This policy performs some best practices validation on Application fields. Path or chart must be specified but never both. And destination.name or destination.server must be specified but never both.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: application-field-validationannotations:policies.kyverno.io/title: Application Field Validationpolicies.kyverno.io/category: Argopolicies.kyverno.io/severity: mediumpolicies.kyverno.io/subject: Applicationkyverno.io/kyverno-version: 1.6.0policies.kyverno.io/minversion: 1.6.0kyverno.io/kubernetes-version: "1.23"policies.kyverno.io/description: This policy performs some best practices validation on Application fields. Path or chart must be specified but never both. And destination.name or destination.server must be specified but never both.spec:validationFailureAction: Auditbackground: truerules:- name: source-path-chartmatch:any:- resources:kinds:- Applicationvalidate:message: "`spec.source.path` OR `spec.source.chart` should be specified but never both."anyPattern:- spec:source:path: "?*"X(chart): null- spec:source:X(path): nullchart: "?*"- name: destination-server-namematch:any:- resources:kinds:- Applicationvalidate:message: "`spec.destination.server` OR `spec.destination.name` should be specified but never both."anyPattern:- spec:destination:server: "?*"X(name): null- spec:destination:X(server): nullname: "?*"
This policy prevents the use of the default project in an Application.
This policy ensures that the name of the ApplicationSet is the same value provided in the project.
According to EKS best practices, the `aws-node` DaemonSet is configured to use a role assigned to the EC2 instances to assign IPs to Pods. This role includes several AWS managed policies that effectively allow all Pods running on a Node to attach/detach ENIs, assign/unassign IP addresses, or pull images from ECR. Since this presents a risk to your cluster, it is recommended that you update the `aws-node` DaemonSet to use IRSA. This policy ensures that the `aws-node` DaemonSet running in the `kube-system` Namespace is not still using the `aws-node` ServiceAccount.