2022-09-28 11:45:16 +00:00
---
apiVersion : apiextensions.k8s.io/v1
kind : CustomResourceDefinition
metadata :
annotations :
2023-03-29 11:24:37 +00:00
controller-gen.kubebuilder.io/version : v0.11.3
2022-09-28 11:45:16 +00:00
creationTimestamp : null
name : admissionreports.kyverno.io
spec :
group : kyverno.io
names :
2022-10-24 10:40:38 +00:00
categories :
- kyverno
2022-09-28 11:45:16 +00:00
kind : AdmissionReport
listKind : AdmissionReportList
plural : admissionreports
shortNames :
- admr
singular : admissionreport
scope : Namespaced
versions :
- additionalPrinterColumns :
2023-03-17 12:07:17 +00:00
- jsonPath : .metadata.creationTimestamp
name : AGE
type : date
2022-09-28 11:45:16 +00:00
- jsonPath : .spec.summary.pass
2023-03-17 12:07:17 +00:00
name : PASS
2022-09-28 11:45:16 +00:00
type : integer
- jsonPath : .spec.summary.fail
2023-03-17 12:07:17 +00:00
name : FAIL
2022-09-28 11:45:16 +00:00
type : integer
- jsonPath : .spec.summary.warn
2023-03-17 12:07:17 +00:00
name : WARN
2022-09-28 11:45:16 +00:00
type : integer
- jsonPath : .spec.summary.error
2023-03-17 12:07:17 +00:00
name : ERROR
2022-09-28 11:45:16 +00:00
type : integer
- jsonPath : .spec.summary.skip
2023-03-17 12:07:17 +00:00
name : SKIP
2022-09-28 11:45:16 +00:00
type : integer
2023-03-17 12:07:17 +00:00
- jsonPath : .metadata.labels['audit\.kyverno\.io/resource\.gvr']
name : GVR
priority : 1
type : string
- jsonPath : .metadata.labels['audit\.kyverno\.io/resource\.name']
name : REF
2022-09-28 11:45:16 +00:00
priority : 1
type : string
2022-11-24 13:21:08 +00:00
- jsonPath : .metadata.labels['audit\.kyverno\.io/report\.aggregate']
name : AGGREGATE
priority : 1
type : string
2022-09-28 11:45:16 +00:00
name : v1alpha2
schema :
openAPIV3Schema :
description : AdmissionReport is the Schema for the AdmissionReports API
properties :
apiVersion :
description : 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info : https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type : string
kind :
description : 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info : https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type : string
metadata :
type : object
spec :
properties :
owner :
description : Owner is a reference to the report owner (e.g. a Deployment,
Namespace, or Node)
properties :
apiVersion :
description : API version of the referent.
type : string
blockOwnerDeletion :
description : If true, AND if the owner has the "foregroundDeletion"
finalizer, then the owner cannot be deleted from the key-value
2022-10-05 10:53:43 +00:00
store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
for how the garbage collector interacts with this field and
enforces the foreground deletion. Defaults to false. To set
this field, a user needs "delete" permission of the owner, otherwise
422 (Unprocessable Entity) will be returned.
2022-09-28 11:45:16 +00:00
type : boolean
controller :
description : If true, this reference points to the managing controller.
type : boolean
kind :
description: 'Kind of the referent. More info : https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type : string
name :
description: 'Name of the referent. More info : http://kubernetes.io/docs/user-guide/identifiers#names'
type : string
uid :
description: 'UID of the referent. More info : http://kubernetes.io/docs/user-guide/identifiers#uids'
type : string
required :
- apiVersion
- kind
- name
- uid
type : object
x-kubernetes-map-type : atomic
results :
description : PolicyReportResult provides result details
items :
description : PolicyReportResult provides the result for an individual
policy
properties :
category :
description : Category indicates policy category
type : string
message :
description : Description is a short user friendly message for
the policy rule
type : string
policy :
description : Policy is the name or identifier of the policy
type : string
properties :
additionalProperties :
type : string
description : Properties provides additional information for
the policy rule
type : object
resourceSelector :
description : SubjectSelector is an optional label selector for
checked Kubernetes resources. For example, a policy result
may apply to all pods that match a label. Either a Subject
or a SubjectSelector can be specified. If neither are provided,
the result is assumed to be for the policy report scope.
properties :
matchExpressions :
description : matchExpressions is a list of label selector
requirements. The requirements are ANDed.
items :
description : A label selector requirement is a selector
that contains values, a key, and an operator that relates
the key and values.
properties :
key :
description : key is the label key that the selector
applies to.
type : string
operator :
description : operator represents a key's relationship
to a set of values. Valid operators are In, NotIn,
Exists and DoesNotExist.
type : string
values :
description : values is an array of string values.
If the operator is In or NotIn, the values array
must be non-empty. If the operator is Exists or
DoesNotExist, the values array must be empty. This
array is replaced during a strategic merge patch.
items :
type : string
type : array
required :
- key
- operator
type : object
type : array
matchLabels :
additionalProperties :
type : string
description : matchLabels is a map of {key,value} pairs.
A single {key,value} in the matchLabels map is equivalent
to an element of matchExpressions, whose key field is
"key" , the operator is "In", and the values array contains
only "value". The requirements are ANDed.
type : object
type : object
x-kubernetes-map-type : atomic
resources :
description : Subjects is an optional reference to the checked
Kubernetes resources
items :
2022-10-05 10:53:43 +00:00
description : "ObjectReference contains enough information
2022-09-28 11:45:16 +00:00
to let you inspect or modify the referred object. --- New
uses of this type are discouraged because of difficulty
2022-10-05 10:53:43 +00:00
describing its usage when embedded in APIs. 1. Ignored fields.
\ It includes many fields which are not generally honored.
\ For instance, ResourceVersion and FieldPath are both very
rarely valid in actual usage. 2. Invalid usage help. It
is impossible to add specific help for individual usage.
\ In most embedded usages, there are particular restrictions
like, \"must refer only to types A and B\" or \"UID not
honored\" or \"name must be restricted\". Those cannot be
well described when embedded. 3. Inconsistent validation.
\ Because the usages are different, the validation rules
are different by usage, which makes it hard for users to
predict what will happen. 4. The fields are both imprecise
and overly precise. Kind is not a precise mapping to a
URL. This can produce ambiguity during interpretation and
require a REST mapping. In most cases, the dependency is
on the group,resource tuple and the version of the actual
2022-09-28 11:45:16 +00:00
struct is irrelevant. 5. We cannot easily change it. Because
this type is embedded in many locations, updates to this
2022-10-05 10:53:43 +00:00
type will affect numerous schemas. Don't make new APIs
embed an underspecified API type they do not control. \n
Instead of using this type, create a locally provided and
used type that is well-focused on your reference. For example,
ServiceReferences for admission registration : https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
."
2022-09-28 11:45:16 +00:00
properties :
apiVersion :
description : API version of the referent.
type : string
fieldPath :
description : 'If referring to a piece of an object instead
of an entire object, this string should contain a valid
JSON/Go field access statement, such as desiredState.manifest.containers[2].
For example, if the object reference is to a container
within a pod, this would take on a value like : "spec.containers{name}"
(where "name" refers to the name of the container that
triggered the event) or if no container name is specified
"spec.containers[2]" (container with index 2 in this
pod). This syntax is chosen only to have some well-defined
way of referencing a part of an object. TODO : this design
is not final and this field is subject to change in
the future.'
type : string
kind :
description: 'Kind of the referent. More info : https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type : string
name :
description: 'Name of the referent. More info : https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
type : string
namespace :
description: 'Namespace of the referent. More info : https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
type : string
resourceVersion :
description : 'Specific resourceVersion to which this reference
is made, if any. More info : https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
type : string
uid :
description: 'UID of the referent. More info : https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
type : string
type : object
x-kubernetes-map-type : atomic
type : array
result :
description : Result indicates the outcome of the policy rule
execution
enum :
- pass
- fail
- warn
- error
- skip
type : string
rule :
description : Rule is the name or identifier of the rule within
the policy
type : string
scored :
description : Scored indicates if this result is scored
type : boolean
severity :
description : Severity indicates policy check result criticality
enum :
- critical
- high
- low
- medium
- info
type : string
source :
description : Source is an identifier for the policy engine that
manages this report
type : string
timestamp :
description : Timestamp indicates the time the result was found
properties :
nanos :
description : Non-negative fractions of a second at nanosecond
resolution. Negative second values with fractions must
still have non-negative nanos values that count forward
in time. Must be from 0 to 999,999,999 inclusive. This
field may be limited in precision depending on context.
format : int32
type : integer
seconds :
description : Represents seconds of UTC time since Unix epoch
1970-01-01T00:00:00Z . Must be from 0001-01-01T00:00:00Z
to 9999-12-31T23:59:59Z inclusive.
format : int64
type : integer
required :
- nanos
- seconds
type : object
required :
- policy
type : object
type : array
summary :
description : PolicyReportSummary provides a summary of results
properties :
error :
description : Error provides the count of policies that could not
be evaluated
type : integer
fail :
description : Fail provides the count of policies whose requirements
were not met
type : integer
pass :
description : Pass provides the count of policies whose requirements
were met
type : integer
skip :
description : Skip indicates the count of policies that were not
selected for evaluation
type : integer
warn :
description : Warn provides the count of non-scored policies whose
requirements were not met
type : integer
type : object
required :
- owner
type : object
required :
- spec
type : object
served : true
storage : true
subresources : {}
