kyverno.io/v1

Resource Types:

ClusterPolicy

ClusterPolicy …

Field Description
apiVersion
string		 kyverno.io/v1
kind
string 		ClusterPolicy
metadata
Kubernetes meta/v1.ObjectMeta 		Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
Spec

Spec is the information to identify the policy



rules
[]Rule

Rules contains the list of rules to be applied to resources
validationFailureAction
string

ValidationFailureAction provides choice to enforce rules to resources during policy violations. Default value is “audit”.
background
bool

Background provides choice for applying rules to existing resources. Default value is “true”.
status
PolicyStatus

Status contains statistics related to policy

ClusterPolicyViolation

ClusterPolicyViolation represents cluster-wide violations

Field Description
apiVersion
string		 kyverno.io/v1
kind
string 		ClusterPolicyViolation
metadata
Kubernetes meta/v1.ObjectMeta 		Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
PolicyViolationSpec

policy
string

Policy is the name of the policy
resource
ResourceSpec
rules
[]ViolatedRule

ViolatedRules contains list of violated rule
status
PolicyViolationStatus

GenerateRequest

GenerateRequest is a request to process generate rule

Field Description
apiVersion
string		 kyverno.io/v1
kind
string 		GenerateRequest
metadata
Kubernetes meta/v1.ObjectMeta 		Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
GenerateRequestSpec

Spec is the information to identify the generate request



policy
string

Policy - The required field represents the name of the policy
resource
ResourceSpec

ResourceSpec is the information to identify the generate request
context
GenerateRequestContext

Context …
status
GenerateRequestStatus

Status contains statistics related to generate request

PolicyViolation

PolicyViolation represents namespaced violations

Field Description
apiVersion
string		 kyverno.io/v1
kind
string 		PolicyViolation
metadata
Kubernetes meta/v1.ObjectMeta 		Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
PolicyViolationSpec

policy
string

Policy is the name of the policy
resource
ResourceSpec
rules
[]ViolatedRule

ViolatedRules contains list of violated rule
status
PolicyViolationStatus

CloneFrom

(Appears on: Generation)

CloneFrom - location of the resource which will be used as source when applying ‘generate’

Field Description
namespace
string

Namespace is the resource namespace
name
string

Name is the name of the resource

Condition

(Appears on: Deny, Rule)

Condition defines the evaluation condition

Field Description
key
interface{}

Key contains key to compare
operator
ConditionOperator

Operator to compare against value
value
interface{}

Value to be compared

ConditionOperator (string alias)

(Appears on: Condition)

ConditionOperator defines the type for condition operator

Deny

(Appears on: Validation)

Field Description
conditions
[]Condition

Conditions contains set of condition to deny validation

ExcludeResources

(Appears on: Rule)

ExcludeResources container resource description of the resources that are to be excluded from the applying the policy rule

Field Description
UserInfo
UserInfo

UserInfo contains user information
resources
ResourceDescription

ResourceDescription contains resources to which rule is excluded

GenerateRequestContext

(Appears on: GenerateRequestSpec)

GenerateRequestContext stores the context to be shared

Field Description
userInfo
RequestInfo

UserRequestInfo …

GenerateRequestSpec

(Appears on: GenerateRequest)

GenerateRequestSpec stores the request specification

Field Description
policy
string

Policy - The required field represents the name of the policy
resource
ResourceSpec

ResourceSpec is the information to identify the generate request
context
GenerateRequestContext

Context …

GenerateRequestState (string alias)

(Appears on: GenerateRequestStatus)

GenerateRequestState defines the state of

GenerateRequestStatus

(Appears on: GenerateRequest)

GenerateRequestStatus stores the status of generated request

Field Description
state
GenerateRequestState

State represents state of the generate request
message
string

Message - An optional field is the request status message
generatedResources
[]ResourceSpec

This will track the resources that are generated by the generate Policy Will be used during clean up resources

Generation

(Appears on: Rule)

Generation describes which resources will be created when other resource is created

Field Description
ResourceSpec
ResourceSpec
synchronize
bool

To keep resources synchronized with source resource
data
interface{}

Data …
clone
CloneFrom

To clone resource from other resource

MatchResources

(Appears on: Rule)

MatchResources contains resource description of the resources that the rule is to apply on

Field Description
UserInfo
UserInfo

UserInfo contains user information
resources
ResourceDescription

ResourceDescription contains resources to which rule is applied

Mutation

(Appears on: Rule)

Mutation describes the way how Mutating Webhook will react on resource creation

Field Description
overlay
interface{}

Overlay contains overlay patterns
patches
[]Patch

Patches contains JSON Patch

Patch

(Appears on: Mutation)

Patch declares patch operation for created object according to RFC 6902

Field Description
path
string

Path represents path of the resource
op
string

Operation contains operations supported by JSON Patch. i.e: add, replace and delete
value
interface{}

Value is the value to be applied

Policy

Policy contains rules to be applied to created resources

Field Description
metadata
Kubernetes meta/v1.ObjectMeta 		Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
Spec

Spec is the information to identify the policy



rules
[]Rule

Rules contains the list of rules to be applied to resources
validationFailureAction
string

ValidationFailureAction provides choice to enforce rules to resources during policy violations. Default value is “audit”.
background
bool

Background provides choice for applying rules to existing resources. Default value is “true”.
status
PolicyStatus

Status contains statistics related to policy

PolicyStatus

(Appears on: ClusterPolicy, Policy)

PolicyStatus mostly contains statistics related to policy

Field Description
averageExecutionTime
string

average time required to process the policy rules on a resource
violationCount
int

number of violations created by this policy
rulesFailedCount
int

Count of rules that failed
rulesAppliedCount
int

Count of rules that were applied
resourcesBlockedCount
int

Count of resources that were blocked for failing a validate, across all rules
resourcesMutatedCount
int

Count of resources that were successfully mutated, across all rules
resourcesGeneratedCount
int

Count of resources that were successfully generated, across all rules
ruleStatus
[]RuleStats

PolicyViolationSpec

(Appears on: ClusterPolicyViolation, PolicyViolation, PolicyViolationTemplate)

PolicyViolationSpec describes policy behavior by its rules

Field Description
policy
string

Policy is the name of the policy
resource
ResourceSpec
rules
[]ViolatedRule

ViolatedRules contains list of violated rule

PolicyViolationStatus

(Appears on: ClusterPolicyViolation, PolicyViolation, PolicyViolationTemplate)

PolicyViolationStatus provides information regarding policyviolation status status: LastUpdateTime : the time the policy violation was updated

Field Description
lastUpdateTime
Kubernetes meta/v1.Time

LastUpdateTime : the time the policy violation was updated

PolicyViolationTemplate

PolicyViolationTemplate stores the information regarinding the resources for which a policy failed to apply

Field Description
metadata
Kubernetes meta/v1.ObjectMeta 		Refer to the Kubernetes API documentation for the fields of the metadata field.
spec
PolicyViolationSpec

policy
string

Policy is the name of the policy
resource
ResourceSpec
rules
[]ViolatedRule

ViolatedRules contains list of violated rule
status
PolicyViolationStatus

RequestInfo

(Appears on: GenerateRequestContext)

RequestInfo contains permission info carried in an admission request

Field Description
roles
[]string

Roles is a list of possible role send the request
clusterRoles
[]string

ClusterRoles is a list of possible clusterRoles send the request
userInfo
Kubernetes authentication/v1.UserInfo

UserInfo is the userInfo carried in the admission request

ResourceDescription

(Appears on: ExcludeResources, MatchResources)

ResourceDescription describes the resource to which the PolicyRule will be applied.

Field Description
kinds
[]string

Kinds contains list of resource kind
name
string

Name is the name of the resource
namespaces
[]string

Namespaces contains the list of namespaces
selector
Kubernetes meta/v1.LabelSelector

Selector is the set of selectors

ResourceSpec

(Appears on: GenerateRequestSpec, GenerateRequestStatus, Generation, PolicyViolationSpec)

ResourceSpec information to identify the resource

Field Description
kind
string

Kind - A required field represents resource kind
namespace
string

Namespace - An optional field represents resource namespace
name
string

Name -A required field represents resource name

Rule

(Appears on: Spec)

Rule is set of mutation, validation and generation actions for the single resource description

Field Description
name
string

Name - A required field represents rule name
match
MatchResources

MatchResources - An optional field contains resources for which the rule has to be applied. If it’s defined, “kind” inside MatchResources block is required.
exclude
ExcludeResources

ExcludeResources - An optional field contains resources for which rule can be excluded
preconditions
[]Condition

Conditions - An optional field allow controlling policy rule execution
mutate
Mutation

Mutation - An optional field contains patterns to mutate resources
validate
Validation

Validation - An optional field contains patterns to validate resources
generate
Generation

Generation - An optional field contains patterns to create additional resources

RuleStats

(Appears on: PolicyStatus)

RuleStats provides status per rule

Field Description
ruleName
string

Rule name
averageExecutionTime
string

average time require to process the rule
violationCount
int

number of violations created by this rule
failedCount
int

Count of rules that failed
appliedCount
int

Count of rules that were applied
resourcesBlockedCount
int

Count of resources for whom update/create api requests were blocked as the resource did not satisfy the policy rules
resourcesMutatedCount
int

Count of resources that were successfully mutated
resourcesGeneratedCount
int

Count of resources that were successfully generated

Spec

(Appears on: ClusterPolicy, Policy)

Spec describes policy behavior by its rules

Field Description
rules
[]Rule

Rules contains the list of rules to be applied to resources
validationFailureAction
string

ValidationFailureAction provides choice to enforce rules to resources during policy violations. Default value is “audit”.
background
bool

Background provides choice for applying rules to existing resources. Default value is “true”.

UserInfo

(Appears on: ExcludeResources, MatchResources)

UserInfo filter based on users

Field Description
roles
[]string

Roles contains list of namespaced role names
clusterRoles
[]string

ClusterRoles contains list of cluster wide role names
subjects
[]Kubernetes rbac/v1.Subject

Subjects contains list of subject names like users, user groups, and service accounts

Validation

(Appears on: Rule)

Validation describes the way how Validating Webhook will check the resource on creation

Field Description
message
string

Message is the message to be displayed on validation policy violation
pattern
interface{}

Pattern is the validation pattern
anyPattern
[]interface{}

AnyPattern is the list of validation patterns
deny
Deny

Deny contains conditions to deny validation

ViolatedRule

(Appears on: PolicyViolationSpec)

ViolatedRule stores the information regarding the rule

Field Description
name
string

Name is the violated rule name
type
string

Type is the violated rule type
message
string

Message is the violation message