Require Pod Probes

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: require-pod-probes
 5  annotations:
 6    pod-policies.kyverno.io/autogen-controllers: DaemonSet,Deployment,StatefulSet
 7    policies.kyverno.io/title: Require Pod Probes
 8    policies.kyverno.io/category: Best Practices, EKS Best Practices
 9    policies.kyverno.io/severity: medium
10    policies.kyverno.io/subject: Pod
11    policies.kyverno.io/description: >-
12      Liveness and readiness probes need to be configured to correctly manage a Pod's
13      lifecycle during deployments, restarts, and upgrades. For each Pod, a periodic
14      `livenessProbe` is performed by the kubelet to determine if the Pod's containers
15      are running or need to be restarted. A `readinessProbe` is used by Services
16      and Deployments to determine if the Pod is ready to receive network traffic.
17      This policy validates that all containers have one of livenessProbe, readinessProbe,
18      or startupProbe defined.      
19spec:
20  validationFailureAction: audit
21  background: true
22  rules:
23  - name: validate-probes
24    match:
25      any:
26      - resources:
27          kinds:
28          - Pod
29    validate:
30      message: "Liveness, readiness, or startup probes are required for all containers."
31      foreach:
32      - list: request.object.spec.containers[]
33        deny:
34          conditions:
35            all:
36            - key: livenessProbe
37              operator: AllNotIn
38              value: "{{ element.keys(@)[] }}"
39            - key: startupProbe
40              operator: AllNotIn
41              value: "{{ element.keys(@)[] }}"
42            - key: readinessProbe
43              operator: AllNotIn
44              value: "{{ element.keys(@)[] }}"