39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: tenant-a
|
|
labels:
|
|
training.cks/lesson: tenant-a
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicy
|
|
metadata:
|
|
name: "validate-namespace-tenant-a"
|
|
spec:
|
|
failurePolicy: Fail
|
|
matchConstraints:
|
|
resourceRules:
|
|
- apiGroups: [""]
|
|
apiVersions: ["v1"]
|
|
operations: ["CREATE", "UPDATE"]
|
|
resources: ["pods"]
|
|
validations:
|
|
- expression: >-
|
|
(!has(object.spec.hostNetwork) || object.spec.hostNetwork==false) &&
|
|
(!has(object.spec.hostPID) || object.spec.hostPID==false) &&
|
|
(!has(object.spec.hostIPC) || object.spec.hostIPC==false) &&
|
|
(!has(object.spec.volumes) || object.spec.volumes.all(v, !has(v.hostPath))) &&
|
|
object.spec.containers.all(c, !has(c.securityContext) || !has(c.securityContext.privileged) || c.securityContext.privileged==false)
|
|
message: "host namespaces, hostPath volumes, and privileged containers are not allowed"
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicyBinding
|
|
metadata:
|
|
name: validate-namespace-tenant-a
|
|
spec:
|
|
policyName: validate-namespace-tenant-a
|
|
validationActions: [Deny]
|
|
matchResources:
|
|
namespaceSelector:
|
|
matchLabels:
|
|
training.cks/lesson: tenant-a |