Skip to content

Instantly share code, notes, and snippets.

@mikery

mikery/allow-loadbalancers-with-dynamic-annotation.rego

Last active November 18, 2018 15:46
Show Gist options
  • Save mikery/ef29a3b4bc5722a74c644a2c77a890ea to your computer and use it in GitHub Desktop.
Save mikery/ef29a3b4bc5722a74c644a2c77a890ea to your computer and use it in GitHub Desktop.
Download ZIP
Raw
allow-loadbalancers-with-dynamic-annotation.rego
package kubernetes.admission
import data.kubernetes.namespaces
import input.request.object.metadata.annotations as annotations
deny[msg] {
input.request.kind.kind = "Service"
input.request.operation = "CREATE"
input.request.object.spec.type = "LoadBalancer"
missing_required_annotations[msg]
}
# Require annotation which matches an annotation on the target namespace
missing_required_annotations[msg] {
namespace_sg := namespaces[input.request.namespace].metadata.annotations["elb-security-group"]
not annotations["service.beta.kubernetes.io/aws-load-balancer-security-groups"] = namespace_sg
msg = sprintf("LoadBalancer Services in namespace %q must use security group %q", [input.request.namespace, namespace_sg])
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment