A PodDisruptionBudget which sets its maxUnavailable value to zero prevents all voluntary evictions including Node drains which may impact maintenance tasks. This policy enforces that if a PodDisruptionBudget specifies the maxUnavailable field it must be greater than zero.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: pdb-maxunavailableannotations:policies.kyverno.io/title: PodDisruptionBudget maxUnavailable Non-Zeropolicies.kyverno.io/category: Otherkyverno.io/kyverno-version: 1.9.0kyverno.io/kubernetes-version: "1.24"policies.kyverno.io/subject: PodDisruptionBudgetpolicies.kyverno.io/description: A PodDisruptionBudget which sets its maxUnavailable value to zero prevents all voluntary evictions including Node drains which may impact maintenance tasks. This policy enforces that if a PodDisruptionBudget specifies the maxUnavailable field it must be greater than zero.spec:validationFailureAction: Auditbackground: falserules:- name: pdb-maxunavailablematch:any:- resources:kinds:- PodDisruptionBudgetvalidate:message: The value of maxUnavailable must be greater than zero.pattern:spec:"=(maxUnavailable)": ">0"
This policy performs some best practices validation on Application fields. Path or chart must be specified but never both. And destination.name or destination.server must be specified but never both.
This policy prevents the use of the default project in an Application.
This policy prevents updates to the project field after an Application is created.