Back to Policies

Validate Probes in ValidatingPolicy

Liveness and readiness probes accomplish different goals, and setting both to the same is an anti-pattern and often results in app problems in the future. This policy checks that liveness and readiness probes are not equal. Keep in mind that if both the probes are not set, they are considered to be equal and hence fails the check.

View on GitHub

Policy Definition

apiVersion: policies.kyverno.io/v1alpha1
kind: ValidatingPolicy
metadata:
name: validate-probes
annotations:
policies.kyverno.io/title: Validate Probes in ValidatingPolicy
policies.kyverno.io/category: Sample in Vpol
policies.kyverno.io/severity: medium
policies.kyverno.io/minversion: 1.14.0
kyverno.io/kubernetes-version: "1.30"
policies.kyverno.io/subject: Pod
policies.kyverno.io/description: Liveness and readiness probes accomplish different goals, and setting both to the same is an anti-pattern and often results in app problems in the future. This policy checks that liveness and readiness probes are not equal. Keep in mind that if both the probes are not set, they are considered to be equal and hence fails the check.
spec:
validationActions:
- Audit
autogen:
podControllers:
controllers: []
evaluation:
background:
enabled: false
matchConstraints:
resourceRules:
- apiGroups:
- apps
apiVersions:
- v1
resources:
- deployments
- daemonsets
- statefulsets
operations:
- CREATE
- UPDATE
validations:
- expression: "!object.spec.template.spec.containers.exists(container, has(container.readinessProbe) && has(container.livenessProbe) && container.readinessProbe == container.livenessProbe)"
message: Liveness and readiness probes cannot be the same.

Related Policies