diff --git a/documentation/writing-policies-autogen.md b/documentation/writing-policies-autogen.md index 2688159602..be14087ce9 100644 --- a/documentation/writing-policies-autogen.md +++ b/documentation/writing-policies-autogen.md @@ -2,13 +2,15 @@ # Auto Generating Rules for Pod Controllers +Note: The Auto-Gen feature is only supported for validation rules with patterns and mutation rules with overlay. Validate - Deny rules and Generate rules are not supported. + Writing policies on pods helps address all pod creation flows. However, when pod controllers are used, pod level policies result in errors not being reported when the pod controller object is created. Kyverno solves this issue by supporting automatic generation of policy rules for pod controllers from a rule written for a pod. This auto-generation behavior is controlled by the `pod-policies.kyverno.io/autogen-controllers` annotation. -By default, Kyverno inserts an annotation `pod-policies.kyverno.io/autogen-controllers=all`, to generate an additional rule that is applied to pod controllers: DaemonSet, Deployment, Job, StatefulSet. +By default, Kyverno inserts an annotation `pod-policies.kyverno.io/autogen-controllers=all`, to generate an additional rule that is applied to pod controllers: DaemonSet, Deployment, Job, StatefulSet. You can change the annotation `pod-policies.kyverno.io/autogen-controllers` to customize the target pod controllers for the auto-generated rules. For example, Kyverno generates a rule for a `Deployment` if the annotation of policy is defined as `pod-policies.kyverno.io/autogen-controllers=Deployment`.