41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: protect-critical-namespaces
|
|
spec:
|
|
validationFailureAction: Enforce
|
|
background: false
|
|
rules:
|
|
- name: deny-deletion-of-critical-namespaces
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Namespace
|
|
names:
|
|
- keda-demand-prd
|
|
- contour-internal-0-demand-prd
|
|
- contour-internal-0-demand-prd-intra
|
|
- contour-external-demand-prd
|
|
- external-secrets-demand-prd
|
|
- flagger-demand-prd
|
|
- victoriametrics
|
|
- kube-system
|
|
- monitoring
|
|
- telegraf-operator
|
|
- loadtester
|
|
- opentelemetry
|
|
- fluentd
|
|
- kube-events
|
|
- observability
|
|
- contour-cert-checker-ns
|
|
- aurva-dataplane
|
|
validate:
|
|
message: "Deletion of critical namespaces is not allowed."
|
|
deny:
|
|
conditions:
|
|
any:
|
|
- key: "{{request.operation}}"
|
|
operator: Equals
|
|
value: DELETE
|