feat(constraint): add new argo-workflow-gc constraint #49
Conversation
There was a problem hiding this comment.
I think this is a good start. Have we thought about using a Mutation to automatically set the GC settings? This might be a good place to do it since it looks to be a pretty simple policy and there isn't too much to change. It could be interesting to have both the mutation and the policy in case, defense in depth. (mutations are run first, then the admission policy so it should work fine!)
Can you add some newline at the end of files? Just some lil' nitpicks :)
| package argoworkflowgc | ||
|
|
||
| violation[{"msg": msg}] { | ||
| input.review.kind.kind == "Workflow" | ||
| not input.review.object.spec.podGC | ||
|
|
||
| msg := sprintf("podGC field is required in an Argo Workflow manifest. %s", [input.parameters.errorMsgAdditionalDetails]) | ||
| } |
There was a problem hiding this comment.
Looks like the violation for CronWorkflows is missing.
Thanks for the reviewing the PR! Good point, I think the mutation idea sounds interesting & useful! I'll look into it. |
All Argo Workflows should have the podGC field set (https://argoproj.github.io/argo-workflows/fields/#podgc).