2020-11-12 16:44:14 -08:00
|
|
|
---
|
|
|
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
|
|
|
kind: CustomResourceDefinition
|
|
|
|
|
metadata:
|
|
|
|
|
annotations:
|
2024-05-09 16:47:44 +08:00
|
|
|
controller-gen.kubebuilder.io/version: v0.15.0
|
2020-11-12 16:44:14 -08:00
|
|
|
name: policies.kyverno.io
|
|
|
|
|
spec:
|
|
|
|
|
group: kyverno.io
|
|
|
|
|
names:
|
2022-10-24 12:40:38 +02:00
|
|
|
categories:
|
|
|
|
|
- kyverno
|
2020-11-12 16:44:14 -08:00
|
|
|
kind: Policy
|
|
|
|
|
listKind: PolicyList
|
|
|
|
|
plural: policies
|
2020-11-12 19:48:39 -08:00
|
|
|
shortNames:
|
|
|
|
|
- pol
|
2020-11-12 16:44:14 -08:00
|
|
|
singular: policy
|
|
|
|
|
scope: Namespaced
|
|
|
|
|
versions:
|
2020-11-12 19:48:39 -08:00
|
|
|
- additionalPrinterColumns:
|
2023-06-28 14:54:27 +02:00
|
|
|
- jsonPath: .spec.admission
|
|
|
|
|
name: ADMISSION
|
|
|
|
|
type: boolean
|
2020-11-12 19:48:39 -08:00
|
|
|
- jsonPath: .spec.background
|
2023-06-28 14:54:27 +02:00
|
|
|
name: BACKGROUND
|
2022-09-14 08:54:56 +02:00
|
|
|
type: boolean
|
2020-11-12 19:48:39 -08:00
|
|
|
- jsonPath: .spec.validationFailureAction
|
2023-06-28 14:54:27 +02:00
|
|
|
name: VALIDATE ACTION
|
2021-09-29 20:53:34 -07:00
|
|
|
type: string
|
2023-01-30 11:16:49 +01:00
|
|
|
- jsonPath: .status.conditions[?(@.type == "Ready")].status
|
2023-06-28 14:54:27 +02:00
|
|
|
name: READY
|
2023-01-30 11:16:49 +01:00
|
|
|
type: string
|
2022-10-25 00:58:23 +05:30
|
|
|
- jsonPath: .metadata.creationTimestamp
|
2023-06-28 14:54:27 +02:00
|
|
|
name: AGE
|
2022-10-25 00:58:23 +05:30
|
|
|
type: date
|
2023-06-28 14:54:27 +02:00
|
|
|
- jsonPath: .spec.failurePolicy
|
|
|
|
|
name: FAILURE POLICY
|
|
|
|
|
priority: 1
|
|
|
|
|
type: string
|
2022-10-27 15:35:32 +05:30
|
|
|
- jsonPath: .status.rulecount.validate
|
2023-06-28 14:54:27 +02:00
|
|
|
name: VALIDATE
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
|
|
|
|
- jsonPath: .status.rulecount.mutate
|
2023-06-28 14:54:27 +02:00
|
|
|
name: MUTATE
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
|
|
|
|
- jsonPath: .status.rulecount.generate
|
2023-06-28 14:54:27 +02:00
|
|
|
name: GENERATE
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
|
|
|
|
- jsonPath: .status.rulecount.verifyimages
|
2023-06-28 14:54:27 +02:00
|
|
|
name: VERIFY IMAGES
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
2023-03-24 08:33:55 +01:00
|
|
|
- jsonPath: .status.conditions[?(@.type == "Ready")].message
|
|
|
|
|
name: MESSAGE
|
|
|
|
|
type: string
|
2020-11-12 19:48:39 -08:00
|
|
|
name: v1
|
2020-11-12 16:44:14 -08:00
|
|
|
schema:
|
|
|
|
|
openAPIV3Schema:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Policy declares validation, mutation, and generation behaviors for matching resources.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/ for more information.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
|
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
|
|
|
may reject unrecognized values.
|
|
|
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind is a string value representing the REST resource this object represents.
|
|
|
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
|
|
|
Cannot be updated.
|
|
|
|
|
In CamelCase.
|
|
|
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
metadata:
|
|
|
|
|
type: object
|
|
|
|
|
spec:
|
2021-06-22 22:33:15 +05:30
|
|
|
description: Spec defines policy behaviors and contains one or more rules.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
2023-06-28 14:54:27 +02:00
|
|
|
admission:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Admission controls if rules are applied during admission.
|
2023-06-28 14:54:27 +02:00
|
|
|
Optional. Default value is "true".
|
|
|
|
|
type: boolean
|
2022-07-29 00:02:26 -07:00
|
|
|
applyRules:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ApplyRules controls how rules in a policy are applied. Rule are processed in
|
|
|
|
|
the order of declaration. When set to `One` processing stops after a rule has
|
|
|
|
|
been applied i.e. the rule matches and results in a pass, fail, or error. When
|
|
|
|
|
set to `All` all rules in the policy are processed. The default is `All`.
|
2022-07-29 00:02:26 -07:00
|
|
|
enum:
|
|
|
|
|
- All
|
|
|
|
|
- One
|
|
|
|
|
type: string
|
2020-11-12 16:44:14 -08:00
|
|
|
background:
|
2022-09-14 08:54:56 +02:00
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Background controls if rules are applied to existing resources during a background scan.
|
|
|
|
|
Optional. Default value is "true". The value must be set to "false" if the policy rule
|
|
|
|
|
uses variables that are only available in the admission review request (e.g. user name).
|
2020-11-12 16:44:14 -08:00
|
|
|
type: boolean
|
2021-09-29 20:53:34 -07:00
|
|
|
failurePolicy:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
FailurePolicy defines how unexpected policy errors and webhook response timeout errors are handled.
|
|
|
|
|
Rules within the same policy share the same failure behavior.
|
|
|
|
|
This field should not be accessed directly, instead `GetFailurePolicy()` should be used.
|
2022-10-21 23:43:36 +05:30
|
|
|
Allowed values are Ignore or Fail. Defaults to Fail.
|
2021-09-29 20:53:34 -07:00
|
|
|
enum:
|
|
|
|
|
- Ignore
|
|
|
|
|
- Fail
|
|
|
|
|
type: string
|
2023-03-03 17:34:55 +08:00
|
|
|
generateExisting:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
GenerateExisting controls whether to trigger generate rule in existing resources
|
|
|
|
|
If is set to "true" generate rule will be triggered and applied to existing matched resources.
|
|
|
|
|
Defaults to "false" if not specified.
|
2022-05-09 12:43:11 +05:30
|
|
|
type: boolean
|
2023-03-24 00:36:51 +08:00
|
|
|
generateExistingOnPolicyUpdate:
|
|
|
|
|
description: Deprecated, use generateExisting instead
|
|
|
|
|
type: boolean
|
2022-05-06 13:46:36 +08:00
|
|
|
mutateExistingOnPolicyUpdate:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MutateExistingOnPolicyUpdate controls if a mutateExisting policy is applied on policy events.
|
|
|
|
|
Default value is "false".
|
2022-05-05 18:56:27 +08:00
|
|
|
type: boolean
|
2020-11-12 16:44:14 -08:00
|
|
|
rules:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rules is a list of Rule instances. A Policy contains multiple rules and
|
|
|
|
|
each rule can validate, mutate, or generate resources.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rule defines a validation, mutation, or generation control for matching resources.
|
|
|
|
|
Each rules contains a match declaration to select resources, and an optional exclude
|
|
|
|
|
declaration to specify which resources to exclude.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
2023-06-01 00:30:55 +03:00
|
|
|
celPreconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CELPreconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of CEL conditions. It can only be used with the validate.cel subrule
|
2023-06-01 00:30:55 +03:00
|
|
|
items:
|
|
|
|
|
description: MatchCondition represents a condition which must
|
|
|
|
|
by fulfilled for a request to be sent to a webhook.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
|
|
|
|
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
'object' - The object from the incoming request. The value is null for DELETE requests.
|
|
|
|
|
'oldObject' - The existing object. The value is null for CREATE requests.
|
|
|
|
|
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
|
|
|
|
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
|
|
|
|
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
|
|
|
|
request resource.
|
|
|
|
|
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
|
|
|
|
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
|
|
|
|
the associated expression.
|
|
|
|
|
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
|
|
|
|
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
|
|
|
|
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
|
|
|
|
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2020-11-12 16:44:14 -08:00
|
|
|
context:
|
2020-12-01 23:19:08 -08:00
|
|
|
description: Context defines variables and data sources that
|
2020-11-15 22:47:55 -08:00
|
|
|
can be used during rule execution.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
2021-02-01 12:59:13 -08:00
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2021-02-01 12:59:13 -08:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data sent to
|
|
|
|
|
the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the HTTP POST
|
|
|
|
|
data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier for
|
|
|
|
|
the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-02-01 12:59:13 -08:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2021-02-01 12:59:13 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request type (GET
|
|
|
|
|
or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a JSON web
|
|
|
|
|
service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2021-02-01 12:59:13 -08:00
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2021-02-01 12:59:13 -08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
configMap:
|
2021-02-01 12:59:13 -08:00
|
|
|
description: ConfigMap is the ConfigMap reference.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
name:
|
2021-02-01 12:59:13 -08:00
|
|
|
description: Name is the ConfigMap name.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
namespace:
|
2021-02-01 12:59:13 -08:00
|
|
|
description: Namespace is the ConfigMap namespace.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
2021-02-01 12:59:13 -08:00
|
|
|
required:
|
|
|
|
|
- name
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
2022-01-17 04:06:44 +00:00
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-01-17 04:06:44 +00:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides credentials
|
|
|
|
|
that will be used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows insecure
|
2023-10-31 05:30:26 +00:00
|
|
|
access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers
|
|
|
|
|
required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-01-17 04:06:44 +00:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2022-01-17 04:06:44 +00:00
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-01-17 04:06:44 +00:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
name:
|
2021-02-01 12:59:13 -08:00
|
|
|
description: Name is the variable name.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
2022-04-25 12:06:07 +01:00
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath context
|
|
|
|
|
variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
2022-04-25 12:06:07 +01:00
|
|
|
expression evaluates to nil
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-04-25 12:06:07 +01:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON object representable
|
|
|
|
|
in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
exclude:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ExcludeResources defines when this policy rule should not be applied. The exclude
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the name or role.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
2021-07-29 01:29:53 +05:30
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
2021-11-04 23:26:22 -07:00
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
2021-07-29 01:29:53 +05:30
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-07-29 01:29:53 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2021-07-29 01:29:53 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
2021-11-04 23:26:22 -07:00
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
2021-07-29 01:29:53 +05:30
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-07-29 01:29:53 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2021-07-29 01:29:53 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2020-11-12 16:44:14 -08:00
|
|
|
clusterRoles:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: ClusterRoles is the list of cluster-wide role
|
|
|
|
|
names for the user.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ResourceDescription contains information about the resource being created or modified.
|
|
|
|
|
Requires at least one tag to be specified when under MatchResources.
|
|
|
|
|
Specifying ResourceDescription directly under match is being deprecated.
|
2022-03-22 15:24:40 +01:00
|
|
|
Please specify under "any" or "all" instead.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
kinds:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Kinds is a list of resource kinds.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
2021-06-29 11:01:22 +05:30
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-06-29 11:01:22 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-02-19 09:09:41 -08:00
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the
|
|
|
|
|
selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-02-19 09:09:41 -08:00
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-02-19 09:09:41 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used to
|
|
|
|
|
match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one of the
|
|
|
|
|
values CREATE, UPDATE, CONNECT, DELETE, which are
|
|
|
|
|
used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-02-19 09:09:41 -08:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2021-02-04 02:39:42 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-02-04 02:39:42 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the
|
|
|
|
|
selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-02-04 02:39:42 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2021-02-04 02:39:42 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-02-04 02:39:42 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
roles:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Roles is the list of namespaced role names
|
|
|
|
|
for the user.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Subjects is the list of subject names like
|
|
|
|
|
users, user groups, and service accounts.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2020-11-12 16:44:14 -08:00
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
generate:
|
2020-12-01 23:19:08 -08:00
|
|
|
description: Generation is used to create new resources.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: APIVersion specifies resource apiVersion.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
clone:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Clone specifies the source resource used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone can be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
name:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Name specifies name of the resource.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
namespace:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Namespace specifies source resource namespace.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-09-08 10:17:09 +05:30
|
|
|
cloneList:
|
|
|
|
|
description: CloneList specifies the list of source resource
|
|
|
|
|
used to populate each generated resource.
|
|
|
|
|
properties:
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies source resource namespace.
|
|
|
|
|
type: string
|
2022-09-28 21:14:38 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels`.
|
|
|
|
|
wildcard characters are not supported.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the
|
|
|
|
|
selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2022-09-28 21:14:38 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2022-09-08 10:17:09 +05:30
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
data:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Data provides the resource declaration used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone must be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2020-11-12 16:44:14 -08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
kind:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Kind specifies resource kind.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
name:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Name specifies the resource name.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
namespace:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Namespace specifies resource namespace.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
synchronize:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Synchronize controls if generated resources should be kept in-sync with their source resource.
|
|
|
|
|
If Synchronize is set to "true" changes to generated resources will be overwritten with resource
|
|
|
|
|
data from Data or the resource specified in the Clone declaration.
|
|
|
|
|
Optional. Defaults to "false" if not specified.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: boolean
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
2022-04-14 17:08:30 +01:00
|
|
|
imageExtractors:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
2023-02-08 06:54:59 -05:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath expression to apply to the image value.
|
|
|
|
|
This is useful when the extracted image begins with a prefix like 'docker://'.
|
|
|
|
|
The 'trim_prefix' function may be used to trim the prefix: trim_prefix(@, 'docker://').
|
|
|
|
|
Note - Image digest mutation may not be used when applying a JMESPAth to an image.
|
2023-02-08 06:54:59 -05:00
|
|
|
type: string
|
2022-04-14 17:08:30 +01:00
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Key is an optional name of the field within 'path' that will be used to uniquely identify an image.
|
2022-04-14 17:08:30 +01:00
|
|
|
Note - this field MUST be unique.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the entry the image will be available under 'images.<name>' in the context.
|
|
|
|
|
If this field is not defined, image entries will appear under 'images.custom'.
|
2022-04-14 17:08:30 +01:00
|
|
|
type: string
|
|
|
|
|
path:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Path is the path to the object containing the image field in a custom resource.
|
|
|
|
|
It should be slash-separated. Each slash-separated key must be a valid YAML key or a wildcard '*'.
|
|
|
|
|
Wildcard keys are expanded in case of arrays or objects.
|
2022-04-14 17:08:30 +01:00
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is an optional name of the field within 'path' that points to the image URI.
|
|
|
|
|
This is useful when a custom 'key' is also defined.
|
2022-04-14 17:08:30 +01:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- path
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageExtractors defines a mapping from kinds to ImageExtractorConfigs.
|
|
|
|
|
This config is only valid for verifyImages rules.
|
2022-04-14 17:08:30 +01:00
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
match:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MatchResources defines when this policy rule should be applied. The match
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the user name or role.
|
|
|
|
|
At least one kind is required.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
2021-07-29 01:29:53 +05:30
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
2021-11-04 23:26:22 -07:00
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
2021-07-29 01:29:53 +05:30
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-07-29 01:29:53 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2021-07-29 01:29:53 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
2021-11-04 23:26:22 -07:00
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
2021-07-29 01:29:53 +05:30
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-07-29 01:29:53 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-07-29 01:29:53 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2021-07-29 01:29:53 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2021-07-29 01:29:53 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2021-07-29 01:29:53 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2021-07-29 01:29:53 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-07-29 01:29:53 +05:30
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2020-11-12 16:44:14 -08:00
|
|
|
clusterRoles:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: ClusterRoles is the list of cluster-wide role
|
|
|
|
|
names for the user.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ResourceDescription contains information about the resource being created or modified.
|
|
|
|
|
Requires at least one tag to be specified when under MatchResources.
|
|
|
|
|
Specifying ResourceDescription directly under match is being deprecated.
|
2021-10-05 00:27:39 +05:30
|
|
|
Please specify under "any" or "all" instead.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
kinds:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Kinds is a list of resource kinds.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
2021-06-29 11:01:22 +05:30
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-06-29 11:01:22 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-02-19 09:09:41 -08:00
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are ANDed.
|
2021-02-04 02:39:42 +05:30
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2021-02-04 02:39:42 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the
|
|
|
|
|
selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2021-02-04 02:39:42 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2021-02-04 02:39:42 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2021-02-04 02:39:42 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2021-02-19 09:09:41 -08:00
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2021-02-19 09:09:41 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used to
|
|
|
|
|
match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one of the
|
|
|
|
|
values CREATE, UPDATE, CONNECT, DELETE, which are
|
|
|
|
|
used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2021-02-19 09:09:41 -08:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2021-02-04 02:39:42 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are ANDed.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the
|
|
|
|
|
selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
roles:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Roles is the list of namespaced role names
|
|
|
|
|
for the user.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Subjects is the list of subject names like
|
|
|
|
|
users, user groups, and service accounts.
|
2020-11-12 16:44:14 -08:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-07-01 17:25:59 +02:00
|
|
|
x-kubernetes-map-type: atomic
|
2020-11-12 16:44:14 -08:00
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
mutate:
|
2020-12-01 23:19:08 -08:00
|
|
|
description: Mutation is used to modify matching resources.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
2021-10-07 16:12:34 +05:30
|
|
|
foreach:
|
2022-03-07 19:26:19 +05:30
|
|
|
description: ForEach applies mutation rules to a list of
|
|
|
|
|
sub-elements by creating a context for each entry in the
|
|
|
|
|
list and looping over it to apply the specified logic.
|
2021-10-14 12:50:52 +05:30
|
|
|
items:
|
2023-01-20 16:56:35 +08:00
|
|
|
description: ForEachMutation applies mutation rules to
|
|
|
|
|
a list of sub-elements by creating a context for each
|
|
|
|
|
entry in the list and looping over it to apply the specified
|
2022-03-07 19:26:19 +05:30
|
|
|
logic.
|
2021-10-14 12:50:52 +05:30
|
|
|
properties:
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2021-10-14 12:50:52 +05:30
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2021-10-14 12:50:52 +05:30
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data
|
|
|
|
|
sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the
|
|
|
|
|
HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-10-14 12:50:52 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2021-10-14 12:50:52 +05:30
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a
|
|
|
|
|
JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
2022-12-27 00:36:49 -08:00
|
|
|
the server certificate.
|
|
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2021-10-14 12:50:52 +05:30
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2021-10-14 12:50:52 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-01-17 04:06:44 +00:00
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
2022-01-17 04:06:44 +00:00
|
|
|
details.
|
|
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
2023-10-31 05:30:26 +00:00
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-01-17 04:06:44 +00:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2022-01-17 04:06:44 +00:00
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-01-17 04:06:44 +00:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
2021-10-14 12:50:52 +05:30
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
2022-04-25 12:06:07 +01:00
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-04-25 12:06:07 +01:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-04-25 12:06:07 +01:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON
|
|
|
|
|
object representable in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
2021-10-14 12:50:52 +05:30
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-12-12 07:20:20 -08:00
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2021-10-14 12:50:52 +05:30
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2021-10-14 12:50:52 +05:30
|
|
|
type: string
|
2023-05-05 17:40:23 +02:00
|
|
|
order:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Order defines the iteration order on the list.
|
|
|
|
|
Can be Ascending to iterate from first to last element or Descending to iterate in from last to first element.
|
2023-05-05 17:40:23 +02:00
|
|
|
enum:
|
|
|
|
|
- Ascending
|
|
|
|
|
- Descending
|
|
|
|
|
type: string
|
2021-10-14 12:50:52 +05:30
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2021-10-14 12:50:52 +05:30
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2022-01-04 17:36:33 -08:00
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
2022-01-04 17:36:33 -08:00
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
|
|
|
|
type: string
|
2021-10-14 12:50:52 +05:30
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2021-10-07 16:12:34 +05:30
|
|
|
properties:
|
2021-10-14 12:50:52 +05:30
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2021-10-14 12:50:52 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2021-10-14 12:50:52 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2021-10-14 12:50:52 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- NotIn
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2021-10-14 12:50:52 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2021-10-14 12:50:52 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2021-10-14 12:50:52 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2021-10-14 12:50:52 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- NotIn
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2021-10-14 12:50:52 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-10-07 16:12:34 +05:30
|
|
|
type: object
|
2021-10-14 12:50:52 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2020-11-12 16:44:14 -08:00
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2020-11-15 22:47:55 -08:00
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
2020-11-18 17:36:06 -08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2020-11-12 16:44:14 -08:00
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
|
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
2022-04-25 20:20:40 +08:00
|
|
|
targets:
|
|
|
|
|
description: Targets defines the target resources to be
|
|
|
|
|
mutated.
|
|
|
|
|
items:
|
2023-04-03 21:58:58 +02:00
|
|
|
description: TargetResourceSpec defines targets for mutating
|
|
|
|
|
existing resources.
|
2022-04-25 20:20:40 +08:00
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
|
|
|
|
description: APIVersion specifies resource apiVersion.
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data
|
|
|
|
|
sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the
|
|
|
|
|
HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a
|
|
|
|
|
JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
2023-04-03 21:58:58 +02:00
|
|
|
the server certificate.
|
|
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2023-04-03 21:58:58 +02:00
|
|
|
type: object
|
|
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
2023-04-03 21:58:58 +02:00
|
|
|
details.
|
|
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
2023-10-31 05:30:26 +00:00
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON
|
|
|
|
|
object representable in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-04-25 20:20:40 +08:00
|
|
|
kind:
|
|
|
|
|
description: Kind specifies resource kind.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies the resource name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies resource namespace.
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements is supported for backwards compatibility but
|
|
|
|
|
will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2022-04-25 20:20:40 +08:00
|
|
|
type: object
|
|
|
|
|
type: array
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
name:
|
2020-12-01 23:19:08 -08:00
|
|
|
description: Name is a label to identify the rule, It must be
|
|
|
|
|
unique within the policy.
|
2021-02-19 09:09:41 -08:00
|
|
|
maxLength: 63
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements is supported for backwards compatibility but
|
|
|
|
|
will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2021-03-02 10:01:06 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-12-19 10:51:47 +00:00
|
|
|
skipBackgroundRequests:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
SkipBackgroundRequests bypasses admission requests that are sent by the background controller.
|
|
|
|
|
The default value is set to "true", it must be set to "false" to apply
|
|
|
|
|
generate and mutateExisting rules to those requests.
|
2023-12-19 10:51:47 +00:00
|
|
|
type: boolean
|
2020-11-12 16:44:14 -08:00
|
|
|
validate:
|
2020-12-01 23:19:08 -08:00
|
|
|
description: Validation is used to validate matching resources.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2020-11-18 17:36:06 -08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-06-01 00:30:55 +03:00
|
|
|
cel:
|
|
|
|
|
description: CEL allows validation checks using the Common
|
|
|
|
|
Expression Language (https://kubernetes.io/docs/reference/using-api/cel/).
|
|
|
|
|
properties:
|
|
|
|
|
auditAnnotations:
|
|
|
|
|
description: AuditAnnotations contains CEL expressions
|
|
|
|
|
which are used to produce audit annotations for the
|
|
|
|
|
audit event of the API request.
|
|
|
|
|
items:
|
|
|
|
|
description: AuditAnnotation describes how to produce
|
|
|
|
|
an audit annotation for an API request.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
key specifies the audit annotation key. The audit annotation keys of
|
|
|
|
|
a ValidatingAdmissionPolicy must be unique. The key must be a qualified
|
|
|
|
|
name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The key is combined with the resource name of the
|
|
|
|
|
ValidatingAdmissionPolicy to construct an audit annotation key:
|
|
|
|
|
"{ValidatingAdmissionPolicy name}/{key}".
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
|
|
|
|
|
and the same audit annotation key, the annotation key will be identical.
|
|
|
|
|
In this case, the first annotation written with the key will be included
|
|
|
|
|
in the audit event and all subsequent annotations with the same key
|
|
|
|
|
will be discarded.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
valueExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
valueExpression represents the expression which is evaluated by CEL to
|
|
|
|
|
produce an audit annotation value. The expression must evaluate to either
|
|
|
|
|
a string or null value. If the expression evaluates to a string, the
|
|
|
|
|
audit annotation is included with the string value. If the expression
|
|
|
|
|
evaluates to null or empty string the audit annotation will be omitted.
|
|
|
|
|
The valueExpression may be no longer than 5kb in length.
|
|
|
|
|
If the result of the valueExpression is more than 10kb in length, it
|
|
|
|
|
will be truncated to 10kb.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple ValidatingAdmissionPolicyBinding resources match an
|
|
|
|
|
API request, then the valueExpression will be evaluated for
|
|
|
|
|
each binding. All unique values produced by the valueExpressions
|
|
|
|
|
will be joined together in a comma-separated list.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- valueExpression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
expressions:
|
|
|
|
|
description: Expressions is a list of CELExpression
|
|
|
|
|
types.
|
|
|
|
|
items:
|
|
|
|
|
description: Validation specifies the CEL expression
|
|
|
|
|
which is used to apply the validation.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
|
|
|
|
description: "Expression represents the expression
|
2024-05-09 16:47:44 +08:00
|
|
|
which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL
|
|
|
|
|
expressions have access to the contents of the
|
|
|
|
|
API request/response, organized into CEL variables
|
|
|
|
|
as well as some other useful variables:\n\n\n-
|
|
|
|
|
'object' - The object from the incoming request.
|
|
|
|
|
The value is null for DELETE requests.\n- 'oldObject'
|
|
|
|
|
- The existing object. The value is null for
|
|
|
|
|
CREATE requests.\n- 'request' - Attributes of
|
|
|
|
|
the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n-
|
|
|
|
|
'params' - Parameter resource referred to by
|
|
|
|
|
the policy binding being evaluated. Only populated
|
|
|
|
|
if the policy has a ParamKind.\n- 'namespaceObject'
|
2023-08-18 05:54:05 +02:00
|
|
|
- The namespace object that the incoming object
|
|
|
|
|
belongs to. The value is null for cluster-scoped
|
2024-05-09 16:47:44 +08:00
|
|
|
resources.\n- 'variables' - Map of composited
|
2023-08-18 05:54:05 +02:00
|
|
|
variables, from its name to its lazily evaluated
|
2024-05-09 16:47:44 +08:00
|
|
|
value.\n For example, a variable named 'foo'
|
|
|
|
|
can be accessed as 'variables.foo'.\n- 'authorizer'
|
2023-06-01 00:30:55 +03:00
|
|
|
- A CEL Authorizer. May be used to perform authorization
|
|
|
|
|
checks for the principal (user or service account)
|
2024-05-09 16:47:44 +08:00
|
|
|
of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n-
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck
|
2023-06-01 00:30:55 +03:00
|
|
|
constructed from the 'authorizer' and configured
|
2024-05-09 16:47:44 +08:00
|
|
|
with the\n request resource.\n\n\nThe `apiVersion`,
|
2023-06-01 00:30:55 +03:00
|
|
|
`kind`, `metadata.name` and `metadata.generateName`
|
2024-05-09 16:47:44 +08:00
|
|
|
are always accessible from the root of the\nobject.
|
|
|
|
|
No other metadata properties are accessible.\n\n\nOnly
|
|
|
|
|
property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*`
|
|
|
|
|
are accessible.\nAccessible property names are
|
2023-06-01 00:30:55 +03:00
|
|
|
escaped according to the following rules when
|
2024-05-09 16:47:44 +08:00
|
|
|
accessed in the expression:\n- '__' escapes
|
|
|
|
|
to '__underscores__'\n- '.' escapes to '__dot__'\n-
|
|
|
|
|
'-' escapes to '__dash__'\n- '/' escapes to
|
|
|
|
|
'__slash__'\n- Property names that exactly match
|
2023-06-01 00:30:55 +03:00
|
|
|
a CEL RESERVED keyword escape to '__{keyword}__'.
|
2024-05-09 16:47:44 +08:00
|
|
|
The keywords are:\n\t \"true\", \"false\",
|
|
|
|
|
\"null\", \"in\", \"as\", \"break\", \"const\",
|
|
|
|
|
\"continue\", \"else\", \"for\", \"function\",
|
|
|
|
|
\"if\",\n\t \"import\", \"let\", \"loop\",
|
|
|
|
|
\"package\", \"namespace\", \"return\".\nExamples:\n
|
|
|
|
|
\ - Expression accessing a property named \"namespace\":
|
|
|
|
|
{\"Expression\": \"object.__namespace__ > 0\"}\n
|
|
|
|
|
\ - Expression accessing a property named \"x-prop\":
|
|
|
|
|
{\"Expression\": \"object.x__dash__prop > 0\"}\n
|
|
|
|
|
\ - Expression accessing a property named \"redact__d\":
|
|
|
|
|
{\"Expression\": \"object.redact__underscores__d
|
|
|
|
|
> 0\"}\n\n\nEquality on arrays with list type
|
|
|
|
|
of 'set' or 'map' ignores element order, i.e.
|
|
|
|
|
[1, 2] == [2, 1].\nConcatenation on arrays with
|
|
|
|
|
x-kubernetes-list-type use the semantics of
|
|
|
|
|
the list type:\n - 'set': `X + Y` performs
|
|
|
|
|
a union where the array positions of all elements
|
|
|
|
|
in `X` are preserved and\n non-intersecting
|
2023-06-01 00:30:55 +03:00
|
|
|
elements in `Y` are appended, retaining their
|
2024-05-09 16:47:44 +08:00
|
|
|
partial order.\n - 'map': `X + Y` performs
|
|
|
|
|
a merge where the array positions of all keys
|
|
|
|
|
in `X` are preserved but the values\n are
|
|
|
|
|
overwritten by values in `Y` when the key sets
|
|
|
|
|
of `X` and `Y` intersect. Elements in `Y` with\n
|
|
|
|
|
\ non-intersecting keys are appended, retaining
|
|
|
|
|
their partial order.\nRequired."
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Message represents the message displayed when validation fails. The message is required if the Expression contains
|
|
|
|
|
line breaks. The message must not contain line breaks.
|
|
|
|
|
If unset, the message is "failed rule: {Rule}".
|
|
|
|
|
e.g. "must be a URL with the host matching spec.host"
|
|
|
|
|
If the Expression contains line breaks. Message is required.
|
|
|
|
|
The message must not contain line breaks.
|
|
|
|
|
If unset, the message is "failed Expression: {Expression}".
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
messageExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
|
|
|
|
|
Since messageExpression is used as a failure message, it must evaluate to a string.
|
|
|
|
|
If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
|
|
|
|
|
If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
|
|
|
|
|
as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
|
|
|
|
|
that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
|
|
|
|
|
the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
|
|
|
|
|
messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'.
|
|
|
|
|
Example:
|
|
|
|
|
"object.x must be less than max ("+string(params.max)+")"
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
reason:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reason represents a machine-readable description of why this validation failed.
|
|
|
|
|
If this is the first validation in the list to fail, this reason, as well as the
|
|
|
|
|
corresponding HTTP response code, are used in the
|
|
|
|
|
HTTP response to the client.
|
|
|
|
|
The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge".
|
|
|
|
|
If not set, StatusReasonInvalid is used in the response to the client.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
paramKind:
|
|
|
|
|
description: ParamKind is a tuple of Group Kind and
|
|
|
|
|
Version.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIVersion is the API group version the resources belong to.
|
|
|
|
|
In format of "group/version".
|
2023-06-01 00:30:55 +03:00
|
|
|
Required.
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind is the API kind the resources belong to.
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
paramRef:
|
|
|
|
|
description: ParamRef references a parameter resource.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`name` is the name of the resource being referenced.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
`name` and `selector` are mutually exclusive properties. If one is set,
|
|
|
|
|
the other must be unset.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
namespace is the namespace of the referenced resource. Allows limiting
|
|
|
|
|
the search for params to a specific namespace. Applies to both `name` and
|
|
|
|
|
`selector` fields.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A per-namespace parameter may be used by specifying a namespace-scoped
|
|
|
|
|
`paramKind` in the policy and leaving this field empty.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
|
|
|
|
|
field results in a configuration error.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is namespace-scoped, the namespace of the object being
|
|
|
|
|
evaluated for admission will be used when this field is left unset. Take
|
|
|
|
|
care that if this is left empty the binding must not match any cluster-scoped
|
|
|
|
|
resources, which will result in an error.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
2023-08-18 05:54:05 +02:00
|
|
|
parameterNotFoundAction:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`parameterNotFoundAction` controls the behavior of the binding when the resource
|
|
|
|
|
exists, and name or selector is valid, but there are no parameters
|
|
|
|
|
matched by the binding. If the value is set to `Allow`, then no
|
|
|
|
|
matched parameters will be treated as successful validation by the binding.
|
|
|
|
|
If set to `Deny`, then no matched parameters will be subject to the
|
|
|
|
|
`failurePolicy` of the policy.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Allowed values are `Allow` or `Deny`
|
|
|
|
|
Default to `Deny`
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
selector can be used to match multiple param objects based on their labels.
|
|
|
|
|
Supply selector: {} to match all resources of the ParamKind.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple params are found, they are all evaluated with the policy expressions
|
|
|
|
|
and the results are ANDed together.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
One of `name` or `selector` must be set, but `name` and `selector` are
|
|
|
|
|
mutually exclusive properties. If one is set, the other must be unset.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2023-08-18 05:54:05 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-08-24 13:00:27 +03:00
|
|
|
variables:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Variables contain definitions of variables that can be used in composition of other expressions.
|
2023-08-24 13:00:27 +03:00
|
|
|
Each variable is defined as a named CEL expression.
|
2024-05-09 16:47:44 +08:00
|
|
|
The variables defined here will be available under `variables` in other expressions of the policy.
|
2023-08-24 13:00:27 +03:00
|
|
|
items:
|
|
|
|
|
description: Variable is the definition of a variable
|
|
|
|
|
that is used for composition.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression is the expression that will be evaluated as the value of the variable.
|
|
|
|
|
The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
|
|
|
|
The variable can be accessed in other expressions through `variables`
|
|
|
|
|
For example, if name is "foo", the variable will be available as `variables.foo`
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
deny:
|
2021-07-09 18:01:46 -07:00
|
|
|
description: Deny defines conditions used to pass or fail
|
|
|
|
|
a validation rule.
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
|
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements) is also supported for backwards compatibility
|
|
|
|
|
but will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2021-03-02 10:01:06 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
2021-10-02 18:29:25 -07:00
|
|
|
foreach:
|
2022-03-07 19:26:19 +05:30
|
|
|
description: ForEach applies validate rules to a list of
|
|
|
|
|
sub-elements by creating a context for each entry in the
|
|
|
|
|
list and looping over it to apply the specified logic.
|
2021-10-14 12:50:52 +05:30
|
|
|
items:
|
2023-01-20 16:56:35 +08:00
|
|
|
description: ForEachValidation applies validate rules
|
|
|
|
|
to a list of sub-elements by creating a context for
|
|
|
|
|
each entry in the list and looping over it to apply
|
|
|
|
|
the specified logic.
|
2021-10-14 12:50:52 +05:30
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2021-10-14 12:50:52 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2021-10-14 12:50:52 +05:30
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2021-10-14 12:50:52 +05:30
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data
|
|
|
|
|
sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the
|
|
|
|
|
HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-10-14 12:50:52 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2021-10-14 12:50:52 +05:30
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a
|
|
|
|
|
JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
2022-12-27 00:36:49 -08:00
|
|
|
the server certificate.
|
|
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2021-10-14 12:50:52 +05:30
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2021-10-14 12:50:52 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
2022-01-17 04:06:44 +00:00
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
2022-01-17 04:06:44 +00:00
|
|
|
details.
|
|
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
2023-10-31 05:30:26 +00:00
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-01-17 04:06:44 +00:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2022-01-17 04:06:44 +00:00
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-01-17 04:06:44 +00:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
2021-10-14 12:50:52 +05:30
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
2022-04-25 12:06:07 +01:00
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-04-25 12:06:07 +01:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-04-25 12:06:07 +01:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON
|
|
|
|
|
object representable in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
2021-10-14 12:50:52 +05:30
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
deny:
|
|
|
|
|
description: Deny defines conditions used to pass
|
|
|
|
|
or fail a validation rule.
|
2021-10-02 18:29:25 -07:00
|
|
|
properties:
|
2021-10-14 12:50:52 +05:30
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements) is also supported for backwards compatibility
|
2021-10-14 12:50:52 +05:30
|
|
|
but will be deprecated in the next major release.
|
2024-05-09 16:47:44 +08:00
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2021-10-14 12:50:52 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2021-10-02 18:29:25 -07:00
|
|
|
type: object
|
2022-01-04 17:36:33 -08:00
|
|
|
elementScope:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ElementScope specifies whether to use the current list element as the scope for validation. Defaults to "true" if not specified.
|
|
|
|
|
When set to "false", "request.object" is used as the validation scope within the foreach
|
|
|
|
|
block to allow referencing other elements in the subtree.
|
2022-01-04 17:36:33 -08:00
|
|
|
type: boolean
|
2022-12-12 07:20:20 -08:00
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2021-10-14 12:50:52 +05:30
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2021-10-14 12:50:52 +05:30
|
|
|
type: string
|
|
|
|
|
pattern:
|
|
|
|
|
description: Pattern specifies an overlay-style pattern
|
|
|
|
|
used to check resources.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2021-10-14 12:50:52 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2021-10-14 12:50:52 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2021-10-14 12:50:52 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2021-10-14 12:50:52 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- NotIn
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2021-10-14 12:50:52 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2021-10-14 12:50:52 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2021-10-14 12:50:52 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2021-10-14 12:50:52 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- NotIn
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
2021-10-14 12:50:52 +05:30
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2021-10-14 12:50:52 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-08-31 02:14:54 +09:00
|
|
|
manifests:
|
|
|
|
|
description: Manifest specifies conditions for manifest
|
|
|
|
|
verification
|
|
|
|
|
properties:
|
|
|
|
|
annotationDomain:
|
|
|
|
|
description: AnnotationDomain is custom domain of annotation
|
2022-09-10 18:11:38 +02:00
|
|
|
for message and signature. Default is "cosign.sigstore.dev".
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-08-31 02:14:54 +09:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-08-31 02:14:54 +09:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set of
|
|
|
|
|
Attestor used to specify a more complex
|
|
|
|
|
set of match authorities.
|
2022-08-31 02:14:54 +09:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies one
|
2023-10-31 05:30:26 +00:00
|
|
|
or more certificates.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional PEM-encoded
|
|
|
|
|
public certificate.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates used
|
|
|
|
|
to verify.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
2022-08-31 02:14:54 +09:00
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
|
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions are
|
|
|
|
|
certificate-extensions used for keyless
|
|
|
|
|
signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-08-31 02:14:54 +09:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret resource
|
|
|
|
|
that contains a public key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name where
|
|
|
|
|
the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
dryRun:
|
|
|
|
|
description: DryRun configuration
|
|
|
|
|
properties:
|
|
|
|
|
enable:
|
|
|
|
|
type: boolean
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
ignoreFields:
|
|
|
|
|
description: Fields which will be ignored while comparing
|
|
|
|
|
manifests.
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
fields:
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
objects:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
group:
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for resource bundle reference.
|
|
|
|
|
The repository can be overridden per Attestor or Attestation.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
message:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Message specifies a custom message to be displayed
|
|
|
|
|
on failure.
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
|
|
|
|
pattern:
|
2020-11-15 22:47:55 -08:00
|
|
|
description: Pattern specifies an overlay-style pattern
|
|
|
|
|
used to check resources.
|
2020-11-18 17:36:06 -08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
podSecurity:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PodSecurity applies exemptions for Kubernetes Pod Security admission
|
|
|
|
|
by specifying exclusions for Pod Security Standards controls.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
properties:
|
|
|
|
|
exclude:
|
|
|
|
|
description: Exclude specifies the Pod Security Standard
|
|
|
|
|
controls to be excluded.
|
|
|
|
|
items:
|
2022-09-01 17:03:41 +08:00
|
|
|
description: PodSecurityStandard specifies the Pod
|
|
|
|
|
Security Standard controls to be excluded.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
properties:
|
|
|
|
|
controlName:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ControlName specifies the name of the Pod Security Standard control.
|
|
|
|
|
See: https://kubernetes.io/docs/concepts/security/pod-security-standards/
|
2022-09-29 12:03:13 +08:00
|
|
|
enum:
|
|
|
|
|
- HostProcess
|
|
|
|
|
- Host Namespaces
|
|
|
|
|
- Privileged Containers
|
|
|
|
|
- Capabilities
|
|
|
|
|
- HostPath Volumes
|
|
|
|
|
- Host Ports
|
|
|
|
|
- AppArmor
|
|
|
|
|
- SELinux
|
|
|
|
|
- /proc Mount Type
|
|
|
|
|
- Seccomp
|
|
|
|
|
- Sysctls
|
|
|
|
|
- Volume Types
|
|
|
|
|
- Privilege Escalation
|
|
|
|
|
- Running as Non-root
|
|
|
|
|
- Running as Non-root user
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
type: string
|
|
|
|
|
images:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Images selects matching containers and applies the container level PSS.
|
|
|
|
|
Each image is the image name consisting of the registry address, repository, image, and tag.
|
|
|
|
|
Empty list matches no containers, PSS checks are applied at the pod level only.
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- controlName
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
level:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Level defines the Pod Security Standard level to be applied to workloads.
|
|
|
|
|
Allowed values are privileged, baseline, and restricted.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
enum:
|
|
|
|
|
- privileged
|
|
|
|
|
- baseline
|
|
|
|
|
- restricted
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Version defines the Pod Security Standard versions that Kubernetes supports.
|
|
|
|
|
Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, latest. Defaults to latest.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
enum:
|
|
|
|
|
- v1.19
|
|
|
|
|
- v1.20
|
|
|
|
|
- v1.21
|
|
|
|
|
- v1.22
|
|
|
|
|
- v1.23
|
|
|
|
|
- v1.24
|
|
|
|
|
- v1.25
|
2023-04-03 20:50:11 +08:00
|
|
|
- v1.26
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
- latest
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
2021-07-09 18:01:46 -07:00
|
|
|
verifyImages:
|
|
|
|
|
description: VerifyImages is used to verify image signatures
|
|
|
|
|
and mutate them to add a digest
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageVerification validates that images that match the specified pattern
|
|
|
|
|
are signed with the supplied public key. Once the image is verified it is
|
|
|
|
|
mutated to include the SHA digest retrieved during the registration.
|
2021-07-09 18:01:46 -07:00
|
|
|
properties:
|
2022-03-17 09:42:12 +01:00
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated.
|
2022-03-17 09:42:12 +01:00
|
|
|
type: object
|
2021-12-16 11:49:44 +05:30
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use annotations per Attestor
|
2022-04-19 08:35:12 -07:00
|
|
|
instead.
|
2021-12-16 11:49:44 +05:30
|
|
|
type: object
|
2021-10-06 00:58:45 -07:00
|
|
|
attestations:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestations are optional checks for signed in-toto Statements used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statement declarations.
|
2021-10-06 00:58:45 -07:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestation are checks for signed in-toto Statements that are used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statements.
|
2021-10-06 00:58:45 -07:00
|
|
|
properties:
|
2022-12-02 06:09:44 +08:00
|
|
|
attestors:
|
|
|
|
|
description: Attestors specify the required attestors
|
2023-10-31 05:30:26 +00:00
|
|
|
(i.e. authorities).
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-12-02 06:09:44 +08:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set
|
|
|
|
|
of Attestor used to specify a more
|
|
|
|
|
complex set of match authorities.
|
2022-12-02 06:09:44 +08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies
|
2023-10-31 05:30:26 +00:00
|
|
|
one or more certificates.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional
|
|
|
|
|
PEM-encoded public certificate.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates
|
|
|
|
|
used to verify.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
|
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions used
|
|
|
|
|
for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret
|
|
|
|
|
resource that contains a public
|
|
|
|
|
key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace name
|
|
|
|
|
where the Secret exists.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
|
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and
|
|
|
|
|
sha512.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-10-06 00:58:45 -07:00
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Conditions are used to verify attributes within a Predicate. If no Conditions are specified
|
|
|
|
|
the attestation check is satisfied as long there are predicates that match the predicate type.
|
2021-10-06 00:58:45 -07:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions consists of conditions wrapped denoting a logical criteria to be fulfilled.
|
|
|
|
|
AnyConditions get fulfilled when at least one of its sub-conditions passes.
|
|
|
|
|
AllConditions get fulfilled only when all of its sub-conditions pass.
|
2021-10-06 00:58:45 -07:00
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2021-10-06 00:58:45 -07:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2021-10-06 00:58:45 -07:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2021-10-06 00:58:45 -07:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
2021-10-06 00:58:45 -07:00
|
|
|
- NotIn
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
2021-10-07 13:50:30 -07:00
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
2021-10-06 00:58:45 -07:00
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2021-10-06 00:58:45 -07:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2021-10-06 00:58:45 -07:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2021-10-06 00:58:45 -07:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2021-10-06 00:58:45 -07:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
2021-10-06 00:58:45 -07:00
|
|
|
- NotIn
|
2021-10-27 05:59:42 +05:30
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
2021-10-07 13:50:30 -07:00
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
2021-10-06 00:58:45 -07:00
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2021-10-06 00:58:45 -07:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
predicateType:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated in favour of 'Type', to
|
|
|
|
|
be removed soon
|
2023-06-01 13:35:28 +05:30
|
|
|
type: string
|
|
|
|
|
type:
|
|
|
|
|
description: Type defines the type of attestation
|
2021-10-06 00:58:45 -07:00
|
|
|
contained within the Statement.
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-04-11 08:47:27 -07:00
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-04-11 08:47:27 -07:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-04-11 08:47:27 -07:00
|
|
|
items:
|
|
|
|
|
properties:
|
2022-04-19 08:35:12 -07:00
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-04-19 08:35:12 -07:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set of Attestor
|
2022-04-11 08:47:27 -07:00
|
|
|
used to specify a more complex set of match
|
2023-10-31 05:30:26 +00:00
|
|
|
authorities.
|
2022-04-19 08:35:12 -07:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2022-05-05 21:57:20 -07:00
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies one or
|
2023-10-31 05:30:26 +00:00
|
|
|
more certificates.
|
2022-05-05 21:57:20 -07:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional PEM-encoded
|
|
|
|
|
public certificate.
|
2022-05-05 21:57:20 -07:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
2022-05-05 21:57:20 -07:00
|
|
|
PEM encoded set of certificates used
|
2023-10-31 05:30:26 +00:00
|
|
|
to verify.
|
2022-05-05 21:57:20 -07:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is used
|
|
|
|
|
to validate SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-05-05 21:57:20 -07:00
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-05-05 21:57:20 -07:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-05-05 21:57:20 -07:00
|
|
|
url:
|
|
|
|
|
description: URL is the address of
|
|
|
|
|
the transparency log. Defaults to
|
2023-10-31 05:30:26 +00:00
|
|
|
the public Rekor log instance https://rekor.sigstore.dev.
|
2022-05-05 21:57:20 -07:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
2022-04-11 08:47:27 -07:00
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
2022-04-11 08:47:27 -07:00
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
|
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions are
|
|
|
|
|
certificate-extensions used for keyless
|
|
|
|
|
signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is used
|
|
|
|
|
to validate SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-04-11 08:47:27 -07:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
2022-04-22 00:10:02 -07:00
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-04-22 00:10:02 -07:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-04-22 00:10:02 -07:00
|
|
|
url:
|
|
|
|
|
description: URL is the address of
|
|
|
|
|
the transparency log. Defaults to
|
2023-10-31 05:30:26 +00:00
|
|
|
the public Rekor log instance https://rekor.sigstore.dev.
|
2022-04-22 00:10:02 -07:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-04-11 08:47:27 -07:00
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-04-11 08:47:27 -07:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified identity
|
|
|
|
|
used for keyless signing, for example
|
2023-10-31 05:30:26 +00:00
|
|
|
the email address.
|
2022-04-11 08:47:27 -07:00
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-05-05 21:57:20 -07:00
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more public
|
2023-10-31 05:30:26 +00:00
|
|
|
keys.
|
2022-04-11 08:47:27 -07:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is used
|
|
|
|
|
to validate SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-05-05 21:57:20 -07:00
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-04-19 08:35:12 -07:00
|
|
|
type: string
|
2022-05-05 21:57:20 -07:00
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-05-05 21:57:20 -07:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-05-05 21:57:20 -07:00
|
|
|
url:
|
|
|
|
|
description: URL is the address of
|
|
|
|
|
the transparency log. Defaults to
|
2023-10-31 05:30:26 +00:00
|
|
|
the public Rekor log instance https://rekor.sigstore.dev.
|
2022-05-05 21:57:20 -07:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret resource
|
|
|
|
|
that contains a public key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret. The
|
|
|
|
|
provided secret must contain a key
|
|
|
|
|
named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name where
|
|
|
|
|
the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values are
|
2023-12-27 08:34:16 +00:00
|
|
|
sha224, sha256, sha384 and sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-04-11 08:47:27 -07:00
|
|
|
type: object
|
2022-05-05 21:57:20 -07:00
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-05-05 21:57:20 -07:00
|
|
|
type: string
|
2022-04-11 08:47:27 -07:00
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-07-09 18:01:46 -07:00
|
|
|
image:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use ImageReferences instead.
|
2021-07-09 18:01:46 -07:00
|
|
|
type: string
|
2022-04-11 08:47:27 -07:00
|
|
|
imageReferences:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageReferences is a list of matching image reference patterns. At least one pattern in the
|
|
|
|
|
list must match the image for the rule to apply. Each image reference consists of a registry
|
|
|
|
|
address (defaults to docker.io), repository, image, and tag (defaults to latest).
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
2022-04-11 08:47:27 -07:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides credentials
|
2023-10-31 05:30:26 +00:00
|
|
|
that will be used for authentication with registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows insecure
|
2023-10-31 05:30:26 +00:00
|
|
|
access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2021-12-16 11:49:44 +05:30
|
|
|
issuer:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2021-12-16 11:49:44 +05:30
|
|
|
type: string
|
2021-07-09 18:01:46 -07:00
|
|
|
key:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use StaticKeyAttestor instead.
|
2021-07-09 18:01:46 -07:00
|
|
|
type: string
|
2022-04-22 13:38:49 +05:30
|
|
|
mutateDigest:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MutateDigest enables replacement of image tags with digests.
|
|
|
|
|
Defaults to true.
|
2022-04-22 13:38:49 +05:30
|
|
|
type: boolean
|
2021-09-16 16:11:38 -07:00
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for image signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override the default OCI image repository configured for the installation.
|
|
|
|
|
The repository can also be overridden per Attestor or Attestation.
|
2021-09-16 16:11:38 -07:00
|
|
|
type: string
|
2022-04-27 08:09:52 -07:00
|
|
|
required:
|
|
|
|
|
default: true
|
|
|
|
|
description: Required validates that images are verified
|
|
|
|
|
i.e. have matched passed a signature or attestation
|
|
|
|
|
check.
|
|
|
|
|
type: boolean
|
2021-11-04 23:26:22 -07:00
|
|
|
roots:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2021-11-04 23:26:22 -07:00
|
|
|
type: string
|
|
|
|
|
subject:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2021-11-04 23:26:22 -07:00
|
|
|
type: string
|
2023-02-20 08:26:10 -08:00
|
|
|
type:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Type specifies the method of signature validation. The allowed options
|
|
|
|
|
are Cosign and Notary. By default Cosign is used if a type is not specified.
|
2023-02-20 08:26:10 -08:00
|
|
|
enum:
|
|
|
|
|
- Cosign
|
2023-06-01 13:35:28 +05:30
|
|
|
- Notary
|
2023-02-20 08:26:10 -08:00
|
|
|
type: string
|
2023-08-07 01:24:52 +05:30
|
|
|
useCache:
|
|
|
|
|
default: true
|
|
|
|
|
description: UseCache enables caching of image verify
|
2023-10-31 05:30:26 +00:00
|
|
|
responses for this rule.
|
2023-08-07 01:24:52 +05:30
|
|
|
type: boolean
|
2022-04-27 08:09:52 -07:00
|
|
|
verifyDigest:
|
|
|
|
|
default: true
|
|
|
|
|
description: VerifyDigest validates that images have a
|
|
|
|
|
digest.
|
|
|
|
|
type: boolean
|
2021-07-09 18:01:46 -07:00
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-08 11:54:58 +02:00
|
|
|
required:
|
|
|
|
|
- name
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-09-08 10:42:44 +05:30
|
|
|
schemaValidation:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
SchemaValidation skips validation checks for policies as well as patched resources.
|
|
|
|
|
Optional. The default value is set to "true", it must be set to "false" to disable the validation checks.
|
2021-09-08 10:42:44 +05:30
|
|
|
type: boolean
|
2023-08-02 18:59:37 +01:00
|
|
|
useServerSideApply:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
UseServerSideApply controls whether to use server-side apply for generate rules
|
|
|
|
|
If is set to "true" create & update for generate rules will use apply instead of create/update.
|
|
|
|
|
Defaults to "false" if not specified.
|
2023-08-02 18:59:37 +01:00
|
|
|
type: boolean
|
2020-11-12 16:44:14 -08:00
|
|
|
validationFailureAction:
|
2023-01-02 16:16:13 +01:00
|
|
|
default: Audit
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ValidationFailureAction defines if a validation policy rule violation should block
|
|
|
|
|
the admission review request (enforce), or allow (audit) the admission review request
|
|
|
|
|
and report an error in a policy report. Optional.
|
|
|
|
|
Allowed values are audit or enforce. The default value is "Audit".
|
2022-01-21 18:06:44 +05:30
|
|
|
enum:
|
|
|
|
|
- audit
|
|
|
|
|
- enforce
|
2022-11-01 09:56:52 +00:00
|
|
|
- Audit
|
|
|
|
|
- Enforce
|
2020-11-12 16:44:14 -08:00
|
|
|
type: string
|
2022-01-21 18:06:44 +05:30
|
|
|
validationFailureActionOverrides:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ValidationFailureActionOverrides is a Cluster Policy attribute that specifies ValidationFailureAction
|
|
|
|
|
namespace-wise. It overrides ValidationFailureAction for the specified namespaces.
|
2022-01-21 18:06:44 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
action:
|
2022-03-23 09:59:41 +01:00
|
|
|
description: ValidationFailureAction defines the policy validation
|
|
|
|
|
failure action
|
2022-01-21 18:06:44 +05:30
|
|
|
enum:
|
|
|
|
|
- audit
|
|
|
|
|
- enforce
|
2023-01-02 19:31:51 +01:00
|
|
|
- Audit
|
|
|
|
|
- Enforce
|
2022-01-21 18:06:44 +05:30
|
|
|
type: string
|
2023-01-18 05:21:34 -05:00
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector is a label query over a set of resources. The result of matchLabels and
|
|
|
|
|
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
|
|
|
|
label selector matches no objects.
|
2023-01-18 05:21:34 -05:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label selector
|
|
|
|
|
requirements. The requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2023-01-18 05:21:34 -05:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the selector
|
|
|
|
|
applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2023-01-18 05:21:34 -05:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2023-01-18 05:21:34 -05:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2023-01-18 05:21:34 -05:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2022-01-21 18:06:44 +05:30
|
|
|
namespaces:
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-09-29 20:53:34 -07:00
|
|
|
webhookTimeoutSeconds:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
WebhookTimeoutSeconds specifies the maximum time in seconds allowed to apply this policy.
|
|
|
|
|
After the configured time expires, the admission request may fail, or may simply ignore the policy results,
|
|
|
|
|
based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds.
|
2021-09-29 20:53:34 -07:00
|
|
|
format: int32
|
|
|
|
|
type: integer
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
status:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Policy metrics are available via the metrics
|
|
|
|
|
endpoint
|
2020-11-12 16:44:14 -08:00
|
|
|
properties:
|
2022-07-04 00:09:18 +02:00
|
|
|
autogen:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: AutogenStatus contains autogen status information.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
rules:
|
|
|
|
|
description: Rules is a list of Rule instances. It contains auto
|
|
|
|
|
generated rules added for pod controllers
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rule defines a validation, mutation, or generation control for matching resources.
|
|
|
|
|
Each rules contains a match declaration to select resources, and an optional exclude
|
|
|
|
|
declaration to specify which resources to exclude.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-06-01 00:30:55 +03:00
|
|
|
celPreconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CELPreconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of CEL conditions. It can only be used with the validate.cel subrule
|
2023-06-01 00:30:55 +03:00
|
|
|
items:
|
|
|
|
|
description: MatchCondition represents a condition which
|
|
|
|
|
must by fulfilled for a request to be sent to a webhook.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
|
|
|
|
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
'object' - The object from the incoming request. The value is null for DELETE requests.
|
|
|
|
|
'oldObject' - The existing object. The value is null for CREATE requests.
|
|
|
|
|
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
|
|
|
|
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
|
|
|
|
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
|
|
|
|
request resource.
|
|
|
|
|
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
|
|
|
|
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
|
|
|
|
the associated expression.
|
|
|
|
|
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
|
|
|
|
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
|
|
|
|
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
|
|
|
|
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data sent
|
|
|
|
|
to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the HTTP POST
|
|
|
|
|
data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request type (GET
|
|
|
|
|
or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a JSON
|
|
|
|
|
web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers
|
2023-06-16 19:07:08 +05:30
|
|
|
required.
|
|
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2022-07-04 00:09:18 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON object
|
|
|
|
|
representable in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
exclude:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ExcludeResources defines when this policy rule should not be applied. The exclude
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the name or role.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-07-04 00:09:18 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-07-04 00:09:18 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ResourceDescription contains information about the resource being created or modified.
|
|
|
|
|
Requires at least one tag to be specified when under MatchResources.
|
|
|
|
|
Specifying ResourceDescription directly under match is being deprecated.
|
|
|
|
|
Please specify under "any" or "all" instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one of
|
|
|
|
|
the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role names
|
|
|
|
|
for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names like
|
|
|
|
|
users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
generate:
|
|
|
|
|
description: Generation is used to create new resources.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
|
|
|
|
description: APIVersion specifies resource apiVersion.
|
|
|
|
|
type: string
|
|
|
|
|
clone:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Clone specifies the source resource used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone can be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies name of the resource.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies source resource
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-09-08 10:17:09 +05:30
|
|
|
cloneList:
|
|
|
|
|
description: CloneList specifies the list of source
|
|
|
|
|
resource used to populate each generated resource.
|
|
|
|
|
properties:
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies source resource
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
2022-09-28 21:14:38 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels`.
|
|
|
|
|
wildcard characters are not supported.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-28 21:14:38 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2022-09-08 10:17:09 +05:30
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
data:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Data provides the resource declaration used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone must be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
kind:
|
|
|
|
|
description: Kind specifies resource kind.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies the resource name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies resource namespace.
|
|
|
|
|
type: string
|
|
|
|
|
synchronize:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Synchronize controls if generated resources should be kept in-sync with their source resource.
|
|
|
|
|
If Synchronize is set to "true" changes to generated resources will be overwritten with resource
|
|
|
|
|
data from Data or the resource specified in the Clone declaration.
|
2022-07-04 00:09:18 +02:00
|
|
|
Optional. Defaults to "false" if not specified.
|
|
|
|
|
type: boolean
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
imageExtractors:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
2023-02-08 06:54:59 -05:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath expression to apply to the image value.
|
|
|
|
|
This is useful when the extracted image begins with a prefix like 'docker://'.
|
|
|
|
|
The 'trim_prefix' function may be used to trim the prefix: trim_prefix(@, 'docker://').
|
|
|
|
|
Note - Image digest mutation may not be used when applying a JMESPAth to an image.
|
2023-02-08 06:54:59 -05:00
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Key is an optional name of the field within 'path' that will be used to uniquely identify an image.
|
|
|
|
|
Note - this field MUST be unique.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the entry the image will be available under 'images.<name>' in the context.
|
|
|
|
|
If this field is not defined, image entries will appear under 'images.custom'.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
path:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Path is the path to the object containing the image field in a custom resource.
|
|
|
|
|
It should be slash-separated. Each slash-separated key must be a valid YAML key or a wildcard '*'.
|
|
|
|
|
Wildcard keys are expanded in case of arrays or objects.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is an optional name of the field within 'path' that points to the image URI.
|
|
|
|
|
This is useful when a custom 'key' is also defined.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- path
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageExtractors defines a mapping from kinds to ImageExtractorConfigs.
|
|
|
|
|
This config is only valid for verifyImages rules.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
match:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MatchResources defines when this policy rule should be applied. The match
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the user name or role.
|
2022-07-04 00:09:18 +02:00
|
|
|
At least one kind is required.
|
|
|
|
|
properties:
|
|
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-07-04 00:09:18 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-07-04 00:09:18 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ResourceDescription contains information about the resource being created or modified.
|
|
|
|
|
Requires at least one tag to be specified when under MatchResources.
|
|
|
|
|
Specifying ResourceDescription directly under match is being deprecated.
|
|
|
|
|
Please specify under "any" or "all" instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one of
|
|
|
|
|
the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-07-04 00:09:18 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role names
|
|
|
|
|
for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names like
|
|
|
|
|
users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
mutate:
|
|
|
|
|
description: Mutation is used to modify matching resources.
|
|
|
|
|
properties:
|
|
|
|
|
foreach:
|
|
|
|
|
description: ForEach applies mutation rules to a list
|
|
|
|
|
of sub-elements by creating a context for each entry
|
|
|
|
|
in the list and looping over it to apply the specified
|
|
|
|
|
logic.
|
|
|
|
|
items:
|
2023-01-20 16:56:35 +08:00
|
|
|
description: ForEachMutation applies mutation rules
|
|
|
|
|
to a list of sub-elements by creating a context
|
|
|
|
|
for each entry in the list and looping over it to
|
|
|
|
|
apply the specified logic.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data
|
|
|
|
|
sources that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST
|
|
|
|
|
data sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains
|
|
|
|
|
the HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data
|
|
|
|
|
value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call
|
|
|
|
|
to a JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
2023-04-26 16:31:44 -07:00
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
2023-04-26 16:31:44 -07:00
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
|
|
|
|
for details.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap
|
|
|
|
|
reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials
|
|
|
|
|
provides credentials that will be
|
|
|
|
|
used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry
|
2023-10-31 05:30:26 +00:00
|
|
|
allows insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2022-07-04 00:09:18 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary
|
|
|
|
|
JMESPath context variable that can be
|
|
|
|
|
defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary
|
|
|
|
|
JSON object representable in YAML
|
|
|
|
|
or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-12-12 07:20:20 -08:00
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach
|
|
|
|
|
iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2022-07-04 00:09:18 +02:00
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
2023-05-05 17:40:23 +02:00
|
|
|
order:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Order defines the iteration order on the list.
|
|
|
|
|
Can be Ascending to iterate from first to last element or Descending to iterate in from last to first element.
|
2023-05-05 17:40:23 +02:00
|
|
|
enum:
|
|
|
|
|
- Ascending
|
|
|
|
|
- Descending
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2022-07-04 00:09:18 +02:00
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
|
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-07-04 00:09:18 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-07-04 00:09:18 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2022-07-04 00:09:18 +02:00
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
|
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
targets:
|
|
|
|
|
description: Targets defines the target resources to
|
|
|
|
|
be mutated.
|
|
|
|
|
items:
|
2023-04-03 21:58:58 +02:00
|
|
|
description: TargetResourceSpec defines targets for
|
|
|
|
|
mutating existing resources.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
|
|
|
|
description: APIVersion specifies resource apiVersion.
|
|
|
|
|
type: string
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data
|
|
|
|
|
sources that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST
|
|
|
|
|
data sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains
|
|
|
|
|
the HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data
|
|
|
|
|
value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call
|
|
|
|
|
to a JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
2023-04-26 16:31:44 -07:00
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
2023-04-26 16:31:44 -07:00
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
|
|
|
|
for details.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap
|
|
|
|
|
reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials
|
|
|
|
|
provides credentials that will be
|
|
|
|
|
used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry
|
2023-10-31 05:30:26 +00:00
|
|
|
allows insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2022-07-04 00:09:18 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary
|
|
|
|
|
JMESPath context variable that can be
|
|
|
|
|
defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary
|
|
|
|
|
JSON object representable in YAML
|
|
|
|
|
or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-04-03 21:58:58 +02:00
|
|
|
kind:
|
|
|
|
|
description: Kind specifies resource kind.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies the resource name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies resource namespace.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements is supported for backwards compatibility but
|
2023-04-03 21:58:58 +02:00
|
|
|
will be deprecated in the next major release.
|
2024-05-09 16:47:44 +08:00
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is a label to identify the rule, It must
|
|
|
|
|
be unique within the policy.
|
|
|
|
|
maxLength: 63
|
|
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements is supported for backwards compatibility but
|
|
|
|
|
will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-12-19 10:51:47 +00:00
|
|
|
skipBackgroundRequests:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
SkipBackgroundRequests bypasses admission requests that are sent by the background controller.
|
|
|
|
|
The default value is set to "true", it must be set to "false" to apply
|
2023-12-19 10:51:47 +00:00
|
|
|
generate and mutateExisting rules to those requests.
|
|
|
|
|
type: boolean
|
2023-04-03 21:58:58 +02:00
|
|
|
validate:
|
|
|
|
|
description: Validation is used to validate matching resources.
|
|
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-06-01 00:30:55 +03:00
|
|
|
cel:
|
|
|
|
|
description: CEL allows validation checks using the
|
|
|
|
|
Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/).
|
|
|
|
|
properties:
|
|
|
|
|
auditAnnotations:
|
|
|
|
|
description: AuditAnnotations contains CEL expressions
|
|
|
|
|
which are used to produce audit annotations for
|
|
|
|
|
the audit event of the API request.
|
|
|
|
|
items:
|
|
|
|
|
description: AuditAnnotation describes how to
|
|
|
|
|
produce an audit annotation for an API request.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
key specifies the audit annotation key. The audit annotation keys of
|
|
|
|
|
a ValidatingAdmissionPolicy must be unique. The key must be a qualified
|
|
|
|
|
name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The key is combined with the resource name of the
|
|
|
|
|
ValidatingAdmissionPolicy to construct an audit annotation key:
|
|
|
|
|
"{ValidatingAdmissionPolicy name}/{key}".
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
|
|
|
|
|
and the same audit annotation key, the annotation key will be identical.
|
|
|
|
|
In this case, the first annotation written with the key will be included
|
|
|
|
|
in the audit event and all subsequent annotations with the same key
|
|
|
|
|
will be discarded.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
valueExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
valueExpression represents the expression which is evaluated by CEL to
|
|
|
|
|
produce an audit annotation value. The expression must evaluate to either
|
|
|
|
|
a string or null value. If the expression evaluates to a string, the
|
|
|
|
|
audit annotation is included with the string value. If the expression
|
|
|
|
|
evaluates to null or empty string the audit annotation will be omitted.
|
|
|
|
|
The valueExpression may be no longer than 5kb in length.
|
|
|
|
|
If the result of the valueExpression is more than 10kb in length, it
|
|
|
|
|
will be truncated to 10kb.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple ValidatingAdmissionPolicyBinding resources match an
|
|
|
|
|
API request, then the valueExpression will be evaluated for
|
|
|
|
|
each binding. All unique values produced by the valueExpressions
|
|
|
|
|
will be joined together in a comma-separated list.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- valueExpression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
expressions:
|
|
|
|
|
description: Expressions is a list of CELExpression
|
|
|
|
|
types.
|
|
|
|
|
items:
|
|
|
|
|
description: Validation specifies the CEL expression
|
|
|
|
|
which is used to apply the validation.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
|
|
|
|
description: "Expression represents the expression
|
2024-05-09 16:47:44 +08:00
|
|
|
which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL
|
|
|
|
|
expressions have access to the contents
|
2023-06-01 00:30:55 +03:00
|
|
|
of the API request/response, organized into
|
|
|
|
|
CEL variables as well as some other useful
|
2024-05-09 16:47:44 +08:00
|
|
|
variables:\n\n\n- 'object' - The object
|
|
|
|
|
from the incoming request. The value is
|
|
|
|
|
null for DELETE requests.\n- 'oldObject'
|
|
|
|
|
- The existing object. The value is null
|
|
|
|
|
for CREATE requests.\n- 'request' - Attributes
|
|
|
|
|
of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n-
|
|
|
|
|
'params' - Parameter resource referred to
|
|
|
|
|
by the policy binding being evaluated. Only
|
|
|
|
|
populated if the policy has a ParamKind.\n-
|
|
|
|
|
'namespaceObject' - The namespace object
|
2023-08-18 05:54:05 +02:00
|
|
|
that the incoming object belongs to. The
|
2024-05-09 16:47:44 +08:00
|
|
|
value is null for cluster-scoped resources.\n-
|
|
|
|
|
'variables' - Map of composited variables,
|
|
|
|
|
from its name to its lazily evaluated value.\n
|
|
|
|
|
\ For example, a variable named 'foo' can
|
|
|
|
|
be accessed as 'variables.foo'.\n- 'authorizer'
|
2023-08-18 05:54:05 +02:00
|
|
|
- A CEL Authorizer. May be used to perform
|
|
|
|
|
authorization checks for the principal (user
|
2024-05-09 16:47:44 +08:00
|
|
|
or service account) of the request.\n See
|
|
|
|
|
https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n-
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck
|
2023-06-01 00:30:55 +03:00
|
|
|
constructed from the 'authorizer' and configured
|
2024-05-09 16:47:44 +08:00
|
|
|
with the\n request resource.\n\n\nThe `apiVersion`,
|
2023-06-01 00:30:55 +03:00
|
|
|
`kind`, `metadata.name` and `metadata.generateName`
|
2024-05-09 16:47:44 +08:00
|
|
|
are always accessible from the root of the\nobject.
|
|
|
|
|
No other metadata properties are accessible.\n\n\nOnly
|
|
|
|
|
property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*`
|
|
|
|
|
are accessible.\nAccessible property names
|
|
|
|
|
are escaped according to the following rules
|
|
|
|
|
when accessed in the expression:\n- '__'
|
|
|
|
|
escapes to '__underscores__'\n- '.' escapes
|
|
|
|
|
to '__dot__'\n- '-' escapes to '__dash__'\n-
|
|
|
|
|
'/' escapes to '__slash__'\n- Property names
|
|
|
|
|
that exactly match a CEL RESERVED keyword
|
|
|
|
|
escape to '__{keyword}__'. The keywords
|
|
|
|
|
are:\n\t \"true\", \"false\", \"null\",
|
|
|
|
|
\"in\", \"as\", \"break\", \"const\", \"continue\",
|
|
|
|
|
\"else\", \"for\", \"function\", \"if\",\n\t
|
|
|
|
|
\ \"import\", \"let\", \"loop\", \"package\",
|
|
|
|
|
\"namespace\", \"return\".\nExamples:\n
|
|
|
|
|
\ - Expression accessing a property named
|
|
|
|
|
\"namespace\": {\"Expression\": \"object.__namespace__
|
|
|
|
|
> 0\"}\n - Expression accessing a property
|
2023-06-01 00:30:55 +03:00
|
|
|
named \"x-prop\": {\"Expression\": \"object.x__dash__prop
|
2024-05-09 16:47:44 +08:00
|
|
|
> 0\"}\n - Expression accessing a property
|
2023-06-01 00:30:55 +03:00
|
|
|
named \"redact__d\": {\"Expression\": \"object.redact__underscores__d
|
2024-05-09 16:47:44 +08:00
|
|
|
> 0\"}\n\n\nEquality on arrays with list
|
|
|
|
|
type of 'set' or 'map' ignores element order,
|
|
|
|
|
i.e. [1, 2] == [2, 1].\nConcatenation on
|
2023-06-01 00:30:55 +03:00
|
|
|
arrays with x-kubernetes-list-type use the
|
2024-05-09 16:47:44 +08:00
|
|
|
semantics of the list type:\n - 'set':
|
|
|
|
|
`X + Y` performs a union where the array
|
|
|
|
|
positions of all elements in `X` are preserved
|
|
|
|
|
and\n non-intersecting elements in `Y`
|
|
|
|
|
are appended, retaining their partial order.\n
|
|
|
|
|
\ - 'map': `X + Y` performs a merge where
|
|
|
|
|
the array positions of all keys in `X` are
|
|
|
|
|
preserved but the values\n are overwritten
|
|
|
|
|
by values in `Y` when the key sets of `X`
|
|
|
|
|
and `Y` intersect. Elements in `Y` with\n
|
|
|
|
|
\ non-intersecting keys are appended,
|
|
|
|
|
retaining their partial order.\nRequired."
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Message represents the message displayed when validation fails. The message is required if the Expression contains
|
|
|
|
|
line breaks. The message must not contain line breaks.
|
|
|
|
|
If unset, the message is "failed rule: {Rule}".
|
|
|
|
|
e.g. "must be a URL with the host matching spec.host"
|
|
|
|
|
If the Expression contains line breaks. Message is required.
|
2023-06-01 00:30:55 +03:00
|
|
|
The message must not contain line breaks.
|
2024-05-09 16:47:44 +08:00
|
|
|
If unset, the message is "failed Expression: {Expression}".
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
messageExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
|
|
|
|
|
Since messageExpression is used as a failure message, it must evaluate to a string.
|
|
|
|
|
If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
|
|
|
|
|
If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
|
|
|
|
|
as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
|
|
|
|
|
that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
|
|
|
|
|
the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
|
|
|
|
|
messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'.
|
|
|
|
|
Example:
|
|
|
|
|
"object.x must be less than max ("+string(params.max)+")"
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
reason:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reason represents a machine-readable description of why this validation failed.
|
|
|
|
|
If this is the first validation in the list to fail, this reason, as well as the
|
|
|
|
|
corresponding HTTP response code, are used in the
|
|
|
|
|
HTTP response to the client.
|
|
|
|
|
The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge".
|
|
|
|
|
If not set, StatusReasonInvalid is used in the response to the client.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
paramKind:
|
|
|
|
|
description: ParamKind is a tuple of Group Kind
|
|
|
|
|
and Version.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIVersion is the API group version the resources belong to.
|
|
|
|
|
In format of "group/version".
|
2023-06-01 00:30:55 +03:00
|
|
|
Required.
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind is the API kind the resources belong to.
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
paramRef:
|
|
|
|
|
description: ParamRef references a parameter resource.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`name` is the name of the resource being referenced.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
`name` and `selector` are mutually exclusive properties. If one is set,
|
|
|
|
|
the other must be unset.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
namespace is the namespace of the referenced resource. Allows limiting
|
|
|
|
|
the search for params to a specific namespace. Applies to both `name` and
|
|
|
|
|
`selector` fields.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A per-namespace parameter may be used by specifying a namespace-scoped
|
|
|
|
|
`paramKind` in the policy and leaving this field empty.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
|
|
|
|
|
field results in a configuration error.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is namespace-scoped, the namespace of the object being
|
|
|
|
|
evaluated for admission will be used when this field is left unset. Take
|
|
|
|
|
care that if this is left empty the binding must not match any cluster-scoped
|
|
|
|
|
resources, which will result in an error.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
2023-08-18 05:54:05 +02:00
|
|
|
parameterNotFoundAction:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`parameterNotFoundAction` controls the behavior of the binding when the resource
|
|
|
|
|
exists, and name or selector is valid, but there are no parameters
|
|
|
|
|
matched by the binding. If the value is set to `Allow`, then no
|
|
|
|
|
matched parameters will be treated as successful validation by the binding.
|
|
|
|
|
If set to `Deny`, then no matched parameters will be subject to the
|
|
|
|
|
`failurePolicy` of the policy.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Allowed values are `Allow` or `Deny`
|
|
|
|
|
Default to `Deny`
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
selector can be used to match multiple param objects based on their labels.
|
|
|
|
|
Supply selector: {} to match all resources of the ParamKind.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple params are found, they are all evaluated with the policy expressions
|
|
|
|
|
and the results are ANDed together.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
One of `name` or `selector` must be set, but `name` and `selector` are
|
|
|
|
|
mutually exclusive properties. If one is set, the other must be unset.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2023-08-18 05:54:05 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-08-24 13:00:27 +03:00
|
|
|
variables:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Variables contain definitions of variables that can be used in composition of other expressions.
|
2023-08-24 13:00:27 +03:00
|
|
|
Each variable is defined as a named CEL expression.
|
2024-05-09 16:47:44 +08:00
|
|
|
The variables defined here will be available under `variables` in other expressions of the policy.
|
2023-08-24 13:00:27 +03:00
|
|
|
items:
|
|
|
|
|
description: Variable is the definition of a variable
|
|
|
|
|
that is used for composition.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression is the expression that will be evaluated as the value of the variable.
|
|
|
|
|
The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
|
|
|
|
The variable can be accessed in other expressions through `variables`
|
|
|
|
|
For example, if name is "foo", the variable will be available as `variables.foo`
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
2023-04-03 21:58:58 +02:00
|
|
|
deny:
|
|
|
|
|
description: Deny defines conditions used to pass or
|
|
|
|
|
fail a validation rule.
|
|
|
|
|
properties:
|
|
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements) is also supported for backwards compatibility
|
2023-04-03 21:58:58 +02:00
|
|
|
but will be deprecated in the next major release.
|
2024-05-09 16:47:44 +08:00
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
foreach:
|
|
|
|
|
description: ForEach applies validate rules to a list
|
|
|
|
|
of sub-elements by creating a context for each entry
|
|
|
|
|
in the list and looping over it to apply the specified
|
|
|
|
|
logic.
|
|
|
|
|
items:
|
|
|
|
|
description: ForEachValidation applies validate rules
|
|
|
|
|
to a list of sub-elements by creating a context
|
|
|
|
|
for each entry in the list and looping over it to
|
|
|
|
|
apply the specified logic.
|
|
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data
|
|
|
|
|
sources that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST
|
|
|
|
|
data sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains
|
|
|
|
|
the HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data
|
|
|
|
|
value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2023-04-26 16:31:44 -07:00
|
|
|
type: string
|
|
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
|
|
|
|
service:
|
|
|
|
|
description: Service is an API call
|
2023-04-03 21:58:58 +02:00
|
|
|
to a JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
2023-04-26 16:31:44 -07:00
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2023-04-03 21:58:58 +02:00
|
|
|
type: object
|
|
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
2023-04-26 16:31:44 -07:00
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
|
|
|
|
for details.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap
|
|
|
|
|
reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials
|
|
|
|
|
provides credentials that will be
|
|
|
|
|
used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry
|
2023-10-31 05:30:26 +00:00
|
|
|
allows insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2023-04-03 21:58:58 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary
|
|
|
|
|
JMESPath context variable that can be
|
|
|
|
|
defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary
|
|
|
|
|
JSON object representable in YAML
|
|
|
|
|
or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
deny:
|
|
|
|
|
description: Deny defines conditions used to pass
|
|
|
|
|
or fail a validation rule.
|
|
|
|
|
properties:
|
|
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements) is also supported for backwards compatibility
|
|
|
|
|
but will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
elementScope:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ElementScope specifies whether to use the current list element as the scope for validation. Defaults to "true" if not specified.
|
|
|
|
|
When set to "false", "request.object" is used as the validation scope within the foreach
|
|
|
|
|
block to allow referencing other elements in the subtree.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: boolean
|
|
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach
|
|
|
|
|
iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
pattern:
|
|
|
|
|
description: Pattern specifies an overlay-style
|
|
|
|
|
pattern used to check resources.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2023-04-03 21:58:58 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
2022-07-04 00:09:18 +02:00
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-07-04 00:09:18 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-07-04 00:09:18 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-08-31 02:14:54 +09:00
|
|
|
manifests:
|
|
|
|
|
description: Manifest specifies conditions for manifest
|
|
|
|
|
verification
|
|
|
|
|
properties:
|
|
|
|
|
annotationDomain:
|
|
|
|
|
description: AnnotationDomain is custom domain of
|
2022-09-10 18:11:38 +02:00
|
|
|
annotation for message and signature. Default
|
2022-08-31 02:14:54 +09:00
|
|
|
is "cosign.sigstore.dev".
|
|
|
|
|
type: string
|
|
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-08-31 02:14:54 +09:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-08-31 02:14:54 +09:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set
|
|
|
|
|
of Attestor used to specify a more
|
|
|
|
|
complex set of match authorities.
|
2022-08-31 02:14:54 +09:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies
|
2023-10-31 05:30:26 +00:00
|
|
|
one or more certificates.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional
|
|
|
|
|
PEM-encoded public certificate.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates
|
|
|
|
|
used to verify.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
|
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions used
|
|
|
|
|
for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-08-31 02:14:54 +09:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-08-31 02:14:54 +09:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret
|
|
|
|
|
resource that contains a public
|
|
|
|
|
key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name
|
|
|
|
|
where the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and
|
|
|
|
|
sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-08-31 02:14:54 +09:00
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
dryRun:
|
|
|
|
|
description: DryRun configuration
|
|
|
|
|
properties:
|
|
|
|
|
enable:
|
|
|
|
|
type: boolean
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
ignoreFields:
|
|
|
|
|
description: Fields which will be ignored while
|
|
|
|
|
comparing manifests.
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
fields:
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
objects:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
group:
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for resource bundle reference.
|
|
|
|
|
The repository can be overridden per Attestor or Attestation.
|
2022-08-31 02:14:54 +09:00
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
message:
|
|
|
|
|
description: Message specifies a custom message to be
|
|
|
|
|
displayed on failure.
|
|
|
|
|
type: string
|
|
|
|
|
pattern:
|
|
|
|
|
description: Pattern specifies an overlay-style pattern
|
|
|
|
|
used to check resources.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
podSecurity:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PodSecurity applies exemptions for Kubernetes Pod Security admission
|
|
|
|
|
by specifying exclusions for Pod Security Standards controls.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
properties:
|
|
|
|
|
exclude:
|
|
|
|
|
description: Exclude specifies the Pod Security
|
|
|
|
|
Standard controls to be excluded.
|
|
|
|
|
items:
|
2022-09-01 17:03:41 +08:00
|
|
|
description: PodSecurityStandard specifies the
|
|
|
|
|
Pod Security Standard controls to be excluded.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
properties:
|
|
|
|
|
controlName:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ControlName specifies the name of the Pod Security Standard control.
|
|
|
|
|
See: https://kubernetes.io/docs/concepts/security/pod-security-standards/
|
2022-09-29 12:03:13 +08:00
|
|
|
enum:
|
|
|
|
|
- HostProcess
|
|
|
|
|
- Host Namespaces
|
|
|
|
|
- Privileged Containers
|
|
|
|
|
- Capabilities
|
|
|
|
|
- HostPath Volumes
|
|
|
|
|
- Host Ports
|
|
|
|
|
- AppArmor
|
|
|
|
|
- SELinux
|
|
|
|
|
- /proc Mount Type
|
|
|
|
|
- Seccomp
|
|
|
|
|
- Sysctls
|
|
|
|
|
- Volume Types
|
|
|
|
|
- Privilege Escalation
|
|
|
|
|
- Running as Non-root
|
|
|
|
|
- Running as Non-root user
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
type: string
|
|
|
|
|
images:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Images selects matching containers and applies the container level PSS.
|
|
|
|
|
Each image is the image name consisting of the registry address, repository, image, and tag.
|
|
|
|
|
Empty list matches no containers, PSS checks are applied at the pod level only.
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- controlName
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
level:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Level defines the Pod Security Standard level to be applied to workloads.
|
|
|
|
|
Allowed values are privileged, baseline, and restricted.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
enum:
|
|
|
|
|
- privileged
|
|
|
|
|
- baseline
|
|
|
|
|
- restricted
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Version defines the Pod Security Standard versions that Kubernetes supports.
|
|
|
|
|
Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, latest. Defaults to latest.
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
enum:
|
|
|
|
|
- v1.19
|
|
|
|
|
- v1.20
|
|
|
|
|
- v1.21
|
|
|
|
|
- v1.22
|
|
|
|
|
- v1.23
|
|
|
|
|
- v1.24
|
|
|
|
|
- v1.25
|
2023-04-03 20:50:11 +08:00
|
|
|
- v1.26
|
Extend Pod Security Admission (#4364)
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 11:16:31 +02:00
|
|
|
- latest
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
verifyImages:
|
|
|
|
|
description: VerifyImages is used to verify image signatures
|
|
|
|
|
and mutate them to add a digest
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageVerification validates that images that match the specified pattern
|
|
|
|
|
are signed with the supplied public key. Once the image is verified it is
|
|
|
|
|
mutated to include the SHA digest retrieved during the registration.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use annotations per Attestor
|
|
|
|
|
instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
attestations:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestations are optional checks for signed in-toto Statements used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statement declarations.
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestation are checks for signed in-toto Statements that are used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statements.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2022-12-02 06:09:44 +08:00
|
|
|
attestors:
|
|
|
|
|
description: Attestors specify the required
|
2023-10-31 05:30:26 +00:00
|
|
|
attestors (i.e. authorities).
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-12-02 06:09:44 +08:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
|
|
|
|
description: Attestor is a nested
|
2023-10-31 05:30:26 +00:00
|
|
|
set of Attestor used to specify
|
|
|
|
|
a more complex set of match authorities.
|
2022-12-02 06:09:44 +08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies
|
2023-10-31 05:30:26 +00:00
|
|
|
one or more certificates.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional
|
|
|
|
|
PEM-encoded public certificate.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an
|
|
|
|
|
optional PEM encoded set of
|
|
|
|
|
certificates used to verify.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if
|
|
|
|
|
set, is used to validate
|
|
|
|
|
SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
|
|
|
|
description: IgnoreTlog
|
2023-10-31 05:30:26 +00:00
|
|
|
skips transparency log
|
|
|
|
|
verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the
|
|
|
|
|
address of the transparency
|
|
|
|
|
log. Defaults to the public
|
2023-10-31 05:30:26 +00:00
|
|
|
Rekor log instance https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
|
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions
|
|
|
|
|
used for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if
|
|
|
|
|
set, is used to validate
|
|
|
|
|
SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
|
|
|
|
description: IgnoreTlog
|
2023-10-31 05:30:26 +00:00
|
|
|
skips transparency log
|
|
|
|
|
verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the
|
|
|
|
|
address of the transparency
|
|
|
|
|
log. Defaults to the public
|
2023-10-31 05:30:26 +00:00
|
|
|
Rekor log instance https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the
|
|
|
|
|
verified identity used for
|
|
|
|
|
keyless signing, for example
|
2023-10-31 05:30:26 +00:00
|
|
|
the email address.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one
|
2023-10-31 05:30:26 +00:00
|
|
|
or more public keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if
|
|
|
|
|
set, is used to validate
|
|
|
|
|
SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
|
|
|
|
description: IgnoreTlog
|
2023-10-31 05:30:26 +00:00
|
|
|
skips transparency log
|
|
|
|
|
verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the
|
|
|
|
|
address of the transparency
|
|
|
|
|
log. Defaults to the public
|
2023-10-31 05:30:26 +00:00
|
|
|
Rekor log instance https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
secret:
|
|
|
|
|
description: Reference to a
|
|
|
|
|
Secret resource that contains
|
|
|
|
|
a public key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the
|
|
|
|
|
secret. The provided secret
|
|
|
|
|
must contain a key named
|
|
|
|
|
cosign.pub.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace name
|
|
|
|
|
where the Secret exists.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
|
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature
|
|
|
|
|
algorithm for public keys.
|
2023-12-27 08:34:16 +00:00
|
|
|
Supported values are sha224,
|
|
|
|
|
sha256, sha384 and sha512.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-07-04 00:09:18 +02:00
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Conditions are used to verify attributes within a Predicate. If no Conditions are specified
|
|
|
|
|
the attestation check is satisfied as long there are predicates that match the predicate type.
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions consists of conditions wrapped denoting a logical criteria to be fulfilled.
|
|
|
|
|
AnyConditions get fulfilled when at least one of its sub-conditions passes.
|
|
|
|
|
AllConditions get fulfilled only when all of its sub-conditions pass.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context
|
|
|
|
|
entry (using JMESPath) for conditional
|
|
|
|
|
rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-07-04 00:09:18 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context
|
|
|
|
|
entry (using JMESPath) for conditional
|
|
|
|
|
rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-07-04 00:09:18 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
predicateType:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated in favour of 'Type',
|
|
|
|
|
to be removed soon
|
2023-06-01 13:35:28 +05:30
|
|
|
type: string
|
|
|
|
|
type:
|
|
|
|
|
description: Type defines the type of attestation
|
|
|
|
|
contained within the Statement.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-07-04 00:09:18 +02:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set
|
|
|
|
|
of Attestor used to specify a more complex
|
|
|
|
|
set of match authorities.
|
2022-07-04 00:09:18 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies one
|
2023-10-31 05:30:26 +00:00
|
|
|
or more certificates.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional PEM-encoded
|
|
|
|
|
public certificate.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates
|
|
|
|
|
used to verify.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
2022-07-04 00:09:18 +02:00
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
|
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions used
|
|
|
|
|
for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-07-04 00:09:18 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret
|
|
|
|
|
resource that contains a public
|
|
|
|
|
key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name where
|
|
|
|
|
the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
image:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use ImageReferences instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
imageReferences:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageReferences is a list of matching image reference patterns. At least one pattern in the
|
|
|
|
|
list must match the image for the rule to apply. Each image reference consists of a registry
|
|
|
|
|
address (defaults to docker.io), repository, image, and tag (defaults to latest).
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
2022-07-04 00:09:18 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides credentials
|
2023-10-31 05:30:26 +00:00
|
|
|
that will be used for authentication with registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows insecure
|
2023-10-31 05:30:26 +00:00
|
|
|
access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers
|
|
|
|
|
required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-07-04 00:09:18 +02:00
|
|
|
issuer:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
key:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use StaticKeyAttestor instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
mutateDigest:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MutateDigest enables replacement of image tags with digests.
|
|
|
|
|
Defaults to true.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: boolean
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for image signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override the default OCI image repository configured for the installation.
|
|
|
|
|
The repository can also be overridden per Attestor or Attestation.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
default: true
|
|
|
|
|
description: Required validates that images are verified
|
|
|
|
|
i.e. have matched passed a signature or attestation
|
|
|
|
|
check.
|
|
|
|
|
type: boolean
|
|
|
|
|
roots:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
|
|
|
|
subject:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2022-07-04 00:09:18 +02:00
|
|
|
type: string
|
2023-02-20 08:26:10 -08:00
|
|
|
type:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Type specifies the method of signature validation. The allowed options
|
|
|
|
|
are Cosign and Notary. By default Cosign is used if a type is not specified.
|
2023-02-20 08:26:10 -08:00
|
|
|
enum:
|
|
|
|
|
- Cosign
|
2023-06-01 13:35:28 +05:30
|
|
|
- Notary
|
2023-02-20 08:26:10 -08:00
|
|
|
type: string
|
2023-08-07 01:24:52 +05:30
|
|
|
useCache:
|
|
|
|
|
default: true
|
|
|
|
|
description: UseCache enables caching of image verify
|
2023-10-31 05:30:26 +00:00
|
|
|
responses for this rule.
|
2023-08-07 01:24:52 +05:30
|
|
|
type: boolean
|
2022-07-04 00:09:18 +02:00
|
|
|
verifyDigest:
|
|
|
|
|
default: true
|
|
|
|
|
description: VerifyDigest validates that images have
|
|
|
|
|
a digest.
|
|
|
|
|
type: boolean
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-08 11:54:58 +02:00
|
|
|
required:
|
|
|
|
|
- name
|
2022-07-04 00:09:18 +02:00
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-03-18 15:00:01 +01:00
|
|
|
conditions:
|
|
|
|
|
items:
|
|
|
|
|
description: "Condition contains details for one aspect of the current
|
2024-05-09 16:47:44 +08:00
|
|
|
state of this API Resource.\n---\nThis struct is intended for
|
|
|
|
|
direct use as an array at the field path .status.conditions. For
|
|
|
|
|
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
|
|
|
|
observations of a foo's current state.\n\t // Known .status.conditions.type
|
|
|
|
|
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
|
|
|
|
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
|
|
|
|
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
|
|
|
|
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
|
|
|
|
\ // other fields\n\t}"
|
2022-03-18 15:00:01 +01:00
|
|
|
properties:
|
|
|
|
|
lastTransitionTime:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
|
|
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
2022-03-18 15:00:01 +01:00
|
|
|
format: date-time
|
|
|
|
|
type: string
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
message is a human readable message indicating details about the transition.
|
|
|
|
|
This may be an empty string.
|
2022-03-18 15:00:01 +01:00
|
|
|
maxLength: 32768
|
|
|
|
|
type: string
|
|
|
|
|
observedGeneration:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
|
|
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
|
|
|
with respect to the current state of the instance.
|
2022-03-18 15:00:01 +01:00
|
|
|
format: int64
|
|
|
|
|
minimum: 0
|
|
|
|
|
type: integer
|
|
|
|
|
reason:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
|
|
|
Producers of specific condition types may define expected values and meanings for this field,
|
|
|
|
|
and whether the values are considered a guaranteed API.
|
|
|
|
|
The value should be a CamelCase string.
|
2022-03-18 15:00:01 +01:00
|
|
|
This field may not be empty.
|
|
|
|
|
maxLength: 1024
|
|
|
|
|
minLength: 1
|
|
|
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
|
|
|
type: string
|
|
|
|
|
status:
|
|
|
|
|
description: status of the condition, one of True, False, Unknown.
|
|
|
|
|
enum:
|
|
|
|
|
- "True"
|
|
|
|
|
- "False"
|
|
|
|
|
- Unknown
|
|
|
|
|
type: string
|
|
|
|
|
type:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
|
|
|
---
|
|
|
|
|
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
|
|
|
|
useful (see .node.status.conditions), the ability to deconflict is important.
|
|
|
|
|
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
2022-03-18 15:00:01 +01:00
|
|
|
maxLength: 316
|
|
|
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- lastTransitionTime
|
|
|
|
|
- message
|
|
|
|
|
- reason
|
|
|
|
|
- status
|
|
|
|
|
- type
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2021-09-23 16:13:27 -07:00
|
|
|
ready:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated in favor of Conditions
|
2021-09-23 16:13:27 -07:00
|
|
|
type: boolean
|
2022-10-27 15:35:32 +05:30
|
|
|
rulecount:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RuleCountStatus contains four variables which describes counts for
|
|
|
|
|
validate, generate, mutate and verify images rules
|
2022-10-27 15:35:32 +05:30
|
|
|
properties:
|
|
|
|
|
generate:
|
|
|
|
|
description: Count for generate rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
mutate:
|
|
|
|
|
description: Count for mutate rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
validate:
|
|
|
|
|
description: Count for validate rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
verifyimages:
|
|
|
|
|
description: Count for verify image rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
required:
|
|
|
|
|
- generate
|
|
|
|
|
- mutate
|
|
|
|
|
- validate
|
|
|
|
|
- verifyimages
|
|
|
|
|
type: object
|
2023-08-31 13:25:21 +03:00
|
|
|
validatingadmissionpolicy:
|
|
|
|
|
description: ValidatingAdmissionPolicy contains status information
|
|
|
|
|
properties:
|
|
|
|
|
generated:
|
|
|
|
|
description: Generated indicates whether a validating admission
|
|
|
|
|
policy is generated from the policy or not
|
|
|
|
|
type: boolean
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Message is a human readable message indicating details about the generation of validating admission policy
|
|
|
|
|
It is an empty string when validating admission policy is successfully generated.
|
2023-08-31 13:25:21 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- generated
|
|
|
|
|
- message
|
|
|
|
|
type: object
|
2021-09-23 16:13:27 -07:00
|
|
|
required:
|
|
|
|
|
- ready
|
2020-11-12 16:44:14 -08:00
|
|
|
type: object
|
|
|
|
|
required:
|
|
|
|
|
- spec
|
|
|
|
|
type: object
|
|
|
|
|
served: true
|
|
|
|
|
storage: true
|
2020-11-12 19:48:39 -08:00
|
|
|
subresources:
|
|
|
|
|
status: {}
|
2022-09-08 16:49:16 +05:30
|
|
|
- additionalPrinterColumns:
|
2023-06-28 14:54:27 +02:00
|
|
|
- jsonPath: .spec.admission
|
|
|
|
|
name: ADMISSION
|
|
|
|
|
type: boolean
|
2022-09-08 16:49:16 +05:30
|
|
|
- jsonPath: .spec.background
|
2023-06-28 14:54:27 +02:00
|
|
|
name: BACKGROUND
|
2022-09-19 11:55:04 +02:00
|
|
|
type: boolean
|
2022-09-08 16:49:16 +05:30
|
|
|
- jsonPath: .spec.validationFailureAction
|
2023-06-28 14:54:27 +02:00
|
|
|
name: VALIDATE ACTION
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-01-30 11:16:49 +01:00
|
|
|
- jsonPath: .status.conditions[?(@.type == "Ready")].status
|
2023-06-28 14:54:27 +02:00
|
|
|
name: READY
|
2023-01-30 11:16:49 +01:00
|
|
|
type: string
|
2022-10-25 00:58:23 +05:30
|
|
|
- jsonPath: .metadata.creationTimestamp
|
2023-06-28 14:54:27 +02:00
|
|
|
name: AGE
|
2022-10-25 00:58:23 +05:30
|
|
|
type: date
|
2023-06-28 14:54:27 +02:00
|
|
|
- jsonPath: .spec.failurePolicy
|
|
|
|
|
name: FAILURE POLICY
|
|
|
|
|
priority: 1
|
|
|
|
|
type: string
|
2022-10-27 15:35:32 +05:30
|
|
|
- jsonPath: .status.rulecount.validate
|
2023-06-28 14:54:27 +02:00
|
|
|
name: VALIDATE
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
|
|
|
|
- jsonPath: .status.rulecount.mutate
|
2023-06-28 14:54:27 +02:00
|
|
|
name: MUTATE
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
|
|
|
|
- jsonPath: .status.rulecount.generate
|
2023-06-28 14:54:27 +02:00
|
|
|
name: GENERATE
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
|
|
|
|
- jsonPath: .status.rulecount.verifyimages
|
2023-06-28 14:54:27 +02:00
|
|
|
name: VERIFY IMAGES
|
2022-10-27 15:35:32 +05:30
|
|
|
priority: 1
|
|
|
|
|
type: integer
|
2023-03-24 08:33:55 +01:00
|
|
|
- jsonPath: .status.conditions[?(@.type == "Ready")].message
|
|
|
|
|
name: MESSAGE
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
name: v2beta1
|
|
|
|
|
schema:
|
|
|
|
|
openAPIV3Schema:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Policy declares validation, mutation, and generation behaviors for matching resources.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/ for more information.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
|
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
|
|
|
may reject unrecognized values.
|
|
|
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind is a string value representing the REST resource this object represents.
|
|
|
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
|
|
|
Cannot be updated.
|
|
|
|
|
In CamelCase.
|
|
|
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
metadata:
|
|
|
|
|
type: object
|
|
|
|
|
spec:
|
|
|
|
|
description: Spec defines policy behaviors and contains one or more rules.
|
|
|
|
|
properties:
|
2023-06-28 14:54:27 +02:00
|
|
|
admission:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Admission controls if rules are applied during admission.
|
2023-06-28 14:54:27 +02:00
|
|
|
Optional. Default value is "true".
|
|
|
|
|
type: boolean
|
2022-09-08 16:49:16 +05:30
|
|
|
applyRules:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ApplyRules controls how rules in a policy are applied. Rule are processed in
|
|
|
|
|
the order of declaration. When set to `One` processing stops after a rule has
|
|
|
|
|
been applied i.e. the rule matches and results in a pass, fail, or error. When
|
|
|
|
|
set to `All` all rules in the policy are processed. The default is `All`.
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- All
|
|
|
|
|
- One
|
|
|
|
|
type: string
|
|
|
|
|
background:
|
2022-09-19 11:55:04 +02:00
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Background controls if rules are applied to existing resources during a background scan.
|
|
|
|
|
Optional. Default value is "true". The value must be set to "false" if the policy rule
|
|
|
|
|
uses variables that are only available in the admission review request (e.g. user name).
|
2022-09-08 16:49:16 +05:30
|
|
|
type: boolean
|
|
|
|
|
failurePolicy:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
FailurePolicy defines how unexpected policy errors and webhook response timeout errors are handled.
|
|
|
|
|
Rules within the same policy share the same failure behavior.
|
|
|
|
|
Allowed values are Ignore or Fail. Defaults to Fail.
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Ignore
|
|
|
|
|
- Fail
|
|
|
|
|
type: string
|
2023-03-03 17:34:55 +08:00
|
|
|
generateExisting:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
GenerateExisting controls whether to trigger generate rule in existing resources
|
|
|
|
|
If is set to "true" generate rule will be triggered and applied to existing matched resources.
|
|
|
|
|
Defaults to "false" if not specified.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: boolean
|
2023-03-24 00:36:51 +08:00
|
|
|
generateExistingOnPolicyUpdate:
|
|
|
|
|
description: Deprecated, use generateExisting instead
|
|
|
|
|
type: boolean
|
2022-09-08 16:49:16 +05:30
|
|
|
mutateExistingOnPolicyUpdate:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MutateExistingOnPolicyUpdate controls if a mutateExisting policy is applied on policy events.
|
|
|
|
|
Default value is "false".
|
2022-09-08 16:49:16 +05:30
|
|
|
type: boolean
|
|
|
|
|
rules:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rules is a list of Rule instances. A Policy contains multiple rules and
|
|
|
|
|
each rule can validate, mutate, or generate resources.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rule defines a validation, mutation, or generation control for matching resources.
|
|
|
|
|
Each rules contains a match declaration to select resources, and an optional exclude
|
|
|
|
|
declaration to specify which resources to exclude.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-06-01 00:30:55 +03:00
|
|
|
celPreconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CELPreconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of CEL conditions. It can only be used with the validate.cel subrule
|
2023-06-01 00:30:55 +03:00
|
|
|
items:
|
|
|
|
|
description: MatchCondition represents a condition which must
|
|
|
|
|
by fulfilled for a request to be sent to a webhook.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
|
|
|
|
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
'object' - The object from the incoming request. The value is null for DELETE requests.
|
|
|
|
|
'oldObject' - The existing object. The value is null for CREATE requests.
|
|
|
|
|
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
|
|
|
|
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
|
|
|
|
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
|
|
|
|
request resource.
|
|
|
|
|
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
|
|
|
|
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
|
|
|
|
the associated expression.
|
|
|
|
|
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
|
|
|
|
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
|
|
|
|
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
|
|
|
|
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources that
|
|
|
|
|
can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data sent to
|
|
|
|
|
the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the HTTP POST
|
|
|
|
|
data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier for
|
|
|
|
|
the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request type (GET
|
|
|
|
|
or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a JSON web
|
|
|
|
|
service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides credentials
|
|
|
|
|
that will be used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows insecure
|
2023-10-31 05:30:26 +00:00
|
|
|
access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers
|
|
|
|
|
required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath context
|
|
|
|
|
variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
2022-09-08 16:49:16 +05:30
|
|
|
expression evaluates to nil
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON object representable
|
|
|
|
|
in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
exclude:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ExcludeResources defines when this policy rule should not be applied. The exclude
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the name or role.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
|
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2022-09-08 16:49:16 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
|
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2022-09-08 16:49:16 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
generate:
|
|
|
|
|
description: Generation is used to create new resources.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
|
|
|
|
description: APIVersion specifies resource apiVersion.
|
|
|
|
|
type: string
|
|
|
|
|
clone:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Clone specifies the source resource used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone can be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies name of the resource.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies source resource namespace.
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
cloneList:
|
|
|
|
|
description: CloneList specifies the list of source resource
|
|
|
|
|
used to populate each generated resource.
|
|
|
|
|
properties:
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies source resource namespace.
|
|
|
|
|
type: string
|
2022-09-28 21:14:38 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels`.
|
|
|
|
|
wildcard characters are not supported.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the
|
|
|
|
|
selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2022-09-28 21:14:38 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
data:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Data provides the resource declaration used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone must be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
kind:
|
|
|
|
|
description: Kind specifies resource kind.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies the resource name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies resource namespace.
|
|
|
|
|
type: string
|
|
|
|
|
synchronize:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Synchronize controls if generated resources should be kept in-sync with their source resource.
|
|
|
|
|
If Synchronize is set to "true" changes to generated resources will be overwritten with resource
|
|
|
|
|
data from Data or the resource specified in the Clone declaration.
|
|
|
|
|
Optional. Defaults to "false" if not specified.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: boolean
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
imageExtractors:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
2023-02-08 06:54:59 -05:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath expression to apply to the image value.
|
|
|
|
|
This is useful when the extracted image begins with a prefix like 'docker://'.
|
|
|
|
|
The 'trim_prefix' function may be used to trim the prefix: trim_prefix(@, 'docker://').
|
|
|
|
|
Note - Image digest mutation may not be used when applying a JMESPAth to an image.
|
2023-02-08 06:54:59 -05:00
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Key is an optional name of the field within 'path' that will be used to uniquely identify an image.
|
2022-09-08 16:49:16 +05:30
|
|
|
Note - this field MUST be unique.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the entry the image will be available under 'images.<name>' in the context.
|
|
|
|
|
If this field is not defined, image entries will appear under 'images.custom'.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
path:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Path is the path to the object containing the image field in a custom resource.
|
|
|
|
|
It should be slash-separated. Each slash-separated key must be a valid YAML key or a wildcard '*'.
|
|
|
|
|
Wildcard keys are expanded in case of arrays or objects.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is an optional name of the field within 'path' that points to the image URI.
|
|
|
|
|
This is useful when a custom 'key' is also defined.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- path
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageExtractors defines a mapping from kinds to ImageExtractorConfigs.
|
|
|
|
|
This config is only valid for verifyImages rules.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
match:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MatchResources defines when this policy rule should be applied. The match
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the user name or role.
|
|
|
|
|
At least one kind is required.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
|
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2022-09-08 16:49:16 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or "OR"
|
|
|
|
|
between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one
|
|
|
|
|
of the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of
|
|
|
|
|
label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-08 16:49:16 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
2022-09-08 16:49:16 +05:30
|
|
|
the Authorizer should report an error.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
mutate:
|
|
|
|
|
description: Mutation is used to modify matching resources.
|
|
|
|
|
properties:
|
|
|
|
|
foreach:
|
|
|
|
|
description: ForEach applies mutation rules to a list of
|
|
|
|
|
sub-elements by creating a context for each entry in the
|
|
|
|
|
list and looping over it to apply the specified logic.
|
|
|
|
|
items:
|
2023-01-20 16:56:35 +08:00
|
|
|
description: ForEachMutation applies mutation rules to
|
|
|
|
|
a list of sub-elements by creating a context for each
|
|
|
|
|
entry in the list and looping over it to apply the specified
|
2022-09-08 16:49:16 +05:30
|
|
|
logic.
|
|
|
|
|
properties:
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data
|
|
|
|
|
sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the
|
|
|
|
|
HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a
|
|
|
|
|
JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
2022-12-27 00:36:49 -08:00
|
|
|
the server certificate.
|
|
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
2022-09-08 16:49:16 +05:30
|
|
|
details.
|
|
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
2023-10-31 05:30:26 +00:00
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON
|
|
|
|
|
object representable in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-12-12 07:20:20 -08:00
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2022-09-08 16:49:16 +05:30
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-05-05 17:40:23 +02:00
|
|
|
order:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Order defines the iteration order on the list.
|
|
|
|
|
Can be Ascending to iterate from first to last element or Descending to iterate in from last to first element.
|
2023-05-05 17:40:23 +02:00
|
|
|
enum:
|
|
|
|
|
- Ascending
|
|
|
|
|
- Descending
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2022-09-08 16:49:16 +05:30
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
2022-09-08 16:49:16 +05:30
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
|
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2023-04-03 21:58:58 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2023-04-03 21:58:58 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2023-04-03 21:58:58 +02:00
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
|
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
targets:
|
|
|
|
|
description: Targets defines the target resources to be
|
|
|
|
|
mutated.
|
|
|
|
|
items:
|
|
|
|
|
description: TargetResourceSpec defines targets for mutating
|
|
|
|
|
existing resources.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
|
|
|
|
description: APIVersion specifies resource apiVersion.
|
|
|
|
|
type: string
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data
|
|
|
|
|
sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the
|
|
|
|
|
HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a
|
|
|
|
|
JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
2023-04-03 21:58:58 +02:00
|
|
|
the server certificate.
|
|
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2023-04-03 21:58:58 +02:00
|
|
|
type: object
|
|
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
2023-04-03 21:58:58 +02:00
|
|
|
details.
|
|
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
2023-10-31 05:30:26 +00:00
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
2023-04-03 21:58:58 +02:00
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-04-03 21:58:58 +02:00
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
value:
|
2023-04-03 21:58:58 +02:00
|
|
|
description: Value is any arbitrary JSON
|
|
|
|
|
object representable in YAML or JSON form.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
2023-04-03 21:58:58 +02:00
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
kind:
|
|
|
|
|
description: Kind specifies resource kind.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies the resource name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies resource namespace.
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements is supported for backwards compatibility but
|
|
|
|
|
will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is a label to identify the rule, It must be
|
|
|
|
|
unique within the policy.
|
|
|
|
|
maxLength: 63
|
|
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using JMESPath)
|
|
|
|
|
for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 22:51:52 +08:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using JMESPath)
|
|
|
|
|
for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 22:51:52 +08:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2023-12-19 10:51:47 +00:00
|
|
|
skipBackgroundRequests:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
SkipBackgroundRequests bypasses admission requests that are sent by the background controller.
|
|
|
|
|
The default value is set to "true", it must be set to "false" to apply
|
|
|
|
|
generate and mutateExisting rules to those requests.
|
2023-12-19 10:51:47 +00:00
|
|
|
type: boolean
|
2022-09-08 16:49:16 +05:30
|
|
|
validate:
|
|
|
|
|
description: Validation is used to validate matching resources.
|
|
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-06-01 00:30:55 +03:00
|
|
|
cel:
|
|
|
|
|
description: CEL allows validation checks using the Common
|
|
|
|
|
Expression Language (https://kubernetes.io/docs/reference/using-api/cel/).
|
|
|
|
|
properties:
|
|
|
|
|
auditAnnotations:
|
|
|
|
|
description: AuditAnnotations contains CEL expressions
|
|
|
|
|
which are used to produce audit annotations for the
|
|
|
|
|
audit event of the API request.
|
|
|
|
|
items:
|
|
|
|
|
description: AuditAnnotation describes how to produce
|
|
|
|
|
an audit annotation for an API request.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
key specifies the audit annotation key. The audit annotation keys of
|
|
|
|
|
a ValidatingAdmissionPolicy must be unique. The key must be a qualified
|
|
|
|
|
name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The key is combined with the resource name of the
|
|
|
|
|
ValidatingAdmissionPolicy to construct an audit annotation key:
|
|
|
|
|
"{ValidatingAdmissionPolicy name}/{key}".
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
|
|
|
|
|
and the same audit annotation key, the annotation key will be identical.
|
|
|
|
|
In this case, the first annotation written with the key will be included
|
|
|
|
|
in the audit event and all subsequent annotations with the same key
|
|
|
|
|
will be discarded.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
valueExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
valueExpression represents the expression which is evaluated by CEL to
|
|
|
|
|
produce an audit annotation value. The expression must evaluate to either
|
|
|
|
|
a string or null value. If the expression evaluates to a string, the
|
|
|
|
|
audit annotation is included with the string value. If the expression
|
|
|
|
|
evaluates to null or empty string the audit annotation will be omitted.
|
|
|
|
|
The valueExpression may be no longer than 5kb in length.
|
|
|
|
|
If the result of the valueExpression is more than 10kb in length, it
|
|
|
|
|
will be truncated to 10kb.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple ValidatingAdmissionPolicyBinding resources match an
|
|
|
|
|
API request, then the valueExpression will be evaluated for
|
|
|
|
|
each binding. All unique values produced by the valueExpressions
|
|
|
|
|
will be joined together in a comma-separated list.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- valueExpression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
expressions:
|
|
|
|
|
description: Expressions is a list of CELExpression
|
|
|
|
|
types.
|
|
|
|
|
items:
|
|
|
|
|
description: Validation specifies the CEL expression
|
|
|
|
|
which is used to apply the validation.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
|
|
|
|
description: "Expression represents the expression
|
2024-05-09 16:47:44 +08:00
|
|
|
which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL
|
|
|
|
|
expressions have access to the contents of the
|
|
|
|
|
API request/response, organized into CEL variables
|
|
|
|
|
as well as some other useful variables:\n\n\n-
|
|
|
|
|
'object' - The object from the incoming request.
|
|
|
|
|
The value is null for DELETE requests.\n- 'oldObject'
|
|
|
|
|
- The existing object. The value is null for
|
|
|
|
|
CREATE requests.\n- 'request' - Attributes of
|
|
|
|
|
the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n-
|
|
|
|
|
'params' - Parameter resource referred to by
|
|
|
|
|
the policy binding being evaluated. Only populated
|
|
|
|
|
if the policy has a ParamKind.\n- 'namespaceObject'
|
2023-08-18 05:54:05 +02:00
|
|
|
- The namespace object that the incoming object
|
|
|
|
|
belongs to. The value is null for cluster-scoped
|
2024-05-09 16:47:44 +08:00
|
|
|
resources.\n- 'variables' - Map of composited
|
2023-08-18 05:54:05 +02:00
|
|
|
variables, from its name to its lazily evaluated
|
2024-05-09 16:47:44 +08:00
|
|
|
value.\n For example, a variable named 'foo'
|
|
|
|
|
can be accessed as 'variables.foo'.\n- 'authorizer'
|
2023-06-01 00:30:55 +03:00
|
|
|
- A CEL Authorizer. May be used to perform authorization
|
|
|
|
|
checks for the principal (user or service account)
|
2024-05-09 16:47:44 +08:00
|
|
|
of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n-
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck
|
2023-06-01 00:30:55 +03:00
|
|
|
constructed from the 'authorizer' and configured
|
2024-05-09 16:47:44 +08:00
|
|
|
with the\n request resource.\n\n\nThe `apiVersion`,
|
2023-06-01 00:30:55 +03:00
|
|
|
`kind`, `metadata.name` and `metadata.generateName`
|
2024-05-09 16:47:44 +08:00
|
|
|
are always accessible from the root of the\nobject.
|
|
|
|
|
No other metadata properties are accessible.\n\n\nOnly
|
|
|
|
|
property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*`
|
|
|
|
|
are accessible.\nAccessible property names are
|
2023-06-01 00:30:55 +03:00
|
|
|
escaped according to the following rules when
|
2024-05-09 16:47:44 +08:00
|
|
|
accessed in the expression:\n- '__' escapes
|
|
|
|
|
to '__underscores__'\n- '.' escapes to '__dot__'\n-
|
|
|
|
|
'-' escapes to '__dash__'\n- '/' escapes to
|
|
|
|
|
'__slash__'\n- Property names that exactly match
|
2023-06-01 00:30:55 +03:00
|
|
|
a CEL RESERVED keyword escape to '__{keyword}__'.
|
2024-05-09 16:47:44 +08:00
|
|
|
The keywords are:\n\t \"true\", \"false\",
|
|
|
|
|
\"null\", \"in\", \"as\", \"break\", \"const\",
|
|
|
|
|
\"continue\", \"else\", \"for\", \"function\",
|
|
|
|
|
\"if\",\n\t \"import\", \"let\", \"loop\",
|
|
|
|
|
\"package\", \"namespace\", \"return\".\nExamples:\n
|
|
|
|
|
\ - Expression accessing a property named \"namespace\":
|
|
|
|
|
{\"Expression\": \"object.__namespace__ > 0\"}\n
|
|
|
|
|
\ - Expression accessing a property named \"x-prop\":
|
|
|
|
|
{\"Expression\": \"object.x__dash__prop > 0\"}\n
|
|
|
|
|
\ - Expression accessing a property named \"redact__d\":
|
|
|
|
|
{\"Expression\": \"object.redact__underscores__d
|
|
|
|
|
> 0\"}\n\n\nEquality on arrays with list type
|
|
|
|
|
of 'set' or 'map' ignores element order, i.e.
|
|
|
|
|
[1, 2] == [2, 1].\nConcatenation on arrays with
|
|
|
|
|
x-kubernetes-list-type use the semantics of
|
|
|
|
|
the list type:\n - 'set': `X + Y` performs
|
|
|
|
|
a union where the array positions of all elements
|
|
|
|
|
in `X` are preserved and\n non-intersecting
|
2023-06-01 00:30:55 +03:00
|
|
|
elements in `Y` are appended, retaining their
|
2024-05-09 16:47:44 +08:00
|
|
|
partial order.\n - 'map': `X + Y` performs
|
|
|
|
|
a merge where the array positions of all keys
|
|
|
|
|
in `X` are preserved but the values\n are
|
|
|
|
|
overwritten by values in `Y` when the key sets
|
|
|
|
|
of `X` and `Y` intersect. Elements in `Y` with\n
|
|
|
|
|
\ non-intersecting keys are appended, retaining
|
|
|
|
|
their partial order.\nRequired."
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Message represents the message displayed when validation fails. The message is required if the Expression contains
|
|
|
|
|
line breaks. The message must not contain line breaks.
|
|
|
|
|
If unset, the message is "failed rule: {Rule}".
|
|
|
|
|
e.g. "must be a URL with the host matching spec.host"
|
|
|
|
|
If the Expression contains line breaks. Message is required.
|
|
|
|
|
The message must not contain line breaks.
|
|
|
|
|
If unset, the message is "failed Expression: {Expression}".
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
messageExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
|
|
|
|
|
Since messageExpression is used as a failure message, it must evaluate to a string.
|
|
|
|
|
If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
|
|
|
|
|
If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
|
|
|
|
|
as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
|
|
|
|
|
that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
|
|
|
|
|
the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
|
|
|
|
|
messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'.
|
|
|
|
|
Example:
|
|
|
|
|
"object.x must be less than max ("+string(params.max)+")"
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
reason:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reason represents a machine-readable description of why this validation failed.
|
|
|
|
|
If this is the first validation in the list to fail, this reason, as well as the
|
|
|
|
|
corresponding HTTP response code, are used in the
|
|
|
|
|
HTTP response to the client.
|
|
|
|
|
The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge".
|
|
|
|
|
If not set, StatusReasonInvalid is used in the response to the client.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
paramKind:
|
|
|
|
|
description: ParamKind is a tuple of Group Kind and
|
|
|
|
|
Version.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIVersion is the API group version the resources belong to.
|
|
|
|
|
In format of "group/version".
|
2023-06-01 00:30:55 +03:00
|
|
|
Required.
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind is the API kind the resources belong to.
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
paramRef:
|
|
|
|
|
description: ParamRef references a parameter resource.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`name` is the name of the resource being referenced.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
`name` and `selector` are mutually exclusive properties. If one is set,
|
|
|
|
|
the other must be unset.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
namespace is the namespace of the referenced resource. Allows limiting
|
|
|
|
|
the search for params to a specific namespace. Applies to both `name` and
|
|
|
|
|
`selector` fields.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A per-namespace parameter may be used by specifying a namespace-scoped
|
|
|
|
|
`paramKind` in the policy and leaving this field empty.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
|
|
|
|
|
field results in a configuration error.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is namespace-scoped, the namespace of the object being
|
|
|
|
|
evaluated for admission will be used when this field is left unset. Take
|
|
|
|
|
care that if this is left empty the binding must not match any cluster-scoped
|
|
|
|
|
resources, which will result in an error.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
2023-08-18 05:54:05 +02:00
|
|
|
parameterNotFoundAction:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`parameterNotFoundAction` controls the behavior of the binding when the resource
|
|
|
|
|
exists, and name or selector is valid, but there are no parameters
|
|
|
|
|
matched by the binding. If the value is set to `Allow`, then no
|
|
|
|
|
matched parameters will be treated as successful validation by the binding.
|
|
|
|
|
If set to `Deny`, then no matched parameters will be subject to the
|
|
|
|
|
`failurePolicy` of the policy.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Allowed values are `Allow` or `Deny`
|
|
|
|
|
Default to `Deny`
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
selector can be used to match multiple param objects based on their labels.
|
|
|
|
|
Supply selector: {} to match all resources of the ParamKind.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple params are found, they are all evaluated with the policy expressions
|
|
|
|
|
and the results are ANDed together.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
One of `name` or `selector` must be set, but `name` and `selector` are
|
|
|
|
|
mutually exclusive properties. If one is set, the other must be unset.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2023-08-18 05:54:05 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-08-24 13:00:27 +03:00
|
|
|
variables:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Variables contain definitions of variables that can be used in composition of other expressions.
|
2023-08-24 13:00:27 +03:00
|
|
|
Each variable is defined as a named CEL expression.
|
2024-05-09 16:47:44 +08:00
|
|
|
The variables defined here will be available under `variables` in other expressions of the policy.
|
2023-08-24 13:00:27 +03:00
|
|
|
items:
|
|
|
|
|
description: Variable is the definition of a variable
|
|
|
|
|
that is used for composition.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression is the expression that will be evaluated as the value of the variable.
|
|
|
|
|
The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
|
|
|
|
The variable can be accessed in other expressions through `variables`
|
|
|
|
|
For example, if name is "foo", the variable will be available as `variables.foo`
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
deny:
|
|
|
|
|
description: Deny defines conditions used to pass or fail
|
|
|
|
|
a validation rule.
|
|
|
|
|
properties:
|
|
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
2023-01-04 17:03:56 +08:00
|
|
|
Here, all of the conditions need to pass.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 22:51:52 +08:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
2023-01-04 17:03:56 +08:00
|
|
|
Here, at least one of the conditions need to pass.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 22:51:52 +08:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
foreach:
|
|
|
|
|
description: ForEach applies validate rules to a list of
|
|
|
|
|
sub-elements by creating a context for each entry in the
|
|
|
|
|
list and looping over it to apply the specified logic.
|
|
|
|
|
items:
|
2023-01-20 16:56:35 +08:00
|
|
|
description: ForEachValidation applies validate rules
|
|
|
|
|
to a list of sub-elements by creating a context for
|
|
|
|
|
each entry in the list and looping over it to apply
|
|
|
|
|
the specified logic.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data
|
|
|
|
|
sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the
|
|
|
|
|
HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a
|
|
|
|
|
JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
2022-12-27 00:36:49 -08:00
|
|
|
the server certificate.
|
|
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
2022-09-08 16:49:16 +05:30
|
|
|
details.
|
|
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
2023-10-31 05:30:26 +00:00
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
|
|
|
|
the image reference.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON
|
|
|
|
|
object representable in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
deny:
|
|
|
|
|
description: Deny defines conditions used to pass
|
|
|
|
|
or fail a validation rule.
|
|
|
|
|
properties:
|
|
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements) is also supported for backwards compatibility
|
2022-09-08 16:49:16 +05:30
|
|
|
but will be deprecated in the next major release.
|
2024-05-09 16:47:44 +08:00
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
elementScope:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ElementScope specifies whether to use the current list element as the scope for validation. Defaults to "true" if not specified.
|
|
|
|
|
When set to "false", "request.object" is used as the validation scope within the foreach
|
|
|
|
|
block to allow referencing other elements in the subtree.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: boolean
|
2022-12-12 07:20:20 -08:00
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2022-09-08 16:49:16 +05:30
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
pattern:
|
|
|
|
|
description: Pattern specifies an overlay-style pattern
|
|
|
|
|
used to check resources.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry (using
|
|
|
|
|
JMESPath) for conditional rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional display
|
|
|
|
|
message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
manifests:
|
|
|
|
|
description: Manifest specifies conditions for manifest
|
|
|
|
|
verification
|
|
|
|
|
properties:
|
|
|
|
|
annotationDomain:
|
|
|
|
|
description: AnnotationDomain is custom domain of annotation
|
2022-09-10 18:11:38 +02:00
|
|
|
for message and signature. Default is "cosign.sigstore.dev".
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-09-08 16:49:16 +05:30
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set of
|
|
|
|
|
Attestor used to specify a more complex
|
|
|
|
|
set of match authorities.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies one
|
2023-10-31 05:30:26 +00:00
|
|
|
or more certificates.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional PEM-encoded
|
|
|
|
|
public certificate.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates used
|
|
|
|
|
to verify.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
2022-09-08 16:49:16 +05:30
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
|
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions are
|
|
|
|
|
certificate-extensions used for keyless
|
|
|
|
|
signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret resource
|
|
|
|
|
that contains a public key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name where
|
|
|
|
|
the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
dryRun:
|
|
|
|
|
description: DryRun configuration
|
|
|
|
|
properties:
|
|
|
|
|
enable:
|
|
|
|
|
type: boolean
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
ignoreFields:
|
|
|
|
|
description: Fields which will be ignored while comparing
|
|
|
|
|
manifests.
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
fields:
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
objects:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
group:
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for resource bundle reference.
|
|
|
|
|
The repository can be overridden per Attestor or Attestation.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
message:
|
|
|
|
|
description: Message specifies a custom message to be displayed
|
|
|
|
|
on failure.
|
|
|
|
|
type: string
|
|
|
|
|
pattern:
|
|
|
|
|
description: Pattern specifies an overlay-style pattern
|
|
|
|
|
used to check resources.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
podSecurity:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PodSecurity applies exemptions for Kubernetes Pod Security admission
|
|
|
|
|
by specifying exclusions for Pod Security Standards controls.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
exclude:
|
|
|
|
|
description: Exclude specifies the Pod Security Standard
|
|
|
|
|
controls to be excluded.
|
|
|
|
|
items:
|
|
|
|
|
description: PodSecurityStandard specifies the Pod
|
|
|
|
|
Security Standard controls to be excluded.
|
|
|
|
|
properties:
|
|
|
|
|
controlName:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ControlName specifies the name of the Pod Security Standard control.
|
|
|
|
|
See: https://kubernetes.io/docs/concepts/security/pod-security-standards/
|
2022-09-29 12:03:13 +08:00
|
|
|
enum:
|
|
|
|
|
- HostProcess
|
|
|
|
|
- Host Namespaces
|
|
|
|
|
- Privileged Containers
|
|
|
|
|
- Capabilities
|
|
|
|
|
- HostPath Volumes
|
|
|
|
|
- Host Ports
|
|
|
|
|
- AppArmor
|
|
|
|
|
- SELinux
|
|
|
|
|
- /proc Mount Type
|
|
|
|
|
- Seccomp
|
|
|
|
|
- Sysctls
|
|
|
|
|
- Volume Types
|
|
|
|
|
- Privilege Escalation
|
|
|
|
|
- Running as Non-root
|
|
|
|
|
- Running as Non-root user
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
images:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Images selects matching containers and applies the container level PSS.
|
|
|
|
|
Each image is the image name consisting of the registry address, repository, image, and tag.
|
|
|
|
|
Empty list matches no containers, PSS checks are applied at the pod level only.
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- controlName
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
level:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Level defines the Pod Security Standard level to be applied to workloads.
|
|
|
|
|
Allowed values are privileged, baseline, and restricted.
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- privileged
|
|
|
|
|
- baseline
|
|
|
|
|
- restricted
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Version defines the Pod Security Standard versions that Kubernetes supports.
|
|
|
|
|
Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, latest. Defaults to latest.
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- v1.19
|
|
|
|
|
- v1.20
|
|
|
|
|
- v1.21
|
|
|
|
|
- v1.22
|
|
|
|
|
- v1.23
|
|
|
|
|
- v1.24
|
|
|
|
|
- v1.25
|
2023-04-03 20:50:11 +08:00
|
|
|
- v1.26
|
2022-09-08 16:49:16 +05:30
|
|
|
- latest
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
verifyImages:
|
|
|
|
|
description: VerifyImages is used to verify image signatures
|
|
|
|
|
and mutate them to add a digest
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageVerification validates that images that match the specified pattern
|
|
|
|
|
are signed with the supplied public key. Once the image is verified it is
|
|
|
|
|
mutated to include the SHA digest retrieved during the registration.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
attestations:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestations are optional checks for signed in-toto Statements used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statement declarations.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestation are checks for signed in-toto Statements that are used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statements.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2022-12-02 06:09:44 +08:00
|
|
|
attestors:
|
|
|
|
|
description: Attestors specify the required attestors
|
2023-10-31 05:30:26 +00:00
|
|
|
(i.e. authorities).
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-12-02 06:09:44 +08:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set
|
|
|
|
|
of Attestor used to specify a more
|
|
|
|
|
complex set of match authorities.
|
2022-12-02 06:09:44 +08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies
|
2023-10-31 05:30:26 +00:00
|
|
|
one or more certificates.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional
|
|
|
|
|
PEM-encoded public certificate.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates
|
|
|
|
|
used to verify.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
|
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions used
|
|
|
|
|
for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret
|
|
|
|
|
resource that contains a public
|
|
|
|
|
key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace name
|
|
|
|
|
where the Secret exists.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
|
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and
|
|
|
|
|
sha512.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-08 16:49:16 +05:30
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Conditions are used to verify attributes within a Predicate. If no Conditions are specified
|
|
|
|
|
the attestation check is satisfied as long there are predicates that match the predicate type.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions consists of conditions wrapped denoting a logical criteria to be fulfilled.
|
|
|
|
|
AnyConditions get fulfilled when at least one of its sub-conditions passes.
|
|
|
|
|
AllConditions get fulfilled only when all of its sub-conditions pass.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
predicateType:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated in favour of 'Type', to
|
|
|
|
|
be removed soon
|
2023-06-01 13:35:28 +05:30
|
|
|
type: string
|
|
|
|
|
type:
|
|
|
|
|
description: Type defines the type of attestation
|
2022-09-08 16:49:16 +05:30
|
|
|
contained within the Statement.
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-09-08 16:49:16 +05:30
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set of Attestor
|
2022-09-08 16:49:16 +05:30
|
|
|
used to specify a more complex set of match
|
2023-10-31 05:30:26 +00:00
|
|
|
authorities.
|
2022-09-08 16:49:16 +05:30
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies one or
|
2023-10-31 05:30:26 +00:00
|
|
|
more certificates.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional PEM-encoded
|
|
|
|
|
public certificate.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
2022-09-08 16:49:16 +05:30
|
|
|
PEM encoded set of certificates used
|
2023-10-31 05:30:26 +00:00
|
|
|
to verify.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is used
|
|
|
|
|
to validate SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
url:
|
|
|
|
|
description: URL is the address of
|
|
|
|
|
the transparency log. Defaults to
|
2023-10-31 05:30:26 +00:00
|
|
|
the public Rekor log instance https://rekor.sigstore.dev.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
2022-09-08 16:49:16 +05:30
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
|
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions are
|
|
|
|
|
certificate-extensions used for keyless
|
|
|
|
|
signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is used
|
|
|
|
|
to validate SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
url:
|
|
|
|
|
description: URL is the address of
|
|
|
|
|
the transparency log. Defaults to
|
2023-10-31 05:30:26 +00:00
|
|
|
the public Rekor log instance https://rekor.sigstore.dev.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified identity
|
|
|
|
|
used for keyless signing, for example
|
2023-10-31 05:30:26 +00:00
|
|
|
the email address.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more public
|
2023-10-31 05:30:26 +00:00
|
|
|
keys.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is used
|
|
|
|
|
to validate SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-08 16:49:16 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips transparency
|
|
|
|
|
log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
url:
|
|
|
|
|
description: URL is the address of
|
|
|
|
|
the transparency log. Defaults to
|
2023-10-31 05:30:26 +00:00
|
|
|
the public Rekor log instance https://rekor.sigstore.dev.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret resource
|
|
|
|
|
that contains a public key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret. The
|
|
|
|
|
provided secret must contain a key
|
|
|
|
|
named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name where
|
|
|
|
|
the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values are
|
2023-12-27 08:34:16 +00:00
|
|
|
sha224, sha256, sha384 and sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
imageReferences:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageReferences is a list of matching image reference patterns. At least one pattern in the
|
|
|
|
|
list must match the image for the rule to apply. Each image reference consists of a registry
|
|
|
|
|
address (defaults to docker.io), repository, image, and tag (defaults to latest).
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides credentials
|
|
|
|
|
that will be used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows insecure
|
2023-10-31 05:30:26 +00:00
|
|
|
access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
mutateDigest:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MutateDigest enables replacement of image tags with digests.
|
|
|
|
|
Defaults to true.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: boolean
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for image signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override the default OCI image repository configured for the installation.
|
|
|
|
|
The repository can also be overridden per Attestor or Attestation.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
default: true
|
|
|
|
|
description: Required validates that images are verified
|
|
|
|
|
i.e. have matched passed a signature or attestation
|
|
|
|
|
check.
|
|
|
|
|
type: boolean
|
2023-02-20 08:26:10 -08:00
|
|
|
type:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Type specifies the method of signature validation. The allowed options
|
|
|
|
|
are Cosign and Notary. By default Cosign is used if a type is not specified.
|
2023-02-20 08:26:10 -08:00
|
|
|
enum:
|
|
|
|
|
- Cosign
|
2023-06-01 13:35:28 +05:30
|
|
|
- Notary
|
2023-02-20 08:26:10 -08:00
|
|
|
type: string
|
2023-08-07 01:24:52 +05:30
|
|
|
useCache:
|
|
|
|
|
default: true
|
|
|
|
|
description: UseCache enables caching of image verify
|
|
|
|
|
responses for this rule
|
|
|
|
|
type: boolean
|
2022-09-08 16:49:16 +05:30
|
|
|
verifyDigest:
|
|
|
|
|
default: true
|
|
|
|
|
description: VerifyDigest validates that images have a
|
|
|
|
|
digest.
|
|
|
|
|
type: boolean
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-08 11:54:58 +02:00
|
|
|
required:
|
|
|
|
|
- name
|
2022-09-08 16:49:16 +05:30
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
schemaValidation:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
SchemaValidation skips validation checks for policies as well as patched resources.
|
|
|
|
|
Optional. The default value is set to "true", it must be set to "false" to disable the validation checks.
|
2022-09-08 16:49:16 +05:30
|
|
|
type: boolean
|
2023-08-02 18:59:37 +01:00
|
|
|
useServerSideApply:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
UseServerSideApply controls whether to use server-side apply for generate rules
|
|
|
|
|
If is set to "true" create & update for generate rules will use apply instead of create/update.
|
|
|
|
|
Defaults to "false" if not specified.
|
2023-08-02 18:59:37 +01:00
|
|
|
type: boolean
|
2022-09-08 16:49:16 +05:30
|
|
|
validationFailureAction:
|
2023-01-02 16:16:13 +01:00
|
|
|
default: Audit
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ValidationFailureAction defines if a validation policy rule violation should block
|
|
|
|
|
the admission review request (enforce), or allow (audit) the admission review request
|
|
|
|
|
and report an error in a policy report. Optional.
|
|
|
|
|
Allowed values are audit or enforce. The default value is "Audit".
|
2022-09-08 16:49:16 +05:30
|
|
|
enum:
|
|
|
|
|
- audit
|
|
|
|
|
- enforce
|
2022-11-01 09:56:52 +00:00
|
|
|
- Audit
|
|
|
|
|
- Enforce
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
|
|
|
|
validationFailureActionOverrides:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ValidationFailureActionOverrides is a Cluster Policy attribute that specifies ValidationFailureAction
|
|
|
|
|
namespace-wise. It overrides ValidationFailureAction for the specified namespaces.
|
2022-09-08 16:49:16 +05:30
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
action:
|
|
|
|
|
description: ValidationFailureAction defines the policy validation
|
|
|
|
|
failure action
|
|
|
|
|
enum:
|
|
|
|
|
- audit
|
|
|
|
|
- enforce
|
2023-01-02 19:31:51 +01:00
|
|
|
- Audit
|
|
|
|
|
- Enforce
|
2022-09-08 16:49:16 +05:30
|
|
|
type: string
|
2023-01-18 05:21:34 -05:00
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector is a label query over a set of resources. The result of matchLabels and
|
|
|
|
|
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
|
|
|
|
label selector matches no objects.
|
2023-01-18 05:21:34 -05:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label selector
|
|
|
|
|
requirements. The requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2023-01-18 05:21:34 -05:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that the selector
|
|
|
|
|
applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2023-01-18 05:21:34 -05:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2023-01-18 05:21:34 -05:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2023-01-18 05:21:34 -05:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2022-09-08 16:49:16 +05:30
|
|
|
namespaces:
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
webhookTimeoutSeconds:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
WebhookTimeoutSeconds specifies the maximum time in seconds allowed to apply this policy.
|
|
|
|
|
After the configured time expires, the admission request may fail, or may simply ignore the policy results,
|
|
|
|
|
based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds.
|
2022-09-08 16:49:16 +05:30
|
|
|
format: int32
|
|
|
|
|
type: integer
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
status:
|
|
|
|
|
description: Status contains policy runtime data.
|
|
|
|
|
properties:
|
|
|
|
|
autogen:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: AutogenStatus contains autogen status information.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
rules:
|
|
|
|
|
description: Rules is a list of Rule instances. It contains auto
|
|
|
|
|
generated rules added for pod controllers
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rule defines a validation, mutation, or generation control for matching resources.
|
|
|
|
|
Each rules contains a match declaration to select resources, and an optional exclude
|
|
|
|
|
declaration to specify which resources to exclude.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-06-01 00:30:55 +03:00
|
|
|
celPreconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CELPreconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of CEL conditions. It can only be used with the validate.cel subrule
|
2023-06-01 00:30:55 +03:00
|
|
|
items:
|
|
|
|
|
description: MatchCondition represents a condition which
|
|
|
|
|
must by fulfilled for a request to be sent to a webhook.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
|
|
|
|
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
'object' - The object from the incoming request. The value is null for DELETE requests.
|
|
|
|
|
'oldObject' - The existing object. The value is null for CREATE requests.
|
|
|
|
|
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
|
|
|
|
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
|
|
|
|
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
|
|
|
|
request resource.
|
|
|
|
|
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
|
|
|
|
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
|
|
|
|
the associated expression.
|
|
|
|
|
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
|
|
|
|
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
|
|
|
|
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
|
|
|
|
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data sources
|
|
|
|
|
that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST data sent
|
|
|
|
|
to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains the HTTP POST
|
|
|
|
|
data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request type (GET
|
|
|
|
|
or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call to a JSON
|
|
|
|
|
web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
|
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
|
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
2023-04-26 16:31:44 -07:00
|
|
|
for details.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides
|
|
|
|
|
credentials that will be used for authentication
|
|
|
|
|
with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows
|
2023-10-31 05:30:26 +00:00
|
|
|
insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers
|
2023-06-16 19:07:08 +05:30
|
|
|
required.
|
|
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2022-09-19 11:55:04 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary JMESPath
|
|
|
|
|
context variable that can be defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary JSON object
|
|
|
|
|
representable in YAML or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
exclude:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ExcludeResources defines when this policy rule should not be applied. The exclude
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the name or role.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-09-19 11:55:04 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-09-19 11:55:04 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ResourceDescription contains information about the resource being created or modified.
|
|
|
|
|
Requires at least one tag to be specified when under MatchResources.
|
|
|
|
|
Specifying ResourceDescription directly under match is being deprecated.
|
|
|
|
|
Please specify under "any" or "all" instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one of
|
|
|
|
|
the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role names
|
|
|
|
|
for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names like
|
|
|
|
|
users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
generate:
|
|
|
|
|
description: Generation is used to create new resources.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
|
|
|
|
description: APIVersion specifies resource apiVersion.
|
|
|
|
|
type: string
|
|
|
|
|
clone:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Clone specifies the source resource used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone can be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies name of the resource.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies source resource
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
cloneList:
|
|
|
|
|
description: CloneList specifies the list of source
|
|
|
|
|
resource used to populate each generated resource.
|
|
|
|
|
properties:
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies source resource
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
2022-09-28 21:14:38 +05:30
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels`.
|
|
|
|
|
wildcard characters are not supported.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-28 21:14:38 +05:30
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-28 21:14:38 +05:30
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-28 21:14:38 +05:30
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
data:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Data provides the resource declaration used to populate each generated resource.
|
|
|
|
|
At most one of Data or Clone must be specified. If neither are provided, the generated
|
|
|
|
|
resource will be created with default data only.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
kind:
|
|
|
|
|
description: Kind specifies resource kind.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies the resource name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies resource namespace.
|
|
|
|
|
type: string
|
|
|
|
|
synchronize:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Synchronize controls if generated resources should be kept in-sync with their source resource.
|
|
|
|
|
If Synchronize is set to "true" changes to generated resources will be overwritten with resource
|
|
|
|
|
data from Data or the resource specified in the Clone declaration.
|
2022-09-19 11:55:04 +02:00
|
|
|
Optional. Defaults to "false" if not specified.
|
|
|
|
|
type: boolean
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
imageExtractors:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
2023-02-08 06:54:59 -05:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath expression to apply to the image value.
|
|
|
|
|
This is useful when the extracted image begins with a prefix like 'docker://'.
|
|
|
|
|
The 'trim_prefix' function may be used to trim the prefix: trim_prefix(@, 'docker://').
|
|
|
|
|
Note - Image digest mutation may not be used when applying a JMESPAth to an image.
|
2023-02-08 06:54:59 -05:00
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Key is an optional name of the field within 'path' that will be used to uniquely identify an image.
|
|
|
|
|
Note - this field MUST be unique.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the entry the image will be available under 'images.<name>' in the context.
|
|
|
|
|
If this field is not defined, image entries will appear under 'images.custom'.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
path:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Path is the path to the object containing the image field in a custom resource.
|
|
|
|
|
It should be slash-separated. Each slash-separated key must be a valid YAML key or a wildcard '*'.
|
|
|
|
|
Wildcard keys are expanded in case of arrays or objects.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is an optional name of the field within 'path' that points to the image URI.
|
|
|
|
|
This is useful when a custom 'key' is also defined.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- path
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageExtractors defines a mapping from kinds to ImageExtractorConfigs.
|
|
|
|
|
This config is only valid for verifyImages rules.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
match:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MatchResources defines when this policy rule should be applied. The match
|
|
|
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
|
|
|
and admission review request information like the user name or role.
|
2022-09-19 11:55:04 +02:00
|
|
|
At least one kind is required.
|
|
|
|
|
properties:
|
|
|
|
|
all:
|
|
|
|
|
description: All allows specifying resources which will
|
|
|
|
|
be ANDed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-09-19 11:55:04 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
|
|
|
|
description: Any allows specifying resources which will
|
|
|
|
|
be ORed
|
|
|
|
|
items:
|
|
|
|
|
description: ResourceFilter allow users to "AND" or
|
|
|
|
|
"OR" between resources
|
|
|
|
|
properties:
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
|
|
|
|
description: ResourceDescription contains information
|
|
|
|
|
about the resource being created or modified.
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
2022-09-19 11:55:04 +02:00
|
|
|
"?" (matches at least one character).
|
|
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values
|
|
|
|
|
["CREATE, "UPDATE", "CONNECT", "DELETE"],
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have
|
|
|
|
|
one of the values CREATE, UPDATE, CONNECT,
|
|
|
|
|
DELETE, which are used to match a specific
|
|
|
|
|
action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The
|
|
|
|
|
requirements are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role
|
|
|
|
|
names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names
|
|
|
|
|
like users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
clusterRoles:
|
|
|
|
|
description: ClusterRoles is the list of cluster-wide
|
|
|
|
|
role names for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
resources:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ResourceDescription contains information about the resource being created or modified.
|
|
|
|
|
Requires at least one tag to be specified when under MatchResources.
|
|
|
|
|
Specifying ResourceDescription directly under match is being deprecated.
|
|
|
|
|
Please specify under "any" or "all" instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
|
|
|
and values support the wildcard characters "*" (matches zero or many characters) and
|
|
|
|
|
"?" (matches at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
kinds:
|
|
|
|
|
description: Kinds is a list of resource kinds.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the resource. The name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
|
|
|
|
NOTE: "Name" is being deprecated in favor of "Names".
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
names:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Names are the names of the resources. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
namespaceSelector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
NamespaceSelector is a label selector for the resource namespace. Label keys and values
|
|
|
|
|
in `matchLabels` support the wildcard characters `*` (matches zero or many characters)
|
|
|
|
|
and `?` (matches one character).Wildcards allows writing label selectors like
|
|
|
|
|
["storage.k8s.io/*": "*"]. Note that using ["*" : "*"] matches any key and value but
|
|
|
|
|
does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
namespaces:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
|
|
|
"*" (matches zero or many characters) and "?" (at least one character).
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-03-29 06:22:21 +02:00
|
|
|
operations:
|
|
|
|
|
description: Operations can contain values ["CREATE,
|
|
|
|
|
"UPDATE", "CONNECT", "DELETE"], which are used
|
|
|
|
|
to match a specific action.
|
|
|
|
|
items:
|
|
|
|
|
description: AdmissionOperation can have one of
|
|
|
|
|
the values CREATE, UPDATE, CONNECT, DELETE,
|
|
|
|
|
which are used to match a specific action.
|
|
|
|
|
enum:
|
|
|
|
|
- CREATE
|
|
|
|
|
- CONNECT
|
|
|
|
|
- UPDATE
|
|
|
|
|
- DELETE
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Selector is a label selector. Label keys and values in `matchLabels` support the wildcard
|
|
|
|
|
characters `*` (matches zero or many characters) and `?` (matches one character).
|
|
|
|
|
Wildcards allows writing label selectors like ["storage.k8s.io/*": "*"]. Note that
|
|
|
|
|
using ["*" : "*"] matches any key and value but does not match an empty label set.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list of label
|
|
|
|
|
selector requirements. The requirements are
|
|
|
|
|
ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key that
|
|
|
|
|
the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
2022-09-19 11:55:04 +02:00
|
|
|
merge patch.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: object
|
|
|
|
|
roles:
|
|
|
|
|
description: Roles is the list of namespaced role names
|
|
|
|
|
for the user.
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
subjects:
|
|
|
|
|
description: Subjects is the list of subject names like
|
|
|
|
|
users, user groups, and service accounts.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference,
|
|
|
|
|
or a value for non-objects such as user and group names.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiGroup:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIGroup holds the API group of the referenced subject.
|
|
|
|
|
Defaults to "" for ServiceAccount subjects.
|
|
|
|
|
Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
|
|
|
|
|
If the Authorizer does not recognized the kind value, the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the object being referenced.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
|
|
|
|
|
the Authorizer should report an error.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- kind
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
mutate:
|
|
|
|
|
description: Mutation is used to modify matching resources.
|
|
|
|
|
properties:
|
|
|
|
|
foreach:
|
|
|
|
|
description: ForEach applies mutation rules to a list
|
|
|
|
|
of sub-elements by creating a context for each entry
|
|
|
|
|
in the list and looping over it to apply the specified
|
|
|
|
|
logic.
|
|
|
|
|
items:
|
2023-01-20 16:56:35 +08:00
|
|
|
description: ForEachMutation applies mutation rules
|
|
|
|
|
to a list of sub-elements by creating a context
|
|
|
|
|
for each entry in the list and looping over it to
|
|
|
|
|
apply the specified logic.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data
|
|
|
|
|
sources that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST
|
|
|
|
|
data sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains
|
|
|
|
|
the HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data
|
|
|
|
|
value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call
|
|
|
|
|
to a JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
2023-04-26 16:31:44 -07:00
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
2023-04-26 16:31:44 -07:00
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
|
|
|
|
for details.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap
|
|
|
|
|
reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials
|
|
|
|
|
provides credentials that will be
|
|
|
|
|
used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry
|
2023-10-31 05:30:26 +00:00
|
|
|
allows insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2022-09-19 11:55:04 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary
|
|
|
|
|
JMESPath context variable that can be
|
|
|
|
|
defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary
|
|
|
|
|
JSON object representable in YAML
|
|
|
|
|
or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-12-12 07:20:20 -08:00
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach
|
|
|
|
|
iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2022-09-19 11:55:04 +02:00
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
2023-05-05 17:40:23 +02:00
|
|
|
order:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Order defines the iteration order on the list.
|
|
|
|
|
Can be Ascending to iterate from first to last element or Descending to iterate in from last to first element.
|
2023-05-05 17:40:23 +02:00
|
|
|
enum:
|
|
|
|
|
- Ascending
|
|
|
|
|
- Descending
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2022-09-19 11:55:04 +02:00
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
|
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
patchStrategicMerge:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
|
|
|
See https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/
|
2022-09-19 11:55:04 +02:00
|
|
|
and https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
patchesJson6902:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
|
|
|
|
See https://tools.ietf.org/html/rfc6902 and https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
targets:
|
|
|
|
|
description: Targets defines the target resources to
|
|
|
|
|
be mutated.
|
|
|
|
|
items:
|
2023-04-03 21:58:58 +02:00
|
|
|
description: TargetResourceSpec defines targets for
|
|
|
|
|
mutating existing resources.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
|
|
|
|
description: APIVersion specifies resource apiVersion.
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data
|
|
|
|
|
sources that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST
|
|
|
|
|
data sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains
|
|
|
|
|
the HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data
|
|
|
|
|
value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call
|
|
|
|
|
to a JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
2023-04-26 16:31:44 -07:00
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2023-04-03 21:58:58 +02:00
|
|
|
type: object
|
|
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
2023-04-26 16:31:44 -07:00
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
|
|
|
|
for details.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap
|
|
|
|
|
reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2023-04-03 21:58:58 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials
|
|
|
|
|
provides credentials that will be
|
|
|
|
|
used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry
|
2023-10-31 05:30:26 +00:00
|
|
|
allows insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2023-04-03 21:58:58 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2023-04-03 21:58:58 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary
|
|
|
|
|
JMESPath context variable that can be
|
|
|
|
|
defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2023-04-03 21:58:58 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary
|
|
|
|
|
JSON object representable in YAML
|
|
|
|
|
or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
kind:
|
|
|
|
|
description: Kind specifies resource kind.
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
description: Name specifies the resource name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace specifies resource namespace.
|
|
|
|
|
type: string
|
2023-04-03 21:58:58 +02:00
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements is supported for backwards compatibility but
|
2023-04-03 21:58:58 +02:00
|
|
|
will be deprecated in the next major release.
|
2024-05-09 16:47:44 +08:00
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2023-04-03 21:58:58 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-11-06 11:26:39 +00:00
|
|
|
uid:
|
|
|
|
|
description: UID specifies the resource uid.
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is a label to identify the rule, It must
|
|
|
|
|
be unique within the policy.
|
|
|
|
|
maxLength: 63
|
|
|
|
|
type: string
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Preconditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements is supported for backwards compatibility but
|
|
|
|
|
will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-12-19 10:51:47 +00:00
|
|
|
skipBackgroundRequests:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
SkipBackgroundRequests bypasses admission requests that are sent by the background controller.
|
|
|
|
|
The default value is set to "true", it must be set to "false" to apply
|
2023-12-19 10:51:47 +00:00
|
|
|
generate and mutateExisting rules to those requests.
|
|
|
|
|
type: boolean
|
2022-09-19 11:55:04 +02:00
|
|
|
validate:
|
|
|
|
|
description: Validation is used to validate matching resources.
|
|
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-06-01 00:30:55 +03:00
|
|
|
cel:
|
|
|
|
|
description: CEL allows validation checks using the
|
|
|
|
|
Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/).
|
|
|
|
|
properties:
|
|
|
|
|
auditAnnotations:
|
|
|
|
|
description: AuditAnnotations contains CEL expressions
|
|
|
|
|
which are used to produce audit annotations for
|
|
|
|
|
the audit event of the API request.
|
|
|
|
|
items:
|
|
|
|
|
description: AuditAnnotation describes how to
|
|
|
|
|
produce an audit annotation for an API request.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
key specifies the audit annotation key. The audit annotation keys of
|
|
|
|
|
a ValidatingAdmissionPolicy must be unique. The key must be a qualified
|
|
|
|
|
name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The key is combined with the resource name of the
|
|
|
|
|
ValidatingAdmissionPolicy to construct an audit annotation key:
|
|
|
|
|
"{ValidatingAdmissionPolicy name}/{key}".
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
|
|
|
|
|
and the same audit annotation key, the annotation key will be identical.
|
|
|
|
|
In this case, the first annotation written with the key will be included
|
|
|
|
|
in the audit event and all subsequent annotations with the same key
|
|
|
|
|
will be discarded.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
valueExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
valueExpression represents the expression which is evaluated by CEL to
|
|
|
|
|
produce an audit annotation value. The expression must evaluate to either
|
|
|
|
|
a string or null value. If the expression evaluates to a string, the
|
|
|
|
|
audit annotation is included with the string value. If the expression
|
|
|
|
|
evaluates to null or empty string the audit annotation will be omitted.
|
|
|
|
|
The valueExpression may be no longer than 5kb in length.
|
|
|
|
|
If the result of the valueExpression is more than 10kb in length, it
|
|
|
|
|
will be truncated to 10kb.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple ValidatingAdmissionPolicyBinding resources match an
|
|
|
|
|
API request, then the valueExpression will be evaluated for
|
|
|
|
|
each binding. All unique values produced by the valueExpressions
|
|
|
|
|
will be joined together in a comma-separated list.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- valueExpression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
expressions:
|
|
|
|
|
description: Expressions is a list of CELExpression
|
|
|
|
|
types.
|
|
|
|
|
items:
|
|
|
|
|
description: Validation specifies the CEL expression
|
|
|
|
|
which is used to apply the validation.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
|
|
|
|
description: "Expression represents the expression
|
2024-05-09 16:47:44 +08:00
|
|
|
which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL
|
|
|
|
|
expressions have access to the contents
|
2023-06-01 00:30:55 +03:00
|
|
|
of the API request/response, organized into
|
|
|
|
|
CEL variables as well as some other useful
|
2024-05-09 16:47:44 +08:00
|
|
|
variables:\n\n\n- 'object' - The object
|
|
|
|
|
from the incoming request. The value is
|
|
|
|
|
null for DELETE requests.\n- 'oldObject'
|
|
|
|
|
- The existing object. The value is null
|
|
|
|
|
for CREATE requests.\n- 'request' - Attributes
|
|
|
|
|
of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n-
|
|
|
|
|
'params' - Parameter resource referred to
|
|
|
|
|
by the policy binding being evaluated. Only
|
|
|
|
|
populated if the policy has a ParamKind.\n-
|
|
|
|
|
'namespaceObject' - The namespace object
|
2023-08-18 05:54:05 +02:00
|
|
|
that the incoming object belongs to. The
|
2024-05-09 16:47:44 +08:00
|
|
|
value is null for cluster-scoped resources.\n-
|
|
|
|
|
'variables' - Map of composited variables,
|
|
|
|
|
from its name to its lazily evaluated value.\n
|
|
|
|
|
\ For example, a variable named 'foo' can
|
|
|
|
|
be accessed as 'variables.foo'.\n- 'authorizer'
|
2023-08-18 05:54:05 +02:00
|
|
|
- A CEL Authorizer. May be used to perform
|
|
|
|
|
authorization checks for the principal (user
|
2024-05-09 16:47:44 +08:00
|
|
|
or service account) of the request.\n See
|
|
|
|
|
https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n-
|
|
|
|
|
'authorizer.requestResource' - A CEL ResourceCheck
|
2023-06-01 00:30:55 +03:00
|
|
|
constructed from the 'authorizer' and configured
|
2024-05-09 16:47:44 +08:00
|
|
|
with the\n request resource.\n\n\nThe `apiVersion`,
|
2023-06-01 00:30:55 +03:00
|
|
|
`kind`, `metadata.name` and `metadata.generateName`
|
2024-05-09 16:47:44 +08:00
|
|
|
are always accessible from the root of the\nobject.
|
|
|
|
|
No other metadata properties are accessible.\n\n\nOnly
|
|
|
|
|
property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*`
|
|
|
|
|
are accessible.\nAccessible property names
|
|
|
|
|
are escaped according to the following rules
|
|
|
|
|
when accessed in the expression:\n- '__'
|
|
|
|
|
escapes to '__underscores__'\n- '.' escapes
|
|
|
|
|
to '__dot__'\n- '-' escapes to '__dash__'\n-
|
|
|
|
|
'/' escapes to '__slash__'\n- Property names
|
|
|
|
|
that exactly match a CEL RESERVED keyword
|
|
|
|
|
escape to '__{keyword}__'. The keywords
|
|
|
|
|
are:\n\t \"true\", \"false\", \"null\",
|
|
|
|
|
\"in\", \"as\", \"break\", \"const\", \"continue\",
|
|
|
|
|
\"else\", \"for\", \"function\", \"if\",\n\t
|
|
|
|
|
\ \"import\", \"let\", \"loop\", \"package\",
|
|
|
|
|
\"namespace\", \"return\".\nExamples:\n
|
|
|
|
|
\ - Expression accessing a property named
|
|
|
|
|
\"namespace\": {\"Expression\": \"object.__namespace__
|
|
|
|
|
> 0\"}\n - Expression accessing a property
|
2023-06-01 00:30:55 +03:00
|
|
|
named \"x-prop\": {\"Expression\": \"object.x__dash__prop
|
2024-05-09 16:47:44 +08:00
|
|
|
> 0\"}\n - Expression accessing a property
|
2023-06-01 00:30:55 +03:00
|
|
|
named \"redact__d\": {\"Expression\": \"object.redact__underscores__d
|
2024-05-09 16:47:44 +08:00
|
|
|
> 0\"}\n\n\nEquality on arrays with list
|
|
|
|
|
type of 'set' or 'map' ignores element order,
|
|
|
|
|
i.e. [1, 2] == [2, 1].\nConcatenation on
|
2023-06-01 00:30:55 +03:00
|
|
|
arrays with x-kubernetes-list-type use the
|
2024-05-09 16:47:44 +08:00
|
|
|
semantics of the list type:\n - 'set':
|
|
|
|
|
`X + Y` performs a union where the array
|
|
|
|
|
positions of all elements in `X` are preserved
|
|
|
|
|
and\n non-intersecting elements in `Y`
|
|
|
|
|
are appended, retaining their partial order.\n
|
|
|
|
|
\ - 'map': `X + Y` performs a merge where
|
|
|
|
|
the array positions of all keys in `X` are
|
|
|
|
|
preserved but the values\n are overwritten
|
|
|
|
|
by values in `Y` when the key sets of `X`
|
|
|
|
|
and `Y` intersect. Elements in `Y` with\n
|
|
|
|
|
\ non-intersecting keys are appended,
|
|
|
|
|
retaining their partial order.\nRequired."
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Message represents the message displayed when validation fails. The message is required if the Expression contains
|
|
|
|
|
line breaks. The message must not contain line breaks.
|
|
|
|
|
If unset, the message is "failed rule: {Rule}".
|
|
|
|
|
e.g. "must be a URL with the host matching spec.host"
|
|
|
|
|
If the Expression contains line breaks. Message is required.
|
2023-06-01 00:30:55 +03:00
|
|
|
The message must not contain line breaks.
|
2024-05-09 16:47:44 +08:00
|
|
|
If unset, the message is "failed Expression: {Expression}".
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
messageExpression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
|
|
|
|
|
Since messageExpression is used as a failure message, it must evaluate to a string.
|
|
|
|
|
If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails.
|
|
|
|
|
If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced
|
|
|
|
|
as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string
|
|
|
|
|
that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and
|
|
|
|
|
the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged.
|
|
|
|
|
messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'.
|
|
|
|
|
Example:
|
|
|
|
|
"object.x must be less than max ("+string(params.max)+")"
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
reason:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reason represents a machine-readable description of why this validation failed.
|
|
|
|
|
If this is the first validation in the list to fail, this reason, as well as the
|
|
|
|
|
corresponding HTTP response code, are used in the
|
|
|
|
|
HTTP response to the client.
|
|
|
|
|
The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge".
|
|
|
|
|
If not set, StatusReasonInvalid is used in the response to the client.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
paramKind:
|
|
|
|
|
description: ParamKind is a tuple of Group Kind
|
|
|
|
|
and Version.
|
|
|
|
|
properties:
|
|
|
|
|
apiVersion:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APIVersion is the API group version the resources belong to.
|
|
|
|
|
In format of "group/version".
|
2023-06-01 00:30:55 +03:00
|
|
|
Required.
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Kind is the API kind the resources belong to.
|
|
|
|
|
Required.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
|
|
|
|
paramRef:
|
|
|
|
|
description: ParamRef references a parameter resource.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`name` is the name of the resource being referenced.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
`name` and `selector` are mutually exclusive properties. If one is set,
|
|
|
|
|
the other must be unset.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
|
|
|
|
namespace:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
namespace is the namespace of the referenced resource. Allows limiting
|
|
|
|
|
the search for params to a specific namespace. Applies to both `name` and
|
|
|
|
|
`selector` fields.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A per-namespace parameter may be used by specifying a namespace-scoped
|
|
|
|
|
`paramKind` in the policy and leaving this field empty.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is cluster-scoped, this field MUST be unset. Setting this
|
|
|
|
|
field results in a configuration error.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- If `paramKind` is namespace-scoped, the namespace of the object being
|
|
|
|
|
evaluated for admission will be used when this field is left unset. Take
|
|
|
|
|
care that if this is left empty the binding must not match any cluster-scoped
|
|
|
|
|
resources, which will result in an error.
|
2023-06-01 00:30:55 +03:00
|
|
|
type: string
|
2023-08-18 05:54:05 +02:00
|
|
|
parameterNotFoundAction:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
`parameterNotFoundAction` controls the behavior of the binding when the resource
|
|
|
|
|
exists, and name or selector is valid, but there are no parameters
|
|
|
|
|
matched by the binding. If the value is set to `Allow`, then no
|
|
|
|
|
matched parameters will be treated as successful validation by the binding.
|
|
|
|
|
If set to `Deny`, then no matched parameters will be subject to the
|
|
|
|
|
`failurePolicy` of the policy.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Allowed values are `Allow` or `Deny`
|
|
|
|
|
Default to `Deny`
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
selector:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
selector can be used to match multiple param objects based on their labels.
|
|
|
|
|
Supply selector: {} to match all resources of the ParamKind.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If multiple params are found, they are all evaluated with the policy expressions
|
|
|
|
|
and the results are ANDed together.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
One of `name` or `selector` must be set, but `name` and `selector` are
|
|
|
|
|
mutually exclusive properties. If one is set, the other must be unset.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
matchExpressions:
|
|
|
|
|
description: matchExpressions is a list
|
|
|
|
|
of label selector requirements. The requirements
|
|
|
|
|
are ANDed.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
A label selector requirement is a selector that contains values, a key, and an operator that
|
|
|
|
|
relates the key and values.
|
2023-08-18 05:54:05 +02:00
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: key is the label key
|
|
|
|
|
that the selector applies to.
|
|
|
|
|
type: string
|
|
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
operator represents a key's relationship to a set of values.
|
|
|
|
|
Valid operators are In, NotIn, Exists and DoesNotExist.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: string
|
|
|
|
|
values:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
values is an array of string values. If the operator is In or NotIn,
|
|
|
|
|
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
|
|
|
|
the values array must be empty. This array is replaced during a strategic
|
|
|
|
|
merge patch.
|
2023-08-18 05:54:05 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- operator
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
matchLabels:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
|
|
|
|
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
|
|
|
|
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
2023-08-18 05:54:05 +02:00
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
|
|
|
|
x-kubernetes-map-type: atomic
|
2023-08-24 13:00:27 +03:00
|
|
|
variables:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Variables contain definitions of variables that can be used in composition of other expressions.
|
2023-08-24 13:00:27 +03:00
|
|
|
Each variable is defined as a named CEL expression.
|
2024-05-09 16:47:44 +08:00
|
|
|
The variables defined here will be available under `variables` in other expressions of the policy.
|
2023-08-24 13:00:27 +03:00
|
|
|
items:
|
|
|
|
|
description: Variable is the definition of a variable
|
|
|
|
|
that is used for composition.
|
|
|
|
|
properties:
|
|
|
|
|
expression:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Expression is the expression that will be evaluated as the value of the variable.
|
|
|
|
|
The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
name:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
|
|
|
|
The variable can be accessed in other expressions through `variables`
|
|
|
|
|
For example, if name is "foo", the variable will be available as `variables.foo`
|
2023-08-24 13:00:27 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- expression
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-01 00:30:55 +03:00
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
deny:
|
|
|
|
|
description: Deny defines conditions used to pass or
|
|
|
|
|
fail a validation rule.
|
|
|
|
|
properties:
|
|
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements) is also supported for backwards compatibility
|
2022-09-19 11:55:04 +02:00
|
|
|
but will be deprecated in the next major release.
|
2024-05-09 16:47:44 +08:00
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
foreach:
|
|
|
|
|
description: ForEach applies validate rules to a list
|
|
|
|
|
of sub-elements by creating a context for each entry
|
|
|
|
|
in the list and looping over it to apply the specified
|
|
|
|
|
logic.
|
|
|
|
|
items:
|
2023-01-20 16:56:35 +08:00
|
|
|
description: ForEachValidation applies validate rules
|
|
|
|
|
to a list of sub-elements by creating a context
|
|
|
|
|
for each entry in the list and looping over it to
|
|
|
|
|
apply the specified logic.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
anyPattern:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
|
|
|
must be satisfied for the validation rule to succeed.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
context:
|
|
|
|
|
description: Context defines variables and data
|
|
|
|
|
sources that can be used during rule execution.
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ContextEntry adds variables and data sources to a rule Context. Either a
|
|
|
|
|
ConfigMap reference or a APILookup must be provided.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
apiCall:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
APICall is an HTTP request to the Kubernetes API server, or other JSON web service.
|
|
|
|
|
The data returned is stored in the context with the name for the context entry.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-04-26 16:31:44 -07:00
|
|
|
data:
|
|
|
|
|
description: Data specifies the POST
|
|
|
|
|
data sent to the server.
|
|
|
|
|
items:
|
|
|
|
|
description: RequestData contains
|
|
|
|
|
the HTTP POST data
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is a unique identifier
|
|
|
|
|
for the data value
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is the data
|
|
|
|
|
value
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
required:
|
|
|
|
|
- key
|
|
|
|
|
- value
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the JSON response returned from the server. For example
|
|
|
|
|
a JMESPath of "items | length(@)" applied to the API server response
|
|
|
|
|
for the URLPath "/apis/apps/v1/deployments" will return the total count
|
|
|
|
|
of deployments across all namespaces.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
method:
|
|
|
|
|
default: GET
|
|
|
|
|
description: Method is the HTTP request
|
|
|
|
|
type (GET or POST).
|
|
|
|
|
enum:
|
|
|
|
|
- GET
|
|
|
|
|
- POST
|
|
|
|
|
type: string
|
2022-12-27 00:36:49 -08:00
|
|
|
service:
|
|
|
|
|
description: Service is an API call
|
|
|
|
|
to a JSON web service
|
|
|
|
|
properties:
|
|
|
|
|
caBundle:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CABundle is a PEM encoded CA bundle which will be used to validate
|
|
|
|
|
the server certificate.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
2023-04-26 16:31:44 -07:00
|
|
|
url:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URL is the JSON web service URL. A typical form is
|
2023-04-26 16:31:44 -07:00
|
|
|
`https://{service}.{namespace}:{port}/{path}`.
|
2022-12-27 00:36:49 -08:00
|
|
|
type: string
|
|
|
|
|
required:
|
2023-04-26 16:31:44 -07:00
|
|
|
- url
|
2022-12-27 00:36:49 -08:00
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
urlPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
|
|
|
|
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
|
|
|
|
The format required is the same format used by the `kubectl get --raw` command.
|
2023-04-26 16:31:44 -07:00
|
|
|
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
|
|
|
|
for details.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
configMap:
|
|
|
|
|
description: ConfigMap is the ConfigMap
|
|
|
|
|
reference.
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the ConfigMap name.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace is the ConfigMap
|
|
|
|
|
namespace.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
type: object
|
|
|
|
|
imageRegistry:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageRegistry defines requests to an OCI/Docker V2 registry to fetch image
|
|
|
|
|
details.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials
|
|
|
|
|
provides credentials that will be
|
|
|
|
|
used for authentication with registry
|
|
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry
|
2023-10-31 05:30:26 +00:00
|
|
|
allows insecure access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
2023-06-16 19:07:08 +05:30
|
|
|
provides the list of credential
|
2023-06-17 01:55:46 +05:30
|
|
|
providers required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JSON Match Expression that can be used to
|
|
|
|
|
transform the ImageData struct returned as a result of processing
|
2022-09-19 11:55:04 +02:00
|
|
|
the image reference.
|
|
|
|
|
type: string
|
|
|
|
|
reference:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Reference is image reference to a container image in the registry.
|
|
|
|
|
Example: ghcr.io/kyverno/kyverno:latest
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- reference
|
|
|
|
|
type: object
|
|
|
|
|
name:
|
|
|
|
|
description: Name is the variable name.
|
|
|
|
|
type: string
|
|
|
|
|
variable:
|
|
|
|
|
description: Variable defines an arbitrary
|
|
|
|
|
JMESPath context variable that can be
|
|
|
|
|
defined inline.
|
|
|
|
|
properties:
|
|
|
|
|
default:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Default is an optional arbitrary JSON object that the variable may take if the JMESPath
|
|
|
|
|
expression evaluates to nil
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
jmesPath:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
JMESPath is an optional JMESPath Expression that can be used to
|
|
|
|
|
transform the variable.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
value:
|
|
|
|
|
description: Value is any arbitrary
|
|
|
|
|
JSON object representable in YAML
|
|
|
|
|
or JSON form.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
deny:
|
|
|
|
|
description: Deny defines conditions used to pass
|
|
|
|
|
or fail a validation rule.
|
|
|
|
|
properties:
|
|
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Multiple conditions can be declared under an `any` or `all` statement. A direct list
|
|
|
|
|
of conditions (without `any` or `all` statements) is also supported for backwards compatibility
|
|
|
|
|
but will be deprecated in the next major release.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/validate/#deny-rules
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
elementScope:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ElementScope specifies whether to use the current list element as the scope for validation. Defaults to "true" if not specified.
|
|
|
|
|
When set to "false", "request.object" is used as the validation scope within the foreach
|
|
|
|
|
block to allow referencing other elements in the subtree.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: boolean
|
2022-12-12 07:20:20 -08:00
|
|
|
foreach:
|
|
|
|
|
description: Foreach declares a nested foreach
|
|
|
|
|
iterator
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2022-09-19 11:55:04 +02:00
|
|
|
list:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
List specifies a JMESPath expression that results in one or more elements
|
|
|
|
|
to which the validation logic is applied.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
pattern:
|
|
|
|
|
description: Pattern specifies an overlay-style
|
|
|
|
|
pattern used to check resources.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
preconditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions are used to determine if a policy rule should be applied by evaluating a
|
|
|
|
|
set of conditions. The declaration can contain nested `any` or `all` statements.
|
|
|
|
|
See: https://kyverno.io/docs/writing-policies/preconditions/
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context entry
|
|
|
|
|
(using JMESPath) for conditional rule
|
|
|
|
|
evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
manifests:
|
|
|
|
|
description: Manifest specifies conditions for manifest
|
|
|
|
|
verification
|
|
|
|
|
properties:
|
|
|
|
|
annotationDomain:
|
|
|
|
|
description: AnnotationDomain is custom domain of
|
|
|
|
|
annotation for message and signature. Default
|
|
|
|
|
is "cosign.sigstore.dev".
|
|
|
|
|
type: string
|
|
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-09-19 11:55:04 +02:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set
|
|
|
|
|
of Attestor used to specify a more
|
|
|
|
|
complex set of match authorities.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies
|
2023-10-31 05:30:26 +00:00
|
|
|
one or more certificates.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional
|
|
|
|
|
PEM-encoded public certificate.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates
|
|
|
|
|
used to verify.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
|
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions used
|
|
|
|
|
for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set,
|
|
|
|
|
is used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret
|
|
|
|
|
resource that contains a public
|
|
|
|
|
key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name
|
|
|
|
|
where the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and
|
|
|
|
|
sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
dryRun:
|
|
|
|
|
description: DryRun configuration
|
|
|
|
|
properties:
|
|
|
|
|
enable:
|
|
|
|
|
type: boolean
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
ignoreFields:
|
|
|
|
|
description: Fields which will be ignored while
|
|
|
|
|
comparing manifests.
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
fields:
|
|
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
objects:
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
group:
|
|
|
|
|
type: string
|
|
|
|
|
kind:
|
|
|
|
|
type: string
|
|
|
|
|
name:
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for resource bundle reference.
|
|
|
|
|
The repository can be overridden per Attestor or Attestation.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
message:
|
|
|
|
|
description: Message specifies a custom message to be
|
|
|
|
|
displayed on failure.
|
|
|
|
|
type: string
|
|
|
|
|
pattern:
|
|
|
|
|
description: Pattern specifies an overlay-style pattern
|
|
|
|
|
used to check resources.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
podSecurity:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
PodSecurity applies exemptions for Kubernetes Pod Security admission
|
|
|
|
|
by specifying exclusions for Pod Security Standards controls.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
exclude:
|
|
|
|
|
description: Exclude specifies the Pod Security
|
|
|
|
|
Standard controls to be excluded.
|
|
|
|
|
items:
|
|
|
|
|
description: PodSecurityStandard specifies the
|
|
|
|
|
Pod Security Standard controls to be excluded.
|
|
|
|
|
properties:
|
|
|
|
|
controlName:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ControlName specifies the name of the Pod Security Standard control.
|
|
|
|
|
See: https://kubernetes.io/docs/concepts/security/pod-security-standards/
|
2022-09-29 12:03:13 +08:00
|
|
|
enum:
|
|
|
|
|
- HostProcess
|
|
|
|
|
- Host Namespaces
|
|
|
|
|
- Privileged Containers
|
|
|
|
|
- Capabilities
|
|
|
|
|
- HostPath Volumes
|
|
|
|
|
- Host Ports
|
|
|
|
|
- AppArmor
|
|
|
|
|
- SELinux
|
|
|
|
|
- /proc Mount Type
|
|
|
|
|
- Seccomp
|
|
|
|
|
- Sysctls
|
|
|
|
|
- Volume Types
|
|
|
|
|
- Privilege Escalation
|
|
|
|
|
- Running as Non-root
|
|
|
|
|
- Running as Non-root user
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
images:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Images selects matching containers and applies the container level PSS.
|
|
|
|
|
Each image is the image name consisting of the registry address, repository, image, and tag.
|
|
|
|
|
Empty list matches no containers, PSS checks are applied at the pod level only.
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
required:
|
|
|
|
|
- controlName
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
level:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Level defines the Pod Security Standard level to be applied to workloads.
|
|
|
|
|
Allowed values are privileged, baseline, and restricted.
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- privileged
|
|
|
|
|
- baseline
|
|
|
|
|
- restricted
|
|
|
|
|
type: string
|
|
|
|
|
version:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Version defines the Pod Security Standard versions that Kubernetes supports.
|
|
|
|
|
Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, latest. Defaults to latest.
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- v1.19
|
|
|
|
|
- v1.20
|
|
|
|
|
- v1.21
|
|
|
|
|
- v1.22
|
|
|
|
|
- v1.23
|
|
|
|
|
- v1.24
|
|
|
|
|
- v1.25
|
2023-04-03 20:50:11 +08:00
|
|
|
- v1.26
|
2022-09-19 11:55:04 +02:00
|
|
|
- latest
|
|
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
verifyImages:
|
|
|
|
|
description: VerifyImages is used to verify image signatures
|
|
|
|
|
and mutate them to add a digest
|
|
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageVerification validates that images that match the specified pattern
|
|
|
|
|
are signed with the supplied public key. Once the image is verified it is
|
|
|
|
|
mutated to include the SHA digest retrieved during the registration.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use annotations per Attestor
|
|
|
|
|
instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
attestations:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestations are optional checks for signed in-toto Statements used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statement declarations.
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Attestation are checks for signed in-toto Statements that are used to verify the image.
|
|
|
|
|
See https://github.com/in-toto/attestation. Kyverno fetches signed attestations from the
|
|
|
|
|
OCI registry and decodes them into a list of Statements.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2022-12-02 06:09:44 +08:00
|
|
|
attestors:
|
|
|
|
|
description: Attestors specify the required
|
2023-10-31 05:30:26 +00:00
|
|
|
attestors (i.e. authorities).
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-12-02 06:09:44 +08:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-12-02 06:09:44 +08:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
|
|
|
|
description: Attestor is a nested
|
2023-10-31 05:30:26 +00:00
|
|
|
set of Attestor used to specify
|
|
|
|
|
a more complex set of match authorities.
|
2022-12-02 06:09:44 +08:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies
|
2023-10-31 05:30:26 +00:00
|
|
|
one or more certificates.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional
|
|
|
|
|
PEM-encoded public certificate.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an
|
|
|
|
|
optional PEM encoded set of
|
|
|
|
|
certificates used to verify.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if
|
|
|
|
|
set, is used to validate
|
|
|
|
|
SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
|
|
|
|
description: IgnoreTlog
|
2023-10-31 05:30:26 +00:00
|
|
|
skips transparency log
|
|
|
|
|
verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the
|
|
|
|
|
address of the transparency
|
|
|
|
|
log. Defaults to the public
|
2023-10-31 05:30:26 +00:00
|
|
|
Rekor log instance https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
|
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions
|
|
|
|
|
used for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if
|
|
|
|
|
set, is used to validate
|
|
|
|
|
SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
|
|
|
|
description: IgnoreTlog
|
2023-10-31 05:30:26 +00:00
|
|
|
skips transparency log
|
|
|
|
|
verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the
|
|
|
|
|
address of the transparency
|
|
|
|
|
log. Defaults to the public
|
2023-10-31 05:30:26 +00:00
|
|
|
Rekor log instance https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the
|
|
|
|
|
verified identity used for
|
|
|
|
|
keyless signing, for example
|
2023-10-31 05:30:26 +00:00
|
|
|
the email address.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one
|
2023-10-31 05:30:26 +00:00
|
|
|
or more public keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if
|
|
|
|
|
set, is used to validate
|
|
|
|
|
SCTs against a custom
|
|
|
|
|
source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-12-02 06:09:44 +08:00
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-12-02 06:09:44 +08:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
|
|
|
|
description: IgnoreTlog
|
2023-10-31 05:30:26 +00:00
|
|
|
skips transparency log
|
|
|
|
|
verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-12-02 06:09:44 +08:00
|
|
|
url:
|
|
|
|
|
description: URL is the
|
|
|
|
|
address of the transparency
|
|
|
|
|
log. Defaults to the public
|
2023-10-31 05:30:26 +00:00
|
|
|
Rekor log instance https://rekor.sigstore.dev.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
secret:
|
|
|
|
|
description: Reference to a
|
|
|
|
|
Secret resource that contains
|
|
|
|
|
a public key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
|
|
|
|
description: Name of the
|
|
|
|
|
secret. The provided secret
|
|
|
|
|
must contain a key named
|
|
|
|
|
cosign.pub.
|
|
|
|
|
type: string
|
|
|
|
|
namespace:
|
|
|
|
|
description: Namespace name
|
|
|
|
|
where the Secret exists.
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
|
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature
|
|
|
|
|
algorithm for public keys.
|
2023-12-27 08:34:16 +00:00
|
|
|
Supported values are sha224,
|
|
|
|
|
sha256, sha384 and sha512.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-12-02 06:09:44 +08:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2022-09-19 11:55:04 +02:00
|
|
|
conditions:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Conditions are used to verify attributes within a Predicate. If no Conditions are specified
|
|
|
|
|
the attestation check is satisfied as long there are predicates that match the predicate type.
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyAllConditions consists of conditions wrapped denoting a logical criteria to be fulfilled.
|
|
|
|
|
AnyConditions get fulfilled when at least one of its sub-conditions passes.
|
|
|
|
|
AllConditions get fulfilled only when all of its sub-conditions pass.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
all:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AllConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, all of the conditions need to pass
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context
|
|
|
|
|
entry (using JMESPath) for conditional
|
|
|
|
|
rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
any:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
AnyConditions enable variable-based conditional rule execution. This is useful for
|
|
|
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
|
|
|
using JMESPath notation.
|
|
|
|
|
Here, at least one of the conditions need to pass
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
description: Condition defines variable-based
|
|
|
|
|
conditional criteria for rule execution.
|
|
|
|
|
properties:
|
|
|
|
|
key:
|
|
|
|
|
description: Key is the context
|
|
|
|
|
entry (using JMESPath) for conditional
|
|
|
|
|
rule evaluation.
|
|
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
2023-05-08 00:34:23 -07:00
|
|
|
message:
|
|
|
|
|
description: Message is an optional
|
|
|
|
|
display message
|
|
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
operator:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Operator is the conditional operation to perform. Valid operators are:
|
|
|
|
|
Equals, NotEquals, In, AnyIn, AllIn, NotIn, AnyNotIn, AllNotIn, GreaterThanOrEquals,
|
|
|
|
|
GreaterThan, LessThanOrEquals, LessThan, DurationGreaterThanOrEquals, DurationGreaterThan,
|
|
|
|
|
DurationLessThanOrEquals, DurationLessThan
|
2022-09-19 11:55:04 +02:00
|
|
|
enum:
|
|
|
|
|
- Equals
|
|
|
|
|
- NotEquals
|
|
|
|
|
- In
|
|
|
|
|
- AnyIn
|
|
|
|
|
- AllIn
|
|
|
|
|
- NotIn
|
|
|
|
|
- AnyNotIn
|
|
|
|
|
- AllNotIn
|
|
|
|
|
- GreaterThanOrEquals
|
|
|
|
|
- GreaterThan
|
|
|
|
|
- LessThanOrEquals
|
|
|
|
|
- LessThan
|
|
|
|
|
- DurationGreaterThanOrEquals
|
|
|
|
|
- DurationGreaterThan
|
|
|
|
|
- DurationLessThanOrEquals
|
|
|
|
|
- DurationLessThan
|
|
|
|
|
type: string
|
|
|
|
|
value:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Value is the conditional value, or set of values. The values can be fixed set
|
|
|
|
|
or can be variables declared using JMESPath.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
predicateType:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated in favour of 'Type',
|
|
|
|
|
to be removed soon
|
2023-06-01 13:35:28 +05:30
|
|
|
type: string
|
|
|
|
|
type:
|
|
|
|
|
description: Type defines the type of attestation
|
|
|
|
|
contained within the Statement.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
attestors:
|
|
|
|
|
description: Attestors specified the required attestors
|
|
|
|
|
(i.e. authorities)
|
|
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
count:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Count specifies the required number of entries that must match. If the count is null, all entries must match
|
|
|
|
|
(a logical AND). If the count is 1, at least one entry must match (a logical OR). If the count contains a
|
|
|
|
|
value N, then N must be less than or equal to the size of entries, and at least N entries must match.
|
2022-09-19 11:55:04 +02:00
|
|
|
minimum: 1
|
|
|
|
|
type: integer
|
|
|
|
|
entries:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Entries contains the available attestors. An attestor can be a static key,
|
|
|
|
|
attributes for keyless verification, or a nested attestor declaration.
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
properties:
|
|
|
|
|
annotations:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Annotations are used for image verification.
|
|
|
|
|
Every specified key-value pair must exist and match in the verified payload.
|
|
|
|
|
The payload may contain other key-value pairs.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
attestor:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Attestor is a nested set
|
|
|
|
|
of Attestor used to specify a more complex
|
|
|
|
|
set of match authorities.
|
2022-09-19 11:55:04 +02:00
|
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
|
|
|
certificates:
|
|
|
|
|
description: Certificates specifies one
|
2023-10-31 05:30:26 +00:00
|
|
|
or more certificates.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
cert:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: Cert is an optional PEM-encoded
|
|
|
|
|
public certificate.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
certChain:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: CertChain is an optional
|
|
|
|
|
PEM encoded set of certificates
|
|
|
|
|
used to verify.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
2023-08-30 12:09:49 +05:30
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
type: object
|
|
|
|
|
keyless:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keyless is a set of attribute used to verify a Sigstore keyless attestor.
|
2022-09-19 11:55:04 +02:00
|
|
|
See https://github.com/sigstore/cosign/blob/main/KEYLESS.md.
|
|
|
|
|
properties:
|
|
|
|
|
additionalExtensions:
|
|
|
|
|
additionalProperties:
|
|
|
|
|
type: string
|
|
|
|
|
description: AdditionalExtensions
|
|
|
|
|
are certificate-extensions used
|
|
|
|
|
for keyless signing.
|
|
|
|
|
type: object
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
issuer:
|
|
|
|
|
description: Issuer is the certificate
|
|
|
|
|
issuer used for keyless signing.
|
|
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
|
|
|
|
roots:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Roots is an optional set of PEM encoded trusted root certificates.
|
|
|
|
|
If not provided, the system roots are used.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
subject:
|
|
|
|
|
description: Subject is the verified
|
|
|
|
|
identity used for keyless signing,
|
2023-10-31 05:30:26 +00:00
|
|
|
for example the email address.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
keys:
|
|
|
|
|
description: Keys specifies one or more
|
2023-10-31 05:30:26 +00:00
|
|
|
public keys.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-30 12:09:49 +05:30
|
|
|
ctlog:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
CTLog (certificate timestamp log) provides a configuration for validation of Signed Certificate
|
|
|
|
|
Timestamps (SCTs). If the value is unset, the default behavior by Cosign is used.
|
2023-08-30 12:09:49 +05:30
|
|
|
properties:
|
|
|
|
|
ignoreSCT:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate
|
|
|
|
|
timestamp. Default is false. Set to true if this was opted out during signing.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: PubKey, if set, is
|
|
|
|
|
used to validate SCTs against
|
|
|
|
|
a custom source.
|
2023-08-30 12:09:49 +05:30
|
|
|
type: string
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
kms:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
KMS provides the URI to the public key stored in a Key Management System. See:
|
|
|
|
|
https://github.com/sigstore/cosign/blob/main/KMS.md
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
publicKeys:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Keys is a set of X.509 public keys used to verify image signatures. The keys can be directly
|
|
|
|
|
specified or can be a variable reference to a key specified in a ConfigMap (see
|
|
|
|
|
https://kyverno.io/docs/writing-policies/variables/), or reference a standard Kubernetes Secret
|
|
|
|
|
elsewhere in the cluster by specifying it in the format "k8s://<namespace>/<secret_name>".
|
|
|
|
|
The named Secret must specify a key `cosign.pub` containing the public key used for
|
|
|
|
|
verification, (see https://github.com/sigstore/cosign/blob/main/KMS.md#kubernetes-secret).
|
|
|
|
|
When multiple keys are specified each key is processed as a separate staticKey entry
|
|
|
|
|
(.attestors[*].entries.keys) within the set of attestors and the count is applied across the keys.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
rekor:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Rekor provides configuration for the Rekor transparency log service. If an empty object
|
|
|
|
|
is provided the public instance of Rekor (https://rekor.sigstore.dev) is used.
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
2023-08-15 19:55:55 +05:30
|
|
|
ignoreTlog:
|
2023-10-31 05:30:26 +00:00
|
|
|
description: IgnoreTlog skips
|
|
|
|
|
transparency log verification.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: boolean
|
|
|
|
|
pubkey:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor.
|
|
|
|
|
If set, this will be used to validate transparency log signatures from a custom Rekor.
|
2023-08-15 19:55:55 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
url:
|
|
|
|
|
description: URL is the address
|
|
|
|
|
of the transparency log. Defaults
|
2023-10-31 05:30:26 +00:00
|
|
|
to the public Rekor log instance
|
|
|
|
|
https://rekor.sigstore.dev.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- url
|
|
|
|
|
type: object
|
2022-10-14 15:10:46 +05:30
|
|
|
secret:
|
|
|
|
|
description: Reference to a Secret
|
|
|
|
|
resource that contains a public
|
|
|
|
|
key
|
|
|
|
|
properties:
|
|
|
|
|
name:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Name of the secret.
|
|
|
|
|
The provided secret must contain
|
|
|
|
|
a key named cosign.pub.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
namespace:
|
2022-11-07 10:59:16 +05:30
|
|
|
description: Namespace name where
|
|
|
|
|
the Secret exists.
|
2022-10-14 15:10:46 +05:30
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- name
|
|
|
|
|
- namespace
|
|
|
|
|
type: object
|
2022-10-14 11:09:57 +05:30
|
|
|
signatureAlgorithm:
|
|
|
|
|
default: sha256
|
|
|
|
|
description: Specify signature algorithm
|
|
|
|
|
for public keys. Supported values
|
2023-12-27 08:34:16 +00:00
|
|
|
are sha224, sha256, sha384 and sha512.
|
2022-10-14 11:09:57 +05:30
|
|
|
type: string
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override other OCI image repository locations for this Attestor.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
image:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use ImageReferences instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
imageReferences:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
ImageReferences is a list of matching image reference patterns. At least one pattern in the
|
|
|
|
|
list must match the image for the rule to apply. Each image reference consists of a registry
|
|
|
|
|
address (defaults to docker.io), repository, image, and tag (defaults to latest).
|
|
|
|
|
Wildcards ('*' and '?') are allowed. See: https://kubernetes.io/docs/concepts/containers/images.
|
2022-09-19 11:55:04 +02:00
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
2023-06-16 19:07:08 +05:30
|
|
|
imageRegistryCredentials:
|
|
|
|
|
description: ImageRegistryCredentials provides credentials
|
2023-10-31 05:30:26 +00:00
|
|
|
that will be used for authentication with registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
properties:
|
|
|
|
|
allowInsecureRegistry:
|
|
|
|
|
description: AllowInsecureRegistry allows insecure
|
2023-10-31 05:30:26 +00:00
|
|
|
access to a registry.
|
2023-06-16 19:07:08 +05:30
|
|
|
type: boolean
|
2023-06-17 01:55:46 +05:30
|
|
|
providers:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Providers specifies a list of OCI Registry names, whose authentication providers are provided.
|
|
|
|
|
It can be of one of these values: default,google,azure,amazon,github.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
2023-06-17 01:55:46 +05:30
|
|
|
description: ImageRegistryCredentialsProvidersType
|
|
|
|
|
provides the list of credential providers
|
|
|
|
|
required.
|
2023-06-16 19:07:08 +05:30
|
|
|
enum:
|
|
|
|
|
- default
|
|
|
|
|
- amazon
|
|
|
|
|
- azure
|
|
|
|
|
- google
|
|
|
|
|
- github
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
secrets:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Secrets specifies a list of secrets that are provided for credentials.
|
|
|
|
|
Secrets must live in the Kyverno namespace.
|
2023-06-16 19:07:08 +05:30
|
|
|
items:
|
|
|
|
|
type: string
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
issuer:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
key:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use StaticKeyAttestor instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
mutateDigest:
|
|
|
|
|
default: true
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
MutateDigest enables replacement of image tags with digests.
|
|
|
|
|
Defaults to true.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: boolean
|
|
|
|
|
repository:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Repository is an optional alternate OCI repository to use for image signatures and attestations that match this rule.
|
|
|
|
|
If specified Repository will override the default OCI image repository configured for the installation.
|
|
|
|
|
The repository can also be overridden per Attestor or Attestation.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
default: true
|
|
|
|
|
description: Required validates that images are verified
|
|
|
|
|
i.e. have matched passed a signature or attestation
|
|
|
|
|
check.
|
|
|
|
|
type: boolean
|
|
|
|
|
roots:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
|
|
|
|
subject:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated. Use KeylessAttestor instead.
|
2022-09-19 11:55:04 +02:00
|
|
|
type: string
|
2023-02-20 08:26:10 -08:00
|
|
|
type:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Type specifies the method of signature validation. The allowed options
|
|
|
|
|
are Cosign and Notary. By default Cosign is used if a type is not specified.
|
2023-02-20 08:26:10 -08:00
|
|
|
enum:
|
|
|
|
|
- Cosign
|
2023-06-01 13:35:28 +05:30
|
|
|
- Notary
|
2023-02-20 08:26:10 -08:00
|
|
|
type: string
|
2023-08-07 01:24:52 +05:30
|
|
|
useCache:
|
|
|
|
|
default: true
|
|
|
|
|
description: UseCache enables caching of image verify
|
2023-10-31 05:30:26 +00:00
|
|
|
responses for this rule.
|
2023-08-07 01:24:52 +05:30
|
|
|
type: boolean
|
2022-09-19 11:55:04 +02:00
|
|
|
verifyDigest:
|
|
|
|
|
default: true
|
|
|
|
|
description: VerifyDigest validates that images have
|
|
|
|
|
a digest.
|
|
|
|
|
type: boolean
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
2023-06-08 11:54:58 +02:00
|
|
|
required:
|
|
|
|
|
- name
|
2022-09-19 11:55:04 +02:00
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
type: object
|
|
|
|
|
conditions:
|
|
|
|
|
items:
|
|
|
|
|
description: "Condition contains details for one aspect of the current
|
2024-05-09 16:47:44 +08:00
|
|
|
state of this API Resource.\n---\nThis struct is intended for
|
|
|
|
|
direct use as an array at the field path .status.conditions. For
|
|
|
|
|
example,\n\n\n\ttype FooStatus struct{\n\t // Represents the
|
|
|
|
|
observations of a foo's current state.\n\t // Known .status.conditions.type
|
|
|
|
|
are: \"Available\", \"Progressing\", and \"Degraded\"\n\t //
|
|
|
|
|
+patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t
|
|
|
|
|
\ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\"
|
|
|
|
|
patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
|
|
|
|
|
\ // other fields\n\t}"
|
2022-09-19 11:55:04 +02:00
|
|
|
properties:
|
|
|
|
|
lastTransitionTime:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
|
|
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
2022-09-19 11:55:04 +02:00
|
|
|
format: date-time
|
|
|
|
|
type: string
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
message is a human readable message indicating details about the transition.
|
|
|
|
|
This may be an empty string.
|
2022-09-19 11:55:04 +02:00
|
|
|
maxLength: 32768
|
|
|
|
|
type: string
|
|
|
|
|
observedGeneration:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
|
|
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
|
|
|
with respect to the current state of the instance.
|
2022-09-19 11:55:04 +02:00
|
|
|
format: int64
|
|
|
|
|
minimum: 0
|
|
|
|
|
type: integer
|
|
|
|
|
reason:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
|
|
|
Producers of specific condition types may define expected values and meanings for this field,
|
|
|
|
|
and whether the values are considered a guaranteed API.
|
|
|
|
|
The value should be a CamelCase string.
|
2022-09-19 11:55:04 +02:00
|
|
|
This field may not be empty.
|
|
|
|
|
maxLength: 1024
|
|
|
|
|
minLength: 1
|
|
|
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
|
|
|
type: string
|
|
|
|
|
status:
|
|
|
|
|
description: status of the condition, one of True, False, Unknown.
|
|
|
|
|
enum:
|
|
|
|
|
- "True"
|
|
|
|
|
- "False"
|
|
|
|
|
- Unknown
|
|
|
|
|
type: string
|
|
|
|
|
type:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
|
|
|
---
|
|
|
|
|
Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
|
|
|
|
|
useful (see .node.status.conditions), the ability to deconflict is important.
|
|
|
|
|
The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
|
2022-09-19 11:55:04 +02:00
|
|
|
maxLength: 316
|
|
|
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- lastTransitionTime
|
|
|
|
|
- message
|
|
|
|
|
- reason
|
|
|
|
|
- status
|
|
|
|
|
- type
|
|
|
|
|
type: object
|
|
|
|
|
type: array
|
|
|
|
|
ready:
|
2023-09-01 03:53:44 +05:30
|
|
|
description: Deprecated in favor of Conditions
|
2022-09-19 11:55:04 +02:00
|
|
|
type: boolean
|
2022-10-27 15:35:32 +05:30
|
|
|
rulecount:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
RuleCountStatus contains four variables which describes counts for
|
|
|
|
|
validate, generate, mutate and verify images rules
|
2022-10-27 15:35:32 +05:30
|
|
|
properties:
|
|
|
|
|
generate:
|
|
|
|
|
description: Count for generate rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
mutate:
|
|
|
|
|
description: Count for mutate rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
validate:
|
|
|
|
|
description: Count for validate rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
verifyimages:
|
|
|
|
|
description: Count for verify image rules in policy
|
|
|
|
|
type: integer
|
|
|
|
|
required:
|
|
|
|
|
- generate
|
|
|
|
|
- mutate
|
|
|
|
|
- validate
|
|
|
|
|
- verifyimages
|
|
|
|
|
type: object
|
2023-08-31 13:25:21 +03:00
|
|
|
validatingadmissionpolicy:
|
|
|
|
|
description: ValidatingAdmissionPolicy contains status information
|
|
|
|
|
properties:
|
|
|
|
|
generated:
|
|
|
|
|
description: Generated indicates whether a validating admission
|
|
|
|
|
policy is generated from the policy or not
|
|
|
|
|
type: boolean
|
|
|
|
|
message:
|
2024-05-09 16:47:44 +08:00
|
|
|
description: |-
|
|
|
|
|
Message is a human readable message indicating details about the generation of validating admission policy
|
|
|
|
|
It is an empty string when validating admission policy is successfully generated.
|
2023-08-31 13:25:21 +03:00
|
|
|
type: string
|
|
|
|
|
required:
|
|
|
|
|
- generated
|
|
|
|
|
- message
|
|
|
|
|
type: object
|
2022-09-19 11:55:04 +02:00
|
|
|
required:
|
|
|
|
|
- ready
|
|
|
|
|
type: object
|
2022-09-08 16:49:16 +05:30
|
|
|
required:
|
|
|
|
|
- spec
|
|
|
|
|
type: object
|
|
|
|
|
served: true
|
|
|
|
|
storage: false
|
|
|
|
|
subresources:
|
|
|
|
|
status: {}
|
