Pods with large terminationGracePeriodSeconds (tGPS) might prevent cluster nodes from getting drained, ultimately making the whole cluster unstable. This policy mutates all incoming Pods to set their tGPS under 50s. If the user creates a pod without specifying tGPS, then the Kubernetes default of 30s is maintained.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: mutate-termination-grace-period-secondsannotations:policies.kyverno.io/title: Mutate termination Grace Periods Secondspolicies.kyverno.io/category: Samplepolicies.kyverno.io/severity: mediumkyverno.io/kyverno-version: 1.6.2policies.kyverno.io/minversion: 1.6.0kyverno.io/kubernetes-version: "1.23"policies.kyverno.io/subject: Podpolicies.kyverno.io/description: Pods with large terminationGracePeriodSeconds (tGPS) might prevent cluster nodes from getting drained, ultimately making the whole cluster unstable. This policy mutates all incoming Pods to set their tGPS under 50s. If the user creates a pod without specifying tGPS, then the Kubernetes default of 30s is maintained.spec:background: falserules:- name: mutate-termination-grace-period-secondsmatch:any:- resources:kinds:- Podpreconditions:all:- key: "{{request.object.spec.terminationGracePeriodSeconds || `0` }}"operator: GreaterThanvalue: 50mutate:patchStrategicMerge:spec:terminationGracePeriodSeconds: 50
The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.
Tiller, found in Helm v2, has known security challenges. It requires administrative privileges and acts as a shared resource accessible to any authenticated user. Tiller can lead to privilege escalation as restricted users can impact other users. It is recommended to use Helm v3+ which does not contain Tiller for these reasons. This policy validates that there is not an image containing the name `tiller`.
The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.