All Policies

Require Pod Probes

Liveness and readiness probes need to be configured to correctly manage a Pod's lifecycle during deployments, restarts, and upgrades. For each Pod, a periodic `livenessProbe` is performed by the kubelet to determine if the Pod's containers are running or need to be restarted. A `readinessProbe` is used by Services and Deployments to determine if the Pod is ready to receive network traffic. This policy validates that all containers have liveness and readiness probes by ensuring the `periodSeconds` field is greater than zero.

Policy Definition

/best-practices/require_probes/require_probes.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: require-pod-probes
 5  annotations:
 6    pod-policies.kyverno.io/autogen-controllers: DaemonSet,Deployment,StatefulSet
 7    policies.kyverno.io/title: Require Pod Probes
 8    policies.kyverno.io/category: Best Practices
 9    policies.kyverno.io/severity: medium
10    policies.kyverno.io/subject: Pod
11    policies.kyverno.io/description: >-
12      Liveness and readiness probes need to be configured to correctly manage a Pod's
13      lifecycle during deployments, restarts, and upgrades. For each Pod, a periodic
14      `livenessProbe` is performed by the kubelet to determine if the Pod's containers
15      are running or need to be restarted. A `readinessProbe` is used by Services
16      and Deployments to determine if the Pod is ready to receive network traffic.
17      This policy validates that all containers have liveness and readiness probes by
18      ensuring the `periodSeconds` field is greater than zero.      
19spec:
20  validationFailureAction: audit
21  background: true
22  rules:
23  - name: validate-livenessProbe-readinessProbe
24    match:
25      resources:
26        kinds:
27        - Pod
28    validate:
29      message: "Liveness and readiness probes are required."
30      pattern:
31        spec:
32          containers:
33          - livenessProbe:
34              periodSeconds: ">0"
35            readinessProbe:
36              periodSeconds: ">0"