rblundon
fe564d7227
git-subtree-dir: cluster-config git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c
37 lines
1.4 KiB
YAML
37 lines
1.4 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: check-openshift-deprecated-apis
|
|
annotations:
|
|
policies.kyverno.io/title: Disallow deprecated APIs
|
|
policies.kyverno.io/category: OpenShift
|
|
policies.kyverno.io/severity: medium
|
|
kyverno.io/kyverno-version: 1.6.0
|
|
policies.kyverno.io/minversion: 1.6.0
|
|
kyverno.io/kubernetes-version: "1.20"
|
|
policies.kyverno.io/subject: ClusterRole,ClusterRoleBinding,Role,RoleBinding,RBAC
|
|
policies.kyverno.io/description: >-
|
|
OpenShift APIs are sometimes deprecated and removed after a few releases.
|
|
As a best practice, older API versions should be replaced with newer versions.
|
|
This policy validates for APIs that are deprecated or scheduled for removal.
|
|
Note that checking for some of these resources may require modifying the Kyverno
|
|
ConfigMap to remove filters.
|
|
spec:
|
|
validationFailureAction: enforce
|
|
failurePolicy: Ignore
|
|
background: false
|
|
rules:
|
|
- name: check-deprecated-apis
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- authorization.openshift.io/v1/ClusterRole
|
|
- authorization.openshift.io/v1/ClusterRoleBinding
|
|
- authorization.openshift.io/v1/Role
|
|
- authorization.openshift.io/v1/RoleBinding
|
|
validate:
|
|
message: >-
|
|
{{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated.
|
|
deny: {}
|