Slide 8
Slide 8 text
8
©2021 VMware, Inc.
Policy の例 – tmc-require-labels
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
name: tmc-require-labels
:
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package tmcrequirelabels
violation[{"msg": msg, "details": {"missing_labels": missing}}] {
provided := {label | input.review.object.metadata.labels[label]}
required := {label | label := input.parameters.labels[_].key}
missing := required - provided
count(missing) > 0
msg := sprintf("You must provide labels with keys: %v",
[missing])
}
violation[{"msg": msg}] {
value := input.review.object.metadata.labels[key]
expected := input.parameters.labels[_]
expected.key == key
expected.value != ""
expected.value != value
msg := sprintf("Label <%v: %v> must match the value: %v", [key,
value, expected.value])
}
{
"parameters": {
"labels": [
{
"value": "production",
"key": "env"
},
]
},
"review": {
"object": {
"apiVersion": "apps/v1",
"kind": "Deployment",
"metadata": {
"labels": {
"app": "nginx",
"env": "production"
},
},
},
}
}
Admission Review Request
(関連部分のみ)
ConstraintTemplate
フルバージョンの Admission Review Request は ここ