example-admission-policy

adm_mut_pol.yaml

apiVersion: admissionregistration.k8s.io/v1alpha1
kind: MutatingAdmissionPolicy
metadata:
  name: "modify-init-container-security-context"
spec:
  matchConstraints:
    resourceRules:
    - apiGroups:   ["apps"]
      apiVersions: ["v1"]
      operations:  ["CREATE", "UPDATE"]
      resources:   ["statefulsets"]
  matchConditions:
    - name: has-init-container-xxx
      expression: "object.spec.template.spec.initContainers.exists(ic, ic.name == \"xxx\")"
  failurePolicy: Fail
  reinvocationPolicy: IfNeeded
  mutations:
    - patchType: "ApplyConfiguration"
      applyConfiguration:
        expression: >
          Object{
            spec: Object.spec{
              template: Object.spec.template{
                spec: Object.spec.template.spec{
                  initContainers: Object.spec.template.spec.initContainers.map(ic,
                    ic.name == "xxx" ? Object{
                      name: ic.name,
                      image: ic.image,
                      securityContext: Object{
                        runAsUser: 1000
                      }
                    } : ic
                  )
                }
              }
            }
          }