Merge pull request #2395 from porter-dev/belanger/fix-node-policies

Fix node policies and add checks for `descheduler` and `vpa` workloads

internal/opa/config.yaml

@@ -132,4 +132,20 @@ node:
   - path: "./policies/node/porter_run_taints.rego"
     name: "node.porter_run_taints"
   - path: "./policies/node/porter_run_labels.rego"
-    name: "node.porter_run_labels"
+    name: "node.porter_run_labels"
+  - path: "./policies/node/healthy.rego"
+    name: "node.healthy"
+descheduler:
+  kind: "helm_release"
+  match:
+    name: descheduler
+    namespace: kube-system
+  mustExist: true
+  policies: []
+vpa:
+  kind: "helm_release"
+  match:
+    name: vpa
+    namespace: kube-system
+  mustExist: true
+  policies: []

internal/opa/policies/node/healthy.rego

@@ -0,0 +1,25 @@
+package node.healthy
+
+import future.keywords
+
+POLICY_ID := sprintf("healthy_%s", [input.metadata.name])
+
+POLICY_VERSION := "v0.0.1"
+
+POLICY_SEVERITY := "critical"
+
+POLICY_TITLE := sprintf("The node %s should be healthy", [input.metadata.name])
+
+POLICY_SUCCESS_MESSAGE := sprintf("Success: this node is healthy", [])
+
+# check if one of the node's conditions states that the kubelet is ready
+allow if {
+	some condition in input.status.conditions
+	condition.reason == "KubeletReady"
+	condition.status = "True"
+}
+
+FAILURE_MESSAGE contains msg if {
+	not allow
+	msg := sprintf("Failed: the node %s is not healthy", [input.metadata.name])
+}

internal/opa/policies/node/k8s_version.rego

@@ -2,7 +2,7 @@ package node.k8s_version
 
 import future.keywords
 
-POLICY_ID := "k8s_version"
+POLICY_ID := sprintf("k8s_version_%s", [input.metadata.name])
 
 POLICY_VERSION := "v0.0.1"
 

internal/opa/policies/node/porter_run_labels.rego

@@ -2,7 +2,7 @@ package node.porter_run_labels
 
 import future.keywords
 
-POLICY_ID := "porter_run_labels"
+POLICY_ID := sprintf("porter_run_labels_%s", [input.metadata.name])
 
 POLICY_VERSION := "v0.0.1"
 

internal/opa/policies/node/porter_run_taints.rego

@@ -2,7 +2,7 @@ package node.porter_run_taints
 
 import future.keywords
 
-POLICY_ID := "porter_run_taints"
+POLICY_ID := sprintf("porter_run_taints_%s", [input.metadata.name])
 
 POLICY_VERSION := "v0.0.1"