## Package: kyverno.io/v2beta1

### Resource Types:

- CleanupPolicy
- ClusterCleanupPolicy
- ClusterPolicy
- Policy
- PolicyException

### CleanupPolicy

CleanupPolicy defines a rule for resource cleanup.

Field | Description
--- | ---
`apiVersion`string | `kyverno.io/v2beta1`
`kind`string | `CleanupPolicy`
`metadata` * meta/v1.ObjectMeta | Refer to the Kubernetes API documentation for the fields of the `metadata` field.
`spec` * CleanupPolicySpec | Spec declares policy behaviors.
`context` []ContextEntry | Context defines variables and data sources that can be used during rule execution.
`match` * MatchResources | MatchResources defines when cleanuppolicy should be applied. The match criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the user name or role. At least one kind is required.
`exclude` MatchResources | ExcludeResources defines when cleanuppolicy should not be applied. The exclude criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the name or role.
`schedule` * string | The schedule in Cron format
`conditions` AnyAllConditions | Conditions defines the conditions used to select the resources which will be cleaned up.
`deletionPropagationPolicy` meta/v1.DeletionPropagation | DeletionPropagationPolicy defines how resources will be deleted (Foreground, Background, Orphan).
`status` CleanupPolicyStatus | Status contains policy runtime data.

### ClusterCleanupPolicy

ClusterCleanupPolicy defines rule for resource cleanup.

Field | Description
--- | ---
`apiVersion`string | `kyverno.io/v2beta1`
`kind`string | `ClusterCleanupPolicy`
`metadata` * meta/v1.ObjectMeta | Refer to the Kubernetes API documentation for the fields of the `metadata` field.
`spec` * CleanupPolicySpec | Spec declares policy behaviors.
`context` []ContextEntry | Context defines variables and data sources that can be used during rule execution.
`match` * MatchResources | MatchResources defines when cleanuppolicy should be applied. The match criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the user name or role. At least one kind is required.
`exclude` MatchResources | ExcludeResources defines when cleanuppolicy should not be applied. The exclude criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the name or role.
`schedule` * string | The schedule in Cron format
`conditions` AnyAllConditions | Conditions defines the conditions used to select the resources which will be cleaned up.
`deletionPropagationPolicy` meta/v1.DeletionPropagation | DeletionPropagationPolicy defines how resources will be deleted (Foreground, Background, Orphan).
`status` CleanupPolicyStatus | Status contains policy runtime data.

### ClusterPolicy

ClusterPolicy declares validation, mutation, and generation behaviors for matching resources.

Field | Description
--- | ---
`apiVersion`string | `kyverno.io/v2beta1`
`kind`string | `ClusterPolicy`
`metadata` * meta/v1.ObjectMeta | Refer to the Kubernetes API documentation for the fields of the `metadata` field.
`spec` * Spec | Spec declares policy behaviors.
`rules` * []Rule | Rules is a list of Rule instances. A Policy contains multiple rules and each rule can validate, mutate, or generate resources.
`applyRules` ApplyRulesType | ApplyRules controls how rules in a policy are applied. Rule are processed in the order of declaration. When set to `One` processing stops after a rule has been applied i.e. the rule matches and results in a pass, fail, or error. When set to `All` all rules in the policy are processed. The default is `All`.
`failurePolicy` * FailurePolicyType | Deprecated, use failurePolicy under the webhookConfiguration instead.
`validationFailureAction` * ValidationFailureAction | Deprecated, use validationFailureAction under the validate rule instead.
`validationFailureActionOverrides` * []ValidationFailureActionOverride | Deprecated, use validationFailureActionOverrides under the validate rule instead.
`emitWarning` bool | EmitWarning enables API response warnings for mutate policy rules or validate policy rules with validationFailureAction set to Audit. Enabling this option will extend admission request processing times. The default value is "false".
`admission` bool | Admission controls if rules are applied during admission. Optional. Default value is "true".
`background` bool | Background controls if rules are applied to existing resources during a background scan. Optional. Default value is "true". The value must be set to "false" if the policy rule uses variables that are only available in the admission review request (e.g. user name).
`schemaValidation` * bool | Deprecated.
`webhookTimeoutSeconds` * int32 | Deprecated, use webhookTimeoutSeconds under webhookConfiguration instead.
`mutateExistingOnPolicyUpdate` bool | Deprecated, use mutateExistingOnPolicyUpdate under the mutate rule instead
`generateExistingOnPolicyUpdate` bool | Deprecated, use generateExisting instead
`generateExisting` * bool | Deprecated, use generateExisting under the generate rule instead
`useServerSideApply` bool | UseServerSideApply controls whether to use server-side apply for generate rules If is set to "true" create & update for generate rules will use apply instead of create/update. Defaults to "false" if not specified.
`webhookConfiguration` WebhookConfiguration | WebhookConfiguration specifies the custom configuration for Kubernetes admission webhookconfiguration.
`status` PolicyStatus | Status contains policy runtime data.

### Policy

Policy declares validation, mutation, and generation behaviors for matching resources. See: https://kyverno.io/docs/writing-policies/ for more information.

Field | Description
--- | ---
`apiVersion`string | `kyverno.io/v2beta1`
`kind`string | `Policy`
`metadata` * meta/v1.ObjectMeta | Refer to the Kubernetes API documentation for the fields of the `metadata` field.
`spec` * Spec | Spec defines policy behaviors and contains one or more rules.
`rules` * []Rule | Rules is a list of Rule instances. A Policy contains multiple rules and each rule can validate, mutate, or generate resources.
`applyRules` ApplyRulesType | ApplyRules controls how rules in a policy are applied. Rule are processed in the order of declaration. When set to `One` processing stops after a rule has been applied i.e. the rule matches and results in a pass, fail, or error. When set to `All` all rules in the policy are processed. The default is `All`.
`failurePolicy` * FailurePolicyType | Deprecated, use failurePolicy under the webhookConfiguration instead.
`validationFailureAction` * ValidationFailureAction | Deprecated, use validationFailureAction under the validate rule instead.
`validationFailureActionOverrides` * []ValidationFailureActionOverride | Deprecated, use validationFailureActionOverrides under the validate rule instead.
`emitWarning` bool | EmitWarning enables API response warnings for mutate policy rules or validate policy rules with validationFailureAction set to Audit. Enabling this option will extend admission request processing times. The default value is "false".
`admission` bool | Admission controls if rules are applied during admission. Optional. Default value is "true".
`background` bool | Background controls if rules are applied to existing resources during a background scan. Optional. Default value is "true". The value must be set to "false" if the policy rule uses variables that are only available in the admission review request (e.g. user name).
`schemaValidation` * bool | Deprecated.
`webhookTimeoutSeconds` * int32 | Deprecated, use webhookTimeoutSeconds under webhookConfiguration instead.
`mutateExistingOnPolicyUpdate` bool | Deprecated, use mutateExistingOnPolicyUpdate under the mutate rule instead
`generateExistingOnPolicyUpdate` bool | Deprecated, use generateExisting instead
`generateExisting` * bool | Deprecated, use generateExisting under the generate rule instead
`useServerSideApply` bool | UseServerSideApply controls whether to use server-side apply for generate rules If is set to "true" create & update for generate rules will use apply instead of create/update. Defaults to "false" if not specified.
`webhookConfiguration` WebhookConfiguration | WebhookConfiguration specifies the custom configuration for Kubernetes admission webhookconfiguration.
`status` PolicyStatus | Status contains policy runtime data.

### PolicyException

PolicyException declares resources to be excluded from specified policies.

Field | Description
--- | ---
`apiVersion`string | `kyverno.io/v2beta1`
`kind`string | `PolicyException`
`metadata` * meta/v1.ObjectMeta | Refer to the Kubernetes API documentation for the fields of the `metadata` field.
`spec` * PolicyExceptionSpec | Spec declares policy exception behaviors.
`background` * bool | Background controls if exceptions are applied to existing policies during a background scan. Optional. Default value is "true". The value must be set to "false" if the policy rule uses variables that are only available in the admission review request (e.g. user name).
`match` * MatchResources | Match defines match clause used to check if a resource applies to the exception
`conditions` AnyAllConditions | Conditions are used to determine if a resource applies to the exception by evaluating a set of conditions. The declaration can contain nested `any` or `all` statements.
`exceptions` * []Exception | Exceptions is a list policy/rules to be excluded
`podSecurity` []PodSecurityStandard | PodSecurity specifies the Pod Security Standard controls to be excluded. Applicable only to policies that have validate.podSecurity subrule.

### AnyAllConditions

(Appears in: CleanupPolicySpec, Deny, PolicyExceptionSpec, Rule)

Field | Description
--- | ---
`any` []Condition | AnyConditions enable variable-based conditional rule execution. This is useful for finer control of when an rule is applied. A condition can reference object data using JMESPath notation. Here, at least one of the conditions need to pass.
`all` []Condition | AllConditions enable variable-based conditional rule execution. This is useful for finer control of when an rule is applied. A condition can reference object data using JMESPath notation. Here, all of the conditions need to pass.

### AssertionTree

(Appears in: Validation)

AssertionTree defines a kyverno-json assertion tree.

### CleanupPolicySpec

(Appears in: CleanupPolicy, ClusterCleanupPolicy)

CleanupPolicySpec stores specifications for selecting resources that the user needs to delete and schedule when the matching resources needs deleted.

Field | Description
--- | ---
`context` []ContextEntry | Context defines variables and data sources that can be used during rule execution.
`match` * MatchResources | MatchResources defines when cleanuppolicy should be applied. The match criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the user name or role. At least one kind is required.
`exclude` MatchResources | ExcludeResources defines when cleanuppolicy should not be applied. The exclude criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the name or role.
`schedule` * string | The schedule in Cron format
`conditions` AnyAllConditions | Conditions defines the conditions used to select the resources which will be cleaned up.
`deletionPropagationPolicy` meta/v1.DeletionPropagation | DeletionPropagationPolicy defines how resources will be deleted (Foreground, Background, Orphan).

### CleanupPolicyStatus

(Appears in: CleanupPolicy, ClusterCleanupPolicy)

CleanupPolicyStatus stores the status of the policy.

Field | Description
--- | ---
`conditions` * []meta/v1.Condition |
`lastExecutionTime` * meta/v1.Time |

### Condition

(Appears in: AnyAllConditions)

Field | Description
--- | ---
`key` * github.com/kyverno/kyverno/api/kyverno.Any | Key is the context entry (using JMESPath) for conditional rule evaluation.
`operator` * ConditionOperator | Operator is the conditional operation to perform. Valid operators are: Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals, GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan, DurationLessThanOrEquals, DurationLessThan
`value` * github.com/kyverno/kyverno/api/kyverno.Any | Value is the conditional value, or set of values. The values can be fixed set or can be variables declared using JMESPath.
`message` * string | Message is an optional display message

### ConditionOperator (`string` alias)

(Appears in: Condition)

ConditionOperator is the operation performed on condition key and value.

### Deny

(Appears in: Validation)

Deny specifies a list of conditions used to pass or fail a validation rule.

Field | Description
--- | ---
`conditions` * AnyAllConditions | Multiple conditions can be declared under an `any` or `all` statement. See: https://kyverno.io/docs/writing-policies/validate/#deny-rules

### Exception

(Appears in: PolicyExceptionSpec)

Exception stores infos about a policy and rules

Field | Description
--- | ---
`policyName` * string | PolicyName identifies the policy to which the exception is applied. The policy name uses the format / unless it references a ClusterPolicy.
`ruleNames` * []string | RuleNames identifies the rules to which the exception is applied.

### ImageVerification

(Appears in: Rule)

ImageVerification validates that images that match the specified pattern are signed with the supplied public key. Once the image is verified it is mutated to include the SHA digest retrieved during the registration.

Field | Description
--- | ---
`failureAction` ValidationFailureAction | Allowed values are Audit or Enforce.
`type` * ImageVerificationType | Type specifies the method of signature validation. The allowed options are Cosign and Notary. By default Cosign is used if a type is not specified.
`imageReferences` * []string | ImageReferences is a list of matching image reference patterns. At least one pattern in the list must match the image for the rule to apply. Each image reference consists of a registry address (defaults to docker.io), repository, image, and tag (defaults to latest). Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
`skipImageReferences` * []string | SkipImageReferences is a list of matching image reference patterns that should be skipped. At least one pattern in the list must match the image for the rule to be skipped. Each image reference consists of a registry address (defaults to docker.io), repository, image, and tag (defaults to latest). Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
`attestors` * []AttestorSet | Attestors specified the required attestors (i.e. authorities)
`attestations` * []Attestation | Attestations are optional checks for signed in-toto Statements used to verify the image. See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the OCI registry and decodes them into a list of Statement declarations.
`repository` * string | Repository is an optional alternate OCI repository to use for image signatures and attestations that match this rule. If specified Repository will override the default OCI image repository configured for the installation. The repository can also be overridden per Attestor or Attestation.
`mutateDigest` * bool | MutateDigest enables replacement of image tags with digests. Defaults to true.
`verifyDigest` * bool | VerifyDigest validates that images have a digest.
`validate` * ValidateImageVerification | Validation checks conditions across multiple image verification attestations or context entries
`required` * bool | Required validates that images are verified i.e. have matched passed a signature or attestation check.
`imageRegistryCredentials` * ImageRegistryCredentials | ImageRegistryCredentials provides credentials that will be used for authentication with registry
`useCache` * bool | UseCache enables caching of image verify responses for this rule

### MatchResources

(Appears in: CleanupPolicySpec, PolicyExceptionSpec, PolicyExceptionSpec, Rule)

MatchResources is used to specify resource and admission review request data for which a policy rule is applicable.

Field | Description
--- | ---
`any` ResourceFilters | Any allows specifying resources which will be ORed
`all` ResourceFilters | All allows specifying resources which will be ANDed

### PolicyExceptionSpec

(Appears in: PolicyException)

PolicyExceptionSpec stores policy exception spec

Field | Description
--- | ---
`background` * bool | Background controls if exceptions are applied to existing policies during a background scan. Optional. Default value is "true". The value must be set to "false" if the policy rule uses variables that are only available in the admission review request (e.g. user name).
`match` * MatchResources | Match defines match clause used to check if a resource applies to the exception
`conditions` AnyAllConditions | Conditions are used to determine if a resource applies to the exception by evaluating a set of conditions. The declaration can contain nested `any` or `all` statements.
`exceptions` * []Exception | Exceptions is a list policy/rules to be excluded
`podSecurity` []PodSecurityStandard | PodSecurity specifies the Pod Security Standard controls to be excluded. Applicable only to policies that have validate.podSecurity subrule.

### ResourceDescription

(Appears in:)

ResourceDescription contains criteria used to match resources.

Field | Description
--- | ---
`kinds` []string | Kinds is a list of resource kinds.
`names` []string | Names are the names of the resources. Each name supports wildcard characters "*" (matches zero or many characters) and "?" (at least one character).
`namespaces` []string | Namespaces is a list of namespaces names. Each name supports wildcard characters "*" (matches zero or many characters) and "?" (at least one character).
`annotations` map[string]string | Annotations is a map of annotations (key-value pairs of type string). Annotation keys and values support the wildcard characters "*" (matches zero or many characters) and "?" (matches at least one character).
`selector` meta/v1.LabelSelector | Selector is a label selector. Label keys and values in `matchLabels` support the wildcard characters `*` (matches zero or many characters) and `?` (matches one character). Wildcards allows writing label selectors like ["storage.k8s.io/": ""]. Note that using ["" : ""] matches any key and value but does not match an empty label set.
`namespaceSelector` meta/v1.LabelSelector | NamespaceSelector is a label selector for the resource namespace. Label keys and values in `matchLabels` support the wildcard characters `*` (matches zero or many characters) and `?` (matches one character).Wildcards allows writing label selectors like ["storage.k8s.io/": ""]. Note that using ["" : ""] matches any key and value but does not match an empty label set.
`operations` []AdmissionOperation | Operations can contain values ["CREATE, "UPDATE", "CONNECT", "DELETE"], which are used to match a specific action.

### Rule

(Appears in: Spec)

Rule defines a validation, mutation, or generation control for matching resources. Each rules contains a match declaration to select resources, and an optional exclude declaration to specify which resources to exclude.

Field | Description
--- | ---
`name` * string | Name is a label to identify the rule, It must be unique within the policy.
`context` []ContextEntry | Context defines variables and data sources that can be used during rule execution.
`match` * MatchResources | MatchResources defines when this policy rule should be applied. The match criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the user name or role. At least one kind is required.
`exclude` MatchResources | ExcludeResources defines when this policy rule should not be applied. The exclude criteria can include resource information (e.g. kind, name, namespace, labels) and admission review request information like the name or role.
`imageExtractors` ImageExtractorConfigs | ImageExtractors defines a mapping from kinds to ImageExtractorConfigs. This config is only valid for verifyImages rules.
`preconditions` AnyAllConditions | Preconditions are used to determine if a policy rule should be applied by evaluating a set of conditions. The declaration can contain nested `any` or `all` statements. See: https://kyverno.io/docs/writing-policies/preconditions/
`celPreconditions` []admissionregistration/v1.MatchCondition | CELPreconditions are used to determine if a policy rule should be applied by evaluating a set of CEL conditions. It can only be used with the validate.cel subrule
`mutate` Mutation | Mutation is used to modify matching resources.
`validate` Validation | Validation is used to validate matching resources.
`generate` Generation | Generation is used to create new resources.
`verifyImages` []ImageVerification | VerifyImages is used to verify image signatures and mutate them to add a digest
`skipBackgroundRequests` * bool | SkipBackgroundRequests bypasses admission requests that are sent by the background controller. The default value is set to "true", it must be set to "false" to apply generate and mutateExisting rules to those requests.

### Spec

(Appears in: ClusterPolicy, Policy)

Spec contains a list of Rule instances and other policy controls.

Field | Description
--- | ---
`rules` * []Rule | Rules is a list of Rule instances. A Policy contains multiple rules and each rule can validate, mutate, or generate resources.
`applyRules` ApplyRulesType | ApplyRules controls how rules in a policy are applied. Rule are processed in the order of declaration. When set to `One` processing stops after a rule has been applied i.e. the rule matches and results in a pass, fail, or error. When set to `All` all rules in the policy are processed. The default is `All`.
`failurePolicy` * FailurePolicyType | Deprecated, use failurePolicy under the webhookConfiguration instead.
`validationFailureAction` * ValidationFailureAction | Deprecated, use validationFailureAction under the validate rule instead.
`validationFailureActionOverrides` * []ValidationFailureActionOverride | Deprecated, use validationFailureActionOverrides under the validate rule instead.
`emitWarning` bool | EmitWarning enables API response warnings for mutate policy rules or validate policy rules with validationFailureAction set to Audit. Enabling this option will extend admission request processing times. The default value is "false".
`admission` bool | Admission controls if rules are applied during admission. Optional. Default value is "true".
`background` bool | Background controls if rules are applied to existing resources during a background scan. Optional. Default value is "true". The value must be set to "false" if the policy rule uses variables that are only available in the admission review request (e.g. user name).
`schemaValidation` * bool | Deprecated.
`webhookTimeoutSeconds` * int32 | Deprecated, use webhookTimeoutSeconds under webhookConfiguration instead.
`mutateExistingOnPolicyUpdate` bool | Deprecated, use mutateExistingOnPolicyUpdate under the mutate rule instead
`generateExistingOnPolicyUpdate` bool | Deprecated, use generateExisting instead
`generateExisting` * bool | Deprecated, use generateExisting under the generate rule instead
`useServerSideApply` bool | UseServerSideApply controls whether to use server-side apply for generate rules If is set to "true" create & update for generate rules will use apply instead of create/update. Defaults to "false" if not specified.
`webhookConfiguration` WebhookConfiguration | WebhookConfiguration specifies the custom configuration for Kubernetes admission webhookconfiguration.

### Validation

(Appears in: Rule)

Validation defines checks to be performed on matching resources.

Field | Description
--- | ---
`failureAction` ValidationFailureAction | FailureAction defines if a validation policy rule violation should block the admission review request (Enforce), or allow (Audit) the admission review request and report an error in a policy report. Optional. Allowed values are Audit or Enforce.
`failureActionOverrides` []ValidationFailureActionOverride | FailureActionOverrides is a Cluster Policy attribute that specifies FailureAction namespace-wise. It overrides FailureAction for the specified namespaces.
`message` string | Message specifies a custom message to be displayed on failure.
`manifests` Manifests | Manifest specifies conditions for manifest verification
`foreach` []ForEachValidation | ForEach applies validate rules to a list of sub-elements by creating a context for each entry in the list and looping over it to apply the specified logic.
`pattern` * github.com/kyverno/kyverno/api/kyverno.Any | Pattern specifies an overlay-style pattern used to check resources.
`anyPattern` * github.com/kyverno/kyverno/api/kyverno.Any | AnyPattern specifies list of validation patterns. At least one of the patterns must be satisfied for the validation rule to succeed.
`deny` Deny | Deny defines conditions used to pass or fail a validation rule.
`podSecurity` PodSecurity | PodSecurity applies exemptions for Kubernetes Pod Security admission by specifying exclusions for Pod Security Standards controls.
`cel` CEL | CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/).
`assert` AssertionTree | Assert defines a kyverno-json assertion tree.