From 1283315e76dcc5fe6a4392bb085ba7d6684a3b92 Mon Sep 17 00:00:00 2001 From: devex-sa Date: Thu, 3 Sep 2026 10:36:51 +0000 Subject: [PATCH 1/3] Update Helm release kyverno to v3.9.0 --- apps/kyverno/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/kyverno/release.yaml b/apps/kyverno/release.yaml index a57795e3..187a9215 100644 --- a/apps/kyverno/release.yaml +++ b/apps/kyverno/release.yaml @@ -9,7 +9,7 @@ spec: chart: spec: chart: kyverno - version: 3.7.1 # when updated reflect the version in .github/workflows/pre-commit.yaml as well + version: 3.9.0 # when updated reflect the version in .github/workflows/pre-commit.yaml as well sourceRef: kind: HelmRepository name: kyverno From af47ddce3163cbb5318adb038c6b1d5ec5576856 Mon Sep 17 00:00:00 2001 From: samidbb Date: Thu, 17 Sep 2026 09:15:03 +0200 Subject: [PATCH 2/3] reflecting the kyverno version installed with flux --- .github/workflows/pre-commit.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index 6d5e416e..c4fc378b 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -12,5 +12,5 @@ jobs: - uses: alexellis/arkade-get@master with: kubeconform: latest - kyverno: v1.17.1 + kyverno: v1.19.0 - uses: pre-commit/action@v3.0.1 From ed0dbfc4234f83cae7f3f8b83a3423e1aa6b6b9f Mon Sep 17 00:00:00 2001 From: samidbb Date: Thu, 17 Sep 2026 07:15:51 +0000 Subject: [PATCH 3/3] Update CRDs and render helm templates --- .../ConfigMap-atlantis-repo-config.yml | 2 +- apps/atlantis/manifests/Ingress-atlantis.yml | 2 +- .../PersistentVolumeClaim-atlantis-data.yml | 2 +- apps/atlantis/manifests/Service-atlantis.yml | 2 +- .../manifests/ServiceAccount-atlantis.yml | 2 +- .../manifests/StatefulSet-atlantis.yml | 4 +- apps/external-secrets/crds.yaml | 100 +- ...yment-external-secrets-cert-controller.yml | 2 +- .../Deployment-external-secrets-webhook.yml | 2 +- .../manifests/Deployment-external-secrets.yml | 2 +- apps/keda/crds.yaml | 309 +- .../ClusterRole-keda-operator-webhook.yml | 7 + .../manifests/ClusterRole-keda-operator.yml | 2 + .../Deployment-keda-admission-webhooks.yml | 2 +- ...oyment-keda-operator-metrics-apiserver.yml | 8 +- .../manifests/Deployment-keda-operator.yml | 11 +- .../ServiceAccount-keda-metrics-server.yml | 1 - .../manifests/ServiceAccount-keda-webhook.yml | 1 - apps/kyverno/crds.yaml | 2647 +++++++++++++++-- ...usterRole-kyverno:admission-controller.yml | 1 + ...Role-kyverno:admission-controller:core.yml | 1 + ...sterRole-kyverno:background-controller.yml | 1 + ...ole-kyverno:background-controller:core.yml | 1 + ...ClusterRole-kyverno:cleanup-controller.yml | 1 + ...erRole-kyverno:cleanup-controller:core.yml | 1 + .../ClusterRole-kyverno:migrate-resources.yml | 1 + ...lusterRole-kyverno:rbac:admin:policies.yml | 22 + ...ClusterRole-kyverno:rbac:view:policies.yml | 18 + ...ClusterRole-kyverno:reports-controller.yml | 1 + ...erRole-kyverno:reports-controller:core.yml | 1 + ...leBinding-kyverno:admission-controller.yml | 1 + ...ding-kyverno:admission-controller:view.yml | 1 + ...eBinding-kyverno:background-controller.yml | 1 + ...ing-kyverno:background-controller:view.yml | 1 + ...RoleBinding-kyverno:cleanup-controller.yml | 1 + ...rRoleBinding-kyverno:migrate-resources.yml | 1 + ...RoleBinding-kyverno:reports-controller.yml | 1 + ...inding-kyverno:reports-controller:view.yml | 1 + .../manifests/ConfigMap-kyverno-metrics.yml | 2 +- ...eployment-kyverno-admission-controller.yml | 24 +- ...ployment-kyverno-background-controller.yml | 22 +- .../Deployment-kyverno-cleanup-controller.yml | 21 +- .../Deployment-kyverno-reports-controller.yml | 19 +- .../Job-kyverno-migrate-resources.yml | 7 +- .../Job-kyverno-rm-validatingwhconfig.yml | 52 - ...config.yml => Job-kyverno-rm-webhooks.yml} | 17 +- .../manifests/Job-kyverno-scale-to-zero.yml | 16 +- ...d-kyverno-admission-controller-metrics.yml | 4 +- ...od-kyverno-cleanup-controller-liveness.yml | 4 +- ...Pod-kyverno-cleanup-controller-metrics.yml | 4 +- ...d-kyverno-cleanup-controller-readiness.yml | 4 +- ...Pod-kyverno-reports-controller-metrics.yml | 4 +- ...ionBudget-kyverno-admission-controller.yml | 1 + .../Role-kyverno:admission-controller.yml | 1 + .../Role-kyverno:background-controller.yml | 1 + .../Role-kyverno:cleanup-controller.yml | 3 + .../Role-kyverno:reports-controller.yml | 1 + ...leBinding-kyverno:admission-controller.yml | 1 + ...eBinding-kyverno:background-controller.yml | 1 + ...RoleBinding-kyverno:cleanup-controller.yml | 1 + ...RoleBinding-kyverno:reports-controller.yml | 1 + ...-kyverno-background-controller-metrics.yml | 1 + ...ice-kyverno-cleanup-controller-metrics.yml | 1 + .../Service-kyverno-cleanup-controller.yml | 1 + ...ice-kyverno-reports-controller-metrics.yml | 1 + .../manifests/Service-kyverno-svc-metrics.yml | 1 + .../kyverno/manifests/Service-kyverno-svc.yml | 1 + ...ceAccount-kyverno-admission-controller.yml | 1 + ...eAccount-kyverno-background-controller.yml | 1 + ...viceAccount-kyverno-cleanup-controller.yml | 1 + ...rviceAccount-kyverno-migrate-resources.yml | 1 + ...viceAccount-kyverno-reports-controller.yml | 1 + .../Deployment-snapshot-controller.yml | 2 +- 73 files changed, 2931 insertions(+), 458 deletions(-) delete mode 100644 apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml rename apps/kyverno/manifests/{Job-kyverno-rm-mutatingwhconfig.yml => Job-kyverno-rm-webhooks.yml} (76%) diff --git a/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml b/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml index 423ab00d..4a0488f0 100644 --- a/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml +++ b/apps/atlantis/manifests/ConfigMap-atlantis-repo-config.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm data: diff --git a/apps/atlantis/manifests/Ingress-atlantis.yml b/apps/atlantis/manifests/Ingress-atlantis.yml index 0722c143..64b15001 100644 --- a/apps/atlantis/manifests/Ingress-atlantis.yml +++ b/apps/atlantis/manifests/Ingress-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: diff --git a/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml b/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml index 0afc05fd..e4108458 100644 --- a/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml +++ b/apps/atlantis/manifests/PersistentVolumeClaim-atlantis-data.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: diff --git a/apps/atlantis/manifests/Service-atlantis.yml b/apps/atlantis/manifests/Service-atlantis.yml index 5b182c66..8cf3051e 100644 --- a/apps/atlantis/manifests/Service-atlantis.yml +++ b/apps/atlantis/manifests/Service-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: diff --git a/apps/atlantis/manifests/ServiceAccount-atlantis.yml b/apps/atlantis/manifests/ServiceAccount-atlantis.yml index 48171b69..96c1576b 100644 --- a/apps/atlantis/manifests/ServiceAccount-atlantis.yml +++ b/apps/atlantis/manifests/ServiceAccount-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm annotations: diff --git a/apps/atlantis/manifests/StatefulSet-atlantis.yml b/apps/atlantis/manifests/StatefulSet-atlantis.yml index a60a8ded..633a5436 100644 --- a/apps/atlantis/manifests/StatefulSet-atlantis.yml +++ b/apps/atlantis/manifests/StatefulSet-atlantis.yml @@ -7,7 +7,7 @@ metadata: namespace: atlantis labels: app: atlantis - chart: atlantis-6.10.1 + chart: atlantis-6.11.0 release: atlantis heritage: Helm spec: @@ -24,7 +24,7 @@ spec: release: atlantis annotations: checksum/config: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b - checksum/repo-config: 4ecac17b3cecc865922d12ddc46838eec3df9b6a87240fcff2c4317e139acb87 + checksum/repo-config: 0bde94a4f3c2b27cd978675afa0e5401d4a986f7f8af55a0f424caaf438a73f4 spec: hostNetwork: false serviceAccountName: atlantis diff --git a/apps/external-secrets/crds.yaml b/apps/external-secrets/crds.yaml index 7df2c771..7f03f9b0 100644 --- a/apps/external-secrets/crds.yaml +++ b/apps/external-secrets/crds.yaml @@ -607,15 +607,13 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -626,7 +624,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -742,15 +739,13 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -761,7 +756,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -788,15 +782,13 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -1240,13 +1232,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -5298,13 +5292,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -9649,6 +9645,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -9664,12 +9666,16 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] may be set + rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size() <= 1' openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. properties: @@ -16803,15 +16809,13 @@ spec: which secret (version/property/..) to fetch. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -16822,7 +16826,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -16938,15 +16941,13 @@ spec: Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -16957,7 +16958,6 @@ spec: description: Key is the key used in the Provider, mandatory type: string metadataPolicy: - default: None description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None enum: - None @@ -16984,15 +16984,13 @@ spec: Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef. properties: conversionStrategy: - default: Default - description: Used to define a conversion Strategy + description: Used to define a conversion Strategy. Defaults to Default when omitted. enum: - Default - Unicode type: string decodingStrategy: - default: None - description: Used to define a decoding Strategy + description: Used to define a decoding Strategy. Defaults to None when omitted. enum: - Auto - Base64 @@ -17436,13 +17434,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -19722,13 +19722,15 @@ spec: default: Data description: |- Target specifies where to place the template result. - For Secret resources, common values are: "Data", "Annotations", "Labels". + For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels"; + any other value is rejected because it would allow writes to privileged Secret fields. For custom resources (when spec.target.manifest is set), this supports nested paths like "spec.database.config" or "data". type: string valuesDecodingStrategy: - default: None - description: Used to define a decoding Strategy for the rendered template values. + description: |- + Used to define a decoding Strategy for the rendered template values. + Defaults to None when omitted. enum: - Auto - Base64 @@ -24191,6 +24193,12 @@ spec: Format: duration string (e.g., "5m", "1h", "30s") type: string type: object + environment: + description: |- + Environment defines the 1Password Environment ID to read variables from. + Environments are read-only: PushSecret, DeleteSecret, and SecretExists return an error when set. + Mutually exclusive with Vault. + type: string integrationInfo: description: |- IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK. @@ -24206,12 +24214,16 @@ spec: type: string type: object vault: - description: Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + description: |- + Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically. + Mutually exclusive with Environment. type: string required: - auth - - vault type: object + x-kubernetes-validations: + - message: at most one of the fields in [vault environment] may be set + rule: '[has(self.vault),has(self.environment)].filter(x,x==true).size() <= 1' openBao: description: OpenBao configures this store to sync secrets using the OpenBao provider. properties: diff --git a/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml b/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml index 186325a2..502daeab 100644 --- a/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml +++ b/apps/external-secrets/manifests/Deployment-external-secrets-cert-controller.yml @@ -38,7 +38,7 @@ spec: runAsUser: 1000 seccompProfile: type: RuntimeDefault - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.9.0 imagePullPolicy: IfNotPresent args: - certcontroller diff --git a/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml b/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml index cf488150..08007923 100644 --- a/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml +++ b/apps/external-secrets/manifests/Deployment-external-secrets-webhook.yml @@ -38,7 +38,7 @@ spec: runAsUser: 1000 seccompProfile: type: RuntimeDefault - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.9.0 imagePullPolicy: IfNotPresent args: - webhook diff --git a/apps/external-secrets/manifests/Deployment-external-secrets.yml b/apps/external-secrets/manifests/Deployment-external-secrets.yml index 0b6ae2cd..ec0327d6 100644 --- a/apps/external-secrets/manifests/Deployment-external-secrets.yml +++ b/apps/external-secrets/manifests/Deployment-external-secrets.yml @@ -38,7 +38,7 @@ spec: runAsUser: 1000 seccompProfile: type: RuntimeDefault - image: ghcr.io/external-secrets/external-secrets:v2.8.0 + image: ghcr.io/external-secrets/external-secrets:v2.9.0 imagePullPolicy: IfNotPresent args: - --concurrent=1 diff --git a/apps/keda/crds.yaml b/apps/keda/crds.yaml index fafc0e62..99556e9d 100644 --- a/apps/keda/crds.yaml +++ b/apps/keda/crds.yaml @@ -3,14 +3,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: cloudeventsources.eventing.keda.sh spec: group: eventing.keda.sh @@ -57,6 +57,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -177,14 +180,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: clustercloudeventsources.eventing.keda.sh spec: group: eventing.keda.sh @@ -230,6 +233,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -350,14 +356,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: clustertriggerauthentications.keda.sh spec: group: keda.sh @@ -494,6 +500,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -542,6 +551,7 @@ spec: - name - parameter type: object + minItems: 1 type: array required: - secrets @@ -596,6 +606,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -638,6 +651,7 @@ spec: - name - parameter type: object + minItems: 1 type: array vaultUri: type: string @@ -727,6 +741,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -769,6 +786,7 @@ spec: - id - parameter type: object + minItems: 1 type: array required: - secrets @@ -780,6 +798,9 @@ spec: type: string authentication: description: VaultAuthentication contains the list of Hashicorp Vault authentication methods + enum: + - token + - kubernetes type: string credential: description: Credential defines the Hashicorp Vault credentials depending on the authentication method @@ -826,23 +847,76 @@ spec: type: object type: description: VaultSecretType defines the type of vault secret + enum: + - "" + - secretV2 + - secret + - pki type: string required: - key - parameter - path type: object + minItems: 1 type: array required: - address - authentication - secrets type: object + oauth2: + properties: + clientId: + type: string + clientSecret: + properties: + valueFrom: + properties: + secretKeyRef: + properties: + key: + type: string + name: + type: string + required: + - key + - name + type: object + required: + - secretKeyRef + type: object + required: + - valueFrom + type: object + scopes: + items: + type: string + type: array + tokenUrl: + type: string + tokenUrlParams: + additionalProperties: + type: string + type: object + type: + default: clientCredentials + enum: + - clientCredentials + type: string + required: + - clientId + - tokenUrl + - type + type: object podIdentity: description: |- AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -910,14 +984,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: scaledjobs.keda.sh spec: group: keda.sh @@ -984,6 +1058,7 @@ spec: type: string failedJobsHistoryLimit: format: int32 + minimum: 0 type: integer jobTargetRef: description: JobSpec describes how the job execution will look like. @@ -1060,9 +1135,6 @@ spec: by RFC 1123. All characters trailing the first "/" must be valid HTTP Path characters as defined by RFC 3986. The value cannot exceed 63 characters. This field is immutable. - - This field is beta-level. The job controller accepts setting the field - when the feature gate JobManagedBy is enabled (enabled by default). type: string manualSelector: description: |- @@ -1199,7 +1271,6 @@ spec: it is required that specified type equals the pod condition type. type: string required: - - status - type type: object type: array @@ -3088,7 +3159,9 @@ spec: type: integer type: object resizePolicy: - description: Resources resize policy for the container. + description: |- + Resources resize policy for the container. + This field cannot be set on ephemeral containers. items: description: ContainerResizePolicy represents resource resize policy for the container. properties: @@ -6163,7 +6236,9 @@ spec: type: integer type: object resizePolicy: - description: Resources resize policy for the container. + description: |- + Resources resize policy for the container. + This field cannot be set on ephemeral containers. items: description: ContainerResizePolicy represents resource resize policy for the container. properties: @@ -6924,8 +6999,8 @@ spec: will be made available to those containers which consume them by name. - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. + This is a stable field but requires that the + DynamicResourceAllocation feature gate is enabled. This field is immutable. items: @@ -7377,9 +7452,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -8151,7 +8227,7 @@ spec: resources: description: |- resources represents the minimum resources the volume should have. - If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + Users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources @@ -8986,6 +9062,24 @@ spec: signerName: description: Kubelet's generated CSRs will be addressed to this signer. type: string + userAnnotations: + additionalProperties: + type: string + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object required: - keyType - signerName @@ -9395,6 +9489,42 @@ spec: x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map + workloadRef: + description: |- + WorkloadRef provides a reference to the Workload object that this Pod belongs to. + This field is used by the scheduler to identify the PodGroup and apply the + correct group scheduling policies. The Workload object referenced + by this field may not exist at the time the Pod is created. + This field is immutable, but a Workload object with the same name + may be recreated with different policies. Doing this during pod scheduling + may result in the placement not conforming to the expected policies. + properties: + name: + description: |- + Name defines the name of the Workload object this Pod belongs to. + Workload must be in the same namespace as the Pod. + If it doesn't match any existing Workload, the Pod will remain unschedulable + until a Workload object is created and observed by the kube-scheduler. + It must be a DNS subdomain. + type: string + podGroup: + description: |- + PodGroup is the name of the PodGroup within the Workload that this Pod + belongs to. If it doesn't match any existing PodGroup within the Workload, + the Pod will remain unschedulable until the Workload object is recreated + and observed by the kube-scheduler. It must be a DNS label. + type: string + podGroupReplicaKey: + description: |- + PodGroupReplicaKey specifies the replica key of the PodGroup to which this + Pod belongs. It is used to distinguish pods belonging to different replicas + of the same pod group. The pod group policy is applied separately to each replica. + When set, it must be a DNS label. + type: string + required: + - name + - podGroup + type: object required: - containers type: object @@ -9415,22 +9545,35 @@ spec: type: object maxReplicaCount: format: int32 + minimum: 1 type: integer minReplicaCount: format: int32 + minimum: 0 type: integer pollingInterval: format: int32 + minimum: 1 type: integer rollout: description: Rollout defines the strategy for job rollouts properties: propagationPolicy: + enum: + - foreground + - background type: string strategy: + enum: + - gradual + - immediate type: string type: object rolloutStrategy: + description: 'Deprecated: Use Rollout.Strategy instead (see https://github.com/kedacore/keda/issues/3596).' + enum: + - gradual + - immediate type: string scalingStrategy: description: ScalingStrategy defines the strategy of Scaling @@ -9441,16 +9584,27 @@ spec: customScalingRunningJobPercentage: type: string multipleScalersCalculation: + enum: + - min + - avg + - sum + - max type: string pendingPodConditions: items: type: string type: array strategy: + enum: + - default + - custom + - accurate + - eager type: string type: object successfulJobsHistoryLimit: format: int32 + minimum: 0 type: integer triggers: items: @@ -9463,6 +9617,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -9476,6 +9633,7 @@ spec: name: type: string type: + minLength: 1 type: string useCachedMetrics: type: boolean @@ -9483,6 +9641,7 @@ spec: - metadata - type type: object + minItems: 1 type: array required: - jobTargetRef @@ -9546,14 +9705,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: scaledobjects.keda.sh spec: group: keda.sh @@ -9705,8 +9864,8 @@ spec: and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi. - This is an alpha field and requires enabling the HPAConfigurableTolerance - feature gate. + This is an beta field and requires the HPAConfigurableTolerance feature + gate to be enabled. pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object @@ -9780,8 +9939,8 @@ spec: and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi. - This is an alpha field and requires enabling the HPAConfigurableTolerance - feature gate. + This is an beta field and requires the HPAConfigurableTolerance feature + gate to be enabled. pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true type: object @@ -9812,6 +9971,7 @@ spec: type: object cooldownPeriod: format: int32 + minimum: 0 type: integer fallback: description: Fallback is the spec for fallback options @@ -9823,12 +9983,15 @@ spec: - currentReplicas - currentReplicasIfHigher - currentReplicasIfLower + - scalingModifiers type: string failureThreshold: format: int32 + minimum: 0 type: integer replicas: format: int32 + minimum: 0 type: integer required: - failureThreshold @@ -9836,18 +9999,23 @@ spec: type: object idleReplicaCount: format: int32 + minimum: 0 type: integer initialCooldownPeriod: format: int32 + minimum: 0 type: integer maxReplicaCount: format: int32 + minimum: 1 type: integer minReplicaCount: format: int32 + minimum: 0 type: integer pollingInterval: format: int32 + minimum: 1 type: integer scaleTargetRef: description: ScaleTarget holds the reference to the scale target Object @@ -9859,6 +10027,7 @@ spec: kind: type: string name: + minLength: 1 type: string required: - name @@ -9874,6 +10043,9 @@ spec: properties: kind: description: Kind of the resource being referred to. Defaults to TriggerAuthentication. + enum: + - TriggerAuthentication + - ClusterTriggerAuthentication type: string name: type: string @@ -9892,6 +10064,7 @@ spec: name: type: string type: + minLength: 1 type: string useCachedMetrics: type: boolean @@ -9899,11 +10072,15 @@ spec: - metadata - type type: object + minItems: 1 type: array required: - scaleTargetRef - triggers type: object + x-kubernetes-validations: + - message: minReplicaCount must be less than or equal to maxReplicaCount + rule: '!has(self.minReplicaCount) || self.minReplicaCount <= (has(self.maxReplicaCount) ? self.maxReplicaCount : 100)' status: description: ScaledObjectStatus is the status for a ScaledObject resource properties: @@ -10007,14 +10184,14 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.20.0 + controller-gen.kubebuilder.io/version: v0.21.0 labels: app.kubernetes.io/name: keda-operator - helm.sh/chart: keda-2.19.0 + helm.sh/chart: keda-2.20.2 app.kubernetes.io/component: operator app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator - app.kubernetes.io/version: 2.19.0 + app.kubernetes.io/version: 2.20.2 name: triggerauthentications.keda.sh spec: group: keda.sh @@ -10148,6 +10325,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -10196,6 +10376,7 @@ spec: - name - parameter type: object + minItems: 1 type: array required: - secrets @@ -10250,6 +10431,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -10292,6 +10476,7 @@ spec: - name - parameter type: object + minItems: 1 type: array vaultUri: type: string @@ -10381,6 +10566,9 @@ spec: AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string @@ -10423,6 +10611,7 @@ spec: - id - parameter type: object + minItems: 1 type: array required: - secrets @@ -10434,6 +10623,9 @@ spec: type: string authentication: description: VaultAuthentication contains the list of Hashicorp Vault authentication methods + enum: + - token + - kubernetes type: string credential: description: Credential defines the Hashicorp Vault credentials depending on the authentication method @@ -10480,23 +10672,76 @@ spec: type: object type: description: VaultSecretType defines the type of vault secret + enum: + - "" + - secretV2 + - secret + - pki type: string required: - key - parameter - path type: object + minItems: 1 type: array required: - address - authentication - secrets type: object + oauth2: + properties: + clientId: + type: string + clientSecret: + properties: + valueFrom: + properties: + secretKeyRef: + properties: + key: + type: string + name: + type: string + required: + - key + - name + type: object + required: + - secretKeyRef + type: object + required: + - valueFrom + type: object + scopes: + items: + type: string + type: array + tokenUrl: + type: string + tokenUrlParams: + additionalProperties: + type: string + type: object + type: + default: clientCredentials + enum: + - clientCredentials + type: string + required: + - clientId + - tokenUrl + - type + type: object podIdentity: description: |- AuthPodIdentity allows users to select the platform native identity mechanism properties: + externalID: + description: ExternalID sets the External ID to be used when assuming an identity. This is only applicable when using AWS pod identity with a RoleArn. + type: string identityAuthorityHost: description: Set identityAuthorityHost to override the default Azure authority host. If this is set, then the IdentityTenantID must also be set type: string diff --git a/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml b/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml index 45743924..b8e44205 100644 --- a/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml +++ b/apps/keda/manifests/ClusterRole-keda-operator-webhook.yml @@ -40,3 +40,10 @@ rules: - limitranges verbs: - list + - apiGroups: + - events.k8s.io + resources: + - events + verbs: + - create + - patch diff --git a/apps/keda/manifests/ClusterRole-keda-operator.yml b/apps/keda/manifests/ClusterRole-keda-operator.yml index c68103a0..8d1b674a 100644 --- a/apps/keda/manifests/ClusterRole-keda-operator.yml +++ b/apps/keda/manifests/ClusterRole-keda-operator.yml @@ -25,6 +25,7 @@ rules: - list - watch - apiGroups: + - events.k8s.io - "" resources: - events @@ -77,6 +78,7 @@ rules: - apps resources: - deployments + - replicasets - statefulsets verbs: - get diff --git a/apps/keda/manifests/Deployment-keda-admission-webhooks.yml b/apps/keda/manifests/Deployment-keda-admission-webhooks.yml index f7c9c155..96c3667b 100644 --- a/apps/keda/manifests/Deployment-keda-admission-webhooks.yml +++ b/apps/keda/manifests/Deployment-keda-admission-webhooks.yml @@ -46,7 +46,7 @@ spec: readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault - image: "ghcr.io/kedacore/keda-admission-webhooks:2.19.0" + image: "ghcr.io/kedacore/keda-admission-webhooks:2.20.2" command: - /keda-admission-webhooks args: diff --git a/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml b/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml index 1253e7e6..42487e22 100644 --- a/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml +++ b/apps/keda/manifests/Deployment-keda-operator-metrics-apiserver.yml @@ -44,7 +44,7 @@ spec: readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault - image: "ghcr.io/kedacore/keda-metrics-apiserver:2.19.0" + image: "ghcr.io/kedacore/keda-metrics-apiserver:2.20.2" imagePullPolicy: Always livenessProbe: httpGet: @@ -77,6 +77,12 @@ spec: value: "3000" - name: KEDA_HTTP_MIN_TLS_VERSION value: TLS12 + - name: KEDA_HTTP_TLS_CIPHER_LIST + value: "" + - name: KEDA_SERVICE_MIN_TLS_VERSION + value: TLS13 + - name: KEDA_SERVICE_TLS_CIPHER_LIST + value: "" command: - /keda-adapter args: diff --git a/apps/keda/manifests/Deployment-keda-operator.yml b/apps/keda/manifests/Deployment-keda-operator.yml index c2429032..6dee9895 100644 --- a/apps/keda/manifests/Deployment-keda-operator.yml +++ b/apps/keda/manifests/Deployment-keda-operator.yml @@ -46,7 +46,7 @@ spec: readOnlyRootFilesystem: true seccompProfile: type: RuntimeDefault - image: "ghcr.io/kedacore/keda:2.19.0" + image: "ghcr.io/kedacore/keda:2.20.2" command: - "/keda" args: @@ -65,6 +65,9 @@ spec: - "--k8s-cluster-name=kubernetes-default" - "--k8s-cluster-domain=cluster.local" - "--enable-prometheus-metrics=false" + - "--http-max-idle-conns=0" + - "--http-max-idle-conns-per-host=1000" + - "--http-idle-conn-timeout=90s" imagePullPolicy: Always livenessProbe: httpGet: @@ -105,6 +108,12 @@ spec: value: "3000" - name: KEDA_HTTP_MIN_TLS_VERSION value: TLS12 + - name: KEDA_HTTP_TLS_CIPHER_LIST + value: "" + - name: KEDA_SERVICE_MIN_TLS_VERSION + value: TLS13 + - name: KEDA_SERVICE_TLS_CIPHER_LIST + value: "" volumeMounts: - mountPath: /certs name: certificates diff --git a/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml b/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml index 6e16db24..3eca3b85 100644 --- a/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml +++ b/apps/keda/manifests/ServiceAccount-keda-metrics-server.yml @@ -9,7 +9,6 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator app.kubernetes.io/instance: keda - annotations: name: keda-metrics-server namespace: keda automountServiceAccountToken: true diff --git a/apps/keda/manifests/ServiceAccount-keda-webhook.yml b/apps/keda/manifests/ServiceAccount-keda-webhook.yml index 3227aa8d..932ab170 100644 --- a/apps/keda/manifests/ServiceAccount-keda-webhook.yml +++ b/apps/keda/manifests/ServiceAccount-keda-webhook.yml @@ -9,7 +9,6 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: keda-operator app.kubernetes.io/instance: keda - annotations: name: keda-webhook namespace: keda automountServiceAccountToken: true diff --git a/apps/kyverno/crds.yaml b/apps/kyverno/crds.yaml index addc6ebc..04333bc8 100644 --- a/apps/kyverno/crds.yaml +++ b/apps/kyverno/crds.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: cleanuppolicies.kyverno.io @@ -309,7 +309,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1535,7 +1536,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -2486,8 +2488,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clustercleanuppolicies.kyverno.io @@ -2788,7 +2790,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -4014,7 +4017,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -4965,8 +4969,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clusterpolicies.kyverno.io @@ -5107,7 +5111,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -5123,7 +5127,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -5300,7 +5304,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6268,7 +6273,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6453,8 +6459,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -7281,7 +7287,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -7637,7 +7644,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -7784,8 +7792,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -7842,11 +7851,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -7869,7 +7878,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -7891,13 +7900,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -7935,7 +7944,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -8010,12 +8019,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -8286,7 +8295,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -9467,7 +9477,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -9658,7 +9669,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -9674,7 +9685,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -9725,7 +9736,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -9741,7 +9752,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -9918,7 +9929,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -10886,7 +10898,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -11071,8 +11084,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -11899,7 +11912,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12255,7 +12269,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12402,8 +12417,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -12460,11 +12476,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -12487,7 +12503,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -12509,13 +12525,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -12553,7 +12569,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -12628,12 +12644,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -12904,7 +12920,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -14085,7 +14102,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -14400,7 +14418,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -14416,7 +14434,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -14593,7 +14611,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -15366,7 +15385,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -15551,8 +15571,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -16184,7 +16204,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16540,7 +16561,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16747,6 +16769,11 @@ spec: type: object type: array type: object + reportProperties: + additionalProperties: + type: string + description: ReportProperties are the additional properties from the rule that will be added to the policy report result + type: object skipBackgroundRequests: default: true description: |- @@ -16763,8 +16790,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -16821,11 +16849,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -16848,7 +16876,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -16870,13 +16898,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -16914,7 +16942,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -16989,12 +17017,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -17350,7 +17378,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -18513,7 +18542,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -18692,7 +18722,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -18708,7 +18738,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -18759,7 +18789,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -18775,7 +18805,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -18952,7 +18982,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -19920,7 +19951,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -20105,8 +20137,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -20933,7 +20965,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -21289,7 +21322,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -21436,8 +21470,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -21494,11 +21529,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -21521,7 +21556,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -21543,13 +21578,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -21587,7 +21622,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -21662,12 +21697,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -21938,7 +21973,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -23119,7 +23155,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -23320,8 +23357,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: globalcontextentries.kyverno.io @@ -24081,8 +24118,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: policies.kyverno.io @@ -24225,7 +24262,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -24241,7 +24278,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -24418,7 +24455,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -25386,7 +25424,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -25571,8 +25610,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -26399,7 +26438,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -26755,7 +26795,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -26902,8 +26943,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -26960,11 +27002,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -26987,7 +27029,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -27009,13 +27051,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -27053,7 +27095,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -27128,12 +27170,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -27404,7 +27446,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -28585,7 +28628,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -28776,7 +28820,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -28792,7 +28836,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -28843,7 +28887,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -28859,7 +28903,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -29036,7 +29080,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -30004,7 +30049,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -30189,8 +30235,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -31017,7 +31063,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -31373,7 +31420,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -31520,8 +31568,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -31578,11 +31627,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -31605,7 +31654,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -31627,13 +31676,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -31671,7 +31720,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -31746,12 +31795,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -32022,7 +32071,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -33203,7 +33253,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -33520,7 +33571,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -33536,7 +33587,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -33713,7 +33764,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -34486,7 +34538,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -34671,8 +34724,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -35304,7 +35357,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -35660,7 +35714,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -35867,6 +35922,11 @@ spec: type: object type: array type: object + reportProperties: + additionalProperties: + type: string + description: ReportProperties are the additional properties from the rule that will be added to the policy report result + type: object skipBackgroundRequests: default: true description: |- @@ -35883,8 +35943,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -35941,11 +36002,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -35968,7 +36029,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -35990,13 +36051,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -36034,7 +36095,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -36109,12 +36170,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -36470,7 +36531,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -37633,7 +37695,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -37812,7 +37875,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -37828,7 +37891,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -37879,7 +37942,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -37895,7 +37958,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -38072,7 +38135,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -39040,7 +39104,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -39225,8 +39290,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -40053,7 +40118,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -40409,7 +40475,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -40556,8 +40623,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -40614,11 +40682,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -40641,7 +40709,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -40663,13 +40731,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -40707,7 +40775,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -40782,12 +40850,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -41058,7 +41126,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -42239,7 +42308,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -42440,8 +42510,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: policyexceptions.kyverno.io @@ -43685,8 +43755,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: updaterequests.kyverno.io @@ -43899,30 +43969,24 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object - required: - - kind - - operation - - resource - - uid - - userInfo type: object operation: description: Operation is the type of resource operation being checked for admission control @@ -43952,22 +44016,22 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object type: object @@ -44257,30 +44321,24 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object - required: - - kind - - operation - - resource - - uid - - userInfo type: object operation: description: Operation is the type of resource operation being checked for admission control @@ -44315,22 +44373,22 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object type: object @@ -44483,8 +44541,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clusterephemeralreports.reports.kyverno.io @@ -44812,8 +44870,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: ephemeralreports.reports.kyverno.io @@ -45142,8 +45200,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clusterpolicyreports.wgpolicyk8s.io @@ -45493,8 +45551,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.0 + helm.sh/chart: crds-3.9.0 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: policyreports.wgpolicyk8s.io @@ -47504,6 +47562,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -47539,6 +47648,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -47562,7 +47677,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -47940,6 +48083,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -48095,6 +48244,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -48130,6 +48330,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -48153,7 +48359,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -48531,6 +48765,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -48685,6 +48925,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -48720,6 +49011,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -48743,7 +49040,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -49121,6 +49446,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -49439,6 +49770,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -49447,6 +49783,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -49457,6 +49796,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -49505,6 +49849,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -49682,7 +50048,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -50387,6 +50753,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -50395,6 +50766,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -50405,6 +50779,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -50453,6 +50832,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -50630,7 +51031,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -51456,6 +51857,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -51464,6 +51870,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -51474,6 +51883,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -51522,6 +51936,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -51699,7 +52135,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -52404,6 +52840,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -52412,6 +52853,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -52422,6 +52866,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -52470,6 +52919,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -52647,7 +53118,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -53472,6 +53943,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -53480,6 +53956,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -53490,6 +53969,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -53538,6 +54022,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -53715,7 +54221,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -54420,6 +54926,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -54428,6 +54939,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -54438,6 +54952,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -54486,6 +55005,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -54663,7 +55204,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -55369,6 +55910,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -55430,6 +56022,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -55500,8 +56106,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -55876,8 +56483,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -55958,6 +56609,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -56202,8 +56856,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -56253,6 +56910,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -56314,6 +57022,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -56384,8 +57106,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -56760,8 +57483,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -56842,6 +57609,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -57086,8 +57856,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -57263,6 +58036,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -57324,6 +58148,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -57394,8 +58232,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -57770,8 +58609,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -57852,6 +58735,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -58096,8 +58982,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -58147,6 +59036,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -58208,6 +59148,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -58278,8 +59232,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -58654,8 +59609,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -58736,6 +59735,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -58980,8 +59982,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -59156,6 +60161,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -59217,6 +60273,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -59287,8 +60357,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -59663,8 +60734,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -59745,6 +60860,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -59989,8 +61107,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -60040,6 +61161,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -60101,6 +61273,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -60171,8 +61357,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -60547,8 +61734,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -60629,6 +61860,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -60873,8 +62107,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -62155,6 +63392,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -62190,6 +63478,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -62213,7 +63507,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -62591,6 +63913,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -62746,6 +64074,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -62781,6 +64160,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -62804,7 +64189,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -63182,6 +64595,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -63500,6 +64919,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -63508,6 +64932,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -63518,6 +64945,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -63566,6 +64998,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -63743,7 +65197,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -64448,6 +65902,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -64456,6 +65915,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -64466,6 +65928,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -64514,6 +65981,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -64691,7 +66180,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -65516,6 +67005,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -65524,6 +67018,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -65534,6 +67031,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -65582,6 +67084,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -65759,7 +67283,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -66464,6 +67988,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -66472,6 +68001,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -66482,6 +68014,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -66530,6 +68067,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -66707,7 +68266,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -67413,6 +68972,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -67474,6 +69084,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -67544,8 +69168,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -67920,8 +69545,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -68002,6 +69671,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -68246,8 +69918,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -68297,6 +69972,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -68358,6 +70084,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -68428,8 +70168,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -68804,8 +70545,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -68886,6 +70671,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -69130,8 +70918,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -69306,6 +71097,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -69367,6 +71209,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -69437,8 +71293,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -69813,8 +71670,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -69895,6 +71796,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -70139,8 +72043,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -70190,6 +72097,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -70251,6 +72209,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -70321,8 +72293,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -70697,8 +72670,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -70779,6 +72796,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -71023,8 +73043,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -71319,7 +73342,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -71954,7 +73977,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -72714,7 +74737,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -73349,7 +75372,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -74028,6 +76051,16 @@ spec: items: type: string type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string images: description: |- Images specifies container images to be excluded from policy evaluation. @@ -74088,6 +76121,16 @@ spec: - name type: object type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object reportResult: default: skip description: |- @@ -74138,6 +76181,16 @@ spec: items: type: string type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string images: description: |- Images specifies container images to be excluded from policy evaluation. @@ -74198,6 +76251,16 @@ spec: - name type: object type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object reportResult: default: skip description: |- @@ -74247,6 +76310,16 @@ spec: items: type: string type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string images: description: |- Images specifies container images to be excluded from policy evaluation. @@ -74307,6 +76380,16 @@ spec: - name type: object type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object reportResult: default: skip description: |- @@ -74475,7 +76558,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -75110,7 +77193,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -75871,7 +77954,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -76506,7 +78589,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -77266,7 +79349,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -77901,7 +79984,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml index cbbb184b..0274df7f 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml index 9fb7d1ba..02f0aac8 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml index 17aa8c4c..8502a8dd 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml index 2b02a07e..a48b1813 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml index 29d7db3d..c31d413f 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml index b222288a..12d25894 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml b/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml index f0b8a20c..a17e5cae 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml index ab2dfbfa..a5dc0cd9 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml @@ -26,3 +26,25 @@ rules: - patch - update - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies + - generatingpolicies + - imagevalidatingpolicies + - mutatingpolicies + - namespaceddeletingpolicies + - namespacedgeneratingpolicies + - namespacedimagevalidatingpolicies + - namespacedmutatingpolicies + - namespacedvalidatingpolicies + - policyexceptions + - validatingpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml index f8625f85..0f9cc976 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml @@ -22,3 +22,21 @@ rules: - get - list - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies + - generatingpolicies + - imagevalidatingpolicies + - mutatingpolicies + - namespaceddeletingpolicies + - namespacedgeneratingpolicies + - namespacedimagevalidatingpolicies + - namespacedmutatingpolicies + - namespacedvalidatingpolicies + - policyexceptions + - validatingpolicies + verbs: + - get + - list + - watch diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml index c9386ef7..b528d185 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml index 513ec32d..e42edbc7 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml index 6076aa21..4d46e070 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml index 5ff87eaa..6d9cda36 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml index 0693977e..43a2260f 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml index 0bab21e6..f4598c84 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml index 506e0a21..7dccef01 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml index 92328e7d..6495e8c8 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml index 03953b0d..61670cd7 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml index e904741b..c3625727 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml b/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml index 01935112..b3a9e726 100644 --- a/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml +++ b/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml @@ -12,5 +12,5 @@ metadata: app.kubernetes.io/part-of: kyverno data: namespaces: "{\"exclude\":[],\"include\":[]}" - metricsExposure: "{\"kyverno_admission_requests_total\":{\"disabledLabelDimensions\":[]},\"kyverno_admission_review_duration_seconds\":{\"disabledLabelDimensions\":[]},\"kyverno_cleanup_controller_deletedobjects_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_generating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_image_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_mutating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_policy_results_total\":{\"disabledLabelDimensions\":[]},\"kyverno_policy_rule_info_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]}}" + metricsExposure: "{\"kyverno_admission_requests_total\":{\"disabledLabelDimensions\":[]},\"kyverno_admission_review_duration_seconds\":{\"disabledLabelDimensions\":[]},\"kyverno_cleanup_controller_deletedobjects_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_generating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_generating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_image_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_image_validating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_mutating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_mutating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_policy_results_total\":{\"disabledLabelDimensions\":[]},\"kyverno_policy_rule_info_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_validating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]}}" bucketBoundaries: "0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 15, 20, 25, 30" diff --git a/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml index b5fd7eda..bec59275 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: replicas: 3 @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true initContainers: - name: kyverno-pre - image: "reg.kyverno.io/kyverno/kyvernopre:v1.17.1" + image: "reg.kyverno.io/kyverno/kyvernopre:v1.19.0" imagePullPolicy: IfNotPresent args: - --loggingFormat=text @@ -71,7 +73,9 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault env: @@ -97,7 +101,7 @@ spec: value: kyverno-svc containers: - name: kyverno - image: "reg.kyverno.io/kyverno/kyverno:v1.17.1" + image: "reg.kyverno.io/kyverno/kyverno:v1.19.0" imagePullPolicy: IfNotPresent args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca @@ -115,6 +119,7 @@ spec: - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true + - --excludeBootstrapResources=false - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true @@ -124,6 +129,8 @@ spec: - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped @@ -145,7 +152,9 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault ports: @@ -209,6 +218,17 @@ spec: volumeMounts: - mountPath: /.sigstore name: sigstore + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true volumes: - name: sigstore emptyDir: {} + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml index c27fd5fb..72e77be1 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno spec: replicas: @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true containers: - name: controller - image: "reg.kyverno.io/kyverno/background-controller:v1.17.1" + image: "reg.kyverno.io/kyverno/background-controller:v1.19.0" imagePullPolicy: IfNotPresent ports: - containerPort: 9443 @@ -66,8 +68,11 @@ spec: - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true + - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped @@ -103,6 +108,21 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault + volumeMounts: + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + volumes: + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml index 2263b1da..3007e669 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: replicas: @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true containers: - name: controller - image: "reg.kyverno.io/kyverno/cleanup-controller:v1.17.1" + image: "reg.kyverno.io/kyverno/cleanup-controller:v1.19.0" imagePullPolicy: IfNotPresent ports: - containerPort: 9443 @@ -73,6 +75,8 @@ spec: - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --protectManagedResources=false @@ -111,7 +115,9 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: @@ -142,3 +148,16 @@ spec: periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 + volumeMounts: + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + volumes: + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml index b9316a4e..d5471905 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno spec: replicas: @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true containers: - name: controller - image: "reg.kyverno.io/kyverno/reports-controller:v1.17.1" + image: "reg.kyverno.io/kyverno/reports-controller:v1.19.0" imagePullPolicy: IfNotPresent ports: - containerPort: 9443 @@ -78,6 +80,8 @@ spec: - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped @@ -117,12 +121,25 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault volumeMounts: - mountPath: /.sigstore name: sigstore + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true volumes: - name: sigstore emptyDir: {} + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml b/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml index 7480d98a..c32ad67c 100644 --- a/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml +++ b/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade @@ -22,8 +23,8 @@ spec: automountServiceAccountToken: true restartPolicy: Never containers: - - name: kubectl - image: "reg.kyverno.io/kyverno/kyverno-cli:v1.17.1" + - name: kyverno-cli + image: "reg.kyverno.io/kyverno/kyverno-cli:v1.19.0" imagePullPolicy: IfNotPresent args: - migrate @@ -82,3 +83,5 @@ spec: runAsUser: 65534 seccompProfile: type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml b/apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml deleted file mode 100644 index 654bcf3b..00000000 --- a/apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -# Source: kyverno/templates/hooks/pre-delete-remove-validatingwebhookconfiguration.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: kyverno-rm-validatingwhconfig - namespace: kyverno - labels: - app.kubernetes.io/component: hooks - app.kubernetes.io/instance: kyverno - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: kyverno - annotations: - helm.sh/hook: pre-delete - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed - helm.sh/hook-weight: "100" -spec: - backoffLimit: 2 - template: - spec: - serviceAccountName: kyverno-admission-controller - automountServiceAccountToken: true - restartPolicy: Never - containers: - - name: kubectl - image: "registry.k8s.io/kubectl:v1.34.3" - imagePullPolicy: - command: - - kubectl - - delete - - validatingwebhookconfiguration - - -l - - webhook.kyverno.io/managed-by=kyverno - resources: - limits: - cpu: 100m - memory: 256Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - privileged: false - readOnlyRootFilesystem: true - runAsGroup: 65534 - runAsNonRoot: true - runAsUser: 65534 - seccompProfile: - type: RuntimeDefault diff --git a/apps/kyverno/manifests/Job-kyverno-rm-mutatingwhconfig.yml b/apps/kyverno/manifests/Job-kyverno-rm-webhooks.yml similarity index 76% rename from apps/kyverno/manifests/Job-kyverno-rm-mutatingwhconfig.yml rename to apps/kyverno/manifests/Job-kyverno-rm-webhooks.yml index 34893f69..a67812ec 100644 --- a/apps/kyverno/manifests/Job-kyverno-rm-mutatingwhconfig.yml +++ b/apps/kyverno/manifests/Job-kyverno-rm-webhooks.yml @@ -1,14 +1,15 @@ --- -# Source: kyverno/templates/hooks/pre-delete-remove-mutatingwebhookconfiguration.yaml +# Source: kyverno/templates/hooks/pre-delete-remove-webhooks.yaml apiVersion: batch/v1 kind: Job metadata: - name: kyverno-rm-mutatingwhconfig + name: kyverno-rm-webhooks namespace: kyverno labels: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: pre-delete @@ -23,14 +24,10 @@ spec: restartPolicy: Never containers: - name: kubectl - image: "registry.k8s.io/kubectl:v1.34.3" + image: "ghcr.io/kyverno/readiness-checker:v1.19.0" imagePullPolicy: - command: - - kubectl - - delete - - mutatingwebhookconfiguration - - -l - - webhook.kyverno.io/managed-by=kyverno + args: + - delete-webhooks resources: limits: cpu: 100m @@ -50,3 +47,5 @@ spec: runAsUser: 65534 seccompProfile: type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml b/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml index e663c87d..014310e5 100644 --- a/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml +++ b/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: pre-delete @@ -23,17 +24,10 @@ spec: restartPolicy: Never containers: - name: kubectl - image: "registry.k8s.io/kubectl:v1.34.3" + image: "ghcr.io/kyverno/readiness-checker:v1.19.0" imagePullPolicy: - command: - - kubectl - - scale - - -n - - kyverno - - deployment - - -l - - app.kubernetes.io/part-of=kyverno - - --replicas=0 + args: + - scale-deploy resources: limits: cpu: 100m @@ -53,3 +47,5 @@ spec: runAsUser: 65534 seccompProfile: type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml b/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml index 9e6c1f79..8e97c6fe 100644 --- a/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml +++ b/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -44,3 +44,5 @@ spec: - --namespace=kyverno - --port=8000 - --path=metrics + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml index 5f03b478..911a262a 100644 --- a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml +++ b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -45,3 +45,5 @@ spec: - --port=443 - --path=health/liveness - --https + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml index 537d7f60..ee4ffc33 100644 --- a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml +++ b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -44,3 +44,5 @@ spec: - --namespace=kyverno - --port=8000 - --path=metrics + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml index b41901eb..93dae003 100644 --- a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml +++ b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -45,3 +45,5 @@ spec: - --port=443 - --path=health/readiness - --https + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml b/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml index 209fe984..9a454fe0 100644 --- a/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml +++ b/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -44,3 +44,5 @@ spec: - --namespace=kyverno - --port=8000 - --path=metrics + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml b/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml index 58e5ebc4..3c4d0749 100644 --- a/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml +++ b/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: minAvailable: 1 diff --git a/apps/kyverno/manifests/Role-kyverno:admission-controller.yml b/apps/kyverno/manifests/Role-kyverno:admission-controller.yml index a8aba8e5..a16de7e5 100644 --- a/apps/kyverno/manifests/Role-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/Role-kyverno:background-controller.yml b/apps/kyverno/manifests/Role-kyverno:background-controller.yml index 4353f55a..c047fb2d 100644 --- a/apps/kyverno/manifests/Role-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno namespace: kyverno rules: diff --git a/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml index 32f58c91..4f431e2a 100644 --- a/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno namespace: kyverno rules: @@ -30,6 +31,8 @@ rules: resourceNames: - kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair + - kyverno-cleanup-controller.kyverno.metering.kyverno-tls-ca + - kyverno-cleanup-controller.kyverno.metering.kyverno-tls-pair - apiGroups: - '' resources: diff --git a/apps/kyverno/manifests/Role-kyverno:reports-controller.yml b/apps/kyverno/manifests/Role-kyverno:reports-controller.yml index ae29f052..d9177940 100644 --- a/apps/kyverno/manifests/Role-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno namespace: kyverno rules: diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml index 3062ba39..b5f06d01 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml index c3483161..39867754 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno namespace: kyverno roleRef: diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml index c5209740..29edf2d3 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno namespace: kyverno roleRef: diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml index 0514df57..690d0f51 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno namespace: kyverno roleRef: diff --git a/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml b/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml index e8135c0f..a07257e7 100644 --- a/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml b/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml index 13210b53..5050ca9e 100644 --- a/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml b/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml index c6a6deb8..31080253 100644 --- a/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml +++ b/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml b/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml index 23ab5ff2..7faf0370 100644 --- a/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml b/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml index c66a0edb..ce45b50e 100644 --- a/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-svc.yml b/apps/kyverno/manifests/Service-kyverno-svc.yml index 6737d9fe..fb718232 100644 --- a/apps/kyverno/manifests/Service-kyverno-svc.yml +++ b/apps/kyverno/manifests/Service-kyverno-svc.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml index c94aa9eb..66584d70 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml index 0a5f97c7..f2b78c75 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml index c4c8e75d..bc7debff 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml index 9c674749..021da672 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml index 5a94cd38..a6c74779 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false diff --git a/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml b/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml index d6e0e08f..f9a67765 100644 --- a/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml +++ b/apps/velero/external-snapshotter/manifests/Deployment-snapshot-controller.yml @@ -24,7 +24,7 @@ spec: - args: - --v=0 - --leader-election=true - image: registry.k8s.io/sig-storage/snapshot-controller:v8.5.0 + image: registry.k8s.io/sig-storage/snapshot-controller:v8.6.0 imagePullPolicy: IfNotPresent name: snapshot-controller serviceAccountName: snapshot-controller