From f00e775159a948095dc6742c7f370f75f78b5997 Mon Sep 17 00:00:00 2001 From: devex-sa Date: Thu, 17 Sep 2026 09:36:23 +0000 Subject: [PATCH 1/2] Update Helm release kyverno to v3.9.1 --- apps/kyverno/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/kyverno/release.yaml b/apps/kyverno/release.yaml index a57795e3..205ca5fa 100644 --- a/apps/kyverno/release.yaml +++ b/apps/kyverno/release.yaml @@ -9,7 +9,7 @@ spec: chart: spec: chart: kyverno - version: 3.7.1 # when updated reflect the version in .github/workflows/pre-commit.yaml as well + version: 3.9.1 # when updated reflect the version in .github/workflows/pre-commit.yaml as well sourceRef: kind: HelmRepository name: kyverno From 641c248aafeed7cb4f39e303bb14d255fdb3fc90 Mon Sep 17 00:00:00 2001 From: devex-sa Date: Thu, 17 Sep 2026 09:37:17 +0000 Subject: [PATCH 2/2] Update CRDs and render helm templates --- apps/kyverno/crds.yaml | 2668 +++++++++++++++-- ...usterRole-kyverno:admission-controller.yml | 1 + ...Role-kyverno:admission-controller:core.yml | 1 + ...sterRole-kyverno:background-controller.yml | 1 + ...ole-kyverno:background-controller:core.yml | 1 + ...ClusterRole-kyverno:cleanup-controller.yml | 1 + ...erRole-kyverno:cleanup-controller:core.yml | 1 + .../ClusterRole-kyverno:migrate-resources.yml | 1 + ...lusterRole-kyverno:rbac:admin:policies.yml | 22 + ...ClusterRole-kyverno:rbac:view:policies.yml | 18 + ...ClusterRole-kyverno:reports-controller.yml | 1 + ...erRole-kyverno:reports-controller:core.yml | 1 + ...leBinding-kyverno:admission-controller.yml | 1 + ...ding-kyverno:admission-controller:view.yml | 1 + ...eBinding-kyverno:background-controller.yml | 1 + ...ing-kyverno:background-controller:view.yml | 1 + ...RoleBinding-kyverno:cleanup-controller.yml | 1 + ...rRoleBinding-kyverno:migrate-resources.yml | 1 + ...RoleBinding-kyverno:reports-controller.yml | 1 + ...inding-kyverno:reports-controller:view.yml | 1 + .../manifests/ConfigMap-kyverno-metrics.yml | 2 +- ...eployment-kyverno-admission-controller.yml | 24 +- ...ployment-kyverno-background-controller.yml | 22 +- .../Deployment-kyverno-cleanup-controller.yml | 21 +- .../Deployment-kyverno-reports-controller.yml | 19 +- .../Job-kyverno-migrate-resources.yml | 7 +- .../Job-kyverno-rm-validatingwhconfig.yml | 52 - ...config.yml => Job-kyverno-rm-webhooks.yml} | 17 +- .../manifests/Job-kyverno-scale-to-zero.yml | 16 +- ...d-kyverno-admission-controller-metrics.yml | 4 +- ...od-kyverno-cleanup-controller-liveness.yml | 4 +- ...Pod-kyverno-cleanup-controller-metrics.yml | 4 +- ...d-kyverno-cleanup-controller-readiness.yml | 4 +- ...Pod-kyverno-reports-controller-metrics.yml | 4 +- ...ionBudget-kyverno-admission-controller.yml | 1 + .../Role-kyverno:admission-controller.yml | 1 + .../Role-kyverno:background-controller.yml | 1 + .../Role-kyverno:cleanup-controller.yml | 3 + .../Role-kyverno:reports-controller.yml | 1 + ...leBinding-kyverno:admission-controller.yml | 1 + ...eBinding-kyverno:background-controller.yml | 1 + ...RoleBinding-kyverno:cleanup-controller.yml | 1 + ...RoleBinding-kyverno:reports-controller.yml | 1 + ...-kyverno-background-controller-metrics.yml | 1 + ...ice-kyverno-cleanup-controller-metrics.yml | 1 + .../Service-kyverno-cleanup-controller.yml | 1 + ...ice-kyverno-reports-controller-metrics.yml | 1 + .../manifests/Service-kyverno-svc-metrics.yml | 1 + .../kyverno/manifests/Service-kyverno-svc.yml | 1 + ...ceAccount-kyverno-admission-controller.yml | 1 + ...eAccount-kyverno-background-controller.yml | 1 + ...viceAccount-kyverno-cleanup-controller.yml | 1 + ...rviceAccount-kyverno-migrate-resources.yml | 1 + ...viceAccount-kyverno-reports-controller.yml | 1 + 54 files changed, 2580 insertions(+), 367 deletions(-) delete mode 100644 apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml rename apps/kyverno/manifests/{Job-kyverno-rm-mutatingwhconfig.yml => Job-kyverno-rm-webhooks.yml} (76%) diff --git a/apps/kyverno/crds.yaml b/apps/kyverno/crds.yaml index addc6ebc..d89a06b5 100644 --- a/apps/kyverno/crds.yaml +++ b/apps/kyverno/crds.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: cleanuppolicies.kyverno.io @@ -32,6 +32,8 @@ spec: - jsonPath: .metadata.creationTimestamp name: Age type: date + deprecated: true + deprecationWarning: kyverno.io/v2 CleanupPolicy is deprecated and will be removed in a future release; migrate to NamespacedDeletingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v2 schema: openAPIV3Schema: @@ -309,7 +311,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1258,6 +1261,7 @@ spec: name: Age type: date deprecated: true + deprecationWarning: kyverno.io/v2beta1 CleanupPolicy is deprecated and will be removed in a future release; migrate to NamespacedDeletingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v2beta1 schema: openAPIV3Schema: @@ -1535,7 +1539,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -2486,8 +2491,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clustercleanuppolicies.kyverno.io @@ -2511,6 +2516,8 @@ spec: - jsonPath: .metadata.creationTimestamp name: Age type: date + deprecated: true + deprecationWarning: kyverno.io/v2 ClusterCleanupPolicy is deprecated and will be removed in a future release; migrate to DeletingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v2 schema: openAPIV3Schema: @@ -2788,7 +2795,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -3737,6 +3745,7 @@ spec: name: Age type: date deprecated: true + deprecationWarning: kyverno.io/v2beta1 ClusterCleanupPolicy is deprecated and will be removed in a future release; migrate to DeletingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v2beta1 schema: openAPIV3Schema: @@ -4014,7 +4023,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -4965,8 +4975,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clusterpolicies.kyverno.io @@ -5019,6 +5029,8 @@ spec: - jsonPath: .status.conditions[?(@.type == "Ready")].message name: MESSAGE type: string + deprecated: true + deprecationWarning: kyverno.io/v1 ClusterPolicy is deprecated and will be removed in a future release; migrate to ValidatingPolicy, MutatingPolicy, GeneratingPolicy or ImageValidatingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v1 schema: openAPIV3Schema: @@ -5107,7 +5119,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -5123,7 +5135,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -5300,7 +5312,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6268,7 +6281,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6453,8 +6467,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -7281,7 +7295,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -7637,7 +7652,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -7784,8 +7800,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -7842,11 +7859,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -7869,7 +7886,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -7891,13 +7908,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -7935,7 +7952,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -8010,12 +8027,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -8286,7 +8303,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -9467,7 +9485,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -9658,7 +9677,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -9674,7 +9693,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -9725,7 +9744,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -9741,7 +9760,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -9918,7 +9937,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -10886,7 +10906,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -11071,8 +11092,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -11899,7 +11920,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12255,7 +12277,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12402,8 +12425,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -12460,11 +12484,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -12487,7 +12511,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -12509,13 +12533,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -12553,7 +12577,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -12628,12 +12652,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -12904,7 +12928,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -14085,7 +14110,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -14312,6 +14338,8 @@ spec: - jsonPath: .status.conditions[?(@.type == "Ready")].message name: MESSAGE type: string + deprecated: true + deprecationWarning: kyverno.io/v2beta1 ClusterPolicy is deprecated and will be removed in a future release; migrate to ValidatingPolicy, MutatingPolicy, GeneratingPolicy or ImageValidatingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v2beta1 schema: openAPIV3Schema: @@ -14400,7 +14428,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -14416,7 +14444,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -14593,7 +14621,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -15366,7 +15395,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -15551,8 +15581,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -16184,7 +16214,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16540,7 +16571,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16747,6 +16779,11 @@ spec: type: object type: array type: object + reportProperties: + additionalProperties: + type: string + description: ReportProperties are the additional properties from the rule that will be added to the policy report result + type: object skipBackgroundRequests: default: true description: |- @@ -16763,8 +16800,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -16821,11 +16859,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -16848,7 +16886,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -16870,13 +16908,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -16914,7 +16952,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -16989,12 +17027,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -17350,7 +17388,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -18513,7 +18552,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -18692,7 +18732,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -18708,7 +18748,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -18759,7 +18799,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -18775,7 +18815,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -18952,7 +18992,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -19920,7 +19961,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -20105,8 +20147,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -20933,7 +20975,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -21289,7 +21332,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -21436,8 +21480,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -21494,11 +21539,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -21521,7 +21566,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -21543,13 +21588,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -21587,7 +21632,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -21662,12 +21707,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -21938,7 +21983,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -23119,7 +23165,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -23320,8 +23367,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: globalcontextentries.kyverno.io @@ -23591,6 +23638,7 @@ spec: name: LAST REFRESH type: date deprecated: true + deprecationWarning: kyverno.io/v2alpha1 GlobalContextEntry is deprecated; use kyverno.io/v2 GlobalContextEntry name: v2alpha1 schema: openAPIV3Schema: @@ -24081,8 +24129,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: policies.kyverno.io @@ -24135,6 +24183,8 @@ spec: - jsonPath: .status.conditions[?(@.type == "Ready")].message name: MESSAGE type: string + deprecated: true + deprecationWarning: kyverno.io/v1 Policy is deprecated and will be removed in a future release; migrate to NamespacedValidatingPolicy and the other namespaced policy types (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v1 schema: openAPIV3Schema: @@ -24225,7 +24275,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -24241,7 +24291,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -24418,7 +24468,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -25386,7 +25437,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -25571,8 +25623,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -26399,7 +26451,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -26755,7 +26808,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -26902,8 +26956,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -26960,11 +27015,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -26987,7 +27042,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -27009,13 +27064,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -27053,7 +27108,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -27128,12 +27183,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -27404,7 +27459,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -28585,7 +28641,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -28776,7 +28833,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -28792,7 +28849,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -28843,7 +28900,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -28859,7 +28916,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -29036,7 +29093,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -30004,7 +30062,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -30189,8 +30248,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -31017,7 +31076,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -31373,7 +31433,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -31520,8 +31581,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -31578,11 +31640,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -31605,7 +31667,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -31627,13 +31689,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -31671,7 +31733,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -31746,12 +31808,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -32022,7 +32084,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -33203,7 +33266,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -33430,6 +33494,8 @@ spec: - jsonPath: .status.conditions[?(@.type == "Ready")].message name: MESSAGE type: string + deprecated: true + deprecationWarning: kyverno.io/v2beta1 Policy is deprecated and will be removed in a future release; migrate to NamespacedValidatingPolicy and the other namespaced policy types (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v2beta1 schema: openAPIV3Schema: @@ -33520,7 +33586,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -33536,7 +33602,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -33713,7 +33779,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -34486,7 +34553,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -34671,8 +34739,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -35304,7 +35372,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -35660,7 +35729,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -35867,6 +35937,11 @@ spec: type: object type: array type: object + reportProperties: + additionalProperties: + type: string + description: ReportProperties are the additional properties from the rule that will be added to the policy report result + type: object skipBackgroundRequests: default: true description: |- @@ -35883,8 +35958,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -35941,11 +36017,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -35968,7 +36044,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -35990,13 +36066,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -36034,7 +36110,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -36109,12 +36185,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -36470,7 +36546,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -37633,7 +37710,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -37812,7 +37890,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -37828,7 +37906,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -37879,7 +37957,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -37895,7 +37973,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -38072,7 +38150,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -39040,7 +39119,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -39225,8 +39305,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -40053,7 +40133,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -40409,7 +40490,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -40556,8 +40638,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common Expression Language (https://kubernetes.io/docs/reference/using-api/cel/). @@ -40614,11 +40697,11 @@ spec: description: Validation specifies the CEL expression which is used to apply the validation. properties: expression: - description: "Expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:\n\n- 'object' - The object from the incoming request. The value is null for DELETE requests.\n- 'oldObject' - The existing object. The value is null for CREATE requests.\n- 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind.\n- 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources.\n- 'variables' - Map of composited variables, from its name to its lazily evaluated value.\n For example, a variable named 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the\n request resource.\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the\nobject. No other metadata properties are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible property names are escaped according to the following rules when accessed in the expression:\n- '__' escapes to '__underscores__'\n- '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' escapes to '__slash__'\n- Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Expression accessing a property named \"namespace\": {\"Expression\": \"object.__namespace__ > 0\"}\n - Expression accessing a property named \"x-prop\": {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression accessing a property named \"redact__d\": {\"Expression\": \"object.redact__underscores__d > 0\"}\n\nEquality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.\nRequired." type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -40641,7 +40724,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -40663,13 +40746,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -40707,7 +40790,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -40782,12 +40865,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -41058,7 +41141,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -42239,7 +42323,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -42440,8 +42525,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: policyexceptions.kyverno.io @@ -42458,7 +42543,9 @@ spec: singular: policyexception scope: Namespaced versions: - - name: v2 + - deprecated: true + deprecationWarning: kyverno.io/v2 PolicyException is deprecated and will be removed in a future release; migrate to PolicyException (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ + name: v2 schema: openAPIV3Schema: description: PolicyException declares resources to be excluded from specified policies. @@ -43067,6 +43154,7 @@ spec: served: true storage: true - deprecated: true + deprecationWarning: kyverno.io/v2beta1 PolicyException is deprecated and will be removed in a future release; migrate to PolicyException (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/ name: v2beta1 schema: openAPIV3Schema: @@ -43685,8 +43773,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: updaterequests.kyverno.io @@ -43729,6 +43817,7 @@ spec: name: Age type: date deprecated: true + deprecationWarning: kyverno.io/v1beta1 UpdateRequest is deprecated; use kyverno.io/v2 UpdateRequest name: v1beta1 schema: openAPIV3Schema: @@ -43899,30 +43988,24 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object - required: - - kind - - operation - - resource - - uid - - userInfo type: object operation: description: Operation is the type of resource operation being checked for admission control @@ -43952,22 +44035,22 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object type: object @@ -44257,30 +44340,24 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object - required: - - kind - - operation - - resource - - uid - - userInfo type: object operation: description: Operation is the type of resource operation being checked for admission control @@ -44315,22 +44392,22 @@ spec: items: type: string type: array - description: Any additional information provided by the authenticator. + description: extra is any additional information provided by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user among all active users. + description: username is the name that uniquely identifies this user among all active users. type: string type: object type: object @@ -44483,8 +44560,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clusterephemeralreports.reports.kyverno.io @@ -44812,8 +44889,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: ephemeralreports.reports.kyverno.io @@ -45142,8 +45219,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: clusterpolicyreports.wgpolicyk8s.io @@ -45493,8 +45570,8 @@ metadata: app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: kyverno-crds - app.kubernetes.io/version: 3.7.1 - helm.sh/chart: crds-3.7.1 + app.kubernetes.io/version: 3.9.1 + helm.sh/chart: crds-3.9.1 annotations: controller-gen.kubebuilder.io/version: v0.20.0 name: policyreports.wgpolicyk8s.io @@ -47504,6 +47581,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -47539,6 +47667,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -47562,7 +47696,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -47940,6 +48102,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -48095,6 +48263,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -48130,6 +48349,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -48153,7 +48378,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -48531,6 +48784,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -48685,6 +48944,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -48720,6 +49030,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -48743,7 +49059,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -49121,6 +49465,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -49439,6 +49789,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -49447,6 +49802,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -49457,6 +49815,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -49505,6 +49868,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -49682,7 +50067,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -50387,6 +50772,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -50395,6 +50785,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -50405,6 +50798,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -50453,6 +50851,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -50630,7 +51050,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -51456,6 +51876,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -51464,6 +51889,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -51474,6 +51902,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -51522,6 +51955,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -51699,7 +52154,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -52404,6 +52859,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -52412,6 +52872,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -52422,6 +52885,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -52470,6 +52938,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -52647,7 +53137,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -53472,6 +53962,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -53480,6 +53975,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -53490,6 +53988,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -53538,6 +54041,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -53715,7 +54240,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -54420,6 +54945,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -54428,6 +54958,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -54438,6 +54971,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -54486,6 +55024,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -54663,7 +55223,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -55369,6 +55929,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -55430,6 +56041,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -55500,8 +56125,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -55876,8 +56502,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -55958,6 +56628,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -56202,8 +56875,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -56253,6 +56929,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -56314,6 +57041,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -56384,8 +57125,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -56760,8 +57502,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -56842,6 +57628,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -57086,8 +57875,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -57263,6 +58055,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -57324,6 +58167,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -57394,8 +58251,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -57770,8 +58628,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -57852,6 +58754,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -58096,8 +59001,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -58147,6 +59055,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -58208,6 +59167,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -58278,8 +59251,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -58654,8 +59628,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -58736,6 +59754,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -58980,8 +60001,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -59156,6 +60180,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -59217,6 +60292,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -59287,8 +60376,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -59663,8 +60753,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -59745,6 +60879,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -59989,8 +61126,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -60040,6 +61180,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -60101,6 +61292,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -60171,8 +61376,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -60547,8 +61753,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -60629,6 +61879,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -60873,8 +62126,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -62155,6 +63411,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -62190,6 +63497,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -62213,7 +63526,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -62591,6 +63932,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -62746,6 +64093,57 @@ spec: spec: description: GeneratingPolicySpec is the specification of the desired behavior of the GeneratingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array evaluation: description: EvaluationConfiguration defines the configuration for the policy evaluation. properties: @@ -62781,6 +64179,12 @@ spec: Optional. Defaults to "false" if not specified. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean synchronize: description: Synchronization defines the configuration for the synchronization of generated resources. properties: @@ -62804,7 +64208,35 @@ spec: expression: description: Expression is a CEL expression that takes a list of resources to be generated. type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) && has(self.template)) minItems: 1 type: array matchConditions: @@ -63182,6 +64614,12 @@ spec: x-kubernetes-list-type: atomic type: object x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean variables: description: |- Variables contain definitions of variables that can be used in composition of other expressions. @@ -63500,6 +64938,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -63508,6 +64951,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -63518,6 +64964,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -63566,6 +65017,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -63743,7 +65216,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -64448,6 +65921,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -64456,6 +65934,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -64466,6 +65947,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -64514,6 +66000,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -64691,7 +66199,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -65516,6 +67024,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -65524,6 +67037,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -65534,6 +67050,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -65582,6 +67103,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -65759,7 +67302,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -66464,6 +68007,11 @@ spec: keyless: description: Keyless sets the configuration to verify the authority against a Fulcio instance. properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions used for keyless signing. + type: object identities: description: Identities sets a list of identities. items: @@ -66472,6 +68020,9 @@ spec: log. Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. properties: issuer: description: Issuer defines the issuer for this identity. @@ -66482,6 +68033,11 @@ spec: subject: description: Subject defines the subject for this identity. type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string subjectRegExp: description: SubjectRegExp specifies a regular expression to match the subject for this identity. type: string @@ -66530,6 +68086,28 @@ spec: fully supported that should likely be the preferred way to handle these. type: string type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object tuf: description: TUF defines the configuration to fetch sigstore root properties: @@ -66707,7 +68285,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -67413,6 +68991,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -67474,6 +69103,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -67544,8 +69187,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -67920,8 +69564,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -68002,6 +69690,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -68246,8 +69937,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -68297,6 +69991,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -68358,6 +70103,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -68428,8 +70187,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -68804,8 +70564,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -68886,6 +70690,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -69130,8 +70937,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -69306,6 +71116,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -69367,6 +71228,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -69437,8 +71312,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -69813,8 +71689,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -69895,6 +71815,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -70139,8 +72062,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -70190,6 +72116,57 @@ spec: spec: description: MutatingPolicySpec is the specification of the desired behavior of the MutatingPolicy. properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array autogen: description: AutogenConfiguration defines the configuration for the generation controller. properties: @@ -70251,6 +72228,20 @@ spec: When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. type: boolean type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean type: object failurePolicy: description: |- @@ -70321,8 +72312,9 @@ spec: x-kubernetes-list-type: map matchConstraints: description: |- - MatchConstraints specifies what resources this policy is designed to evaluate. + MatchConstraints specifies the trigger resources this policy is designed to evaluate. The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. Required. properties: excludeResourceRules: @@ -70697,8 +72689,52 @@ spec: reinvoked when mutations change the object after this mutation is invoked. Required. type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map targetMatchConstraints: - description: TargetMatchConstraints specifies what target mutation resources this policy is designed to evaluate. + description: TargetMatchConstraints resolves the resources to mutate after Variables are evaluated. properties: excludeResourceRules: description: |- @@ -70779,6 +72815,9 @@ spec: type: array x-kubernetes-list-type: atomic expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. type: string matchPolicy: description: |- @@ -71023,8 +73062,11 @@ spec: description: |- Variables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic. @@ -71319,7 +73361,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -71954,7 +73996,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -72714,7 +74756,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -73349,7 +75391,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -74028,6 +76070,16 @@ spec: items: type: string type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string images: description: |- Images specifies container images to be excluded from policy evaluation. @@ -74088,6 +76140,16 @@ spec: - name type: object type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object reportResult: default: skip description: |- @@ -74138,6 +76200,16 @@ spec: items: type: string type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string images: description: |- Images specifies container images to be excluded from policy evaluation. @@ -74198,6 +76270,16 @@ spec: - name type: object type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object reportResult: default: skip description: |- @@ -74247,6 +76329,16 @@ spec: items: type: string type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string images: description: |- Images specifies container images to be excluded from policy evaluation. @@ -74307,6 +76399,16 @@ spec: - name type: object type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object reportResult: default: skip description: |- @@ -74475,7 +76577,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -75110,7 +77212,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -75871,7 +77973,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -76506,7 +78608,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -77266,7 +79368,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object @@ -77901,7 +80003,7 @@ spec: mode: description: |- Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". + Allowed values are "Kubernetes", "HTTP" or "Envoy". Optional. Default value is "Kubernetes". type: string type: object diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml index cbbb184b..0274df7f 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml index 9fb7d1ba..02f0aac8 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:admission-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml index 17aa8c4c..8502a8dd 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml index 2b02a07e..a48b1813 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:background-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml index 29d7db3d..c31d413f 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml index b222288a..12d25894 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:cleanup-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml b/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml index f0b8a20c..a17e5cae 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:migrate-resources.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml index ab2dfbfa..a5dc0cd9 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:admin:policies.yml @@ -26,3 +26,25 @@ rules: - patch - update - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies + - generatingpolicies + - imagevalidatingpolicies + - mutatingpolicies + - namespaceddeletingpolicies + - namespacedgeneratingpolicies + - namespacedimagevalidatingpolicies + - namespacedmutatingpolicies + - namespacedvalidatingpolicies + - policyexceptions + - validatingpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - watch diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml index f8625f85..0f9cc976 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:rbac:view:policies.yml @@ -22,3 +22,21 @@ rules: - get - list - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies + - generatingpolicies + - imagevalidatingpolicies + - mutatingpolicies + - namespaceddeletingpolicies + - namespacedgeneratingpolicies + - namespacedimagevalidatingpolicies + - namespacedmutatingpolicies + - namespacedvalidatingpolicies + - policyexceptions + - validatingpolicies + verbs: + - get + - list + - watch diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml index c9386ef7..b528d185 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno aggregationRule: clusterRoleSelectors: diff --git a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml index 513ec32d..e42edbc7 100644 --- a/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml +++ b/apps/kyverno/manifests/ClusterRole-kyverno:reports-controller:core.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml index 6076aa21..4d46e070 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml index 5ff87eaa..6d9cda36 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:admission-controller:view.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml index 0693977e..43a2260f 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml index 0bab21e6..f4598c84 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:background-controller:view.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml index 506e0a21..7dccef01 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml index 92328e7d..6495e8c8 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:migrate-resources.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml index 03953b0d..61670cd7 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml index e904741b..c3625727 100644 --- a/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml +++ b/apps/kyverno/manifests/ClusterRoleBinding-kyverno:reports-controller:view.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml b/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml index 01935112..b3a9e726 100644 --- a/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml +++ b/apps/kyverno/manifests/ConfigMap-kyverno-metrics.yml @@ -12,5 +12,5 @@ metadata: app.kubernetes.io/part-of: kyverno data: namespaces: "{\"exclude\":[],\"include\":[]}" - metricsExposure: "{\"kyverno_admission_requests_total\":{\"disabledLabelDimensions\":[]},\"kyverno_admission_review_duration_seconds\":{\"disabledLabelDimensions\":[]},\"kyverno_cleanup_controller_deletedobjects_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_generating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_image_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_mutating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_policy_results_total\":{\"disabledLabelDimensions\":[]},\"kyverno_policy_rule_info_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]}}" + metricsExposure: "{\"kyverno_admission_requests_total\":{\"disabledLabelDimensions\":[]},\"kyverno_admission_review_duration_seconds\":{\"disabledLabelDimensions\":[]},\"kyverno_cleanup_controller_deletedobjects_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_generating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_generating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_image_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_image_validating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_mutating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_mutating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_policy_results_total\":{\"disabledLabelDimensions\":[]},\"kyverno_policy_rule_info_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]},\"kyverno_validating_policy_execution_duration_seconds\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"resource_request_operation\"]},\"kyverno_validating_policy_results_total\":{\"disabledLabelDimensions\":[\"resource_namespace\",\"policy_namespace\"]}}" bucketBoundaries: "0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 15, 20, 25, 30" diff --git a/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml index b5fd7eda..6f8a7707 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: replicas: 3 @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true initContainers: - name: kyverno-pre - image: "reg.kyverno.io/kyverno/kyvernopre:v1.17.1" + image: "reg.kyverno.io/kyverno/kyvernopre:v1.19.1" imagePullPolicy: IfNotPresent args: - --loggingFormat=text @@ -71,7 +73,9 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault env: @@ -97,7 +101,7 @@ spec: value: kyverno-svc containers: - name: kyverno - image: "reg.kyverno.io/kyverno/kyverno:v1.17.1" + image: "reg.kyverno.io/kyverno/kyverno:v1.19.1" imagePullPolicy: IfNotPresent args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca @@ -115,6 +119,7 @@ spec: - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true + - --excludeBootstrapResources=false - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true @@ -124,6 +129,8 @@ spec: - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped @@ -145,7 +152,9 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault ports: @@ -209,6 +218,17 @@ spec: volumeMounts: - mountPath: /.sigstore name: sigstore + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true volumes: - name: sigstore emptyDir: {} + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml index c27fd5fb..4a38f278 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-background-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno spec: replicas: @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true containers: - name: controller - image: "reg.kyverno.io/kyverno/background-controller:v1.17.1" + image: "reg.kyverno.io/kyverno/background-controller:v1.19.1" imagePullPolicy: IfNotPresent ports: - containerPort: 9443 @@ -66,8 +68,11 @@ spec: - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true + - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped @@ -103,6 +108,21 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault + volumeMounts: + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + volumes: + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml index 2263b1da..119cb82a 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-cleanup-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: replicas: @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true containers: - name: controller - image: "reg.kyverno.io/kyverno/cleanup-controller:v1.17.1" + image: "reg.kyverno.io/kyverno/cleanup-controller:v1.19.1" imagePullPolicy: IfNotPresent ports: - containerPort: 9443 @@ -73,6 +75,8 @@ spec: - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --protectManagedResources=false @@ -111,7 +115,9 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: @@ -142,3 +148,16 @@ spec: periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 + volumeMounts: + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + volumes: + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml b/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml index b9316a4e..8cbbd134 100644 --- a/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml +++ b/apps/kyverno/manifests/Deployment-kyverno-reports-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno spec: replicas: @@ -29,6 +30,7 @@ spec: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno spec: nodeSelector: @@ -51,7 +53,7 @@ spec: automountServiceAccountToken: true containers: - name: controller - image: "reg.kyverno.io/kyverno/reports-controller:v1.17.1" + image: "reg.kyverno.io/kyverno/reports-controller:v1.19.1" imagePullPolicy: IfNotPresent ports: - containerPort: 9443 @@ -78,6 +80,8 @@ spec: - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 + - --apiCallTimeout=30s + - --maxGlobalContextEntries=0 - --loggingFormat=text - --v=2 - --omitEvents=PolicyViolation,PolicyApplied,PolicySkipped @@ -117,12 +121,25 @@ spec: - ALL privileged: false readOnlyRootFilesystem: true + runAsGroup: 65534 runAsNonRoot: true + runAsUser: 65534 seccompProfile: type: RuntimeDefault volumeMounts: - mountPath: /.sigstore name: sigstore + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true volumes: - name: sigstore emptyDir: {} + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: 3600 + audience: kyverno-svc.kyverno.io diff --git a/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml b/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml index 7480d98a..1c06808f 100644 --- a/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml +++ b/apps/kyverno/manifests/Job-kyverno-migrate-resources.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade @@ -22,8 +23,8 @@ spec: automountServiceAccountToken: true restartPolicy: Never containers: - - name: kubectl - image: "reg.kyverno.io/kyverno/kyverno-cli:v1.17.1" + - name: kyverno-cli + image: "reg.kyverno.io/kyverno/kyverno-cli:v1.19.1" imagePullPolicy: IfNotPresent args: - migrate @@ -82,3 +83,5 @@ spec: runAsUser: 65534 seccompProfile: type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml b/apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml deleted file mode 100644 index 654bcf3b..00000000 --- a/apps/kyverno/manifests/Job-kyverno-rm-validatingwhconfig.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -# Source: kyverno/templates/hooks/pre-delete-remove-validatingwebhookconfiguration.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: kyverno-rm-validatingwhconfig - namespace: kyverno - labels: - app.kubernetes.io/component: hooks - app.kubernetes.io/instance: kyverno - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: kyverno - annotations: - helm.sh/hook: pre-delete - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed - helm.sh/hook-weight: "100" -spec: - backoffLimit: 2 - template: - spec: - serviceAccountName: kyverno-admission-controller - automountServiceAccountToken: true - restartPolicy: Never - containers: - - name: kubectl - image: "registry.k8s.io/kubectl:v1.34.3" - imagePullPolicy: - command: - - kubectl - - delete - - validatingwebhookconfiguration - - -l - - webhook.kyverno.io/managed-by=kyverno - resources: - limits: - cpu: 100m - memory: 256Mi - requests: - cpu: 10m - memory: 64Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - privileged: false - readOnlyRootFilesystem: true - runAsGroup: 65534 - runAsNonRoot: true - runAsUser: 65534 - seccompProfile: - type: RuntimeDefault diff --git a/apps/kyverno/manifests/Job-kyverno-rm-mutatingwhconfig.yml b/apps/kyverno/manifests/Job-kyverno-rm-webhooks.yml similarity index 76% rename from apps/kyverno/manifests/Job-kyverno-rm-mutatingwhconfig.yml rename to apps/kyverno/manifests/Job-kyverno-rm-webhooks.yml index 34893f69..9d90c19e 100644 --- a/apps/kyverno/manifests/Job-kyverno-rm-mutatingwhconfig.yml +++ b/apps/kyverno/manifests/Job-kyverno-rm-webhooks.yml @@ -1,14 +1,15 @@ --- -# Source: kyverno/templates/hooks/pre-delete-remove-mutatingwebhookconfiguration.yaml +# Source: kyverno/templates/hooks/pre-delete-remove-webhooks.yaml apiVersion: batch/v1 kind: Job metadata: - name: kyverno-rm-mutatingwhconfig + name: kyverno-rm-webhooks namespace: kyverno labels: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: pre-delete @@ -23,14 +24,10 @@ spec: restartPolicy: Never containers: - name: kubectl - image: "registry.k8s.io/kubectl:v1.34.3" + image: "ghcr.io/kyverno/readiness-checker:v1.19.1" imagePullPolicy: - command: - - kubectl - - delete - - mutatingwebhookconfiguration - - -l - - webhook.kyverno.io/managed-by=kyverno + args: + - delete-webhooks resources: limits: cpu: 100m @@ -50,3 +47,5 @@ spec: runAsUser: 65534 seccompProfile: type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml b/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml index e663c87d..fb3c710c 100644 --- a/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml +++ b/apps/kyverno/manifests/Job-kyverno-scale-to-zero.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: pre-delete @@ -23,17 +24,10 @@ spec: restartPolicy: Never containers: - name: kubectl - image: "registry.k8s.io/kubectl:v1.34.3" + image: "ghcr.io/kyverno/readiness-checker:v1.19.1" imagePullPolicy: - command: - - kubectl - - scale - - -n - - kyverno - - deployment - - -l - - app.kubernetes.io/part-of=kyverno - - --replicas=0 + args: + - scale-deploy resources: limits: cpu: 100m @@ -53,3 +47,5 @@ spec: runAsUser: 65534 seccompProfile: type: RuntimeDefault + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml b/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml index 9e6c1f79..8e97c6fe 100644 --- a/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml +++ b/apps/kyverno/manifests/Pod-kyverno-admission-controller-metrics.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -44,3 +44,5 @@ spec: - --namespace=kyverno - --port=8000 - --path=metrics + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml index 5f03b478..911a262a 100644 --- a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml +++ b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-liveness.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -45,3 +45,5 @@ spec: - --port=443 - --path=health/liveness - --https + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml index 537d7f60..ee4ffc33 100644 --- a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml +++ b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-metrics.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -44,3 +44,5 @@ spec: - --namespace=kyverno - --port=8000 - --path=metrics + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml index b41901eb..93dae003 100644 --- a/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml +++ b/apps/kyverno/manifests/Pod-kyverno-cleanup-controller-readiness.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -45,3 +45,5 @@ spec: - --port=443 - --path=health/readiness - --https + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml b/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml index 209fe984..9a454fe0 100644 --- a/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml +++ b/apps/kyverno/manifests/Pod-kyverno-reports-controller-metrics.yml @@ -17,7 +17,7 @@ spec: restartPolicy: Never containers: - name: test - image: ghcr.io/kyverno/readiness-checker:v0.1.0 + image: ghcr.io/kyverno/readiness-checker:latest imagePullPolicy: IfNotPresent resources: limits: @@ -44,3 +44,5 @@ spec: - --namespace=kyverno - --port=8000 - --path=metrics + nodeSelector: + kubernetes.io/os: linux diff --git a/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml b/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml index 58e5ebc4..3c4d0749 100644 --- a/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml +++ b/apps/kyverno/manifests/PodDisruptionBudget-kyverno-admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: minAvailable: 1 diff --git a/apps/kyverno/manifests/Role-kyverno:admission-controller.yml b/apps/kyverno/manifests/Role-kyverno:admission-controller.yml index a8aba8e5..a16de7e5 100644 --- a/apps/kyverno/manifests/Role-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno rules: - apiGroups: diff --git a/apps/kyverno/manifests/Role-kyverno:background-controller.yml b/apps/kyverno/manifests/Role-kyverno:background-controller.yml index 4353f55a..c047fb2d 100644 --- a/apps/kyverno/manifests/Role-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno namespace: kyverno rules: diff --git a/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml index 32f58c91..4f431e2a 100644 --- a/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno namespace: kyverno rules: @@ -30,6 +31,8 @@ rules: resourceNames: - kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair + - kyverno-cleanup-controller.kyverno.metering.kyverno-tls-ca + - kyverno-cleanup-controller.kyverno.metering.kyverno-tls-pair - apiGroups: - '' resources: diff --git a/apps/kyverno/manifests/Role-kyverno:reports-controller.yml b/apps/kyverno/manifests/Role-kyverno:reports-controller.yml index ae29f052..d9177940 100644 --- a/apps/kyverno/manifests/Role-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/Role-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno namespace: kyverno rules: diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml index 3062ba39..b5f06d01 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:admission-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml index c3483161..39867754 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:background-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno namespace: kyverno roleRef: diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml index c5209740..29edf2d3 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:cleanup-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno namespace: kyverno roleRef: diff --git a/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml b/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml index 0514df57..690d0f51 100644 --- a/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml +++ b/apps/kyverno/manifests/RoleBinding-kyverno:reports-controller.yml @@ -8,6 +8,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno namespace: kyverno roleRef: diff --git a/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml b/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml index e8135c0f..a07257e7 100644 --- a/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-background-controller-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml b/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml index 13210b53..5050ca9e 100644 --- a/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-cleanup-controller-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml b/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml index c6a6deb8..31080253 100644 --- a/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml +++ b/apps/kyverno/manifests/Service-kyverno-cleanup-controller.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml b/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml index 23ab5ff2..7faf0370 100644 --- a/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-reports-controller-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml b/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml index c66a0edb..ce45b50e 100644 --- a/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml +++ b/apps/kyverno/manifests/Service-kyverno-svc-metrics.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/Service-kyverno-svc.yml b/apps/kyverno/manifests/Service-kyverno-svc.yml index 6737d9fe..fb718232 100644 --- a/apps/kyverno/manifests/Service-kyverno-svc.yml +++ b/apps/kyverno/manifests/Service-kyverno-svc.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno spec: ports: diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml index c94aa9eb..66584d70 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-admission-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml index 0a5f97c7..f2b78c75 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-background-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml index c4c8e75d..bc7debff 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-cleanup-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml index 9c674749..021da672 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-migrate-resources.yml @@ -9,6 +9,7 @@ metadata: app.kubernetes.io/component: hooks app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-hooks app.kubernetes.io/part-of: kyverno annotations: helm.sh/hook: post-upgrade diff --git a/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml b/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml index 5a94cd38..a6c74779 100644 --- a/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml +++ b/apps/kyverno/manifests/ServiceAccount-kyverno-reports-controller.yml @@ -9,5 +9,6 @@ metadata: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno automountServiceAccountToken: false