https://github.com/redhat-cop/rego-policies/blob/master/POLICIES.md#rhcop-ocp_bestpract-00021-pod-replica-below-1 The above link is the rego policy for pod replica below one.
I created constrainttemplate.yaml and constraint.yaml for podreplicabelowone rego policy
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
name: podreplicasbelowone
spec:
crd:
spec:
names:
kind: PodReplicasBelowOne
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package ocp.bestpractices.pod_replicas_below_one
violation[{"msg": msg}] {
openshift.is_policy_active("RHCOP-OCP_BESTPRACT-00021")
openshift.pod
replicas := konstraint_core.resource.spec.replicas
replicas <= 1
msg := konstraint_core.format_with_id(sprintf("%s/%s: replicas is %d - expected replicas to be greater than 1 for HA guarantees.", [konstraint_core.kind, konstraint_core.name, replicas]), "RHCOP-OCP_BESTPRACT-00021")
}
below is the constraint.yaml for podreplicasbelowone
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: PodReplicasBelowOne
metadata:
name: podreplicasbelowone
spec:
match:
kinds:
- apiGroups: [""]
kinds: ["Pod"]
I applied constrainttemplate and constraint.yaml
nny@nn:~/Documents/new/podreplica$ kubectl apply -f template.yaml
constrainttemplate.templates.gatekeeper.sh/podreplicasbelowone created
nny@nn:~/Documents/new/podreplica$ kubectl apply -f constraint.yaml
error: unable to recognize "constraint.yaml": no matches for kind "PodReplicasBelowOne" in version "constraints.gatekeeper.sh/v1beta1"
why it is showing this error? Are the above two yaml files are correct? What i need to change? What i need to specify in example.yaml so that it shows violations for the rego policy?