Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

components/kyverno/overlays/policies/check-deprecated-apis.yaml

@@ -0,0 +1,119 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: check-deprecated-apis
+  annotations:
+    policies.kyverno.io/title: Check deprecated APIs
+    policies.kyverno.io/category: Best Practices
+    policies.kyverno.io/subject: Kubernetes APIs
+    kyverno.io/kyverno-version: 1.7.4
+    policies.kyverno.io/minversion: 1.7.4
+    kyverno.io/kubernetes-version: "1.23"
+    policies.kyverno.io/description: >-
+      Kubernetes APIs are sometimes deprecated and removed after a few releases.
+      As a best practice, older API versions should be replaced with newer versions.
+      This policy validates for APIs that are deprecated or scheduled for removal.
+      Note that checking for some of these resources may require modifying the Kyverno
+      ConfigMap to remove filters. In the validate-v1-22-removals rule, the Lease kind
+      has been commented out due to a check for this kind having a performance penalty
+      on Kubernetes clusters with many leases. Its enabling should be attended carefully
+      and is not recommended on large clusters. PodSecurityPolicy is removed in v1.25
+      so therefore the validate-v1-25-removals rule may not completely work on 1.25+.
+      This policy requires Kyverno v1.7.4+ to function properly.
+spec:
+  validationFailureAction: audit
+  background: true
+  rules:
+  - name: validate-v1-25-removals
+    match:
+      any:
+      - resources:
+          # NOTE: PodSecurityPolicy is completely removed in 1.25.
+          kinds:
+          - batch/*/CronJob
+          - discovery.k8s.io/*/EndpointSlice
+          - events.k8s.io/*/Event
+          - policy/*/PodDisruptionBudget
+          - node.k8s.io/*/RuntimeClass
+    preconditions:
+      all:
+      - key: "{{ request.operation || 'BACKGROUND' }}"
+        operator: NotEquals
+        value: DELETE
+      - key: "{{request.object.apiVersion}}"
+        operator: AnyIn
+        value:
+        - batch/v1beta1
+        - discovery.k8s.io/v1beta1
+        - events.k8s.io/v1beta1
+        - policy/v1beta1
+        - node.k8s.io/v1beta1
+    validate:
+      message: >-
+        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.25.
+        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
+      deny: {}
+  - name: validate-v1-26-removals
+    match:
+      any:
+      - resources:
+          kinds:
+          - flowcontrol.apiserver.k8s.io/*/FlowSchema
+          - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
+          - autoscaling/*/HorizontalPodAutoscaler
+    preconditions:
+      all:
+      - key: "{{ request.operation || 'BACKGROUND' }}"
+        operator: NotEquals
+        value: DELETE
+      - key: "{{request.object.apiVersion}}"
+        operator: AnyIn
+        value:
+        - flowcontrol.apiserver.k8s.io/v1beta1
+        - autoscaling/v2beta2
+    validate:
+      message: >-
+        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.26.
+        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
+      deny: {}
+  - name: validate-v1-27-removals
+    match:
+      any:
+      - resources:
+          kinds:
+          - storage.k8s.io/*/CSIStorageCapacity
+    preconditions:
+      all:
+      - key: "{{ request.operation || 'BACKGROUND' }}"
+        operator: NotEquals
+        value: DELETE
+      - key: "{{request.object.apiVersion}}"
+        operator: AnyIn
+        value:
+        - storage.k8s.io/v1beta1
+    validate:
+      message: >-
+        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.27.
+        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
+      deny: {}
+  - name: validate-v1-29-removals
+    match:
+      any:
+      - resources:
+          kinds:
+          - flowcontrol.apiserver.k8s.io/*/FlowSchema
+          - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
+    preconditions:
+      all:
+      - key: "{{ request.operation || 'BACKGROUND' }}"
+        operator: NotEquals
+        value: DELETE
+      - key: "{{request.object.apiVersion}}"
+        operator: AnyIn
+        value:
+        - flowcontrol.apiserver.k8s.io/v1beta2
+    validate:
+      message: >-
+        {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.29.
+        See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/
+      deny: {}