Basic examples
Basic schema use-cases
Ensure a specific key exists
The following schema ensures that the key metadata.labels.app
exists (regardless of its value):
properties:
metadata:
properties:
labels:
required:
- app
required:
- labels
Set a minimum value for key of a specific kind
The following schema ensures that in a YAML of kind Deployment
, the key spec.replicas
has a value of 3 or higher:
if:
properties:
kind:
enum:
- Deployment
then:
properties:
spec:
properties:
replicas:
minimum: 3
Note that the key maximum
is also available.
Ensure value of a specific key is not one of predefined values
The following schema defines a blacklist of values for the key metadata.namespace
:
properties:
metadata:
properties:
namespace:
not:
enum:
- default
- misc
- general
Full custom rule examples
Ensure correct environment labels are used
Here is an example of a custom rule logic that will ensure only pre-approved values are used (allow-list) with the label key `environment`:
customRules:
- identifier: CUSTOM_WORKLOAD_INCORRECT_ENVIRONMENT_LABELS
name: Ensure correct environment labels are used [CUSTOM RULE]
defaultMessageOnFailure: Use only approved environment labels (`prod`, `staging` and `test`)
schema:
properties:
metadata:
properties:
labels:
properties:
environment:
enum:
- prod
- staging
- test
required:
- environment
required:
- labels
Every custom rule must be coupled with a specific policy
policies:
- name: Default
isDefault: true
rules:
- identifier: CUSTOM_WORKLOAD_INCORRECT_ENVIRONMENT_LABELS
messageOnFailure: ''
# more rules... #
And this is how the Policy as code file should look:
apiVersion: v1
policies:
- name: Default
isDefault: true
rules:
- identifier: CUSTOM_WORKLOAD_INCORRECT_ENVIRONMENT_LABELS
messageOnFailure: This message will override the rule's `defaultMessageOnFailure` property
# - name: staging
# rules:
# - identifier: CUSTOM_WORKLOAD_INCORRECT_ENVIRONMENT_LABELS
# messageOnFailure: ''
customRules:
- identifier: CUSTOM_WORKLOAD_INCORRECT_ENVIRONMENT_LABELS
name: Ensure correct environment labels are used [CUSTOM RULE]
defaultMessageOnFailure: Use only approved environment labels (`prod`, `staging` and `test`)
schema:
properties:
metadata:
properties:
labels:
properties:
environment:
enum:
- prod
- staging
- test
required:
- environment
required:
- labels
tip
Applying the new policies to your account
Enable PaC mode and publish the policies.yaml configuration (read more)
Dashboard | Terminal |
---|---|
![]() | ![]() |
Prevent workload from using the (system) default namespaces
Here is an example of a custom rule logic that will ensure pre-defined `namespace` values are excluded (block-list):
apiVersion: v1
policies:
- name: Default
isDefault: true
rules:
- identifier: CUSTOM_WORKLOAD_INCORRECT_NAMESPACE_VALUE
messageOnFailure: This message will override the rule's `defaultMessageOnFailure` property
# - name: staging
# rules:
# - identifier: CUSTOM_WORKLOAD_INCORRECT_NAMESPACE_VALUE
# messageOnFailure: ''
customRules:
- identifier: CUSTOM_WORKLOAD_INCORRECT_NAMESPACE_VALUE
name: Prevent workload from using the (system) default namespaces [CUSTOM RULE]
defaultMessageOnFailure: Don't use saved namespaces (`default`, `kube-node-lease`, `kube-public` and `kube-system`)
schema:
properties:
metadata:
properties:
namespace:
not:
enum:
- default
- kube-node-lease
- kube-public
- kube-syste
required:
- namespace
The above rule enforces similar logic to our built-in rule - ☑️ Prevent workload from using the default namespace
Ensure Deployment has replicas set between 2-10
Here is an example of a custom rule logic that will ensure the number of `replicas` is set between 2-10 for resources kind `Deployment`:
apiVersion: v1
policies:
- name: Default
isDefault: true
rules:
- identifier: CUSTOM_DEPLOYMENT_INCORRECT_REPLICAS_VALUE
messageOnFailure: This message will override the rule's `defaultMessageOnFailure` property
# - name: staging
# rules:
# - identifier: CUSTOM_DEPLOYMENT_INCORRECT_REPLICAS_VALUE
# messageOnFailure: ''
customRules:
- identifier: CUSTOM_DEPLOYMENT_INCORRECT_REPLICAS_VALUE
name: Ensure Deployment has replicas set between 2-10 [CUSTOM RULE]
defaultMessageOnFailure: Running 2 or more replicas will increase the availability of the service
schema:
if:
properties:
kind:
enum:
- Deployment
then:
properties:
spec:
properties:
replicas:
minimum: 2
maximum: 10
required:
- replicas
The above rule enforces similar logic to our built-in rule - ☑️ Ensure Deployment has more than one replica configured;