mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-06 07:57:07 +00:00
1873 lines
34 KiB
HTML
1873 lines
34 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
|
|
<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T" crossorigin="anonymous">
|
|
<title>Kyverno API</title>
|
|
<style>
|
|
.bg-blue {
|
|
color: #ffffff;
|
|
background-color: #1589dd;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div class="container">
|
|
<nav class="navbar navbar-expand-lg navbar-dark bg-dark">
|
|
<a class="navbar-brand" href="#"><p><b>Packages : </b></p></a>
|
|
<ul style="list-style:none">
|
|
<li>
|
|
<a href="#kyverno.io%2fv1"><b style="color: white">kyverno.io/v1</b></a>
|
|
</li>
|
|
</ul>
|
|
</nav>
|
|
<h2 id="kyverno.io/v1">kyverno.io/v1</h2>
|
|
Resource Types:
|
|
<ul></ul>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.CloneFrom">CloneFrom
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Generation">Generation</a>)
|
|
</p>
|
|
<p>
|
|
<p>CloneFrom provides the location of the source resource used to generate target resources.
|
|
The resource kind is derived from the match criteria.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>namespace</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Namespace specifies source resource namespace.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>name</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Name specifies name of the resource.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.ClusterPolicy">ClusterPolicy
|
|
</h3>
|
|
<p>
|
|
<p>ClusterPolicy declares validation, mutation, and generation behaviors for matching resources.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>metadata</code></br>
|
|
<em>
|
|
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#objectmeta-v1-meta">
|
|
Kubernetes meta/v1.ObjectMeta
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
Refer to the Kubernetes API documentation for the fields of the
|
|
<code>metadata</code> field.
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>spec</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Spec">
|
|
Spec
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Spec declares policy behaviors.</p>
|
|
<br/>
|
|
<br/>
|
|
<table class="table table-striped">
|
|
<tr>
|
|
<td>
|
|
<code>rules</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Rule">
|
|
[]Rule
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Rules is a list of Rule instances. A Policy contains multiple rules and
|
|
each rule can validate, mutate, or generate resources.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>validationFailureAction</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ValidationFailureAction controls if a validation policy rule failure should disallow
|
|
the admission review request (enforce), or allow (audit) the admission review request
|
|
and report an error in a policy report. Optional. The default value is “audit”.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>background</code></br>
|
|
<em>
|
|
bool
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Background controls if rules are applied to existing resources during a background scan.
|
|
Optional. Default value is “true”. The value must be set to “false” if the policy rule
|
|
uses variables that are only available in the admission review request (e.g. user name).</p>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>status</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.PolicyStatus">
|
|
PolicyStatus
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Status contains policy runtime data.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Condition">Condition
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Deny">Deny</a>,
|
|
<a href="#kyverno.io/v1.Rule">Rule</a>)
|
|
</p>
|
|
<p>
|
|
<p>Condition defines variable-based conditional criteria for rule execution.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>key</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Key is the context entry (using JMESPath) for conditional rule evaluation.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>operator</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ConditionOperator">
|
|
ConditionOperator
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Operator is the operation to perform.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>value</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Value is the conditional value, or set of values. The values can be fixed set
|
|
or can be variables declared using using JMESPath.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.ConditionOperator">ConditionOperator
|
|
(<code>string</code> alias)</p></h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Condition">Condition</a>)
|
|
</p>
|
|
<p>
|
|
<p>ConditionOperator is the operation performed on condition key and value.</p>
|
|
</p>
|
|
<h3 id="kyverno.io/v1.ConfigMapReference">ConfigMapReference
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.ContextEntry">ContextEntry</a>)
|
|
</p>
|
|
<p>
|
|
<p>ConfigMapReference refers to a ConfigMap</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>name</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>namespace</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.ContextEntry">ContextEntry
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Rule">Rule</a>)
|
|
</p>
|
|
<p>
|
|
<p>ContextEntry adds variables and data sources to a rule Context</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>name</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>configMap</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ConfigMapReference">
|
|
ConfigMapReference
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Deny">Deny
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Validation">Validation</a>)
|
|
</p>
|
|
<p>
|
|
<p>Deny specifies a list of conditions. The validation rule fails, if any Condition
|
|
evaluates to “false”.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>conditions</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Condition">
|
|
[]Condition
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Specifies set of condition to deny.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.ExcludeResources">ExcludeResources
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Rule">Rule</a>)
|
|
</p>
|
|
<p>
|
|
<p>ExcludeResources specifies resource and admission review request data for
|
|
which a policy rule is not applicable.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>UserInfo</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.UserInfo">
|
|
UserInfo
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>UserInfo contains information about the user performing the operation.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resources</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ResourceDescription">
|
|
ResourceDescription
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ResourceDescription contains information about the resource being created or modified.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.GenerateRequest">GenerateRequest
|
|
</h3>
|
|
<p>
|
|
<p>GenerateRequest is a request to process generate rule.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>metadata</code></br>
|
|
<em>
|
|
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#objectmeta-v1-meta">
|
|
Kubernetes meta/v1.ObjectMeta
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
Refer to the Kubernetes API documentation for the fields of the
|
|
<code>metadata</code> field.
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>spec</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.GenerateRequestSpec">
|
|
GenerateRequestSpec
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Spec is the information to identify the generate request.</p>
|
|
<br/>
|
|
<br/>
|
|
<table class="table table-striped">
|
|
<tr>
|
|
<td>
|
|
<code>policy</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Specifies the name of the policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resource</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ResourceSpec">
|
|
ResourceSpec
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>ResourceSpec is the information to identify the generate request.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>context</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.GenerateRequestContext">
|
|
GenerateRequestContext
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Context …</p>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>status</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.GenerateRequestStatus">
|
|
GenerateRequestStatus
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Status contains statistics related to generate request.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.GenerateRequestContext">GenerateRequestContext
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.GenerateRequestSpec">GenerateRequestSpec</a>)
|
|
</p>
|
|
<p>
|
|
<p>GenerateRequestContext stores the context to be shared.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>userInfo</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.RequestInfo">
|
|
RequestInfo
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.GenerateRequestSpec">GenerateRequestSpec
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.GenerateRequest">GenerateRequest</a>)
|
|
</p>
|
|
<p>
|
|
<p>GenerateRequestSpec stores the request specification.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>policy</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Specifies the name of the policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resource</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ResourceSpec">
|
|
ResourceSpec
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>ResourceSpec is the information to identify the generate request.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>context</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.GenerateRequestContext">
|
|
GenerateRequestContext
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Context …</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.GenerateRequestState">GenerateRequestState
|
|
(<code>string</code> alias)</p></h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.GenerateRequestStatus">GenerateRequestStatus</a>)
|
|
</p>
|
|
<p>
|
|
<p>GenerateRequestState defines the state of request.</p>
|
|
</p>
|
|
<h3 id="kyverno.io/v1.GenerateRequestStatus">GenerateRequestStatus
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.GenerateRequest">GenerateRequest</a>)
|
|
</p>
|
|
<p>
|
|
<p>GenerateRequestStatus stores the status of generated request.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>state</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.GenerateRequestState">
|
|
GenerateRequestState
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>State represents state of the generate request.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>message</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Specifies request status message.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>generatedResources</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ResourceSpec">
|
|
[]ResourceSpec
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>This will track the resources that are generated by the generate Policy.
|
|
Will be used during clean up resources.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Generation">Generation
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Rule">Rule</a>)
|
|
</p>
|
|
<p>
|
|
<p>Generation defines how new resources should be created and managed.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>ResourceSpec</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ResourceSpec">
|
|
ResourceSpec
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>ResourceSpec contains information to select the resource.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>synchronize</code></br>
|
|
<em>
|
|
bool
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Synchronize controls if generated resources should be kept in-sync with their source resource.
|
|
If Synchronize is set to “true” changes to generated resources will be overwritten with resource
|
|
data from Data or the resource specified in the Clone declaration.
|
|
Optional. Defaults to “false” if not specified.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>data</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Data provides the resource declaration used to populate each generated resource.
|
|
At most one of Data or Clone must be specified. If neither are provided, the generated
|
|
resource will be created with default data only.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>clone</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.CloneFrom">
|
|
CloneFrom
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Clone specifies the source resource used to populate each generated resource.
|
|
At most one of Data or Clone can be specified. If neither are provided, the generated
|
|
resource will be created with default data only.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.MatchResources">MatchResources
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Rule">Rule</a>)
|
|
</p>
|
|
<p>
|
|
<p>MatchResources is used to specify resource and admission review request data for
|
|
which a policy rule is applicable.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>UserInfo</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.UserInfo">
|
|
UserInfo
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>UserInfo contains information about the user performing the operation.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resources</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ResourceDescription">
|
|
ResourceDescription
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>ResourceDescription contains information about the resource being created or modified.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Mutation">Mutation
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Rule">Rule</a>)
|
|
</p>
|
|
<p>
|
|
<p>Mutation defines how resource are modified.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>overlay</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Overlay specifies an overlay pattern to modify resources.
|
|
DEPRECATED. Use PatchStrategicMerge instead. Scheduled for
|
|
removal in release 1.5+.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>patches</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Patch">
|
|
[]Patch
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Patches specifies a RFC 6902 JSON Patch to modify resources.
|
|
DEPRECATED. Use PatchesJSON6902 instead. Scheduled for
|
|
removal in release 1.5+.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>patchStrategicMerge</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>PatchStrategicMerge is a strategic merge patch used to modify resources.
|
|
See <a href="https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/">https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/</a>
|
|
and <a href="https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/">https://kubectl.docs.kubernetes.io/references/kustomize/patchesstrategicmerge/</a>.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>patchesJson6902</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>PatchesJSON6902 is a list of RFC 6902 JSON Patch declarations used to modify resources.
|
|
See <a href="https://tools.ietf.org/html/rfc6902">https://tools.ietf.org/html/rfc6902</a> and <a href="https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/">https://kubectl.docs.kubernetes.io/references/kustomize/patchesjson6902/</a>.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Patch">Patch
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Mutation">Mutation</a>)
|
|
</p>
|
|
<p>
|
|
<p>Patch is a RFC 6902 JSON Patch.
|
|
See: <a href="https://tools.ietf.org/html/rfc6902">https://tools.ietf.org/html/rfc6902</a></p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>path</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Path specifies path of the resource.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>op</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Operation specifies operations supported by JSON Patch.
|
|
i.e:- add, replace and delete.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>value</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Value specifies the value to be applied.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Policy">Policy
|
|
</h3>
|
|
<p>
|
|
<p>Policy declares validation, mutation, and generation behaviors for matching resources.
|
|
See: <a href="https://kyverno.io/docs/writing-policies/">https://kyverno.io/docs/writing-policies/</a> for more information.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>metadata</code></br>
|
|
<em>
|
|
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#objectmeta-v1-meta">
|
|
Kubernetes meta/v1.ObjectMeta
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
Refer to the Kubernetes API documentation for the fields of the
|
|
<code>metadata</code> field.
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>spec</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Spec">
|
|
Spec
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Spec defines policy behaviors and contains one or rules.</p>
|
|
<br/>
|
|
<br/>
|
|
<table class="table table-striped">
|
|
<tr>
|
|
<td>
|
|
<code>rules</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Rule">
|
|
[]Rule
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Rules is a list of Rule instances. A Policy contains multiple rules and
|
|
each rule can validate, mutate, or generate resources.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>validationFailureAction</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ValidationFailureAction controls if a validation policy rule failure should disallow
|
|
the admission review request (enforce), or allow (audit) the admission review request
|
|
and report an error in a policy report. Optional. The default value is “audit”.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>background</code></br>
|
|
<em>
|
|
bool
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Background controls if rules are applied to existing resources during a background scan.
|
|
Optional. Default value is “true”. The value must be set to “false” if the policy rule
|
|
uses variables that are only available in the admission review request (e.g. user name).</p>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>status</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.PolicyStatus">
|
|
PolicyStatus
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Status contains policy runtime information.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.PolicyStatus">PolicyStatus
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.ClusterPolicy">ClusterPolicy</a>,
|
|
<a href="#kyverno.io/v1.Policy">Policy</a>)
|
|
</p>
|
|
<p>
|
|
<p>PolicyStatus mostly contains runtime information related to policy execution.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>averageExecutionTime</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>AvgExecutionTime is the average time taken to process the policy rules on a resource.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>violationCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ViolationCount is the total count of policy failure results for this policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>rulesFailedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>RulesFailedCount is the total count of policy execution errors for this policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>rulesAppliedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>RulesAppliedCount is the total number of times this policy was applied.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resourcesBlockedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ResourcesBlockedCount is the total count of admission review requests that were blocked by this policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resourcesMutatedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ResourcesMutatedCount is the total count of resources that were mutated by this policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resourcesGeneratedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ResourcesGeneratedCount is the total count of resources that were generated by this policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>ruleStatus</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.RuleStats">
|
|
[]RuleStats
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Rules provides per rule statistics</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.RequestInfo">RequestInfo
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.GenerateRequestContext">GenerateRequestContext</a>)
|
|
</p>
|
|
<p>
|
|
<p>RequestInfo contains permission info carried in an admission request.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>roles</code></br>
|
|
<em>
|
|
[]string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Roles is a list of possible role send the request.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>clusterRoles</code></br>
|
|
<em>
|
|
[]string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ClusterRoles is a list of possible clusterRoles send the request.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>userInfo</code></br>
|
|
<em>
|
|
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#userinfo-v1-authentication">
|
|
Kubernetes authentication/v1.UserInfo
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>UserInfo is the userInfo carried in the admission request.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.ResourceDescription">ResourceDescription
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.ExcludeResources">ExcludeResources</a>,
|
|
<a href="#kyverno.io/v1.MatchResources">MatchResources</a>)
|
|
</p>
|
|
<p>
|
|
<p>ResourceDescription contains criteria used to match resources.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>kinds</code></br>
|
|
<em>
|
|
[]string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Kinds is a list of resource kinds.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>name</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Name is the name of the resource. The name supports wildcard characters
|
|
“*” (matches zero or many characters) and “?” (at least one character).</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>namespaces</code></br>
|
|
<em>
|
|
[]string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Namespaces is a list of namespaces names. Each name supports wildcard characters
|
|
“*” (matches zero or many characters) and “?” (at least one character).</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>annotations</code></br>
|
|
<em>
|
|
map[string]string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Annotations is a map of annotations (key-value pairs of type string). Annotation keys
|
|
and values support the wildcard characters “*” (matches zero or many characters) and
|
|
“?” (matches at least one character).</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>selector</code></br>
|
|
<em>
|
|
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#labelselector-v1-meta">
|
|
Kubernetes meta/v1.LabelSelector
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Selector is a label selector. Label keys and values in <code>matchLabels</code> support the wildcard
|
|
characters <code>*</code> (matches zero or many characters) and <code>?</code> (matches one character).
|
|
Wildcards allows writing label selectors like [“storage.k8s.io/<em>”: “</em>”]. Note that
|
|
using [”<em>” : “</em>”] matches any key and value but does not match an empty label set.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.ResourceSpec">ResourceSpec
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.GenerateRequestSpec">GenerateRequestSpec</a>,
|
|
<a href="#kyverno.io/v1.GenerateRequestStatus">GenerateRequestStatus</a>,
|
|
<a href="#kyverno.io/v1.Generation">Generation</a>)
|
|
</p>
|
|
<p>
|
|
<p>ResourceSpec contains information to identify a resource.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>apiVersion</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>APIVersion specifies resource apiVersion.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>kind</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Kind specifies resource kind.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>namespace</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Namespace specifies resource namespace.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>name</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Name specifies the resource name.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Rule">Rule
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Spec">Spec</a>)
|
|
</p>
|
|
<p>
|
|
<p>Rule defines a validation, mutation, or generation control for matching resources.
|
|
Each rules contains a match declaration to select resources, and an optional exclude
|
|
declaration to specify which resources to exclude.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>name</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Name is a label to identify the rule, It must be unique within the policy.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>context</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ContextEntry">
|
|
[]ContextEntry
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Context defines variables and data sources that can be used during rule execution.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>match</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.MatchResources">
|
|
MatchResources
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>MatchResources defines when this policy rule should be applied. The match
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
and admission review request information like the user name or role.
|
|
At least one kind is required.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>exclude</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.ExcludeResources">
|
|
ExcludeResources
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ExcludeResources defines when this policy rule should not be applied. The exclude
|
|
criteria can include resource information (e.g. kind, name, namespace, labels)
|
|
and admission review request information like the name or role.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>preconditions</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Condition">
|
|
[]Condition
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Conditions enable variable-based conditional rule execution. This is useful for
|
|
finer control of when an rule is applied. A condition can reference object data
|
|
using JMESPath notation.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>mutate</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Mutation">
|
|
Mutation
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Mutation is used to modify matching resources.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>validate</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Validation">
|
|
Validation
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Validation is used to validate matching resources.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>generate</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Generation">
|
|
Generation
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Generation is used to create new resources.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.RuleStats">RuleStats
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.PolicyStatus">PolicyStatus</a>)
|
|
</p>
|
|
<p>
|
|
<p>RuleStats provides statistics for an individual rule within a policy.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>ruleName</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Name is the rule name.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>averageExecutionTime</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ExecutionTime is the average time taken to execute this rule.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>violationCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ViolationCount is the total count of policy failure results for this rule.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>failedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>FailedCount is the total count of policy error results for this rule.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>appliedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>AppliedCount is the total number of times this rule was applied.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resourcesBlockedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ResourcesBlockedCount is the total count of admission review requests that were blocked by this rule.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resourcesMutatedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ResourcesMutatedCount is the total count of resources that were mutated by this rule.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>resourcesGeneratedCount</code></br>
|
|
<em>
|
|
int
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ResourcesGeneratedCount is the total count of resources that were generated by this rule.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Spec">Spec
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.ClusterPolicy">ClusterPolicy</a>,
|
|
<a href="#kyverno.io/v1.Policy">Policy</a>)
|
|
</p>
|
|
<p>
|
|
<p>Spec contains a list of Rule instances and other policy controls.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>rules</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Rule">
|
|
[]Rule
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Rules is a list of Rule instances. A Policy contains multiple rules and
|
|
each rule can validate, mutate, or generate resources.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>validationFailureAction</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ValidationFailureAction controls if a validation policy rule failure should disallow
|
|
the admission review request (enforce), or allow (audit) the admission review request
|
|
and report an error in a policy report. Optional. The default value is “audit”.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>background</code></br>
|
|
<em>
|
|
bool
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Background controls if rules are applied to existing resources during a background scan.
|
|
Optional. Default value is “true”. The value must be set to “false” if the policy rule
|
|
uses variables that are only available in the admission review request (e.g. user name).</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.UserInfo">UserInfo
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.ExcludeResources">ExcludeResources</a>,
|
|
<a href="#kyverno.io/v1.MatchResources">MatchResources</a>)
|
|
</p>
|
|
<p>
|
|
<p>UserInfo contains information about the user performing the operation.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>roles</code></br>
|
|
<em>
|
|
[]string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Roles is the list of namespaced role names for the user.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>clusterRoles</code></br>
|
|
<em>
|
|
[]string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>ClusterRoles is the list of cluster-wide role names for the user.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>subjects</code></br>
|
|
<em>
|
|
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#subject-v1-rbac">
|
|
[]Kubernetes rbac/v1.Subject
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Subjects is the list of subject names like users, user groups, and service accounts.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.Validation">Validation
|
|
</h3>
|
|
<p>
|
|
(<em>Appears on:</em>
|
|
<a href="#kyverno.io/v1.Rule">Rule</a>)
|
|
</p>
|
|
<p>
|
|
<p>Validation defines checks to be performed on matching resources.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>message</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Message specifies a custom message to be displayed on failure.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>pattern</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Pattern specifies an overlay-style pattern used to check resources.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>anyPattern</code></br>
|
|
<em>
|
|
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions.JSON
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>AnyPattern specifies list of validation patterns. At least one of the patterns
|
|
must be satisfied for the validation rule to succeed.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>deny</code></br>
|
|
<em>
|
|
<a href="#kyverno.io/v1.Deny">
|
|
Deny
|
|
</a>
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Deny defines conditions to fail the validation rule.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
<h3 id="kyverno.io/v1.ViolatedRule">ViolatedRule
|
|
</h3>
|
|
<p>
|
|
<p>ViolatedRule stores the information regarding the rule.</p>
|
|
</p>
|
|
<table class="table table-striped">
|
|
<thead class="thead-dark">
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<code>name</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Specifies violated rule name.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>type</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<p>Specifies violated rule type.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>message</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
<p>Specifies violation message.</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
<code>check</code></br>
|
|
<em>
|
|
string
|
|
</em>
|
|
</td>
|
|
<td>
|
|
<em>(Optional)</em>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
<hr />
|
|
</div>
|
|
<script src="https://code.jquery.com/jquery-3.3.1.slim.min.js" integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo" crossorigin="anonymous"></script>
|
|
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js" integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1" crossorigin="anonymous"></script>
|
|
<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js" integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM" crossorigin="anonymous"></script>
|
|
</body>
|
|
</html>
|