Skip to content

Commit bd75658

Browse files
matanbaruchmatanbaruch
committed
Implement add-configmap-ownerreference policy to automatically set owner references for ConfigMaps used by ReplicaSets. Includes policy definition, test cases, and example resources for validation.
Signed-off-by: matanbaruch <[email protected]>
1 parent 2b440a9 commit bd75658

File tree

9 files changed

+217
-0
lines changed

9 files changed

+217
-0
lines changed

‎other/add-configmap-ownerreference/.chainsaw-test/chainsaw-step-01-assert-1.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: add-configmap-ownerreference
5+
spec:
6+
mutateExistingOnPolicyUpdate: false

‎other/add-configmap-ownerreference/.chainsaw-test/chainsaw-step-02-assert-1.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: test-configmap
5+
namespace: default
6+
ownerReferences:
7+
- apiVersion: apps/v1
8+
kind: ReplicaSet
9+
name: test-replicaset
10+
controller: false
11+
blockOwnerDeletion: false

‎other/add-configmap-ownerreference/.chainsaw-test/chainsaw-test.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
2+
apiVersion: chainsaw.kyverno.io/v1alpha1
3+
kind: Test
4+
metadata:
5+
creationTimestamp: null
6+
name: add-configmap-ownerreference
7+
spec:
8+
steps:
9+
- name: step-01
10+
try:
11+
- apply:
12+
file: ../add-configmap-ownerreference.yaml
13+
- patch:
14+
resource:
15+
apiVersion: kyverno.io/v1
16+
kind: ClusterPolicy
17+
metadata:
18+
name: add-configmap-ownerreference
19+
spec:
20+
mutateExistingOnPolicyUpdate: false
21+
- assert:
22+
file: chainsaw-step-01-assert-1.yaml
23+
- name: step-02
24+
try:
25+
- apply:
26+
file: configmap-good.yaml
27+
- apply:
28+
file: replicaset-with-configmap.yaml
29+
- sleep:
30+
duration: 2s
31+
- assert:
32+
file: chainsaw-step-02-assert-1.yaml
33+
- name: step-03
34+
try:
35+
- apply:
36+
file: replicaset-without-configmap.yaml

‎other/add-configmap-ownerreference/.chainsaw-test/configmap-good.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: test-configmap
5+
namespace: default
6+
data:
7+
key1: value1
8+
key2: value2

‎other/add-configmap-ownerreference/.chainsaw-test/replicaset-with-configmap.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: apps/v1
2+
kind: ReplicaSet
3+
metadata:
4+
name: test-replicaset
5+
namespace: default
6+
labels:
7+
app: test-app
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: test-app
13+
template:
14+
metadata:
15+
labels:
16+
app: test-app
17+
spec:
18+
containers:
19+
- name: test-container
20+
image: nginx:1.21
21+
volumeMounts:
22+
- name: config-volume
23+
mountPath: /etc/config
24+
volumes:
25+
- name: config-volume
26+
configMap:
27+
name: test-configmap

‎other/add-configmap-ownerreference/.chainsaw-test/replicaset-without-configmap.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: apps/v1
2+
kind: ReplicaSet
3+
metadata:
4+
name: test-replicaset-no-cm
5+
namespace: default
6+
labels:
7+
app: test-app-no-cm
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: test-app-no-cm
13+
template:
14+
metadata:
15+
labels:
16+
app: test-app-no-cm
17+
spec:
18+
containers:
19+
- name: test-container
20+
image: nginx:1.21

‎other/add-configmap-ownerreference/.kyverno-test/kyverno-test.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: cli.kyverno.io/v1alpha1
2+
kind: Test
3+
metadata:
4+
name: add-configmap-ownerreference
5+
policies:
6+
- ../add-configmap-ownerreference.yaml
7+
resources:
8+
- ../.chainsaw-test/configmap-good.yaml
9+
- ../.chainsaw-test/replicaset-with-configmap.yaml
10+
- ../.chainsaw-test/replicaset-without-configmap.yaml
11+
results:
12+
- kind: ReplicaSet
13+
policy: add-configmap-ownerreference
14+
resources:
15+
- test-replicaset
16+
result: pass
17+
rule: add-configmap-ownerref-from-replicaset
18+
- kind: ReplicaSet
19+
policy: add-configmap-ownerreference
20+
resources:
21+
- test-replicaset-no-cm
22+
result: skip
23+
rule: add-configmap-ownerref-from-replicaset

‎other/add-configmap-ownerreference/add-configmap-ownerreference.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: add-configmap-ownerreference
5+
annotations:
6+
policies.kyverno.io/title: Add ConfigMap Owner Reference from ReplicaSet
7+
policies.kyverno.io/category: Other
8+
policies.kyverno.io/severity: medium
9+
policies.kyverno.io/subject: ReplicaSet,ConfigMap
10+
kyverno.io/kyverno-version: 1.9.0
11+
policies.kyverno.io/minversion: 1.9.0
12+
kyverno.io/kubernetes-version: "1.24"
13+
policies.kyverno.io/description: >-
14+
When a new ReplicaSet is created (typically by updating a Deployment),
15+
this policy will automatically add an owner reference to any ConfigMaps
16+
that the ReplicaSet mounts as volumes. This ensures that ConfigMaps have
17+
proper ownership relationships with the ReplicaSets that use them, which
18+
can be useful for garbage collection, monitoring, and dependency tracking.
19+
This policy requires additional RBAC permissions for Kyverno to update ConfigMaps.
20+
spec:
21+
mutateExistingOnPolicyUpdate: false
22+
rules:
23+
- name: add-configmap-ownerref-from-replicaset
24+
match:
25+
any:
26+
- resources:
27+
kinds:
28+
- ReplicaSet
29+
preconditions:
30+
all:
31+
- key: "{{ request.operation }}"
32+
operator: Equals
33+
value: CREATE
34+
# Only process ReplicaSets that have volumes with configMap
35+
- key: "{{ request.object.spec.template.spec.volumes[?configMap] | length(@) }}"
36+
operator: GreaterThan
37+
value: 0
38+
mutate:
39+
foreach:
40+
- list: "request.object.spec.template.spec.volumes[?configMap].configMap.name"
41+
targets:
42+
- apiVersion: v1
43+
kind: ConfigMap
44+
name: "{{ element }}"
45+
namespace: "{{ request.object.metadata.namespace }}"
46+
patchStrategicMerge:
47+
metadata:
48+
ownerReferences:
49+
- apiVersion: apps/v1
50+
kind: ReplicaSet
51+
name: "{{ request.object.metadata.name }}"
52+
uid: "{{ request.object.metadata.uid }}"
53+
controller: false
54+
blockOwnerDeletion: false

‎other/add-configmap-ownerreference/artifacthub-pkg.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: add-configmap-ownerreference
2+
version: 1.0.0
3+
displayName: Add ConfigMap Owner Reference from ReplicaSet
4+
createdAt: "2024-12-19T00:00:00.000Z"
5+
description: >-
6+
When a new ReplicaSet is created (typically by updating a Deployment),
7+
this policy will automatically add an owner reference to any ConfigMaps
8+
that the ReplicaSet mounts as volumes. This ensures that ConfigMaps have
9+
proper ownership relationships with the ReplicaSets that use them, which
10+
can be useful for garbage collection, monitoring, and dependency tracking.
11+
This policy requires additional RBAC permissions for Kyverno to update ConfigMaps.
12+
install: |-
13+
```shell
14+
kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/other/add-configmap-ownerreference/add-configmap-ownerreference.yaml
15+
```
16+
keywords:
17+
- kyverno
18+
- Other
19+
readme: |
20+
When a new ReplicaSet is created (typically by updating a Deployment),
21+
this policy will automatically add an owner reference to any ConfigMaps
22+
that the ReplicaSet mounts as volumes. This ensures that ConfigMaps have
23+
proper ownership relationships with the ReplicaSets that use them, which
24+
can be useful for garbage collection, monitoring, and dependency tracking.
25+
This policy requires additional RBAC permissions for Kyverno to update ConfigMaps.
26+
27+
Refer to the documentation for more details on Kyverno annotations: https://artifacthub.io/docs/topics/annotations/kyverno/
28+
annotations:
29+
kyverno/category: "Other"
30+
kyverno/kubernetesVersion: "1.24"
31+
kyverno/subject: "ReplicaSet, ConfigMap"
32+
digest: f3122f221e2423d9aec9839f051018fb250bb449315522169b783c8cd0106371

0 commit comments

Comments
 (0)