1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-09 09:26:54 +00:00
kyverno/docs/user/crd/kyverno.v2alpha1.html
Charles-Edouard Brétéché 47e99166a5
feat: add kyverno vap API (#11790)
* feat: add kyverno vap API

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* add context lib

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2025-01-08 15:56:36 +00:00

1099 lines
20 KiB
HTML

<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css">
<style>
.bg-blue {
color: #ffffff;
background-color: #1589dd;
}
</style>
</head>
<body>
<div class="container">
<h2 id="kyverno-io-v2alpha1">Package: <span style="font-family: monospace">kyverno.io/v2alpha1</span></h2>
<p></p>
<h3>Resource Types:</h3>
<ul><li>
<a href="#kyverno-io-v2alpha1-GlobalContextEntry">GlobalContextEntry</a>
</li><li>
<a href="#kyverno-io-v2alpha1-ValidatingPolicy">ValidatingPolicy</a>
</li></ul>
<H3 id="kyverno-io-v2alpha1-GlobalContextEntry">GlobalContextEntry
</H3>
<p><p>GlobalContextEntry declares resources to be cached.</p>
</p>
<table class="table table-striped">
<thead class="thead-dark">
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>apiVersion</code></br>string</td>
<td><code>kyverno.io/v2alpha1</code></td>
</tr>
<tr>
<td><code>kind</code></br>string</td>
<td><code>GlobalContextEntry</code></td>
</tr>
<tr>
<td><code>metadata</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">meta/v1.ObjectMeta</span>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td><code>spec</code>
<span style="color:blue;"> *</span>
</br>
<a href="#kyverno-io-v2alpha1-GlobalContextEntrySpec">
<span style="font-family: monospace">GlobalContextEntrySpec</span>
</a>
</td>
<td>
<p>Spec declares policy exception behaviors.</p>
<br/>
<br/>
<table>
<tr>
<td><code>kubernetesResource</code>
<span style="color:blue;"> *</span>
</br>
<a href="#kyverno-io-v2alpha1-KubernetesResource">
<span style="font-family: monospace">KubernetesResource</span>
</a>
</td>
<td>
<p>Stores a list of Kubernetes resources which will be cached.
Mutually exclusive with APICall.</p>
</td>
</tr>
<tr>
<td><code>apiCall</code>
<span style="color:blue;"> *</span>
</br>
<a href="#kyverno-io-v2alpha1-ExternalAPICall">
<span style="font-family: monospace">ExternalAPICall</span>
</a>
</td>
<td>
<p>Stores results from an API call which will be cached.
Mutually exclusive with KubernetesResource.
This can be used to make calls to external (non-Kubernetes API server) services.
It can also be used to make calls to the Kubernetes API server in such cases:</p>
<ol>
<li>A POST is needed to create a resource.</li>
<li>Finer-grained control is needed. Example: To restrict the number of resources cached.</li>
</ol>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td><code>status</code>
</br>
<a href="#kyverno-io-v2alpha1-GlobalContextEntryStatus">
<span style="font-family: monospace">GlobalContextEntryStatus</span>
</a>
</td>
<td>
<p>Status contains globalcontextentry runtime data.</p>
</td>
</tr>
</tbody>
</table>
<H3 id="kyverno-io-v2alpha1-ValidatingPolicy">ValidatingPolicy
</H3>
<p></p>
<table class="table table-striped">
<thead class="thead-dark">
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>apiVersion</code></br>string</td>
<td><code>kyverno.io/v2alpha1</code></td>
</tr>
<tr>
<td><code>kind</code></br>string</td>
<td><code>ValidatingPolicy</code></td>
</tr>
<tr>
<td><code>metadata</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">meta/v1.ObjectMeta</span>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td><code>spec</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">admissionregistration/v1.ValidatingAdmissionPolicySpec</span>
</td>
<td>
<br/>
<br/>
<table>
<tr>
<td><code>paramKind</code>
</br>
<span style="font-family: monospace">admissionregistration/v1.ParamKind</span>
</td>
<td>
<p>ParamKind specifies the kind of resources used to parameterize this policy.
If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions.
If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied.
If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.</p>
</td>
</tr>
<tr>
<td><code>matchConstraints</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">admissionregistration/v1.MatchResources</span>
</td>
<td>
<p>MatchConstraints specifies what resources this policy is designed to validate.
The AdmissionPolicy cares about a request if it matches <em>all</em> Constraints.
However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API
ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding.
Required.</p>
</td>
</tr>
<tr>
<td><code>validations</code>
</br>
<span style="font-family: monospace">[]admissionregistration/v1.Validation</span>
</td>
<td>
<p>Validations contain CEL expressions which is used to apply the validation.
Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is
required.</p>
</td>
</tr>
<tr>
<td><code>failurePolicy</code>
</br>
<span style="font-family: monospace">admissionregistration/v1.FailurePolicyType</span>
</td>
<td>
<p>failurePolicy defines how to handle failures for the admission policy. Failures can
occur from CEL expression parse errors, type check errors, runtime errors and invalid
or mis-configured policy definitions or bindings.</p>
<p>A policy is invalid if spec.paramKind refers to a non-existent Kind.
A binding is invalid if spec.paramRef.name refers to a non-existent resource.</p>
<p>failurePolicy does not define how validations that evaluate to false are handled.</p>
<p>When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions
define how failures are enforced.</p>
<p>Allowed values are Ignore or Fail. Defaults to Fail.</p>
</td>
</tr>
<tr>
<td><code>auditAnnotations</code>
</br>
<span style="font-family: monospace">[]admissionregistration/v1.AuditAnnotation</span>
</td>
<td>
<p>auditAnnotations contains CEL expressions which are used to produce audit
annotations for the audit event of the API request.
validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is
required.</p>
</td>
</tr>
<tr>
<td><code>matchConditions</code>
</br>
<span style="font-family: monospace">[]admissionregistration/v1.MatchCondition</span>
</td>
<td>
<p>MatchConditions is a list of conditions that must be met for a request to be validated.
Match conditions filter requests that have already been matched by the rules,
namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
There are a maximum of 64 match conditions allowed.</p>
<p>If a parameter object is provided, it can be accessed via the <code>params</code> handle in the same
manner as validation expressions.</p>
<p>The exact matching logic is (in order):</p>
<ol>
<li>If ANY matchCondition evaluates to FALSE, the policy is skipped.</li>
<li>If ALL matchConditions evaluate to TRUE, the policy is evaluated.</li>
<li>If any matchCondition evaluates to an error (but none are FALSE):
<ul>
<li>If failurePolicy=Fail, reject the request</li>
<li>If failurePolicy=Ignore, the policy is skipped</li>
</ul>
</li>
</ol>
</td>
</tr>
<tr>
<td><code>variables</code>
</br>
<span style="font-family: monospace">[]admissionregistration/v1.Variable</span>
</td>
<td>
<p>Variables contain definitions of variables that can be used in composition of other expressions.
Each variable is defined as a named CEL expression.
The variables defined here will be available under <code>variables</code> in other expressions of the policy
except MatchConditions because MatchConditions are evaluated before the rest of the policy.</p>
<p>The expression of a variable can refer to other variables defined earlier in the list but not those after.
Thus, Variables must be sorted by the order of first appearance and acyclic.</p>
</td>
</tr>
</table>
</td>
</tr>
</tbody>
</table>
<H3 id="kyverno-io-v2alpha1-ExternalAPICall">ExternalAPICall
</H3>
<p>
(<em>Appears in:</em>
<a href="#kyverno-io-v2alpha1-GlobalContextEntrySpec">GlobalContextEntrySpec</a>)
</p>
<p></p>
<table class="table table-striped">
<thead class="thead-dark">
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>APICall</code>
<span style="color:blue;"> *</span>
</br>
<a href="#kyverno-io-v1-APICall">
<span style="font-family: monospace">APICall</span>
</a>
</td>
<td>
<p>(Members of <code>APICall</code> are embedded into this type.)</p>
</td>
</tr>
<tr>
<td><code>refreshInterval</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">meta/v1.Duration</span>
</td>
<td>
<p>RefreshInterval defines the interval in duration at which to poll the APICall.
The duration is a sequence of decimal numbers, each with optional fraction and a unit suffix,
such as &quot;300ms&quot;, &quot;1.5h&quot; or &quot;2h45m&quot;. Valid time units are &quot;ns&quot;, &quot;us&quot; (or &quot;µs&quot;), &quot;ms&quot;, &quot;s&quot;, &quot;m&quot;, &quot;h&quot;.</p>
</td>
</tr>
<tr>
<td><code>retryLimit</code>
</br>
<span style="font-family: monospace">int</span>
</td>
<td>
<p>RetryLimit defines the number of times the APICall should be retried in case of failure.</p>
</td>
</tr>
</tbody>
</table>
<H3 id="kyverno-io-v2alpha1-GlobalContextEntrySpec">GlobalContextEntrySpec
</H3>
<p>
(<em>Appears in:</em>
<a href="#kyverno-io-v2alpha1-GlobalContextEntry">GlobalContextEntry</a>)
</p>
<p><p>GlobalContextEntrySpec stores policy exception spec</p>
</p>
<table class="table table-striped">
<thead class="thead-dark">
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>kubernetesResource</code>
<span style="color:blue;"> *</span>
</br>
<a href="#kyverno-io-v2alpha1-KubernetesResource">
<span style="font-family: monospace">KubernetesResource</span>
</a>
</td>
<td>
<p>Stores a list of Kubernetes resources which will be cached.
Mutually exclusive with APICall.</p>
</td>
</tr>
<tr>
<td><code>apiCall</code>
<span style="color:blue;"> *</span>
</br>
<a href="#kyverno-io-v2alpha1-ExternalAPICall">
<span style="font-family: monospace">ExternalAPICall</span>
</a>
</td>
<td>
<p>Stores results from an API call which will be cached.
Mutually exclusive with KubernetesResource.
This can be used to make calls to external (non-Kubernetes API server) services.
It can also be used to make calls to the Kubernetes API server in such cases:</p>
<ol>
<li>A POST is needed to create a resource.</li>
<li>Finer-grained control is needed. Example: To restrict the number of resources cached.</li>
</ol>
</td>
</tr>
</tbody>
</table>
<H3 id="kyverno-io-v2alpha1-GlobalContextEntryStatus">GlobalContextEntryStatus
</H3>
<p>
(<em>Appears in:</em>
<a href="#kyverno-io-v2alpha1-GlobalContextEntry">GlobalContextEntry</a>)
</p>
<p></p>
<table class="table table-striped">
<thead class="thead-dark">
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>ready</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">bool</span>
</td>
<td>
<p>Deprecated in favor of Conditions</p>
</td>
</tr>
<tr>
<td><code>conditions</code>
</br>
<span style="font-family: monospace">[]meta/v1.Condition</span>
</td>
<td>
</td>
</tr>
<tr>
<td><code>lastRefreshTime</code>
</br>
<span style="font-family: monospace">meta/v1.Time</span>
</td>
<td>
<p>Indicates the time when the globalcontextentry was last refreshed successfully for the API Call</p>
</td>
</tr>
</tbody>
</table>
<H3 id="kyverno-io-v2alpha1-KubernetesResource">KubernetesResource
</H3>
<p>
(<em>Appears in:</em>
<a href="#kyverno-io-v2alpha1-GlobalContextEntrySpec">GlobalContextEntrySpec</a>)
</p>
<p><p>KubernetesResource stores infos about kubernetes resource that should be cached</p>
</p>
<table class="table table-striped">
<thead class="thead-dark">
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>group</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">string</span>
</td>
<td>
<p>Group defines the group of the resource.</p>
</td>
</tr>
<tr>
<td><code>version</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">string</span>
</td>
<td>
<p>Version defines the version of the resource.</p>
</td>
</tr>
<tr>
<td><code>resource</code>
<span style="color:blue;"> *</span>
</br>
<span style="font-family: monospace">string</span>
</td>
<td>
<p>Resource defines the type of the resource.
Requires the pluralized form of the resource kind in lowercase. (Ex., &quot;deployments&quot;)</p>
</td>
</tr>
<tr>
<td><code>namespace</code>
</br>
<span style="font-family: monospace">string</span>
</td>
<td>
<p>Namespace defines the namespace of the resource. Leave empty for cluster scoped resources.
If left empty for namespaced resources, all resources from all namespaces will be cached.</p>
</td>
</tr>
</tbody>
</table>
<hr />
</div>
</body>
</html>