An ingress resource needs to define an actual host name in order to be valid. This policy ensures that there is a hostname for each rule defined.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: disallow-empty-ingress-hostannotations:policies.kyverno.io/title: Disallow empty Ingress hostpolicies.kyverno.io/category: Best Practicespolicies.kyverno.io/minversion: 1.6.0policies.kyverno.io/severity: mediumpolicies.kyverno.io/subject: Ingresspolicies.kyverno.io/description: An ingress resource needs to define an actual host name in order to be valid. This policy ensures that there is a hostname for each rule defined.spec:validationFailureAction: Auditbackground: falserules:- name: disallow-empty-ingress-hostmatch:any:- resources:kinds:- Ingressvalidate:message: The Ingress host name must be defined, not empty.deny:conditions:all:- key: "{{ request.object.spec.rules[].host || `[]` | length(@) }}"operator: NotEqualsvalue: "{{ request.object.spec.rules[].http || `[]` | length(@) }}"
This policy prevents the use of the default project in an Application.
Services of type LoadBalancer when deployed inside AWS have support for transport encryption if it is enabled via an annotation. This policy requires that Services of type LoadBalancer contain the annotation service.beta.kubernetes.io/aws-load-balancer-ssl-cert with some value.
This policy prevents updates to the project field after an Application is created.