27 lines
1.1 KiB
YAML
27 lines
1.1 KiB
YAML
apiVersion: kyverno.io/v2
|
|
kind: ClusterCleanupPolicy
|
|
metadata:
|
|
name: clean-bare-pods
|
|
annotations:
|
|
policies.kyverno.io/title: Cleanup Bare Pods
|
|
policies.kyverno.io/category: Other
|
|
policies.kyverno.io/severity: medium
|
|
policies.kyverno.io/subject: Pod
|
|
kyverno.io/kyverno-version: 1.11.1
|
|
policies.kyverno.io/minversion: 1.10.0
|
|
pod-policies.kyverno.io/autogen-controllers: none
|
|
kyverno.io/kubernetes-version: "1.27"
|
|
policies.kyverno.io/description: A bare Pod is any Pod created directly and not owned by a controller such as a Deployment or Job. Bare Pods are often create manually by users in an attempt to troubleshoot an issue. If left in the cluster, they create clutter, increase cost, and can be a security risk. Bare Pods can be cleaned up periodically through use of a policy. This policy finds and removes all bare Pods across the cluster.
|
|
spec:
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
conditions:
|
|
all:
|
|
- key: "{{ target.metadata.ownerReferences[] || `[]` }}"
|
|
operator: Equals
|
|
value: []
|
|
schedule: "*/5 * * * *"
|