k8sblocknodeport

Basic Information

• Policy type: compliance
• Recommended level: L1
• Effective resource type: Service
• Parameter: None

Function

NodePort Services are not allowed.

Policy Example

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sBlockNodePort
metadata:
  name: block-node-port
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Service"]

Resource Definition That Complies with the Policy

The service type is not Nodeport, which complies with the policy instance.

apiVersion: v1
kind: Service
metadata:
  name: my-service-disallowed
spec:
  ports:
    - port: 80
      targetPort: 80
      nodePort: 30007

Resource Definition That Does Not Comply with the Policy

The service type is Nodeport, which does not comply with the policy instance.

apiVersion: v1
kind: Service
metadata:
  name: my-service-disallowed
spec:
  type: NodePort
  ports:
    - port: 80
      targetPort: 80
      nodePort: 30007