mirror of
https://github.com/fluxerapp/fluxer
synced 2026-10-17 21:15:32 +09:00
53 lines
2.5 KiB
YAML
53 lines
2.5 KiB
YAML
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicy
|
|
metadata:
|
|
name: fluxer-api-approved-image
|
|
labels:
|
|
app.kubernetes.io/part-of: fluxer
|
|
app.kubernetes.io/name: api-image-policy
|
|
spec:
|
|
failurePolicy: Fail
|
|
paramKind:
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
matchConstraints:
|
|
resourceRules:
|
|
- apiGroups: ["apps"]
|
|
apiVersions: ["v1"]
|
|
operations: ["CREATE", "UPDATE"]
|
|
resources: ["deployments"]
|
|
matchConditions:
|
|
- name: fluxer-api-deployments
|
|
expression: "request.namespace == 'fluxer' && (object.metadata.name == 'api' || object.metadata.name == 'api-canary')"
|
|
variables:
|
|
- name: containerName
|
|
expression: "object.metadata.name == 'api' ? 'api' : 'api-canary'"
|
|
- name: targetContainers
|
|
expression: "object.spec.template.spec.containers.filter(c, c.name == variables.containerName)"
|
|
validations:
|
|
- expression: "params.data[\"tag\"].matches(\"^[1-9][0-9]{3}\\\\.[1-9][0-9]{2,3}\\\\.(0|[1-9][0-9]{0,5})$\")"
|
|
message: "approved fluxer-api tag must be a Fluxer CalVer value"
|
|
- expression: "params.data[\"previousTag\"] == \"\" || params.data[\"previousTag\"].matches(\"^[1-9][0-9]{3}\\\\.[1-9][0-9]{2,3}\\\\.(0|[1-9][0-9]{0,5})$\")"
|
|
message: "previous approved fluxer-api tag must be empty or a Fluxer CalVer value"
|
|
- expression: "variables.targetContainers.size() == 1"
|
|
message: "api deployment must have exactly one target api container"
|
|
- expression: "variables.targetContainers.all(c, (c.image == params.data[\"image\"] && c.env.exists(e, e.name == \"BUILD_VERSION\" && e.value == params.data[\"tag\"])) || (params.data[\"previousImage\"] != \"\" && c.image == params.data[\"previousImage\"] && c.env.exists(e, e.name == \"BUILD_VERSION\" && e.value == params.data[\"previousTag\"])))"
|
|
messageExpression: "params.data[\"previousImage\"] == \"\" ? \"api deployment image and BUILD_VERSION must match \" + params.data[\"image\"] : \"api deployment image and BUILD_VERSION must match approved image \" + params.data[\"image\"] + \" or temporary rollback image \" + params.data[\"previousImage\"]"
|
|
---
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingAdmissionPolicyBinding
|
|
metadata:
|
|
name: fluxer-api-approved-image
|
|
labels:
|
|
app.kubernetes.io/part-of: fluxer
|
|
app.kubernetes.io/name: api-image-policy
|
|
spec:
|
|
policyName: fluxer-api-approved-image
|
|
validationActions: [Deny]
|
|
paramRef:
|
|
name: fluxer-api-approved-image
|
|
namespace: fluxer
|
|
parameterNotFoundAction: Deny
|