Add rules to disallow default namespace for pod controllers.
@@ -3,6 +3,7 @@ kind: ClusterPolicy
metadata:
name: disallow-default-namespace
annotations:
+ pod-policies.kyverno.io/autogen-controllers: none
policies.kyverno.io/category: Workload Isolation
policies.kyverno.io/description: Kubernetes namespaces are an optional feature
that provide a way to segment and isolate cluster resources across multiple
@@ -31,4 +32,30 @@ spec:
pattern:
metadata:
namespace: "?*"
+ - name: validate-podcontroller-namespace
+ match:
+ resources:
+ kinds:
+ - DaemonSet
+ - Deployment
+ - Job
+ - StatefulSet
+ validate:
+ message: "Using 'default' namespace is not allowed for podcontrollers"
+ pattern:
+ metadata:
+ namespace: "!default"
+ - name: require-podcontroller-namespace
+ match:
+ resources:
+ kinds:
+ - DaemonSet
+ - Deployment
+ - Job
+ - StatefulSet
+ validate:
+ message: "A namespace is required for podcontrollers"
+ pattern:
+ metadata:
+ namespace: "?*"
