{"id":47268,"date":"2023-03-25T22:35:23","date_gmt":"2023-03-04T14:31:55","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/"},"modified":"2024-04-29T20:31:24","modified_gmt":"2024-04-29T12:31:24","slug":"%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/","title":{"rendered":"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno"},"content":{"rendered":"<h1>\u5173\u4e8e\u8fd9\u7bc7\u6587\u7ae0<\/h1>\n<p>\u6211\u5728\u4e1a\u52a1\u4e2d\u4f7f\u7528Kyverno\uff0c\u4f46\u53ea\u4f7f\u7528\u4e86\u90e8\u5206\u529f\u80fd\uff0c\u5c1a\u672a\u5b8c\u5168\u638c\u63e1\u6240\u6709\u529f\u80fd\uff0c\u56e0\u6b64\u6211\u6b63\u5728\u64b0\u5199\u8fd9\u7bc7\u6587\u7ae0\u8fdb\u884c\u8c03\u67e5\u3002<\/p>\n<h1>Kyverno\u662f\u4ec0\u4e48\uff1f<\/h1>\n<p>Kyverno\u662f\u4e13\u4e3aKubernetes\u8bbe\u8ba1\u7684\u7b56\u7565\u5f15\u64ce\u3002\u7b56\u7565\u6307\u7684\u662f\u5728\u521b\u5efak8s\u8d44\u6e90\u65f6\u7684\u89c4\u5219\u3002\u4f8b\u5982&#8230;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">Pod\u306b\u306f\u5fc5\u305a\u25cb\u25cb\u3068\u3044\u3046Label\u304c\u3064\u3044\u3066\u3044\u306a\u3044\u3068\u3044\u3051\u306a\u3044<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">latest\u30bf\u30b0\u306e\u5229\u7528\u7981\u6b62<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\u306a\u3069\u306a\u3069<\/ul>\n<p>\u6211\u8ba4\u4e3a\u4e0eOpenPolicyAgent\u76f8\u6bd4\u7684\u4e00\u4e2a\u91cd\u5927\u533a\u522b\u662f\u53ef\u4ee5\u4e0d\u4f7f\u7528\u50cfRego\u8fd9\u6837\u7684\u7279\u6b8a\u8bed\u8a00\u6765\u5b9a\u4e49\u7b56\u7565\u3002<\/p>\n<h2>Kyverno\u7684\u529f\u80fd<\/h2>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u30ea\u30bd\u30fc\u30b9\u304c\u65b0\u898f\u4f5c\u6210\u3055\u308c\u305f\u969b\u306b\u5225\u306e\u30ea\u30bd\u30fc\u30b9\u3092\u65b0\u898f\u4f5c\u6210\u3067\u304d\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">\u30ea\u30bd\u30fc\u30b9\u304c\u65b0\u898f\u4f5c\u6210\u30fb\u66f4\u65b0\u3055\u308c\u305f\u969b\u306b\u30d1\u30c3\u30c1\u3092\u5f53\u3066\u3089\u308c\u308b<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<ul class=\"post-ul\">\u30ea\u30bd\u30fc\u30b9\u306e\u4f5c\u6210\u3055\u308c\u305f\u969b\u306b\u3001\u30dd\u30ea\u30b7\u30fc\u306b\u5247\u3063\u3066\u308b\u304b\u691c\u8a3c\u3057\u3001\u4f5c\u6210\u3092\u62d2\u5426\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b<\/ul>\n<p>\u6211\u60f3\u8981\u5206\u522b\u4f53\u9a8c\u8fd9\u4e9b\u529f\u80fd\uff01<\/p>\n<h1>\u5b89\u88c5<\/h1>\n<p>\u7531\u65bcManifest\u5728GitHub\u4e0a\u5df2\u6e96\u5099\u597d\uff0c\u6211\u5011\u5c07\u4f7f\u7528\u5b83\u3002<br \/>\n\u9806\u4fbf\u4e00\u63d0\uff0c\u6211\u5011\u5c07\u4f7f\u7528Kyverno\u7684\u7248\u672c\u70bav1.4.1\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl apply <span class=\"nt\">-f<\/span> https:\/\/raw.githubusercontent.com\/kyverno\/kyverno\/v1.4.1\/definitions\/install.yaml\r\n<\/code><\/pre>\n<h1>\u78b0\u4e00\u4e0b\u8bd5\u8bd5<\/h1>\n<h2>\u4ea7\u751f\u8d44\u6e90<\/h2>\n<p>Generate Resources\u662f\u4e00\u4e2a\u529f\u80fd\uff0c\u7528\u4e8e\u5728\u521b\u5efa\u6216\u66f4\u65b0\u8d44\u6e90\u65f6\u89e6\u53d1\u521b\u5efa\u65b0\u8d44\u6e90\u3002\u60a8\u53ef\u4ee5\u5728\u6b64\u94fe\u63a5\u4e2d\u4e86\u89e3\u66f4\u591a\u4fe1\u606f\uff1ahttps:\/\/kyverno.io\/docs\/writing-policies\/generate\/<\/p>\n<p>\u5148\u8bd5\u8bd5\u770b\u5427\uff01<\/p>\n<p>\u6211\u8ba4\u4e3a\u5728\u4e0d\u540c\u7684\u547d\u540d\u7a7a\u95f4\u4e2d\u53ef\u80fd\u4f1a\u6709\u4f7f\u7528\u76f8\u540c\u7684\u673a\u5bc6\u4fe1\u606f\u7684\u60c5\u51b5\u3002<br \/>\n\u4e3a\u4e86\u5e94\u5bf9\u8fd9\u79cd\u60c5\u51b5\uff0c\u6211\u4f1a\u7f16\u5199\u4e00\u4e2a\u7b56\u7565\uff0c\u5f53\u547d\u540d\u7a7a\u95f4\u88ab\u521b\u5efa\u65f6\uff0c\u53ef\u4ee5\u62f7\u8d1d\u5df2\u5b58\u5728\u7684\u673a\u5bc6\u4fe1\u606f\u3002<\/p>\n<p>\u9996\u5148\uff0c\u5728\u9ed8\u8ba4\u547d\u540d\u7a7a\u95f4\u4e2d\u521b\u5efa\u4f5c\u4e3a\u6e90\u7684\u79d8\u5bc6\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Secret<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sample-secret<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">default<\/span>\r\n<span class=\"na\">type<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Opaque<\/span>\r\n<span class=\"na\">data<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">password<\/span><span class=\"pi\">:<\/span> <span class=\"s\">aG9nZQo=<\/span> <span class=\"c1\"># hoge<\/span>\r\n<\/code><\/pre>\n<p>\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u5c06\u5b9a\u4e49\u4e00\u4e2a\u590d\u5236\u6b64Secret\u7684\u7b56\u7565\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">kyverno.io\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ClusterPolicy<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sync-secrets<\/span>\r\n  <span class=\"na\">annotations<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/title<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Sync Secrets<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/category<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Sample<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/subject<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Secret<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/description<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">&gt;-<\/span>\r\n      <span class=\"s\">copy sample secret from default namespace to requested namespace.<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">background<\/span><span class=\"pi\">:<\/span> <span class=\"no\">false<\/span>\r\n  <span class=\"na\">rules<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sync-sample-secret<\/span>\r\n    <span class=\"na\">match<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">resources<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">kinds<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">Namespace<\/span>\r\n    <span class=\"na\">generate<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Secret<\/span>\r\n      <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sample-secret<\/span>\r\n      <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">{{request.object.metadata.name}}\"<\/span>\r\n      <span class=\"na\">synchronize<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">clone<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">default<\/span>\r\n        <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sample-secret<\/span>\r\n<\/code><\/pre>\n<p>\u8ba9\u6211\u4eec\u521b\u5efa\u4e00\u4e2a\u547d\u540d\u7a7a\u95f4\u5e76\u8fdb\u884c\u64cd\u4f5c\u4ee5\u786e\u8ba4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl create namespace <span class=\"nb\">test\r\n<\/span>namespace\/test created\r\n\r\n<span class=\"c\"># \u95a2\u4fc2\u3042\u308b\u3068\u3053\u308d\u3060\u3051\u629c\u7c8b<\/span>\r\n<span class=\"nv\">$ <\/span>kubectl get secret sample-secret <span class=\"nt\">-o<\/span> yaml <span class=\"nt\">-n<\/span> <span class=\"nb\">test\r\n<\/span>apiVersion: v1\r\ndata:\r\n  password: <span class=\"nv\">aG9nZQo<\/span><span class=\"o\">=<\/span>\r\nkind: Secret\r\nmetadata:\r\n  name: sample-secret\r\n  namespace: <span class=\"nb\">test\r\ntype<\/span>: Opaque\r\n<\/code><\/pre>\n<p>\u6240\u4ee5\uff0c\u6211\u6210\u529f\u5730\u505a\u5230\u4e86\u6211\u60f3\u505a\u7684\u4e8b\u60c5\u3002<\/p>\n<h3>\u6709\u7591\u554f<\/h3>\n<p>\u6211\u4f1a\u5199\u4e0b\u5c1d\u8bd5\u540e\u51fa\u73b0\u7684\u7591\u95ee\u548c\u5bf9\u5e94\u7684\u7b54\u6848\u3002<\/p>\n<h4>spec.rules.generate.synchronize\u662f\u4ec0\u4e48\u610f\u601d\uff1f<\/h4>\n<p>\u5728\u8fd9\u4e2a\u793a\u4f8b\u4e2d\uff0c\u6211\u4eec\u8bbe\u7f6e\u4e86 synchronize: true\u3002\u8fd9\u5177\u4f53\u610f\u5473\u7740\u4ec0\u4e48\u5462\uff1f<\/p>\n<p>\u5982\u679c\u8d44\u6e90\u662f\u901a\u8fc7\u590d\u5236\u521b\u5efa\u7684\uff0c\u90a3\u4e48\u65e0\u6cd5\u8fdb\u884c\u6e90\u4ee3\u7801\u7ba1\u7406\u3002\u5982\u679c\u4f7f\u7528Yaml\u5b9a\u4e49\u6e05\u5355\u5e76\u5728Git\u4e2d\u8fdb\u884c\u7ba1\u7406\uff0c\u5e76\u4f7f\u7528GitOps\uff0c\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0c\u53ef\u4ee5\u76f4\u63a5\u7f16\u8f91\u8fd9\u4e9b\u8d44\u6e90\u3002\u4e3a\u4e86\u9632\u6b62\u8fd9\u79cd\u60c5\u51b5\uff0c\u5c06synchronize\u8bbe\u7f6e\u4e3atrue\uff0c\u4ee5\u4fbf\u4e0e\u590d\u5236\u7684\u8d44\u6e90\u8fdb\u884c\u540c\u6b65\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\"># \u30b3\u30d4\u30fc\u3057\u305fSecret\u30ea\u30bd\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u90e8\u5206\u5909\u66f4<\/span>\r\n<span class=\"nv\">$ <\/span>k edit secret sample-secret <span class=\"nt\">-n<\/span> <span class=\"nb\">test\r\n<\/span>secret\/sample-secret edited\r\n\r\n<span class=\"c\"># \u30b3\u30d4\u30fc\u5143<\/span>\r\n<span class=\"nv\">$ <\/span>k get secret sample-secret <span class=\"nt\">-o<\/span> yaml <span class=\"nt\">-n<\/span> default | <span class=\"nb\">grep <\/span>password | <span class=\"nb\">head<\/span> <span class=\"nt\">-1<\/span>\r\n  password: <span class=\"nv\">aG9nZQo<\/span><span class=\"o\">=<\/span>\r\n\r\n<span class=\"c\"># \u30b3\u30d4\u30fc\u5148\u3002edit\u3067\u66f4\u65b0\u3057\u305f\u306e\u306b\u5143\u306b\u623b\u3063\u3066\u308b<\/span>\r\n<span class=\"nv\">$ <\/span>k get secret sample-secret <span class=\"nt\">-o<\/span> yaml <span class=\"nt\">-n<\/span> <span class=\"nb\">test<\/span> | <span class=\"nb\">grep <\/span>password | <span class=\"nb\">head<\/span> <span class=\"nt\">-1<\/span>\r\n  password: <span class=\"nv\">aG9nZQo<\/span><span class=\"o\">=<\/span>\r\n<\/code><\/pre>\n<p>\u73b0\u5728\uff0c\u521a\u624d\u6211\u4eec\u5c1d\u8bd5\u7f16\u8f91\u4e86\u590d\u5236\u7684\u5185\u5bb9\uff0c\u90a3\u4e48\u5982\u679c\u6211\u4eec\u7f16\u8f91\u539f\u59cb\u5185\u5bb9\u4f1a\u53d1\u751f\u4ec0\u4e48\u5462\uff1f<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\"># \u30b3\u30d4\u30fc\u5143\u306eSecret\u30ea\u30bd\u30fc\u30b9\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u90e8\u5206\u5909\u66f4<\/span>\r\n<span class=\"nv\">$ <\/span>k edit secret sample-secret <span class=\"nt\">-n<\/span> default\r\nsecret\/sample-secret edited\r\n\r\n<span class=\"c\"># \u30b3\u30d4\u30fc\u5143<\/span>\r\n<span class=\"nv\">$ <\/span>k get secret sample-secret <span class=\"nt\">-o<\/span> yaml <span class=\"nt\">-n<\/span> default | <span class=\"nb\">grep <\/span>password | <span class=\"nb\">head<\/span> <span class=\"nt\">-1<\/span>\r\n  password: <span class=\"nv\">YWFhCg<\/span><span class=\"o\">==<\/span>\r\n\r\n<span class=\"c\"># \u30b3\u30d4\u30fc\u5148<\/span>\r\n<span class=\"nv\">$ <\/span>k get secret sample-secret <span class=\"nt\">-o<\/span> yaml <span class=\"nt\">-n<\/span> <span class=\"nb\">test<\/span> | <span class=\"nb\">grep <\/span>password | <span class=\"nb\">head<\/span> <span class=\"nt\">-1<\/span>\r\n  password: <span class=\"nv\">YWFhCg<\/span><span class=\"o\">==<\/span>\r\n<\/code><\/pre>\n<p>\u8fd9\u4e2a\u4e5f\u4f1a\u4e0e\u4e4b\u540c\u6b65\u3002\u5f88\u65b9\u4fbf\uff01<\/p>\n<h4>\u9664\u4e86\u514b\u9686\uff08Clone\uff09\u4e4b\u5916\uff0c\u8fd8\u6709\u54ea\u4e9b\u9009\u9879\u53ef\u4f9b\u9009\u62e9\uff1f<\/h4>\n<p>\u8fd9\u6b21\u6211\u4eec\u4f7f\u7528\u4e86\u514b\u9686\u529f\u80fd\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">clone<\/span><span class=\"pi\">:<\/span>\r\n   <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">default<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sample-secret<\/span>\r\n<\/code><\/pre>\n<p>\u8fd8\u53ef\u4ee5\u76f4\u63a5\u6309\u7167\u58f0\u660e\u7684\u5b9a\u4e49\u8fdb\u884c\u4e66\u5199\u3002<\/p>\n<pre class=\"post-pre\"><code>    <span class=\"na\">generate<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">synchronize<\/span><span class=\"pi\">:<\/span> <span class=\"no\">true<\/span>\r\n      <span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ConfigMap<\/span>\r\n      <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">zk-kafka-address<\/span>\r\n      <span class=\"c1\"># generate the resource in the new namespace<\/span>\r\n      <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">{{request.object.metadata.name}}\"<\/span>\r\n      <span class=\"na\">data<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ConfigMap<\/span>\r\n        <span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n          <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n            <span class=\"na\">somekey<\/span><span class=\"pi\">:<\/span> <span class=\"s\">somevalue<\/span>\r\n        <span class=\"na\">data<\/span><span class=\"pi\">:<\/span>\r\n          <span class=\"na\">ZK_ADDRESS<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">192.168.10.10:2181,192.168.10.11:2181,192.168.10.12:2181\"<\/span>\r\n          <span class=\"na\">KAFKA_ADDRESS<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">192.168.10.13:9092,192.168.10.14:9092,192.168.10.15:9092\"<\/span>\r\n<\/code><\/pre>\n<h2>\u8d44\u6e90\u53d8\u5f02<\/h2>\n<p>Mutate Resources\u662f\u4e00\u79cd\u9488\u5bf9\u5339\u914d\u8d44\u6e90\u5e94\u7528\u4fee\u8865\u7a0b\u5e8f\u7684\u529f\u80fd\u3002<\/p>\n<p>\u6211\u60f3\u5217\u4e3e\u4e00\u4e9b\u9009\u9879\uff1a<br \/>\n1. \u6211\u6253\u7b97\u7ee7\u7eed\u63a2\u8ba8\u4e0b\u53bb\u3002<br \/>\n2. \u8fd9\u6b21\u6211\u4eec\u5047\u8bbe\u7684\u573a\u666f\u662f\u5e0c\u671b\u5728\u4e00\u4e2a\u547d\u540d\u7a7a\u95f4\u7684Pod\u4e0b\u5fc5\u987b\u52a0\u8f7d\u4e00\u4e2a\u516c\u5171\u7684ConfigMap\u3002<\/p>\n<p>\u9996\u5148\uff0c\u6211\u4eec\u521b\u5efa\u4e00\u4e2a\u547d\u540d\u7a7a\u95f4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl create namespace test2\r\nnamespace\/test2 created\r\n<\/code><\/pre>\n<p>\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u5c06\u521b\u5efa\u4e00\u4e2a\u8981\u52a0\u8f7d\u7684ConfigMap\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ConfigMap<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sample-configmap<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">test2<\/span>\r\n<span class=\"na\">data<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">environment_name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">staging<\/span>\r\n<\/code><\/pre>\n<p>\u6211\u4eec\u9700\u8981\u5199\u4e00\u4e2a\u7b56\u7565\uff0c\u8ba9test2\u4e2d\u7684Pod\u80fd\u591f\u52a0\u8f7d\u4e0a\u8ff0\u7684ConfigMap\u3002\u4f7f\u5f97ConfigMap\u4e2d\u7684\u503c\u53ef\u4ee5\u53d8\u4e3a\u73af\u5883\u53d8\u91cf\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">kyverno.io\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ClusterPolicy<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">add-configmap-policy<\/span>\r\n  <span class=\"na\">annotations<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/title<\/span><span class=\"pi\">:<\/span> <span class=\"s\">add configmap<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/category<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Sample<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/subject<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Pod<\/span>\r\n    <span class=\"s\">policies.kyverno.io\/description<\/span><span class=\"pi\">:<\/span> <span class=\"pi\">&gt;-<\/span>\r\n      <span class=\"s\">Add env to pods which place to test2 namespace.<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">rules<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">Set<\/span> <span class=\"s\">common<\/span> <span class=\"s\">environment<\/span> <span class=\"s\">variables\"<\/span>\r\n    <span class=\"na\">match<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">resources<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">kinds<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">Pod<\/span>\r\n        <span class=\"na\">namespaces<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">test2<\/span>\r\n    <span class=\"na\">mutate<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">overlay<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n          <span class=\"na\">containers<\/span><span class=\"pi\">:<\/span>\r\n          <span class=\"pi\">-<\/span> <span class=\"s\">(name)<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">*\"<\/span>\r\n            <span class=\"na\">env<\/span><span class=\"pi\">:<\/span>\r\n              <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ENVIRONMENT<\/span>\r\n                <span class=\"na\">valueFrom<\/span><span class=\"pi\">:<\/span>\r\n                  <span class=\"na\">configMapKeyRef<\/span><span class=\"pi\">:<\/span>\r\n                    <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">sample-configmap<\/span>\r\n                    <span class=\"na\">key<\/span><span class=\"pi\">:<\/span> <span class=\"s\">environment_name<\/span>\r\n<\/code><\/pre>\n<p>\u6700\u7ec8\uff0c\u5c06\u521b\u5efa\u7528\u4e8e\u6d4b\u8bd5\u7684\u90e8\u7f72\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">apps\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">Deployment<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">test-deployment<\/span>\r\n  <span class=\"na\">namespace<\/span><span class=\"pi\">:<\/span> <span class=\"s\">test2<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">selector<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">matchLabels<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">app<\/span><span class=\"pi\">:<\/span> <span class=\"s\">test<\/span>\r\n  <span class=\"na\">replicas<\/span><span class=\"pi\">:<\/span> <span class=\"m\">1<\/span>\r\n  <span class=\"na\">template<\/span><span class=\"pi\">:<\/span>\r\n    <span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">labels<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">app<\/span><span class=\"pi\">:<\/span> <span class=\"s\">test<\/span>\r\n    <span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">containers<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx<\/span>\r\n        <span class=\"na\">image<\/span><span class=\"pi\">:<\/span> <span class=\"s\">nginx:latest<\/span>\r\n        <span class=\"na\">ports<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"na\">containerPort<\/span><span class=\"pi\">:<\/span> <span class=\"m\">80<\/span>\r\n<\/code><\/pre>\n<p>\u8ba9\u6211\u4eec\u6765\u770b\u770b\uff0c\u8fd9\u4e2a\u90e8\u7f72\u5c06\u4e3a\u521b\u5efa\u7684Pod\u6dfb\u52a0\u4e86\u5c06ConfigMap\u4e2d\u5b9a\u4e49\u7684\u503c\u8bbe\u7f6e\u4e3a\u73af\u5883\u53d8\u91cf\u7684\u8bbe\u7f6e\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl describe pod <span class=\"nt\">-n<\/span> test2 test-deployment-c49854788-s2wg4 | <span class=\"nb\">grep<\/span> <span class=\"nt\">-i<\/span> ENVIRONMENT\r\n    Environment:\r\n      ENVIRONMENT:  &lt;<span class=\"nb\">set <\/span>to the key <span class=\"s1\">'environment_name'<\/span> of config map <span class=\"s1\">'sample-configmap'<\/span><span class=\"o\">&gt;<\/span>  Optional: <span class=\"nb\">false<\/span>\r\n<\/code><\/pre>\n<p>\u6211\u4eec\u6210\u529f\u5730\u8bbe\u7f6e\u4e86\u4e00\u79cd\u53ef\u4ee5\u81ea\u52a8\u63d2\u5165env\u914d\u7f6e\u7684\u8bbe\u7f6e\u3002<\/p>\n<h3>\u95ee\u9898<\/h3>\n<h4>spec.rules.mutate.overlay\u662f\u4ec0\u4e48\uff1f<\/h4>\n<p>\u53d8\u5f02\u53ef\u4ee5\u6307\u5b9a\u4ee5\u4e0b3\u79cd\u8865\u4e01\u7684\u5e94\u7528\u65b9\u5f0f\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">overlay<\/ul>\n<\/li>\n<\/ul>\n<p>\u8ffd\u52a0\u30fb\u7f6e\u304d\u63db\u3048\u305f\u3044\u30de\u30cb\u30d5\u30a7\u30b9\u30c8\u3092\u8a18\u8ff0\u3059\u308b\u65b9\u6cd5\u3067\u3059<\/p>\n<p>Strategic Merge Patch<\/p>\n<p>overlay\u3068\u540c\u3058\u304f\u3001\u8ffd\u52a0\u3084\u7f6e\u304d\u63db\u3048\u306e\u8a18\u8ff0\u304c\u51fa\u6765\u307e\u3059<br \/>\n\u524a\u9664\u3082\u53ef\u80fd\u3067\u3059<\/p>\n<p>RFC 6902 JSONPatch<\/p>\n<p>\u30ea\u30bd\u30fc\u30b9\u306b\u5bfe\u3057\u3066 json patch\u3092\u5f53\u3066\u308b\u65b9\u6cd5\u3067\u3059\u3002kustomize\u3067\u3044\u3046 patchesJson6902<\/p>\n<p>Strategi Merge Patch\u3067\u306f\u5b9f\u73fe\u3067\u304d\u306a\u3044\u66f4\u65b0\u3092\u3057\u305f\u3044\u3068\u304d\u306b\u4f7f\u3044\u307e\u3059<\/p>\n<p>\u4f8b\u3048\u3070array\u306e\u4e00\u90e8\u8981\u7d20\u3092\u66f8\u304d\u63db\u3048\u305f\u3044\u3068\u304b<\/p>\n<h4>\u5728match\u4e2d\u53ef\u4ee5\u6307\u5b9a\u4ec0\u4e48\uff1f<\/h4>\n<p>\u8be6\u7ec6\u7684\u4fe1\u606f\u53ef\u4ee5\u5728\u8fd9\u91cc\u627e\u5230\uff1a<br \/>\nhttps:\/\/kyverno.io\/docs\/writing-policies\/match-exclude\/<\/p>\n<p>\u60a8\u53ef\u4ee5\u901a\u8fc7\u8d44\u6e90\u7684\u540d\u79f0\u6216\u6807\u7b7e\u6765\u9650\u5236\u76ee\u6807\u5bf9\u8c61\uff0c\u5e76\u4e14\u8fd8\u53ef\u4ee5\u8fdb\u884c\u6392\u9664\u8bbe\u7f6e\u3002<\/p>\n<h2>\u9a8c\u8bc1\u8d44\u6e90<\/h2>\n<p>\u8fd9\u4e2a\u529f\u80fd\u662f\u7528\u6765\u68c0\u67e5\u65b0\u7684\u6216\u73b0\u6709\u8d44\u6e90\u662f\u5426\u7b26\u5408\u5b9a\u4e49\u7684\u7b56\u7565\u3002<\/p>\n<p>\u8fd9\u6b21\u7684\u60c5\u666f\u8bbe\u7f6e\u662f\u300c\u5fc5\u987b\u5728Pod\u4e2d\u52a0\u5165resources.requests\/limits\u3002\u5982\u679c\u6ca1\u6709\u52a0\u5165\uff0c\u5c31\u4e0d\u4f1a\u751f\u6210Pod\u300d\u3002<br \/>\n\u9996\u5148\uff0c\u6211\u4eec\u8981\u64b0\u5199\u8fd9\u4e2a\u9650\u5236\u7684\u7b56\u7565\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"na\">apiVersion<\/span><span class=\"pi\">:<\/span> <span class=\"s\">kyverno.io\/v1<\/span>\r\n<span class=\"na\">kind<\/span><span class=\"pi\">:<\/span> <span class=\"s\">ClusterPolicy<\/span>\r\n<span class=\"na\">metadata<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">all-containers-need-requests-and-limits<\/span>\r\n<span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"na\">validationFailureAction<\/span><span class=\"pi\">:<\/span> <span class=\"s\">enforce<\/span>\r\n  <span class=\"na\">background<\/span><span class=\"pi\">:<\/span> <span class=\"no\">false<\/span>\r\n  <span class=\"na\">rules<\/span><span class=\"pi\">:<\/span>\r\n  <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s\">check-container-resources<\/span>\r\n    <span class=\"na\">match<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">resources<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">kinds<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">Pod<\/span>\r\n        <span class=\"na\">namespaces<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"pi\">-<\/span> <span class=\"s\">test2<\/span>\r\n    <span class=\"na\">validate<\/span><span class=\"pi\">:<\/span>\r\n      <span class=\"na\">message<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">All<\/span> <span class=\"s\">containers<\/span> <span class=\"s\">must<\/span> <span class=\"s\">have<\/span> <span class=\"s\">CPU<\/span> <span class=\"s\">and<\/span> <span class=\"s\">memory<\/span> <span class=\"s\">resource<\/span> <span class=\"s\">requests<\/span> <span class=\"s\">and<\/span> <span class=\"s\">limits<\/span> <span class=\"s\">defined.\"<\/span>\r\n      <span class=\"na\">pattern<\/span><span class=\"pi\">:<\/span>\r\n        <span class=\"na\">spec<\/span><span class=\"pi\">:<\/span>\r\n          <span class=\"na\">containers<\/span><span class=\"pi\">:<\/span>\r\n          <span class=\"pi\">-<\/span> <span class=\"na\">name<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">*\"<\/span>\r\n            <span class=\"na\">resources<\/span><span class=\"pi\">:<\/span>\r\n              <span class=\"na\">limits<\/span><span class=\"pi\">:<\/span>\r\n                <span class=\"na\">memory<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">?*\"<\/span>\r\n                <span class=\"na\">cpu<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">?*\"<\/span>\r\n              <span class=\"na\">requests<\/span><span class=\"pi\">:<\/span>\r\n                <span class=\"na\">memory<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">?*\"<\/span>\r\n                <span class=\"na\">cpu<\/span><span class=\"pi\">:<\/span> <span class=\"s2\">\"<\/span><span class=\"s\">?*\"<\/span>\r\n<\/code><\/pre>\n<p>\u6211\u4f1a\u5e94\u7528\u4f7f\u7528\u8fc7\u7684Deployment\u6765\u8fdb\u884c\u53d8\u5f02\u3002<br \/>\n\u7136\u540e\u2026<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl apply <span class=\"nt\">-f<\/span> test.yaml\r\nError from server: error when creating <span class=\"s2\">\"test.yaml\"<\/span>: admission webhook <span class=\"s2\">\"validate.kyverno.svc\"<\/span> denied the request:\r\n\r\nresource Deployment\/test2\/test-deployment was blocked due to the following policies\r\n\r\nall-containers-need-requests-and-limits:\r\n  autogen-check-container-resources: <span class=\"s1\">'validation error: All containers must have CPU\r\n    and memory resource requests and limits defined. Rule autogen-check-container-resources\r\n    failed at path \/spec\/template\/spec\/containers\/0\/resources\/limits\/'<\/span>\r\n\r\n<span class=\"c\"># Pod\u306f\u4f5c\u6210\u3055\u308c\u3066\u3044\u306a\u3044<\/span>\r\n<span class=\"nv\">$ <\/span>kubectl <span class=\"nt\">-n<\/span> test2 get pods\r\nNo resources found <span class=\"k\">in <\/span>test2 namespace.\r\n<\/code><\/pre>\n<p>\u6240\u4ee5\uff0c\u6211\u6210\u529f\u5b8c\u6210\u4e86\u6211\u60f3\u505a\u7684\u4e8b\u60c5\u3002<\/p>\n<h3>\u8fd9\u662f\u4e00\u4e2a\u7591\u95ee<\/h3>\n<h4>spec.background\u662f\u4ec0\u4e48\uff1f<\/h4>\n<p>\u5982\u679c\u5c06\u6b64\u8bbe\u7f6e\u4e3a true\uff0c\u5219\u4f1a\u5bf9\u73b0\u6709\u8d44\u6e90\u6267\u884c\u7b56\u7565\u68c0\u67e5\u3002<br \/>\nhttps:\/\/kyverno.io\/docs\/writing-policies\/background\/<\/p>\n<p>\u5982\u679c\u73b0\u6709\u8d44\u6e90\u8fdd\u53cd\u653f\u7b56\uff0c\u5c3d\u7ba1\u73b0\u6709\u8d44\u6e90\u4fdd\u6301\u4e0d\u53d8\uff0c<br \/>\n\u4f46\u4f1a\u521b\u5efa\u540d\u4e3aClusterPolicyReport\u6216PolicyReport\u7684\u8d44\u6e90\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"nv\">$ <\/span>kubectl get policyreport <span class=\"nt\">-A<\/span>\r\nNAMESPACE   NAME            PASS   FAIL   WARN   ERROR   SKIP   AGE\r\ntest2       polr-ns-test2   0      1      0      0       0      67s\r\n<\/code><\/pre>\n<p>\u67e5\u770b\u5185\u90e8\u5185\u5bb9\u540e\uff0c\u4f1a\u663e\u793a\u9519\u8bef\u539f\u56e0\u3002<\/p>\n<p>\u8fd9\u4e2a spec.background \u7684\u9ed8\u8ba4\u503c\u662ftrue\uff0c\u5bf9\u4e8emutate\u6216generate\u6ca1\u6709\u5f71\u54cd\u3002<\/p>\n<h4>\u53ef\u4ee5\u5728spec.validationFailureAction\u4e2d\u6307\u5b9a\u4ec0\u4e48\u5185\u5bb9\uff1f<\/h4>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">enforce<\/ul>\n<\/li>\n<\/ul>\n<p>\u30dd\u30ea\u30b7\u30fc\u9055\u53cd\u306e\u5834\u5408\u3001\u65b0\u898f\u30ea\u30bd\u30fc\u30b9\u306e\u5834\u5408\u306f\u3001\u305d\u306e\u30ea\u30bd\u30fc\u30b9\u306f\u4f5c\u6210\u3055\u308c\u307e\u305b\u3093<\/p>\n<p>audit<\/p>\n<p>\u30dd\u30ea\u30b7\u30fc\u9055\u53cd\u306e\u5834\u5408\u3001ClusterPolicyReport \u307e\u305f\u306f PolicyReport \u3068\u3044\u3046\u30ea\u30bd\u30fc\u30b9\u304c\u4f5c\u6210\u3055\u308c\u307e\u3059<br \/>\n\u30dd\u30ea\u30b7\u30fc\u9055\u53cd\u3067\u3082\u305d\u306e\u30ea\u30bd\u30fc\u30b9\u306f\u4f5c\u6210\u3055\u308c\u307e\u3059<\/p>\n<h2>\u5176\u4ed6\u65b9\u4fbf\u529f\u80fd<\/h2>\n<p>\u8fd9\u4e00\u6b21\u6211\u6ca1\u6709\u4eb2\u81ea\u89e6\u6478\uff0c\u4f46\u662f\u6211\u4f1a\u4ecb\u7ecd\u4e00\u4e0b\u4f3c\u4e4e\u5728\u719f\u7ec3\u4f7f\u7528\u65f6\u5f88\u65b9\u4fbf\u7684\u529f\u80fd\u3002<\/p>\n<h3>\u53d8\u91cf<\/h3>\n<p>\u60a8\u53ef\u4ee5\u5c06\u8bf7\u6c42\u7684\u8d44\u6e90\u4fe1\u606f\u4f5c\u4e3a\u53d8\u91cf\u4f7f\u7528\u3002<br \/>\nhttps:\/\/kyverno.io\/docs\/writing-policies\/variables\/<\/p>\n<p>\u8fd8\u53ef\u4ee5\u8c03\u7528ConfigMap\u7684\u4fe1\u606f\u3002<br \/>\n\u8fd9\u610f\u5473\u7740\u53ef\u4ee5\u57fa\u4e8eConfigMap\u5b9a\u4e49\u7684\u503c\u8fdb\u884c\u9a8c\u8bc1\u6216\u5176\u4ed6\u64cd\u4f5c\u3002<br \/>\nhttps:\/\/kyverno.io\/docs\/writing-policies\/external-data-sources\/<\/p>\n<h3>\u672c\u9898\u8981\u6c42\u4ee5\u4e2d\u6587\u539f\u751f\u65b9\u5f0f\u91cd\u65b0\u8868\u8fbe\u7ed9\u5b9a\u7684\u77ed\u8bed&#8221;\u524d\u63d0\u6761\u4ef6&#8221;\u3002<\/h3>\n<p>\u5047\u8bbe\u57fa\u7840<\/p>\n<p>\u5982\u679c\u60f3\u8981\u8fdb\u884c\u6bd4&#8221;match&#8221;\u6216&#8221;exclude&#8221;\u66f4\u7cbe\u7ec6\u7684\u6761\u4ef6\u6307\u5b9a\uff0c\u53ef\u4ee5\u4f7f\u7528&#8221;preconditions&#8221;\u3002<br \/>\nhttps:\/\/kyverno.io\/docs\/writing-policies\/preconditions\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5173\u4e8e\u8fd9\u7bc7\u6587\u7ae0 \u6211\u5728\u4e1a\u52a1\u4e2d\u4f7f\u7528Kyverno\uff0c\u4f46\u53ea\u4f7f\u7528\u4e86\u90e8\u5206\u529f\u80fd\uff0c\u5c1a\u672a\u5b8c\u5168\u638c\u63e1\u6240\u6709\u529f\u80fd\uff0c\u56e0\u6b64\u6211\u6b63\u5728\u64b0\u5199\u8fd9\u7bc7\u6587\u7ae0\u8fdb [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-47268","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bkyverno\u3002\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno\" \/>\n<meta property=\"og:description\" content=\"\u5173\u4e8e\u8fd9\u7bc7\u6587\u7ae0 \u6211\u5728\u4e1a\u52a1\u4e2d\u4f7f\u7528Kyverno\uff0c\u4f46\u53ea\u4f7f\u7528\u4e86\u90e8\u5206\u529f\u80fd\uff0c\u5c1a\u672a\u5b8c\u5168\u638c\u63e1\u6240\u6709\u529f\u80fd\uff0c\u56e0\u6b64\u6211\u6b63\u5728\u64b0\u5199\u8fd9\u7bc7\u6587\u7ae0\u8fdb [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bkyverno\u3002\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-04T14:31:55+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-29T12:31:24+00:00\" \/>\n<meta name=\"author\" content=\"\u9038, \u79d1\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u9038, \u79d1\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/\",\"name\":\"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-03-04T14:31:55+00:00\",\"dateModified\":\"2024-04-29T12:31:24+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/85c1dae56e6ea1e695c73d33c684d487\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/85c1dae56e6ea1e695c73d33c684d487\",\"name\":\"\u9038, \u79d1\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c94f6d9cbbfbca863fab309840bd690c153c95f8490c290ad2ed54dd693dad16?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c94f6d9cbbfbca863fab309840bd690c153c95f8490c290ad2ed54dd693dad16?s=96&d=mm&r=g\",\"caption\":\"\u9038, \u79d1\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/keyi\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bkyverno\u3002\/","og_locale":"zh_CN","og_type":"article","og_title":"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno","og_description":"\u5173\u4e8e\u8fd9\u7bc7\u6587\u7ae0 \u6211\u5728\u4e1a\u52a1\u4e2d\u4f7f\u7528Kyverno\uff0c\u4f46\u53ea\u4f7f\u7528\u4e86\u90e8\u5206\u529f\u80fd\uff0c\u5c1a\u672a\u5b8c\u5168\u638c\u63e1\u6240\u6709\u529f\u80fd\uff0c\u56e0\u6b64\u6211\u6b63\u5728\u64b0\u5199\u8fd9\u7bc7\u6587\u7ae0\u8fdb [&hellip;]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bkyverno\u3002\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-03-04T14:31:55+00:00","article_modified_time":"2024-04-29T12:31:24+00:00","author":"\u9038, \u79d1","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u9038, \u79d1","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/","name":"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-03-04T14:31:55+00:00","dateModified":"2024-04-29T12:31:24+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/85c1dae56e6ea1e695c73d33c684d487"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u6211\u8bd5\u7740\u73a9\u4e86\u4e00\u4e0bKyverno"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/85c1dae56e6ea1e695c73d33c684d487","name":"\u9038, \u79d1","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/c94f6d9cbbfbca863fab309840bd690c153c95f8490c290ad2ed54dd693dad16?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c94f6d9cbbfbca863fab309840bd690c153c95f8490c290ad2ed54dd693dad16?s=96&d=mm&r=g","caption":"\u9038, \u79d1"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/keyi\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e6%88%91%e8%af%95%e7%9d%80%e7%8e%a9%e4%ba%86%e4%b8%80%e4%b8%8bkyverno%e3%80%82\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/47268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=47268"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/47268\/revisions"}],"predecessor-version":[{"id":87483,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/47268\/revisions\/87483"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=47268"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=47268"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=47268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}