feat: add best practices check-deprecated-apis policy in CEL expressi…

…ons (#1042) * copy check-deprecated-apis Signed-off-by: Chandan-DK <[email protected]> * convert policy Signed-off-by: Chandan-DK <[email protected]> --------- Signed-off-by: Chandan-DK <[email protected]> Co-authored-by: Mariam Fahmy <[email protected]> Co-authored-by: Chip Zoller <[email protected]> Co-authored-by: shuting <[email protected]>
kyverno · Aug 2, 2024 · 2d8b3a4 · 2d8b3a4
1 parent 4854f24
commit 2d8b3a4
Show file tree

Hide file tree

Showing 4 changed files with 197 additions and 0 deletions.
diff --git a/best-practices-cel/check-deprecated-apis/.kyverno-test/kyverno-test.yaml b/best-practices-cel/check-deprecated-apis/.kyverno-test/kyverno-test.yaml
@@ -0,0 +1,27 @@
+apiVersion: cli.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: check-deprecated-apis
+policies:
+- ../check-deprecated-apis.yaml
+resources:
+- resource.yaml
+results:
+- kind: CronJob
+  policy: check-deprecated-apis
+  resources:
+  - bad-cronjob
+  result: fail
+  rule: validate-v1-25-removals
+- kind: CronJob
+  policy: check-deprecated-apis
+  resources:
+  - good-cronjob
+  result: skip
+  rule: validate-v1-25-removals
+- kind: FlowSchema
+  policy: check-deprecated-apis
+  resources:
+  - bad-flowschema
+  result: fail
+  rule: validate-v1-29-removals
diff --git a/best-practices-cel/check-deprecated-apis/.kyverno-test/resource.yaml b/best-practices-cel/check-deprecated-apis/.kyverno-test/resource.yaml
@@ -0,0 +1,52 @@
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: bad-cronjob
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: hello
+            image: busybox:1.28
+            imagePullPolicy: IfNotPresent
+            command:
+            - /bin/sh
+            - -c
+            - date; echo Hello from the Kubernetes cluster
+          restartPolicy: OnFailure
+
+---
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: good-cronjob
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: hello
+            image: busybox:1.28
+            imagePullPolicy: IfNotPresent
+            command:
+            - /bin/sh
+            - -c
+            - date; echo Hello from the Kubernetes cluster
+          restartPolicy: OnFailure
+
+---
+apiVersion: flowcontrol.apiserver.k8s.io/v1beta2
+kind: FlowSchema
+metadata:
+  name: bad-flowschema
+spec:
+  matchingPrecedence: 1000
+  priorityLevelConfiguration:
+    name: exempt
+
diff --git a/best-practices-cel/check-deprecated-apis/artifacthub-pkg.yml b/best-practices-cel/check-deprecated-apis/artifacthub-pkg.yml
@@ -0,0 +1,23 @@
+name: check-deprecated-apis-cel
+version: 1.0.0
+displayName: Check deprecated APIs in CEL expressions
+description: >-
+  Kubernetes APIs are sometimes deprecated and removed after a few releases. As a best practice, older API versions should be replaced with newer versions. This policy validates for APIs that are deprecated or scheduled for removal. Note that checking for some of these resources may require modifying the Kyverno ConfigMap to remove filters. PodSecurityPolicy is removed in v1.25 so therefore the validate-v1-25-removals rule may not completely work on 1.25+. 
+install: |-
+  ```shell
+  kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/best-practices-cel/check-deprecated-apis/check-deprecated-apis.yaml
+  ```
+keywords:
+  - kyverno
+  - Best Practices
+  - CEL Expressions
+readme: |
+  Kubernetes APIs are sometimes deprecated and removed after a few releases. As a best practice, older API versions should be replaced with newer versions. This policy validates for APIs that are deprecated or scheduled for removal. Note that checking for some of these resources may require modifying the Kyverno ConfigMap to remove filters. PodSecurityPolicy is removed in v1.25 so therefore the validate-v1-25-removals rule may not completely work on 1.25+. 
+  
+  Refer to the documentation for more details on Kyverno annotations: https://artifacthub.io/docs/topics/annotations/kyverno/
+annotations:
+  kyverno/category: "Best Practices in CEL"
+  kyverno/kubernetesVersion: "1.26-1.27"
+  kyverno/subject: "Kubernetes APIs"
+digest: da368de7982e748983a14198e8f8ef46d455023e8938031444f832919fabba6e
+createdAt: "2024-05-31T09:44:23Z"
diff --git a/best-practices-cel/check-deprecated-apis/check-deprecated-apis.yaml b/best-practices-cel/check-deprecated-apis/check-deprecated-apis.yaml
@@ -0,0 +1,95 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: check-deprecated-apis
+  annotations:
+    policies.kyverno.io/title: Check deprecated APIs in CEL expressions
+    policies.kyverno.io/category: Best Practices in CEL 
+    policies.kyverno.io/subject: Kubernetes APIs
+    kyverno.io/kyverno-version: 1.12.1
+    kyverno.io/kubernetes-version: "1.26-1.27"
+    policies.kyverno.io/description: >-
+      Kubernetes APIs are sometimes deprecated and removed after a few releases.
+      As a best practice, older API versions should be replaced with newer versions.
+      This policy validates for APIs that are deprecated or scheduled for removal.
+      Note that checking for some of these resources may require modifying the Kyverno
+      ConfigMap to remove filters. PodSecurityPolicy is removed in v1.25
+      so therefore the validate-v1-25-removals rule may not completely work on 1.25+.
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+  - name: validate-v1-25-removals
+    match:
+      any:
+      - resources:
+          # NOTE: PodSecurityPolicy is completely removed in 1.25.
+          kinds:
+          - batch/*/CronJob
+          - discovery.k8s.io/*/EndpointSlice
+          - events.k8s.io/*/Event
+          - policy/*/PodDisruptionBudget
+          - policy/*/PodSecurityPolicy
+          - node.k8s.io/*/RuntimeClass
+    celPreconditions:
+      - name: "allowed-api-versions"
+        expression: "object.apiVersion in ['batch/v1beta1', 'discovery.k8s.io/v1beta1', 'events.k8s.io/v1beta1', 'policy/v1beta1', 'node.k8s.io/v1beta1']"
+    validate:
+      cel:
+        expressions:
+          - expression: "false"
+            messageExpression: >-
+              object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.25.
+              See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
+  - name: validate-v1-26-removals
+    match:
+      any:
+      - resources:
+          kinds:
+          - flowcontrol.apiserver.k8s.io/*/FlowSchema
+          - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
+          - autoscaling/*/HorizontalPodAutoscaler
+    celPreconditions:
+      - name: "allowed-api-versions"
+        expression: "object.apiVersion in ['flowcontrol.apiserver.k8s.io/v1beta1', 'autoscaling/v2beta2']"
+    validate:
+      cel:
+        expressions:
+          - expression: "false"
+            messageExpression: >-
+              object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.26.
+              See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
+  - name: validate-v1-27-removals
+    match:
+      any:
+      - resources:
+          kinds:
+          - storage.k8s.io/*/CSIStorageCapacity
+    celPreconditions:
+      - name: "allowed-api-versions"
+        expression: "object.apiVersion in ['storage.k8s.io/v1beta1']"
+    validate:
+      cel:
+        expressions:
+          - expression: "false"
+            messageExpression: >-
+              object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.27.
+              See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
+  - name: validate-v1-29-removals
+    match:
+      any:
+      - resources:
+          kinds:
+          - flowcontrol.apiserver.k8s.io/*/FlowSchema
+          - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration
+    celPreconditions:
+      - name: "object.apiVersion"
+        expression: "object.apiVersion in ['flowcontrol.apiserver.k8s.io/v1beta2']"
+    validate:
+      cel:
+        expressions:
+          - expression: "false"
+            messageExpression: >-
+              object.apiVersion + '/' + object.kind + ' is deprecated and will be removed in v1.29.
+              See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/'
+