From 7b324317978764b401fe2a0a589311a71e5def36 Mon Sep 17 00:00:00 2001 From: shivkumar dudhani Date: Thu, 23 Jan 2020 10:41:22 -0800 Subject: [PATCH] add background processing documentation --- documentation/writing-policies.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/documentation/writing-policies.md b/documentation/writing-policies.md index 1c0d2bcc4f..4b86c62b15 100644 --- a/documentation/writing-policies.md +++ b/documentation/writing-policies.md @@ -131,5 +131,22 @@ Operators supported: - Equal - NotEqual +# Background processing +Kyverno applies policies in foreground and background mode. +- `foreground`: leverages admission control webhooks to intercept the resource api-request and apply policy on it. +- `background`: policy-controller applies policies on the existing resoruces after configured re-conciliation time. + +A policy is always enable for `foreground` processing, but `background` processing is configurable using a boolean flag at `{spec.background}`. + +``` +spec: + background: true + rules: + - name: default-deny-ingress +``` +- Unless specified the default value is `true` +- As the userInformation is only avaiable in the incoming api-request, a policy using userInfo filters and variables reffering to `{{request.userInfo}}` can only be processed in foreground mode. +- When a new policy is created, the policy validation will throw an error if using `userInfo` with a policy defined in background mode. + --- *Read Next >> [Validate](/documentation/writing-policies-validate.md)* \ No newline at end of file