Skip to content

Commit 0b54638

Browse files
raks-ttrrajashe
raks-tt
and
rrajashe
authored
Enable cost-management in stone-prod-p01 (#9358)
* Apply cost management policies to stone-prod-p01 in prod --------- Co-authored-by: rrajashe <[email protected]>
1 parent db39485 commit 0b54638

21 files changed

+619
-0
lines changed

‎components/policies/production/base/cost-management/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- propagate-cost-management-labels/
5+
- validate-cost-management-labels/

‎components/policies/production/base/cost-management/propagate-cost-management-labels/.chainsaw-test/chainsaw-assert-clusterpolicy.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: propagate-cost-management-labels
5+
status:
6+
conditions:
7+
- reason: Succeeded
8+
status: "True"
9+
type: Ready

‎components/policies/production/base/cost-management/propagate-cost-management-labels/.chainsaw-test/chainsaw-test.yaml‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
apiVersion: chainsaw.kyverno.io/v1alpha1
2+
kind: Test
3+
metadata:
4+
name: label-propagation-valid-cost-center
5+
spec:
6+
concurrent: false
7+
description: |
8+
tests that the labels are correctly set on pods in tenant namespace
9+
that have the `cost-center` label
10+
steps:
11+
- name: Create namespaces for testing
12+
try:
13+
- create:
14+
file: ./resources/namespace-cost-center.yaml
15+
template: true
16+
bindings:
17+
- name: namespace
18+
value: tenant
19+
- name: cost_center
20+
value: "670"
21+
- name: Apply RBAC
22+
try:
23+
- apply:
24+
file: ../kyverno-rbac.yaml
25+
- name: Apply kyverno Cluster Policy and assert it exists
26+
try:
27+
- apply:
28+
file: ../propagate-cost-management-labels.yaml
29+
- assert:
30+
file: chainsaw-assert-clusterpolicy.yaml
31+
template: true
32+
bindings:
33+
- name: cluster_policy_name
34+
value: propagate-cost-management-labels
35+
- name: create pods in tenant
36+
try:
37+
- create:
38+
file: ./resources/pod.yaml
39+
bindings:
40+
- name: namespace
41+
value: tenant
42+
template: true
43+
- name: assert pods in the tenant are labeled
44+
try:
45+
- assert:
46+
file: ./resources/expected-pod-matching.yaml
47+
template: true
48+
bindings:
49+
- name: namespace
50+
value: tenant
51+
- name: cost_center
52+
value: "670"
53+
---
54+
apiVersion: chainsaw.kyverno.io/v1alpha1
55+
kind: Test
56+
metadata:
57+
name: label-not-applied-random-ns
58+
spec:
59+
concurrent: false
60+
description: |
61+
tests that the label is not applied to pods in a non-tenant namespace
62+
steps:
63+
- name: Create namespaces for testing
64+
try:
65+
- create:
66+
file: ./resources/namespace-nonmatching.yaml
67+
- name: Apply RBAC
68+
try:
69+
- apply:
70+
file: ../kyverno-rbac.yaml
71+
- name: Apply kyverno Cluster Policy and assert it exists
72+
try:
73+
- apply:
74+
file: ../propagate-cost-management-labels.yaml
75+
- assert:
76+
file: chainsaw-assert-clusterpolicy.yaml
77+
template: true
78+
bindings:
79+
- name: cluster_policy_name
80+
value: propagate-cost-management-labels
81+
- name: create pods in random-ns
82+
try:
83+
- create:
84+
file: ./resources/pod.yaml
85+
template: true
86+
bindings:
87+
- name: namespace
88+
value: random-ns
89+
- name: assert pods in random-ns are not labeled
90+
try:
91+
- assert:
92+
file: ./resources/pod.yaml
93+
template: true
94+
bindings:
95+
- name: namespace
96+
value: random-ns
97+
---
98+
apiVersion: chainsaw.kyverno.io/v1alpha1
99+
kind: Test
100+
metadata:
101+
name: rule-not-applied-to-rhtap-releng-tenant
102+
spec:
103+
concurrent: false
104+
description: |
105+
Tests that the Kyverno policy does not apply to pods in managed tenant namespaces.
106+
steps:
107+
- name: Create a managed namespace
108+
try:
109+
- create:
110+
file: ./resources/namespace-no-cost-center.yaml
111+
template: true
112+
bindings:
113+
- name: namespace
114+
value: rhtap-releng-tenant
115+
- name: Apply RBAC
116+
try:
117+
- apply:
118+
file: ../kyverno-rbac.yaml
119+
- name: Apply Kyverno Cluster Policy and assert it exists
120+
try:
121+
- apply:
122+
file: ../propagate-cost-management-labels.yaml
123+
- assert:
124+
file: chainsaw-assert-clusterpolicy.yaml
125+
template: true
126+
bindings:
127+
- name: cluster_policy_name
128+
value: propagate-cost-management-labels
129+
- name: Create a pod in the namespace
130+
try:
131+
- create:
132+
file: ./resources/pod.yaml
133+
template: true
134+
bindings:
135+
- name: namespace
136+
value: rhtap-releng-tenant
137+
- name: Assert pod in namespace is not labeled
138+
try:
139+
- assert:
140+
resource:
141+
apiVersion: v1
142+
kind: Pod
143+
metadata:
144+
name: demo-pod
145+
namespace: rhtap-releng-tenant
146+
labels: {}
147+
---
148+
apiVersion: chainsaw.kyverno.io/v1alpha1
149+
kind: Test
150+
metadata:
151+
name: create-pod-in-tenant-namespace-without-cost-center
152+
spec:
153+
concurrent: false
154+
description: |
155+
Tests that it is possible to create a pod in an existing tenant namespace
156+
that does not have the `cost-center` label.
157+
steps:
158+
- name: Create a tenant namespace without cost-center label
159+
try:
160+
- create:
161+
file: ./resources/namespace-no-cost-center.yaml
162+
template: true
163+
bindings:
164+
- name: namespace
165+
value: tenant-no-cost-center
166+
- name: Apply RBAC
167+
try:
168+
- apply:
169+
file: ../kyverno-rbac.yaml
170+
- name: Apply Kyverno Cluster Policy and assert it exists
171+
try:
172+
- apply:
173+
file: ../propagate-cost-management-labels.yaml
174+
- assert:
175+
file: chainsaw-assert-clusterpolicy.yaml
176+
template: true
177+
bindings:
178+
- name: cluster_policy_name
179+
value: propagate-cost-management-labels
180+
- name: Create a pod in the tenant namespace without cost-center label
181+
try:
182+
- create:
183+
file: ./resources/pod.yaml
184+
template: true
185+
bindings:
186+
- name: namespace
187+
value: tenant-no-cost-center
188+
- name: Assert pod in tenant namespace is created successfully
189+
try:
190+
- assert:
191+
file: ./resources/pod.yaml
192+
template: true
193+
bindings:
194+
- name: namespace
195+
value: tenant-no-cost-center

‎components/policies/production/base/cost-management/propagate-cost-management-labels/.chainsaw-test/resources/expected-pod-matching.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: demo-pod
5+
namespace: ($namespace)
6+
labels:
7+
cost-center: ($cost_center)
8+
cost_management_optimizations: "true"

‎components/policies/production/base/cost-management/propagate-cost-management-labels/.chainsaw-test/resources/namespace-cost-center.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: ($namespace)
5+
labels:
6+
konflux-ci.dev/type: tenant
7+
cost-center: ($cost_center)
8+
cost_management_optimizations: "true"

‎components/policies/production/base/cost-management/propagate-cost-management-labels/.chainsaw-test/resources/namespace-no-cost-center.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: ($namespace)
5+
labels:
6+
konflux-ci.dev/type: tenant

‎components/policies/production/base/cost-management/propagate-cost-management-labels/.chainsaw-test/resources/namespace-nonmatching.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: random-ns

‎components/policies/production/base/cost-management/propagate-cost-management-labels/.chainsaw-test/resources/pod.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: demo-pod
5+
namespace: ($namespace)
6+
labels:
7+
app: test-app
8+
spec:
9+
containers:
10+
- name: test-container
11+
image: nginx

‎components/policies/production/base/cost-management/propagate-cost-management-labels/kustomization.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- propagate-cost-management-labels.yaml
5+
- kyverno-rbac.yaml

‎components/policies/production/base/cost-management/propagate-cost-management-labels/kyverno-rbac.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: kyverno-admission-propagate-cost-management-labels
6+
labels:
7+
rbac.kyverno.io/aggregate-to-admission-controller: "true"
8+
rules:
9+
- apiGroups:
10+
- ""
11+
resources:
12+
- pods
13+
- namespaces
14+
verbs:
15+
- list
16+
- get

0 commit comments

Comments
 (0)