Compare languages | Модуль admission-policy-engine: Custom Resources (от Gatekeeper)

Для мутационных хуков используется настройка reinvocationPolicy: IfNeeded в MutatingWebhookConfiguration. Подробнее в документации Kubernetes.

The reinvocationPolicy: IfNeeded is used in MutatingWebhookConfiguration. More details in the Kubernetes documentation.

Представляют собой набор настраиваемых политик модификации ресурсов Kubernets в момент их создания.

Provide a configurable set of policies for modifying Kubernetes resources at the time they are deployed.

Позволяет изменять секцию Metadata ресурса.
На данный момент сервисом Gatekeeper разрешено только добавление объектов lables и annotations. Изменение существующих объектов не предусмотрено.

Allows you to modify the Metadata section of a resource. At the moment, Gatekeeper only allows adding labels and annotations objects. Modification of existing objects is not provided.

В spec.match.kinds запрещено использовать *. При указании * мутация не применяется. Вместо этого необходимо явно перечислять целевые ресурсы (kinds) и их apiGroups.

Using * in spec.match.kinds is not allowed. If * is specified, the mutation will not be applied. Instead, you must explicitly list the target resources (kinds) along with their corresponding apiGroups.

Пример 1. Добавление лейбла owner со значением admin во всех пространствах имён: yaml apiVersion: mutations.gatekeeper.sh/v1 kind: AssignMetadata metadata: name: demo-annotation-owner spec: match: scope: Namespaced location: “metadata.labels.owner” parameters: assign: value: “admin”

Example 1. Adding the owner label with the value admin to all namespaces:

Пример 2. Добавление лейбла в конкретном пространстве имён и только на выбранные ресурсы:

yaml apiVersion: mutations.gatekeeper.sh/v1 kind: AssignMetadata metadata: name: demo-annotation-owner spec: match: scope: Namespaced location: “metadata.labels.owner” parameters: assign: value: “admin”

yaml apiVersion: mutations.gatekeeper.sh/v1 kind: AssignMetadata metadata: name: set-labels- spec: match: scope: Namespaced namespaces: [""] kinds:

• apiGroups: [””] kinds: [“Pod”] # Запрещено использовать “*” . location: “metadata.labels." parameters: assign: value:

Example 2. Adding a label in a specific namespace and only to selected resources:

Assign

yaml apiVersion: mutations.gatekeeper.sh/v1 kind: AssignMetadata metadata: name: set-labels- spec: match: scope: Namespaced namespaces: [""] kinds:

• apiGroups: [””] kinds: [“Pod”] # The use of “*” is not allowed. location: “metadata.labels." parameters: assign: value:

Assign

Позволяет изменять поля, за пределом секции Metadata.

Пример установки imagePullPolicy для всех контейнеров на Always во всех пространствах имен, кроме system:

Allows you to modify fields outside the Metadata section.

yaml apiVersion: mutations.gatekeeper.sh/v1 kind: Assign metadata: name: demo-image-pull-policy spec: applyTo:

• groups: [””] kinds: [“Pod”] versions: [“v1”] match: scope: Namespaced kinds:
• apiGroups: [“”] kinds: [“Pod”] excludedNamespaces: [“system”] location: “spec.containers[name:].imagePullPolicy” parameters: assign: value: Always

An example of setting imagePullPolicy for all containers to Always in all namespaces except the system namespace:

ModifySet

yaml apiVersion: mutations.gatekeeper.sh/v1 kind: Assign metadata: name: demo-image-pull-policy spec: applyTo:

• groups: [””] kinds: [“Pod”] versions: [“v1”] match: scope: Namespaced kinds:
• apiGroups: [“”] kinds: [“Pod”] excludedNamespaces: [“system”] location: “spec.containers[name:].imagePullPolicy” parameters: assign: value: Always

Reference

ModifySet

Позволяет добавлять и удалять элементы из списка, например из списка аргументов для запуска контейнера.
Новые значения добавляются в конец списка.

Reference

Пример удаления аргумента --alsologtostderr из всех контейнеров в поде:

Allows you to add and remove items from a list, such as arguments for running a container. New values are added to the end of the list.

yaml apiVersion: mutations.gatekeeper.sh/v1 kind: ModifySet metadata: name: remove-err-logging spec: applyTo:

• groups: [””] kinds: [“Pod”] versions: [“v1”] location: “spec.containers[name: *].args” parameters: operation: prune values: fromList:
• –alsologtostderr

An example of removing the --alsologtostderr argument from all containers in a pod:

AssignImage

yaml apiVersion: mutations.gatekeeper.sh/v1 kind: ModifySet metadata: name: remove-err-logging spec: applyTo:

• groups: [””] kinds: [“Pod”] versions: [“v1”] location: “spec.containers[name: *].args” parameters: operation: prune values: fromList:
• –alsologtostderr

Reference

AssignImage

Позволяет вносить изменения в параметр image ресурса.

Reference

Пример изменения параметра image на значение my.registry.io/repo/app@sha256:abcde67890123456789abc345678901a: yaml apiVersion: mutations.gatekeeper.sh/v1alpha1 kind: AssignImage metadata: name: assign-container-image spec: applyTo:

• groups: [ “” ] kinds: [ “Pod” ] versions: [ “v1” ] location: “spec.containers[name:*].image” parameters: assignDomain: “my.registry.io” assignPath: “repo/app” assignTag: “@sha256:abcde67890123456789abc345678901a” match: source: “All” scope: Namespaced kinds:
• apiGroups: [ “*” ] kinds: [ “Pod” ]

Allows you to make changes to the image parameter of a resource.

An example of changing the image parameter to the value my.registry.io/repo/app@sha256:abcde67890123456789abc345678901a:

yaml apiVersion: mutations.gatekeeper.sh/v1alpha1 kind: AssignImage metadata: name: assign-container-image spec: applyTo:

• groups: [ “” ] kinds: [ “Pod” ] versions: [ “v1” ] location: “spec.containers[name:*].image” parameters: assignDomain: “my.registry.io” assignPath: “repo/app” assignTag: “@sha256:abcde67890123456789abc345678901a” match: source: “All” scope: Namespaced kinds:
• apiGroups: [ “*” ] kinds: [ “Pod” ]