&
|
||
|
|
variables.oldLabels['app.kubernetes.io/name'] == 'tunnel'
|
||
|
|
message: The tunnel may only update tunnel pods.
|
||
|
|
- expression: object.spec == oldObject.spec
|
||
|
|
message: The tunnel may not change pod specifications.
|
||
|
|
- expression: >-
|
||
|
|
variables.labels.all(k, k == 'role' ||
|
||
|
|
(k in variables.oldLabels && variables.labels[k] == variables.oldLabels[k])) &&
|
||
|
|
variables.oldLabels.all(k, k == 'role' || k in variables.labels) &&
|
||
|
|
(!('role' in variables.labels) || variables.labels['role'] == 'active')
|
||
|
|
message: The tunnel may only set or remove the active role label.
|
||
|
|
- expression: >-
|
||
|
|
(has(object.metadata.annotations) ? object.metadata.annotations : {}) ==
|
||
|
|
(has(oldObject.metadata.annotations) ? oldObject.metadata.annotations : {}) &&
|
||
|
|
(has(object.metadata.ownerReferences) ? object.metadata.ownerReferences : []) ==
|
||
|
|
(has(oldObject.metadata.ownerReferences) ? oldObject.metadata.ownerReferences : []) &&
|
||
|
|
(has(object.metadata.finalizers) ? object.metadata.finalizers : []) ==
|
||
|
|
(has(oldObject.metadata.finalizers) ? oldObject.metadata.finalizers : [])
|
||
|
|
message: The tunnel may not change annotations, owners, or finalizers.
|
||
|
|
---
|
||
|
|
apiVersion: admissionregistration.k8s.io/v1
|
||
|
|
kind: ValidatingAdmissionPolicyBinding
|
||
|
|
metadata: {name: short-election}
|
||
|
|
spec:
|
||
|
|
policyName: short-election
|
||
|
|
validationActions: [Deny]
|