Skip to content
CNPEPlatform APIs and Self-Service CapabilitiesSingle nodeMedium

Self-service namespaces: Kyverno generate rules for team onboarding

Scenario cnpe-api-004 · about 15 minutes · 10 points · 6 grader checks

A team gets a working namespace by labelling it: a Kyverno ClusterPolicy generates the quota and the admin RoleBinding for every namespace carrying the team label and keeps them in sync.

  • kyverno
  • generate
  • self-service
  • namespace-provisioning
  • policy
  • platform-api

What you will practise

  • Write Kyverno generate rules with synchronize
  • Use the namespace label value in generated objects
  • Match only labelled namespaces

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cnpe-api-004

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Kyverno runs in namespace "kyverno". Its background controller has already been granted what it needs to create ResourceQuotas and RoleBindings to the ClusterRole "edit". 1. Create a ClusterPolicy "team-onboarding" that, for every Namespace with the label platform.example.com/team, generates in that namespace: - a ResourceQuota "team-quota" with hard limits pods 20 and requests.cpu 4; - a RoleBinding "team-admins" that binds the ClusterRole "edit" to the Group "team:<value of the label>". Generated objects must be kept in sync with the policy. 2. Create the namespace "team-orion" with the label platform.example.com/team=orion. Namespaces without the label (such as "sandbox") must not get these objects.

Requirements and details

Certification
CNPE · Certified Cloud Native Platform Engineer
Domain
Platform APIs and Self-Service Capabilities
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
15 minutes
Points
10
Grader checks
6
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 6 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Platform APIs and Self-Service Capabilities labs

CNPEPlatform APIs and Self-Service CapabilitiesMedium

Platform API: design a Database CRD with validation and status

Offer databases as a platform API: a namespaced CustomResourceDefinition with an enum-validated schema, a status subresource and printer columns, plus the first claim.

Single node · ~15 min · 10 points

  • crd
  • customresourcedefinition
  • openapi-schema
  • platform-api
  • self-service

goldenkube start cnpe-api-001

CNPEPlatform APIs and Self-Service CapabilitiesHard

Self-service with Crossplane: an XRD and a Composition that compose a ConfigMap

Expose app configuration as a Crossplane v2 namespaced composite API: define the XRD, write a pipeline Composition with patch-and-transform, and provision the first composite.

Single node · ~20 min · 10 points

  • crossplane
  • composition
  • xrd
  • self-service
  • platform-api
  • function-patch-and-transform

goldenkube start cnpe-api-002

CNPEPlatform APIs and Self-Service CapabilitiesMedium

Operators: run Alertmanager through the Prometheus Operator

Use the Prometheus Operator as a platform automation: declare an Alertmanager and a namespaced AlertmanagerConfig, and confirm the operator reconciled them into a running, configured instance.

Single node · ~15 min · 8 points

  • operator
  • prometheus-operator
  • alertmanager
  • alertmanagerconfig
  • custom-resources
  • platform-automation

goldenkube start cnpe-api-003

CNPEPlatform APIs and Self-Service CapabilitiesMedium

Automation framework: an Argo WorkflowTemplate that provisions environments

Offer environment provisioning as a reusable Argo WorkflowTemplate with a parameter and a resource step, then provision the blue environment through it.

Single node · ~15 min · 8 points

  • argo-workflows
  • workflowtemplate
  • automation
  • self-service
  • resource-template
  • platform-api

goldenkube start cnpe-api-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.