diff options
| author | Patrick Spek <p.spek@tyil.nl> | 2026-07-20 16:30:11 +0200 |
|---|---|---|
| committer | Patrick Spek <p.spek@tyil.nl> | 2026-07-20 16:30:11 +0200 |
| commit | 21bd609835751964ea6f2f91cb6e4597e38cf45e (patch) | |
| tree | e8bbba4350080e671ad6d7f3437b770b69410e17 | |
| parent | a45655aa5def00554d1b22c327ecb3f649860e94 (diff) | |
| download | tyilnet-ansible-21bd609835751964ea6f2f91cb6e4597e38cf45e.tar.gz tyilnet-ansible-21bd609835751964ea6f2f91cb6e4597e38cf45e.tar.bz2 | |
Add cluster policy for mutating Traefik ingresses
| -rw-r--r-- | data/kubernetes/base/kyverno/mutate-ingress-traefik.yaml | 55 |
1 files changed, 55 insertions, 0 deletions
diff --git a/data/kubernetes/base/kyverno/mutate-ingress-traefik.yaml b/data/kubernetes/base/kyverno/mutate-ingress-traefik.yaml new file mode 100644 index 0000000..4f40da1 --- /dev/null +++ b/data/kubernetes/base/kyverno/mutate-ingress-traefik.yaml @@ -0,0 +1,55 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: mutate-ingress-traefik + annotations: + policies.kyverno.io/title: Mutate Ingresses for Traefik + policies.kyverno.io/subject: Ingress + policies.kyverno.io/description: >- + Apply several mutations on Ingresses handles by Traefik. +spec: + rules: + - name: annotation-cluster-issuer + match: + any: + - resources: + kinds: + - Ingress + operations: + - CREATE + - UPDATE + preconditions: + all: + - key: "{{ request.object.spec.ingressClassName }}" + operator: Equals + value: "traefik" + - key: "{{ request.object.metadata.labels.\"acme.cert-manager.io/http01-solver\" || '' }}" + operator: NotEquals + value: "true" + mutate: + patchStrategicMerge: + metadata: + annotations: + +(cert-manager.io/cluster-issuer): traefik-letsencrypt + - name: middleware-redirect-websecure + match: + any: + - resources: + kinds: + - Ingress + operations: + - CREATE + - UPDATE + preconditions: + all: + - key: "{{ request.object.spec.ingressClassName }}" + operator: Equals + value: "traefik" + - key: "{{ request.object.metadata.labels.\"acme.cert-manager.io/http01-solver\" || '' }}" + operator: NotEquals + value: "true" + mutate: + patchStrategicMerge: + metadata: + annotations: + +(traefik.ingress.kubernetes.io/router.middlewares): base-system-redirect-websecure@kubernetescrd |