feat: add ability to restrict required-probes constraint to containers in pods selected by a service

artifacthub/library/general/requiredprobes/1.1.0/artifacthub-pkg.yml

@@ -0,0 +1,22 @@
+version: 1.1.0
+name: k8srequiredprobes
+displayName: Required Probes
+createdAt: "2023-01-04T23:20:17Z"
+description: Requires Pods to have readiness and/or liveness probes.
+digest: 1f871f3eb3e25749d3d6872736253ae2cd2dc394ed9b402bb1560cdd28613666
+license: Apache-2.0
+homeURL: https://open-policy-agent.github.io/gatekeeper-library/website/requiredprobes
+keywords:
+    - gatekeeper
+    - open-policy-agent
+    - policies
+readme: |-
+    # Required Probes
+    Requires Pods to have readiness and/or liveness probes.
+install: |-
+    ### Usage
+    ```shell
+    kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/artifacthub/library/general/requiredprobes/1.1.0/template.yaml
+    ```
+provider:
+    name: Gatekeeper Library

artifacthub/library/general/requiredprobes/1.1.0/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - template.yaml

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes-on-service/constraint.yaml

@@ -0,0 +1,14 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sRequiredProbes
+metadata:
+  name: must-have-probes-on-service
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+  parameters:
+    onlyServices: true
+    probes: ["readinessProbe", "livenessProbe"]
+    probeTypes: ["tcpSocket", "httpGet", "exec"]
+    customViolationMessage: "See https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes for more info."

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes-on-service/example_allowed_with_service.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: allowed-pod-with-service
+  namespace: default
+  labels:
+    app.kubernetes.io/name: tomcat
+spec:
+  containers:
+  - name: tomcat
+    image: tomcat
+    ports:
+    - containerPort: 8080
+      name: tomcat-http
+    livenessProbe:
+      tcpSocket:
+        port: 80
+      initialDelaySeconds: 5
+      periodSeconds: 10
+    readinessProbe:
+      tcpSocket:
+        port: 8080
+      initialDelaySeconds: 5
+      periodSeconds: 10
+  volumes:
+  - name: cache-volume
+    emptyDir: {}

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes-on-service/example_allowed_without_service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: allowed-pod-without-service
+  namespace: default
+  labels:
+    app.kubernetes.io/name: tomcat-no-svc
+    second-label: "example"
+spec:
+  containers:
+  - name: tomcat
+    image: tomcat
+    ports:
+    - containerPort: 8080
+  volumes:
+  - name: cache-volume
+    emptyDir: {}

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes-on-service/example_disallowed_with_service.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: disallowed-pod-with-service
+  namespace: default
+  labels:
+    app.kubernetes.io/name: tomcat
+    second-label: "example"
+spec:
+  containers:
+  - name: nginx-1
+    image: nginx:1.7.9
+    ports:
+    - containerPort: 80
+    livenessProbe:
+      # tcpSocket:
+      #   port: 80
+      # initialDelaySeconds: 5
+      # periodSeconds: 10
+    volumeMounts:
+    - mountPath: /tmp/cache
+      name: cache-volume
+  - name: tomcat
+    image: tomcat
+    ports:
+    - containerPort: 8080
+      name: tomcat-http
+    readinessProbe:
+      tcpSocket:
+        port: 8080
+      initialDelaySeconds: 5
+      periodSeconds: 10
+  volumes:
+  - name: cache-volume
+    emptyDir: {}

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes-on-service/example_inventory.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tomcat-service
+  namespace: default
+spec:
+  selector:
+    app.kubernetes.io/name: tomcat
+  ports:
+  - name: name-of-service-port
+    protocol: TCP
+    port: 80
+    targetPort: tomcat-http

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes/constraint.yaml

@@ -0,0 +1,13 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sRequiredProbes
+metadata:
+  name: must-have-probes
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+  parameters:
+    onlyServices: false
+    probes: ["readinessProbe", "livenessProbe"]
+    probeTypes: ["tcpSocket", "httpGet", "exec"]

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes/example_allowed.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod1
+spec:
+  containers:
+  - name: tomcat
+    image: tomcat
+    ports:
+    - containerPort: 8080
+    livenessProbe:
+      tcpSocket:
+        port: 80
+      initialDelaySeconds: 5
+      periodSeconds: 10
+    readinessProbe:
+      tcpSocket:
+        port: 8080
+      initialDelaySeconds: 5
+      periodSeconds: 10
+  volumes:
+  - name: cache-volume
+    emptyDir: {}

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes/example_disallowed.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod1
+spec:
+  containers:
+  - name: nginx-1
+    image: nginx:1.7.9
+    ports:
+    - containerPort: 80
+    livenessProbe:
+      # tcpSocket:
+      #   port: 80
+      # initialDelaySeconds: 5
+      # periodSeconds: 10
+    volumeMounts:
+    - mountPath: /tmp/cache
+      name: cache-volume
+  - name: tomcat
+    image: tomcat
+    ports:
+    - containerPort: 8080
+    readinessProbe:
+      tcpSocket:
+        port: 8080
+      initialDelaySeconds: 5
+      periodSeconds: 10
+  volumes:
+  - name: cache-volume
+    emptyDir: {}

artifacthub/library/general/requiredprobes/1.1.0/samples/must-have-probes/example_disallowed2.yaml

@@ -0,0 +1,41 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: test-pod2
+spec:
+  containers:
+  - name: nginx-1
+    image: nginx:1.7.9
+    ports:
+    - containerPort: 80
+    readinessProbe:
+    # httpGet:
+    #   path: /
+    #   port: 80
+    # initialDelaySeconds: 5
+    # periodSeconds: 10
+    livenessProbe:
+      tcpSocket:
+        port: 80
+      initialDelaySeconds: 5
+      periodSeconds: 10
+    volumeMounts:
+    - mountPath: /tmp/cache
+      name: cache-volume
+  - name: tomcat
+    image: tomcat
+    ports:
+    - containerPort: 8080
+    readinessProbe:
+      tcpSocket:
+        port: 8080
+      initialDelaySeconds: 5
+      periodSeconds: 10
+    # livenessProbe:
+    #   tcpSocket:
+    #     port: 8080
+    #   initialDelaySeconds: 5
+    #   periodSeconds: 10
+  volumes:
+  - name: cache-volume
+    emptyDir: {}

artifacthub/library/general/requiredprobes/1.1.0/suite.yaml

@@ -0,0 +1,43 @@
+kind: Suite
+apiVersion: test.gatekeeper.sh/v1alpha1
+metadata:
+  name: requiredprobes
+tests:
+- name: required-probes
+  template: template.yaml
+  constraint: samples/must-have-probes/constraint.yaml
+  cases:
+  - name: example-allowed
+    object: samples/must-have-probes/example_allowed.yaml
+    assertions:
+    - violations: no
+  - name: example-disallowed
+    object: samples/must-have-probes/example_disallowed.yaml
+    assertions:
+    - violations: yes
+  - name: example-disallowed2
+    object: samples/must-have-probes/example_disallowed2.yaml
+    assertions:
+    - violations: yes
+- name: required-probes-only-services
+  template: template.yaml
+  constraint: samples/must-have-probes-on-service/constraint.yaml
+  cases:
+  - name: example-allowed-without-service
+    object: samples/must-have-probes-on-service/example_allowed_without_service.yaml
+    inventory:
+    - samples/must-have-probes-on-service/example_inventory.yaml
+    assertions:
+    - violations: no
+  - name: example-allowed-with-service
+    object: samples/must-have-probes-on-service/example_allowed_with_service.yaml
+    inventory:
+    - samples/must-have-probes-on-service/example_inventory.yaml
+    assertions:
+    - violations: no
+  - name: example-disallowed-with-service
+    object: samples/must-have-probes-on-service/example_disallowed_with_service.yaml
+    inventory:
+    - samples/must-have-probes-on-service/example_inventory.yaml
+    assertions:
+    - violations: yes

artifacthub/library/general/requiredprobes/1.1.0/sync.yaml

@@ -0,0 +1,11 @@
+apiVersion: config.gatekeeper.sh/v1alpha1
+kind: Config
+metadata:
+  name: config
+  namespace: "gatekeeper-system"
+spec:
+  sync:
+    syncOnly:
+      - group: ""
+        version: "v1"
+        kind: "Service"