Labels are used as an important source of metadata describing objects in various ways or triggering other functionality. Labels are also a very basic concept and should be used throughout Kubernetes. This policy performs a simple mutation which adds a label `foo=bar` to Pods, Services, ConfigMaps, and Secrets.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: add-labelsannotations:policies.kyverno.io/title: Add Labelspolicies.kyverno.io/category: Samplepolicies.kyverno.io/minversion: 1.6.0policies.kyverno.io/severity: mediumpolicies.kyverno.io/subject: Labelpolicies.kyverno.io/description: Labels are used as an important source of metadata describing objects in various ways or triggering other functionality. Labels are also a very basic concept and should be used throughout Kubernetes. This policy performs a simple mutation which adds a label `foo=bar` to Pods, Services, ConfigMaps, and Secrets.spec:rules:- name: add-labelsmatch:any:- resources:kinds:- Pod- Service- ConfigMap- Secretmutate:patchStrategicMerge:metadata:labels:foo: bar
The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.
Tiller, found in Helm v2, has known security challenges. It requires administrative privileges and acts as a shared resource accessible to any authenticated user. Tiller can lead to privilege escalation as restricted users can impact other users. It is recommended to use Helm v3+ which does not contain Tiller for these reasons. This policy validates that there is not an image containing the name `tiller`.
The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.