Require Requests and Limits for emptyDir

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: require-emptydir-requests-and-limits
 5  annotations:
 6    policies.kyverno.io/title: Require Requests and Limits for emptyDir
 7    policies.kyverno.io/category: Other
 8    policies.kyverno.io/severity: medium
 9    policies.kyverno.io/minversion: 1.9.0
10    kyverno.io/kyverno-version: 1.11.1
11    kyverno.io/kubernetes-version: "1.27"
12    policies.kyverno.io/subject: Pod
13    policies.kyverno.io/description: >-
14      Pods which mount emptyDir volumes may be allowed to potentially overrun
15      the medium backing the emptyDir volume. This sample ensures that any
16      initContainers or containers mounting an emptyDir volume have
17      ephemeral-storage requests and limits set. Policy will be skipped if
18      the volume has already a sizeLimit set.
19spec:
20  background: false
21  validationFailureAction: Audit
22  rules:
23    - name: check-emptydir-requests-limits
24      match:
25        any:
26          - resources:
27              kinds:
28                - Pod
29      context:
30      - name: emptydirnames
31        variable:
32          jmesPath: request.object.spec.volumes[?contains(keys(@), 'emptyDir') && !contains(keys(emptyDir), 'sizeLimit')].name
33      preconditions:
34        all:
35          - key: "{{ request.object.spec.volumes[?contains(keys(@), 'emptyDir')] || `[]` | length(@) }}"
36            operator: GreaterThanOrEquals
37            value: 1
38          - key: "{{request.operation || 'BACKGROUND'}}"
39            operator: AnyIn
40            value:
41              - CREATE
42              - UPDATE
43      validate:
44        message: Containers mounting emptyDir volumes must specify requests and limits for ephemeral-storage.
45        foreach:
46          - list: "request.object.spec.[initContainers, containers][]"
47            preconditions:
48              any:
49              - key: "{{ element.volumeMounts[].name }}"
50                operator: AnyIn
51                value: "{{ emptydirnames }}"
52            pattern:
53              resources:
54                requests:
55                  ephemeral-storage: "?*"
56                limits:
57                  ephemeral-storage: "?*"