We currently have two Kubewarden Admission policies that can be useful to the runtime-enforcer users.
It would be great to have docs introducing them to our users.
Prevent scheduling of non-protected workloads
As an administrator, I want to prevent the scheduling of workloads inside of the cluster that are not protected by a WorkloadPolicy.
To achieve that, the administrator can deploy the labels policy of Kubewarden.
The policy can validate both high-order resources (like Deployment, StatefulSet) and low level Pods. It can be applied to the entire cluster, or it could be configured to ignore certain namespaces (like kube-system) or to be enforced only inside of specific namespaces (using namespaceSelector).
Prevent scheduling of workloads that are referencing a non-existing WorkloadPolicy
As an administrator, I want to prevent the scheduling of workloads that are referencing a WorkloadPolicy that doesn't exist.
This can be done using this policy.
Warning: currently the policy is not published by Kubewarden. We will ask the team to do that.
We currently have two Kubewarden Admission policies that can be useful to the runtime-enforcer users.
It would be great to have docs introducing them to our users.
Prevent scheduling of non-protected workloads
As an administrator, I want to prevent the scheduling of workloads inside of the cluster that are not protected by a WorkloadPolicy.
To achieve that, the administrator can deploy the labels policy of Kubewarden.
The policy can validate both high-order resources (like Deployment, StatefulSet) and low level Pods. It can be applied to the entire cluster, or it could be configured to ignore certain namespaces (like
kube-system) or to be enforced only inside of specific namespaces (usingnamespaceSelector).Prevent scheduling of workloads that are referencing a non-existing WorkloadPolicy
As an administrator, I want to prevent the scheduling of workloads that are referencing a WorkloadPolicy that doesn't exist.
This can be done using this policy.
Warning: currently the policy is not published by Kubewarden. We will ask the team to do that.