A PodDisruptionBudget which sets its maxUnavailable value to zero prevents all voluntary evictions including Node drains which may impact maintenance tasks. This policy enforces that if a PodDisruptionBudget specifies the maxUnavailable field it must be greater than zero.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: pdb-maxunavailableannotations:policies.kyverno.io/title: PodDisruptionBudget maxUnavailable Non-Zeropolicies.kyverno.io/category: Otherkyverno.io/kyverno-version: 1.9.0kyverno.io/kubernetes-version: "1.24"policies.kyverno.io/subject: PodDisruptionBudgetpolicies.kyverno.io/description: A PodDisruptionBudget which sets its maxUnavailable value to zero prevents all voluntary evictions including Node drains which may impact maintenance tasks. This policy enforces that if a PodDisruptionBudget specifies the maxUnavailable field it must be greater than zero.spec:validationFailureAction: Auditbackground: falserules:- name: pdb-maxunavailablematch:any:- resources:kinds:- PodDisruptionBudgetvalidate:message: The value of maxUnavailable must be greater than zero.pattern:spec:"=(maxUnavailable)": ">0"
This policy prevents the use of the default project in an Application.
This policy ensures that the name of the ApplicationSet is the same value provided in the project.
Services of type LoadBalancer when deployed inside AWS have support for transport encryption if it is enabled via an annotation. This policy requires that Services of type LoadBalancer contain the annotation service.beta.kubernetes.io/aws-load-balancer-ssl-cert with some value.