A PodDisruptionBudget which sets its maxUnavailable value to zero prevents all voluntary evictions including Node drains which may impact maintenance tasks. This policy enforces that if a PodDisruptionBudget specifies the maxUnavailable field it must be greater than zero.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: pdb-maxunavailableannotations:policies.kyverno.io/title: PodDisruptionBudget maxUnavailable Non-Zeropolicies.kyverno.io/category: Otherkyverno.io/kyverno-version: 1.9.0kyverno.io/kubernetes-version: "1.24"policies.kyverno.io/subject: PodDisruptionBudgetpolicies.kyverno.io/description: A PodDisruptionBudget which sets its maxUnavailable value to zero prevents all voluntary evictions including Node drains which may impact maintenance tasks. This policy enforces that if a PodDisruptionBudget specifies the maxUnavailable field it must be greater than zero.spec:validationFailureAction: Auditbackground: falserules:- name: pdb-maxunavailablematch:any:- resources:kinds:- PodDisruptionBudgetvalidate:message: The value of maxUnavailable must be greater than zero.pattern:spec:"=(maxUnavailable)": ">0"
This policy prevents the use of the default project in an Application.
Services of type LoadBalancer when deployed inside AWS have support for transport encryption if it is enabled via an annotation. This policy requires that Services of type LoadBalancer contain the annotation service.beta.kubernetes.io/aws-load-balancer-ssl-cert with some value.
This policy prevents updates to the project field after an Application is created.