Restrict volume types

[ssvinarev]

Restrict volume types

[JimBugwadia]

Hi @ssvinarev - since the volume type is an object, this may be a bit tricky to do using an include / allow list.

Have you tried using an anyPattern and to define the types of volumes you want to allow.

      pattern:
        - spec:
          (volumes):
          - configMap : 
        - spec:
          (volumes):
          - emptyDir: 
        - spec:
          (volumes):
          - persistentVolumeClaim: 

https://kyverno.io/docs/writing-policies/validate/#anypattern---logical-or-across-multiple-validation-patterns

[chipzoller]

Hi @ssvinarev I think Jim's suggestion is a good approach and so I'm going to close this issue. If you still need help with adapting either one of these, please either re-open or come see us in the #kyverno Kubernetes Slack channel.