From 3c094d5a5a1b54fee909b489a431105d48bc40e4 Mon Sep 17 00:00:00 2001 From: Shuting Zhao Date: Fri, 31 Jan 2020 14:30:49 -0800 Subject: [PATCH] add auto-gen markdown --- documentation/writing-policies.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/documentation/writing-policies.md b/documentation/writing-policies.md index 1c0d2bcc4f..18bb045624 100644 --- a/documentation/writing-policies.md +++ b/documentation/writing-policies.md @@ -131,5 +131,14 @@ Operators supported: - Equal - NotEqual +# Auto generating rules for pod controllers +A pod policy is automatically applied to pod controllers. By default, Kyverno inserts an annotation `pod-policies.kyverno.io/autogen-controllers=all`, to generate an additional rule that is applied to pod controllers: DaemonSet, Deployment, Job, StatefulSet. + +Change the annotation `pod-policies.kyverno.io/autogen-controllers` to customize the applicable pod controllers of the auto-gen rule. For example, Kyverno generates the rule for `Deployment` if the annotation of policy is defined as `pod-policies.kyverno.io/autogen-controllers=Deployment`. If `name` or `labelSelector` is specified in the match / exclude block, Kyverno skips generating pod controllers rule as these filters may not be applicable to pod controllers. + +To disable auto-generating rules for pod controllers, set `pod-policies.kyverno.io/autogen-controllers=none`. + + + --- *Read Next >> [Validate](/documentation/writing-policies-validate.md)* \ No newline at end of file