best-practices+karpenter+other: Enhance policies by iterating over all container types

best-practices/require-probes/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ readme: |
 annotations:
  kyverno/category: "Best Practices, EKS Best Practices"
  kyverno/subject: "Pod"
-digest: 8160370e07d5daa9a9ff342cc1c923015cadd3101e837f47af6fe2361e69993a
+digest: 69812a72c0862c71b4d384a2bf048ebda4b46a72fece31ac90bc62605d7c91ab

best-practices/require-probes/require-probes.yaml

@@ -36,7 +36,7 @@ spec:
  validate:
  message: "Liveness, readiness, or startup probes are required for all containers."
  foreach:
- - list: request.object.spec.containers[]
+ - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
  deny:
  conditions:
  all:

karpenter/set-karpenter-non-cpu-limits/artifacthub-pkg.yml

@@ -24,4 +24,4 @@ annotations:
  kyverno/category: "Karpenter, EKS Best Practices"
  kyverno/kubernetesVersion: "1.26"
  kyverno/subject: "Pod"
-digest: 93d84f8ba71d2bf87cb84d4174962cc50ecd0b0f9bb29f6fccb8a8a41d11b500
+digest: f1e76f16a57f31b55584f2dbd59caa7030d986efb80790147c9810e657840ea4

karpenter/set-karpenter-non-cpu-limits/set-karpenter-non-cpu-limits.yaml

@@ -25,7 +25,7 @@ spec:
  - Pod
  mutate:
  foreach:
- - list: request.object.spec.containers
+ - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
  patchStrategicMerge:
  spec:
  containers:
@@ -43,7 +43,7 @@ spec:
  - Pod
  mutate:
  foreach:
- - list: request.object.spec.containers
+ - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
  patchStrategicMerge:
  spec:
  containers:

other/add-certificates-volume/add-certificates-volume.yaml

@@ -36,7 +36,7 @@ spec:
  - UPDATE
  mutate:
  foreach:
- - list: "request.object.spec.containers"
+ - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
  patchStrategicMerge:
  spec:
  containers:

other/add-certificates-volume/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Sample"
  kyverno/kubernetesVersion: "1.21"
  kyverno/subject: "Pod,Volume"
-digest: d0bece92401b5c2c3fe482333fed5c09379d383934cd5bc860e416875a6d6267
+digest: f3ceb66ca299c702a2fbc2d709ff7f82c5a3dd82310b856eb0c3b1d5dab57e5d

other/add-image-as-env-var/add-image-as-env-var.yaml

@@ -26,7 +26,7 @@ spec:
  - Pod
  mutate:
  foreach:
- - list: request.object.spec.containers[]
+ - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
  patchesJson6902: |-
  - op: add
  path: /spec/containers/{{elementIndex}}/env/-

other/add-image-as-env-var/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.26"
  kyverno/subject: "Pod"
-digest: a2c5e16677bc0ff1b228b69256ed3cd374df954122cb3c1ef351d36931972136
+digest: 6ed53fcc80991a1d34382e66fe91a5fa5464673b64c4d4c88ce82fdbd010d61d

other/annotate-base-images/annotate-base-images.yaml

@@ -33,7 +33,7 @@ spec:
  value: DELETE
  mutate:
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context:
  - name: imageData
  imageRegistry: 

other/annotate-base-images/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 1aa592a7d3d49643b835c56d97220b9a8728ac3e2160d4be83fbe590db252e9a
+digest: e9660e4bc65e802d8b5be8c4705a9376cdf5686b699c79e363f9e1ec902d0441

other/block-images-with-volumes/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 84345ccd7ae57215dd11b5248f811119d38dcb4648c749146c887ec6c7389940
+digest: b22bdab9f37335fe5f010a4ae44252a77aa4b2f72bb7b39a1b48f103e9a85c54

other/block-images-with-volumes/block-images-with-volumes.yaml

@@ -32,7 +32,7 @@ spec:
  validate:
  message: "Images containing built-in volumes are prohibited."
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context: 
  - name: imageData
  imageRegistry: 

other/block-large-images/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 3137003b33b29c736e18da96eba3c14b707a825053684304fe8a1f68c3fb7b03
+digest: 9b2d29ef8ea57f0da1c868da87866af0d91cbcc5416447e99b0dd581aa580d1c

other/block-large-images/block-large-images.yaml

@@ -32,7 +32,7 @@ spec:
  validate:
  message: "images with size greater than 2Gi not allowed" 
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context: 
  - name: imageSize
  imageRegistry: 

other/block-stale-images/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 8e0fab0441480492ab506e9401eda165e86156c63b8768953386dffe7a0efc6b
+digest: febc775e685b304d83a24be44159ff3c7525d7f7dc2fd1232a8f2c9958be4b2d

other/block-stale-images/block-stale-images.yaml

@@ -26,7 +26,7 @@ spec:
  validate:
  message: "Images built more than 6 months ago are prohibited."
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context:
  - name: imageData
  imageRegistry:

other/check-nvidia-gpu/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: e5286892d05b3b220ed0b9d8cad3ae4c50e2d394678758e3137661ab8c8b5648
+digest: d3b53c4acdf6efa6a3f3c55e62b1bf886c5380e13d01dcf4812577e1a1ae08f0

other/check-nvidia-gpu/check-nvidia-gpu.yaml

@@ -33,7 +33,7 @@ spec:
  validate:
  message: "Images which reserve NVIDIA GPUs must be built to use them."
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context: 
  - name: imageData
  imageRegistry: 

other/deny-commands-in-exec-probe/artifacthub-pkg.yml

@@ -20,4 +20,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.26"
  kyverno/subject: "Pod"
-digest: 3bd86d6873aa7380c01b621c0bfb468a7832ac2d03a5cda4fd8063a432d6d4d1
+digest: 7934e90f438fdb191a5e6a543cd579c938108a15fcc2c1323aed39235f6b7312

other/deny-commands-in-exec-probe/deny-commands-in-exec-probe.yaml

@@ -26,7 +26,7 @@ spec:
  - Pod
  preconditions:
  all:
- - key: "{{ length(request.object.spec.containers[].livenessProbe.exec.command[] || `[]`) }}"
+ - key: "{{ length(request.object.spec.[ephemeralContainers, initContainers, containers][].livenessProbe.exec.command[] || `[]`) }}"
  operator: GreaterThan
  value: 0
  - key: "{{ request.operation }}"
@@ -40,12 +40,12 @@ spec:
  - key:
  - true
  operator: AnyIn
- value: "{{ request.object.spec.containers[].livenessProbe.exec.command[].regex_match('\\bjcmd\\b',@) }}"
+ value: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].livenessProbe.exec.command[].regex_match('\\bjcmd\\b',@) }}"
  - key:
  - true
  operator: AnyIn
- value: "{{ request.object.spec.containers[].livenessProbe.exec.command[].regex_match('\\bps\\b',@) }}"
+ value: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].livenessProbe.exec.command[].regex_match('\\bps\\b',@) }}"
  - key:
  - true
  operator: AnyIn
- value: "{{ request.object.spec.containers[].livenessProbe.exec.command[].regex_match('\\bls\\b',@) }}"
+ value: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][].livenessProbe.exec.command[].regex_match('\\bls\\b',@) }}"

other/enforce-resources-as-ratio/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: cf12c44542d243f69c182ef98ea13d14cf1761268193410cfbac79408c3c060e
+digest: 5dbddbb353688c86721b2f206e02eaf9675e97732c23ba8a488dd4c3342174fd

other/enforce-resources-as-ratio/enforce-resources-as-ratio.yaml

@@ -34,7 +34,7 @@ spec:
  validate:
  message: Limits may not exceed 2.5x the requests.
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  deny:
  conditions:
  any:

other/inject-env-var-from-image-label/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 42f75a6b260b6b537291422dd43cb59492231dd34a4c398b56e13b54fb6d0475
+digest: e24260cbe86905615dd55fe220b69ed6b3b82b911e998b5c7b713b630b92f60b

other/inject-env-var-from-image-label/inject-env-var-from-image-label.yaml

@@ -32,7 +32,7 @@ spec:
  value: DELETE
  mutate:
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context: 
  - name: maintainer
  imageRegistry: 

other/limit-containers-per-pod/artifacthub-pkg.yml

@@ -18,4 +18,4 @@ readme: |
 annotations:
  kyverno/category: "Sample"
  kyverno/subject: "Pod"
-digest: 375b0ea0b5a26365b69af559cbbda54c352e8a13c838fdbbdcb9d3f01b4941e9
+digest: 8818000e91df5bba9115310da780e3cadbe402200aa8309fca49ea54d32afa84

other/limit-containers-per-pod/limit-containers-per-pod.yaml

@@ -35,6 +35,6 @@ spec:
  deny:
  conditions:
  any:
- - key: "{{request.object.spec.containers[] | length(@)}}"
+ - key: "{{request.object.spec.[ephemeralContainers, initContainers, containers][] | length(@)}}"
  operator: GreaterThan
  value: "4"

other/memory-requests-equal-limits/artifacthub-pkg.yml

@@ -18,4 +18,4 @@ readme: |
 annotations:
  kyverno/category: "Sample"
  kyverno/subject: "Pod"
-digest: 634be7d8371928ed519a4576f84751fd423ae3d3e6e9146bb2280910dc8954c5
+digest: f914d76c5f19c1a9bb10edc8fab73472d4813eb600bd4f6ef561b9f21975f068

other/memory-requests-equal-limits/memory-requests-equal-limits.yaml

@@ -27,6 +27,6 @@ spec:
  deny:
  conditions:
  any:
- - key: "{{ request.object.spec.containers[?resources.requests.memory!=resources.limits.memory] | length(@) }}"
- operator: NotEquals
- value: 0
+ - key: "{{ request.object.spec.[ephemeralContainers, initContainers, containers][] | [?resources.requests.memory!=resources.limits.memory] | length(@) }}"
+ operator: GreaterThanOrEquals
+ value: 1

other/only-trustworthy-registries-set-root/artifacthub-pkg.yml

@@ -20,4 +20,4 @@ annotations:
  kyverno/category: "Other, EKS Best Practices"
  kyverno/kubernetesVersion: "1.22-1.23"
  kyverno/subject: "Pod"
-digest: 4543cc84b584a3a39e4e279cb032ce21e6dde1271bde7a55c0c3351ab4db722c
+digest: 38d6e34d41aa7047bfa80e6179a8cd130dd14624abd196417e7eddcadfc330ff

other/only-trustworthy-registries-set-root/only-trustworthy-registries-set-root.yaml

@@ -32,7 +32,7 @@ spec:
  validate:
  message: "Images with root user are not allowed to be pulled from any registry other than ghcr.io." 
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context: 
  - name: imageData
  imageRegistry: 

other/prepend-image-registry/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.21"
  kyverno/subject: "Pod"
-digest: 6325c3d888d0dcba78dcbe2c29f3fe6730addb8c4dda2e3c97b48ff8d3873943
+digest: b87c75b91e96d54d5c6e3356a533295766b37b0175f328d4f2fc703a0def4b38

other/prepend-image-registry/prepend-image-registry.yaml

@@ -64,3 +64,27 @@ spec:
  initContainers:
  - name: "{{ element.name }}" 
  image: registry.io/{{ images.initContainers."{{element.name}}".path}}:{{images.initContainers."{{element.name}}".tag}}
+ - name: prepend-registry-ephemeralContainers
+ match:
+ any:
+ - resources:
+ kinds:
+ - Pod
+ preconditions:
+ all:
+ - key: "{{request.operation || 'BACKGROUND'}}"
+ operator: AnyIn
+ value:
+ - CREATE
+ - UPDATE
+ - key: "{{ request.object.spec.ephemeralContainers[] || '' | length(@) }}"
+ operator: GreaterThanOrEquals
+ value: 1
+ mutate:
+ foreach:
+ - list: "request.object.spec.ephemeralContainers"
+ patchStrategicMerge:
+ spec:
+ ephemeralContainers:
+ - name: "{{ element.name }}"
+ image: registry.io/{{ images.ephemeralContainers."{{element.name}}".path}}:{{images.ephemeralContainers."{{element.name}}".tag}}

other/remove-hostpath-volumes/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.25"
  kyverno/subject: "Pod,Volume"
-digest: ce19781cd972d0f15f3e52a330640d42df9adda5d8cd111ffc2f7b08c8eaf1fd
+digest: 65649a85d2f538961c881f7e97dd492f75b71b1ecbc37b1b2aed2b1b14c992b2

other/remove-hostpath-volumes/remove-hostpath-volumes.yaml

@@ -46,7 +46,7 @@ spec:
  patchesJson6902: |-
  - path: /spec/volumes/{{elementIndex}}
  op: remove
- - list: request.object.spec.containers[]
+ - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
  foreach:
  - list: " element.volumeMounts || `[]` "
  order: Descending

other/remove-serviceaccount-token/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.25"
  kyverno/subject: "Pod,ServiceAccount,Volume"
-digest: d23bd2501b0c893a15d5d956af131fbaa0d25e6278980e3ba6cce9608841bebd
+digest: d45cb1004833009f73346ab46c47bed7f3b4a733b93be43914217defd7002b50

other/remove-serviceaccount-token/remove-serviceaccount-token.yaml

@@ -58,7 +58,7 @@ spec:
  patchesJson6902: |-
  - path: /spec/volumes/{{elementIndex}}
  op: remove
- - list: request.object.spec.containers[]
+ - list: request.object.spec.[ephemeralContainers, initContainers, containers][]
  foreach:
  - list: element.volumeMounts
  order: Descending

other/replace-image-registry-with-harbor/artifacthub-pkg.yml

@@ -31,4 +31,4 @@ annotations:
  kyverno/category: "Sample"
  kyverno/kubernetesVersion: "1.27"
  kyverno/subject: "Pod"
-digest: 8f88cbddbaec89d29c062e6f6c8385b75f46b7d958954e637d686e82e893856c
+digest: 489642fcf09dcc59705fa58848796eafc1fa72be670f98e02b3ae3930f157f1d

other/replace-image-registry-with-harbor/replace-image-registry-with-harbor.yaml

@@ -61,3 +61,18 @@ spec:
  containers:
  - name: "{{ element.name }}"
  image: harbor.example.com/k8s/{{imageData.repository}}:{{imageData.identifier}}
+ - list: request.object.spec.ephemeralContainers[]
+ context:
+ - name: imageData
+ imageRegistry:
+ reference: "{{ element.image }}"
+ preconditions:
+ any:
+ - key: "{{imageData.registry}}"
+ operator: Equals
+ value: index.docker.io
+ patchStrategicMerge:
+ spec:
+ containers:
+ - name: "{{ element.name }}"
+ image: harbor.example.com/k8s/{{imageData.repository}}:{{imageData.identifier}}

other/replace-image-registry/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Sample"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 9fde3b8caba3a05c5534b588fcd794975b8c1016004fa4ffdfb5bc4e93997e58
+digest: 72ee2c8a17b7232ac21bec317971add1383781c1227f18d279289a10771a7011

other/replace-image-registry/replace-image-registry.yaml

@@ -57,3 +57,22 @@ spec:
  initContainers:
  - name: "{{ element.name }}"
  image: "{{ regex_replace_all('^(localhost/|(?:[a-z0-9]+\\.)+[a-z0-9]+/)?(.*)$', '{{element.image}}', 'myregistry.corp.com/$2' )}}"
+ - name: replace-image-registry-pod-ephemeralContainers
+ match:
+ any:
+ - resources:
+ kinds:
+ - Pod
+ preconditions:
+ all:
+ - key: "{{ request.object.spec.ephemeralContainers[] || `[]` | length(@) }}"
+ operator: GreaterThanOrEquals
+ value: 1
+ mutate:
+ foreach:
+ - list: "request.object.spec.ephemeralContainers"
+ patchStrategicMerge:
+ spec:
+ initContainers:
+ - name: "{{ element.name }}"
+ image: "{{ regex_replace_all('^(localhost/|(?:[a-z0-9]+\\.)+[a-z0-9]+/)?(.*)$', '{{element.image}}', 'myregistry.corp.com/$2' )}}"

other/require-base-image/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other, EKS Best Practices"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 23dcc8f9a56d36ceb6f45b8c7e76b450472e5c22a4a701bea37c25c8df68984e
+digest: 36ec28f78945a75ab650893cd252c2fdb80d4893bf6c340d4b68dca41e69d41d

other/require-base-image/require-base-image.yaml

@@ -37,7 +37,7 @@ spec:
  validate:
  message: "Images must specify a source/base image from which they are built."
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context: 
  - name: imageData
  imageRegistry: 

other/require-image-source/artifacthub-pkg.yml

@@ -19,4 +19,4 @@ annotations:
  kyverno/category: "Other"
  kyverno/kubernetesVersion: "1.23"
  kyverno/subject: "Pod"
-digest: 439869ce881c7a4eea43180435dad9eb03c5c9c2cfae470822de7b988b2da514
+digest: bf8c40ca9999ad6c800c655264acb28313da5e8bd64476b3599e79c5ab410fd7

other/require-image-source/require-image-source.yaml

@@ -34,7 +34,7 @@ spec:
  validate:
  message: "The image source must be specified in a label or annotation."
  foreach:
- - list: "request.object.spec.containers"
+ - list: "request.object.spec.[ephemeralContainers, initContainers, containers][]"
  context: 
  - name: imageData
  imageRegistry: