This policy performs some best practices validation on Application fields. Path or chart must be specified but never both. And destination.name or destination.server must be specified but never both.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: application-field-validationannotations:policies.kyverno.io/title: Application Field Validationpolicies.kyverno.io/category: Argopolicies.kyverno.io/severity: mediumpolicies.kyverno.io/subject: Applicationkyverno.io/kyverno-version: 1.6.0policies.kyverno.io/minversion: 1.6.0kyverno.io/kubernetes-version: "1.23"policies.kyverno.io/description: This policy performs some best practices validation on Application fields. Path or chart must be specified but never both. And destination.name or destination.server must be specified but never both.spec:validationFailureAction: Auditbackground: truerules:- name: source-path-chartmatch:any:- resources:kinds:- Applicationvalidate:message: "`spec.source.path` OR `spec.source.chart` should be specified but never both."anyPattern:- spec:source:path: "?*"X(chart): null- spec:source:X(path): nullchart: "?*"- name: destination-server-namematch:any:- resources:kinds:- Applicationvalidate:message: "`spec.destination.server` OR `spec.destination.name` should be specified but never both."anyPattern:- spec:destination:server: "?*"X(name): null- spec:destination:X(server): nullname: "?*"
This policy prevents the use of the default project in an Application.
This policy ensures that the name of the ApplicationSet is the same value provided in the project.
Services of type LoadBalancer when deployed inside AWS have support for transport encryption if it is enabled via an annotation. This policy requires that Services of type LoadBalancer contain the annotation service.beta.kubernetes.io/aws-load-balancer-ssl-cert with some value.