From c4057f9c35789b8b11c1983d90b320001788aaed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= Date: Mon, 17 Feb 2025 14:46:07 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20Minor=20update=20to=20Kyverno=20?= =?UTF-8?q?chapter=20and=20manifests?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- k8s/kyverno-pod-color-1.yaml | 2 +- k8s/kyverno-pod-color-2.yaml | 2 +- k8s/kyverno-pod-color-3.yaml | 2 +- slides/k8s/kyverno.md | 14 +++++++++----- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/k8s/kyverno-pod-color-1.yaml b/k8s/kyverno-pod-color-1.yaml index 6752f042..151cffa4 100644 --- a/k8s/kyverno-pod-color-1.yaml +++ b/k8s/kyverno-pod-color-1.yaml @@ -3,7 +3,7 @@ kind: ClusterPolicy metadata: name: pod-color-policy-1 spec: - validationFailureAction: enforce + validationFailureAction: Enforce rules: - name: ensure-pod-color-is-valid match: diff --git a/k8s/kyverno-pod-color-2.yaml b/k8s/kyverno-pod-color-2.yaml index 199f8a0b..a7d3ca47 100644 --- a/k8s/kyverno-pod-color-2.yaml +++ b/k8s/kyverno-pod-color-2.yaml @@ -3,7 +3,7 @@ kind: ClusterPolicy metadata: name: pod-color-policy-2 spec: - validationFailureAction: enforce + validationFailureAction: Enforce background: false rules: - name: prevent-color-change diff --git a/k8s/kyverno-pod-color-3.yaml b/k8s/kyverno-pod-color-3.yaml index d3055a3e..5ad5bd45 100644 --- a/k8s/kyverno-pod-color-3.yaml +++ b/k8s/kyverno-pod-color-3.yaml @@ -3,7 +3,7 @@ kind: ClusterPolicy metadata: name: pod-color-policy-3 spec: - validationFailureAction: enforce + validationFailureAction: Enforce background: false rules: - name: prevent-color-change diff --git a/slides/k8s/kyverno.md b/slides/k8s/kyverno.md index 6f27256f..ddebb111 100644 --- a/slides/k8s/kyverno.md +++ b/slides/k8s/kyverno.md @@ -50,7 +50,7 @@ - It's not the only solution! - (see e.g. [Open Policy Agent](https://www.openpolicyagent.org/docs/v0.12.2/kubernetes-admission-control/)) + (see e.g. [Open Policy Agent](https://www.openpolicyagent.org/docs/v0.12.2/kubernetes-admission-control/) or [Validating Admission Policies](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/)) --- @@ -148,19 +148,23 @@ ## Installing Kyverno -- Kyverno can be installed with a (big) YAML manifest +The recommended [installation method][install-kyverno] is to use Helm charts. + +(It's also possible to install with a single YAML manifest.) -- ... or with Helm charts (which allows to customize a few things) .lab[ - Install Kyverno: ```bash - kubectl create -f https://raw.githubusercontent.com/kyverno/kyverno/release-1.7/config/release/install.yaml + helm upgrade --install --repo https://kyverno.github.io/kyverno/ \ + --namespace kyverno --create-namespace kyverno kyverno ``` ] +[install-kyverno]: https://kyverno.io/docs/installation/methods/ + --- ## Kyverno policies in a nutshell @@ -584,7 +588,7 @@ class: extra-details - See [Linking resources with ownerReferences][ownerref] for an example -[ownerref]: https://kyverno.io/docs/writing-policies/generate/#linking-resources-with-ownerreferences +[ownerref]: https://kyverno.io/docs/writing-policies/generate/#linking-trigger-with-downstream ---