diff --git a/manifests/helm/kyverno/3.4.1/CUSTOM-README.md b/manifests/helm/kyverno/3.4.1/CUSTOM-README.md deleted file mode 100644 index 4780854..0000000 --- a/manifests/helm/kyverno/3.4.1/CUSTOM-README.md +++ /dev/null @@ -1,10 +0,0 @@ - -# Kyverno 배포 - -## 1. 배포 방법 - -``` sh -git clone https://github.com/paasup/dip-catalog.git -cd charts/kyverno -helm upgrade kyverno --install ./ -n kyverno --create-namespace -``` diff --git a/manifests/helm/kyverno/3.4.1/Chart.lock b/manifests/helm/kyverno/3.4.1/Chart.lock deleted file mode 100644 index 5cde9d0..0000000 --- a/manifests/helm/kyverno/3.4.1/Chart.lock +++ /dev/null @@ -1,9 +0,0 @@ -dependencies: -- name: grafana - repository: "" - version: 3.4.1 -- name: crds - repository: "" - version: 3.4.1 -digest: sha256:3d2f7b50b356e76cded3843a17ea5b83ca08b40b7cbda5f6ec621473f986459a -generated: "2025-04-30T14:55:51.216823113Z" diff --git a/manifests/helm/kyverno/3.4.1/Chart.yaml b/manifests/helm/kyverno/3.4.1/Chart.yaml deleted file mode 100644 index 1fb2a96..0000000 --- a/manifests/helm/kyverno/3.4.1/Chart.yaml +++ /dev/null @@ -1,45 +0,0 @@ -annotations: - artifacthub.io/changes: | - - kind: added - description: Add toggle for enabeling/disabling aggregating the user-facing roles with the kyverno rbac. - artifacthub.io/links: | - - name: Documentation - url: https://kyverno.io/docs - artifacthub.io/operator: "false" - artifacthub.io/prerelease: "false" -apiVersion: v2 -appVersion: v1.14.1 -dependencies: -- condition: grafana.enabled - name: grafana - repository: "" - version: 3.4.1 -- condition: crds.install - name: crds - repository: "" - version: 3.4.1 -description: Kubernetes Native Policy Management -home: https://kyverno.io/ -icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png -keywords: -- kubernetes -- nirmata -- policy agent -- policy -- validating webhook -- admission controller -- mutation -- mutate -- validate -- generate -- supply chain -- security -kubeVersion: '>=1.25.0-0' -maintainers: -- name: Nirmata - url: https://kyverno.io/ -name: kyverno -sources: -- https://github.com/kyverno/kyverno -type: application -version: 3.4.1 diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_globalcontextentries.yaml b/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_globalcontextentries.yaml deleted file mode 100644 index eaa328e..0000000 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_globalcontextentries.yaml +++ /dev/null @@ -1,280 +0,0 @@ -{{- if .Values.groups.kyverno.globalcontextentries }} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - labels: - {{- include "kyverno.crds.labels" . | nindent 4 }} - annotations: - {{- with .Values.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 - name: globalcontextentries.kyverno.io -spec: - group: kyverno.io - names: - categories: - - kyverno - kind: GlobalContextEntry - listKind: GlobalContextEntryList - plural: globalcontextentries - shortNames: - - gctxentry - singular: globalcontextentry - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: AGE - type: date - - jsonPath: .spec.apiCall.refreshInterval - name: REFRESH INTERVAL - type: string - - jsonPath: .status.lastRefreshTime - name: LAST REFRESH - type: date - name: v2alpha1 - schema: - openAPIV3Schema: - description: GlobalContextEntry declares resources to be cached. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec declares policy exception behaviors. - oneOf: - - required: - - kubernetesResource - - required: - - apiCall - properties: - apiCall: - description: |- - Stores results from an API call which will be cached. - Mutually exclusive with KubernetesResource. - This can be used to make calls to external (non-Kubernetes API server) services. - It can also be used to make calls to the Kubernetes API server in such cases: - 1. A POST is needed to create a resource. - 2. Finer-grained control is needed. Example: To restrict the number of resources cached. - properties: - data: - description: |- - The data object specifies the POST data sent to the server. - Only applicable when the method field is set to POST. - items: - description: RequestData contains the HTTP POST data - properties: - key: - description: Key is a unique identifier for the data value - type: string - value: - description: Value is the data value - x-kubernetes-preserve-unknown-fields: true - required: - - key - - value - type: object - type: array - method: - default: GET - description: Method is the HTTP request type (GET or POST). Defaults - to GET. - enum: - - GET - - POST - type: string - refreshInterval: - default: 10m - description: |- - RefreshInterval defines the interval in duration at which to poll the APICall. - The duration is a sequence of decimal numbers, each with optional fraction and a unit suffix, - such as "300ms", "1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - format: duration - type: string - retryLimit: - default: 3 - description: RetryLimit defines the number of times the APICall - should be retried in case of failure. - minimum: 1 - type: integer - service: - description: |- - Service is an API call to a JSON web service. - This is used for non-Kubernetes API server calls. - It's mutually exclusive with the URLPath field. - properties: - caBundle: - description: |- - CABundle is a PEM encoded CA bundle which will be used to validate - the server certificate. - type: string - headers: - description: Headers is a list of optional HTTP headers to - be included in the request. - items: - properties: - key: - description: Key is the header key - type: string - value: - description: Value is the header value - type: string - required: - - key - - value - type: object - type: array - url: - description: |- - URL is the JSON web service URL. A typical form is - `https://{service}.{namespace}:{port}/{path}`. - type: string - required: - - url - type: object - urlPath: - description: |- - URLPath is the URL path to be used in the HTTP GET or POST request to the - Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments"). - The format required is the same format used by the `kubectl get --raw` command. - See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls - for details. - It's mutually exclusive with the Service field. - type: string - type: object - kubernetesResource: - description: |- - Stores a list of Kubernetes resources which will be cached. - Mutually exclusive with APICall. - properties: - group: - description: Group defines the group of the resource. - type: string - namespace: - description: |- - Namespace defines the namespace of the resource. Leave empty for cluster scoped resources. - If left empty for namespaced resources, all resources from all namespaces will be cached. - type: string - resource: - description: |- - Resource defines the type of the resource. - Requires the pluralized form of the resource kind in lowercase. (Ex., "deployments") - type: string - version: - description: Version defines the version of the resource. - type: string - required: - - resource - - version - type: object - projections: - description: Projections defines the list of JMESPath expressions - to extract values from the cached resource. - items: - properties: - jmesPath: - description: JMESPath is the JMESPath expression to extract - the value from the cached resource. - type: string - name: - description: Name is the name to use for the extracted value - in the context. - type: string - required: - - jmesPath - - name - type: object - type: array - type: object - status: - description: Status contains globalcontextentry runtime data. - properties: - conditions: - items: - description: Condition contains details for one aspect of the current - state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - lastRefreshTime: - description: Indicates the time when the globalcontextentry was last - refreshed successfully for the API Call - format: date-time - type: string - ready: - description: Deprecated in favor of Conditions - type: boolean - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_imagevalidatingpolicies.yaml b/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_imagevalidatingpolicies.yaml deleted file mode 100644 index 42e8fd9..0000000 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_imagevalidatingpolicies.yaml +++ /dev/null @@ -1,2241 +0,0 @@ -{{- if .Values.groups.policies.imagevalidatingpolicies }} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - labels: - {{- include "kyverno.crds.labels" . | nindent 4 }} - annotations: - {{- with .Values.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 - name: imagevalidatingpolicies.policies.kyverno.io -spec: - group: policies.kyverno.io - names: - categories: - - kyverno - kind: ImageValidatingPolicy - listKind: ImageValidatingPolicyList - plural: imagevalidatingpolicies - shortNames: - - ivpol - singular: imagevalidatingpolicy - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: AGE - type: date - - jsonPath: .status.conditionStatus.ready - name: READY - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: ImageValidatingPolicySpec is the specification of the desired - behavior of the ImageValidatingPolicy. - properties: - attestations: - description: Attestations provides a list of image metadata to verify - items: - description: Attestation defines the identification details of the metadata - that has to be verified - properties: - intoto: - description: InToto defines the details of attestation attached - using intoto format - properties: - type: - description: Type defines the type of attestation contained - within the statement. - type: string - required: - - type - type: object - name: - description: Name is the name for this attestation. It is used - to refer to the attestation in verification - type: string - referrer: - description: Referrer defines the details of attestation attached - using OCI 1.1 format - properties: - type: - description: Type defines the type of attestation attached - to the image. - type: string - required: - - type - type: object - required: - - name - type: object - type: array - attestors: - description: Attestors provides a list of trusted authorities. - items: - description: Attestor is an identity that confirms or verifies the - authenticity of an image or an attestation - properties: - cosign: - description: Cosign defines attestor configuration for Cosign - based signatures - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations are used for image verification. - Every specified key-value pair must exist and match in the verified payload. - The payload may contain other key-value pairs. - type: object - certificate: - description: Certificate defines the configuration for local - signature verification - properties: - cert: - description: Certificate is the to the public certificate - for local signature verification. - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the a CEL expression - input. - type: string - value: - description: Value defines the raw string input. - type: string - type: object - certChain: - description: |- - CertificateChain is the list of CA certificates in PEM format which will be needed - when building the certificate chain for the signing certificate. Must start with the - parent intermediate CA certificate of the signing certificate and end with the root certificate - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the a CEL expression - input. - type: string - value: - description: Value defines the raw string input. - type: string - type: object - type: object - ctlog: - description: CTLog sets the configuration to verify the - authority against a Rekor instance. - properties: - ctLogPubKey: - description: CTLogPubKey, if set, is used to validate - SCTs against a custom source. - type: string - insecureIgnoreSCT: - description: |- - IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate - timestamp. Default is false. Set to true if this was opted out during signing. - type: boolean - insecureIgnoreTlog: - description: InsecureIgnoreTlog skips transparency log - verification. - type: boolean - rekorPubKey: - description: |- - RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. - If set, this will be used to validate transparency log signatures from a custom Rekor. - type: string - tsaCertChain: - description: |- - TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must - contain the root CA certificate. Optionally may contain intermediate CA certificates, and - may contain the leaf TSA certificate if not present in the timestamurce. - type: string - url: - description: URL sets the url to the rekor instance - (by default the public rekor.sigstore.dev) - type: string - type: object - key: - description: Key defines the type of key to validate the - image. - properties: - data: - description: Data contains the inline public key - type: string - expression: - description: Expression is a Expression expression that - returns the public key. - type: string - hashAlgorithm: - description: |- - HashAlgorithm specifues signature algorithm for public keys. Supported values are - sha224, sha256, sha384 and sha512. Defaults to sha256. - type: string - kms: - description: |- - KMS contains the KMS url of the public key - Supported formats differ based on the KMS system used. - type: string - type: object - keyless: - description: Keyless sets the configuration to verify the - authority against a Fulcio instance. - properties: - identities: - description: Identities sets a list of identities. - items: - description: |- - Identity may contain the issuer and/or the subject found in the transparency - log. - Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp - apply a regexp for matching. - properties: - issuer: - description: Issuer defines the issuer for this - identity. - type: string - issuerRegExp: - description: IssuerRegExp specifies a regular - expression to match the issuer for this identity. - type: string - subject: - description: Subject defines the subject for this - identity. - type: string - subjectRegExp: - description: SubjectRegExp specifies a regular - expression to match the subject for this identity. - type: string - type: object - type: array - roots: - description: |- - Roots is an optional set of PEM encoded trusted root certificates. - If not provided, the system roots are used. - type: string - required: - - identities - type: object - source: - description: Sources sets the configuration to specify the - sources from where to consume the signature and attestations. - properties: - PullSecrets: - description: |- - SignaturePullSecrets is an optional list of references to secrets in the - same namespace as the deploying resource for pulling any of the signatures - used by this Source. - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - repository: - description: Repository defines the location from where - to pull the signature / attestations. - type: string - tagPrefix: - description: |- - TagPrefix is an optional prefix that signature and attestations have. - This is the 'tag based discovery' and in the future once references are - fully supported that should likely be the preferred way to handle these. - type: string - type: object - tuf: - description: TUF defines the configuration to fetch sigstore - root - properties: - mirror: - description: Mirror is the base URL of Sigstore TUF - repository - type: string - root: - description: Root defines the path or data of the trusted - root - properties: - data: - description: Data is the base64 encoded TUF root - type: string - path: - description: Path is the URL or File location of - the TUF root - type: string - type: object - type: object - type: object - name: - description: Name is the name for this attestor. It is used - to refer to the attestor in verification - type: string - notary: - description: Notary defines attestor configuration for Notary - based signatures - properties: - certs: - description: Certs define the cert chain for Notary signature - verification - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the a CEL expression - input. - type: string - value: - description: Value defines the raw string input. - type: string - type: object - tsaCerts: - description: TSACerts define the cert chain for verifying - timestamps of notary signature - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the a CEL expression - input. - type: string - value: - description: Value defines the raw string input. - type: string - type: object - type: object - required: - - name - type: object - type: array - auditAnnotations: - description: |- - auditAnnotations contains CEL expressions which are used to produce audit - annotations for the audit event of the API request. - validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is - required. - items: - description: AuditAnnotation describes how to produce an audit annotation - for an API request. - properties: - key: - description: |- - key specifies the audit annotation key. The audit annotation keys of - a ValidatingAdmissionPolicy must be unique. The key must be a qualified - name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. - - The key is combined with the resource name of the - ValidatingAdmissionPolicy to construct an audit annotation key: - "{ValidatingAdmissionPolicy name}/{key}". - - If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy - and the same audit annotation key, the annotation key will be identical. - In this case, the first annotation written with the key will be included - in the audit event and all subsequent annotations with the same key - will be discarded. - - Required. - type: string - valueExpression: - description: |- - valueExpression represents the expression which is evaluated by CEL to - produce an audit annotation value. The expression must evaluate to either - a string or null value. If the expression evaluates to a string, the - audit annotation is included with the string value. If the expression - evaluates to null or empty string the audit annotation will be omitted. - The valueExpression may be no longer than 5kb in length. - If the result of the valueExpression is more than 10kb in length, it - will be truncated to 10kb. - - If multiple ValidatingAdmissionPolicyBinding resources match an - API request, then the valueExpression will be evaluated for - each binding. All unique values produced by the valueExpressions - will be joined together in a comma-separated list. - - Required. - type: string - required: - - key - - valueExpression - type: object - type: array - x-kubernetes-list-type: atomic - autogen: - description: AutogenConfiguration defines the configuration for the - generation controller. - properties: - podControllers: - description: PodControllers specifies whether to generate a pod - controllers rules. - properties: - controllers: - items: - type: string - type: array - type: object - type: object - credentials: - description: Credentials provides credentials that will be used for - authentication with registry. - properties: - allowInsecureRegistry: - description: AllowInsecureRegistry allows insecure access to a - registry. - type: boolean - providers: - description: |- - Providers specifies a list of OCI Registry names, whose authentication providers are provided. - It can be of one of these values: default,google,azure,amazon,github. - items: - description: CredentialsProvidersType provides the list of credential - providers required. - enum: - - default - - amazon - - azure - - google - - github - type: string - type: array - secrets: - description: |- - Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. - items: - type: string - type: array - type: object - evaluation: - description: EvaluationConfiguration defines the configuration for - the policy evaluation. - properties: - admission: - description: Admission controls policy evaluation during admission. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied during admission. - Optional. Default value is "true". - type: boolean - type: object - background: - description: Background controls policy evaluation during background - scan. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied to existing resources during a background scan. - Optional. Default value is "true". The value must be set to "false" if the policy rule - uses variables that are only available in the admission review request (e.g. user name). - type: boolean - type: object - mode: - description: |- - Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". - Optional. Default value is "Kubernetes". - type: string - type: object - failurePolicy: - description: |- - FailurePolicy defines how to handle failures for the admission policy. Failures can - occur from CEL expression parse errors, type check errors, runtime errors and invalid - or mis-configured policy definitions or bindings. - enum: - - Ignore - - Fail - type: string - images: - description: ImageExtractors is a list of CEL expression to extract - images from the resource - items: - properties: - expression: - description: Expression defines CEL expression to extract images - from the resource. - type: string - name: - description: Name is the name for this imageList. It is used - to refer to the images in verification block as images. - type: string - required: - - expression - - name - type: object - type: array - matchConditions: - description: |- - MatchConditions is a list of conditions that must be met for a request to be validated. - Match conditions filter requests that have already been matched by the rules, - namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. - There are a maximum of 64 match conditions allowed. - items: - description: MatchCondition represents a condition which must by - fulfilled for a request to be sent to a webhook. - properties: - expression: - description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. - CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: - - 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. - See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the - request resource. - Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ - - Required. - type: string - name: - description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, - as well as providing an identifier for logging purposes. A good name should be descriptive of - the associated expression. - Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and - must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or - '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an - optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') - - Required. - type: string - required: - - expression - - name - type: object - type: array - matchConstraints: - description: MatchConstraints specifies what resources this policy - is designed to validate. - properties: - excludeResourceRules: - description: |- - ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. - The exclude rules take precedence over include rules (if a resource matches both, it is excluded) - items: - description: NamedRuleWithOperations is a tuple of Operations - and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an operation for - a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional white list of - names that the rule applies to. An empty set means that - everything is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - matchPolicy: - description: |- - matchPolicy defines how the "MatchResources" list is used to match incoming requests. - Allowed values are "Exact" or "Equivalent". - - - Exact: match a request only if it exactly matches a specified rule. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. - - - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. - - Defaults to "Equivalent" - type: string - namespaceSelector: - description: |- - NamespaceSelector decides whether to run the admission control policy on an object based - on whether the namespace for that object matches the selector. If the - object itself is a namespace, the matching is performed on - object.metadata.labels. If the object is another cluster scoped resource, - it never skips the policy. - - For example, to run the webhook on any objects whose namespace is not - associated with "runlevel" of "0" or "1"; you will set the selector as - follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "runlevel", - "operator": "NotIn", - "values": [ - "0", - "1" - ] - } - ] - } - - If instead you want to only run the policy on any objects whose - namespace is associated with the "environment" of "prod" or "staging"; - you will set the selector as follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "environment", - "operator": "In", - "values": [ - "prod", - "staging" - ] - } - ] - } - - See - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - for more examples of label selectors. - - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - objectSelector: - description: |- - ObjectSelector decides whether to run the validation based on if the - object has matching labels. objectSelector is evaluated against both - the oldObject and newObject that would be sent to the cel validation, and - is considered to match if either object matches the selector. A null - object (oldObject in the case of create, or newObject in the case of - delete) or an object that cannot have labels (like a - DeploymentRollback or a PodProxyOptions object) is not considered to - match. - Use the object selector only if the webhook is opt-in, because end - users may skip the admission webhook by setting the labels. - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - resourceRules: - description: |- - ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. - The policy cares about an operation if it matches _any_ Rule. - items: - description: NamedRuleWithOperations is a tuple of Operations - and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an operation for - a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional white list of - names that the rule applies to. An empty set means that - everything is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - matchImageReferences: - description: |- - MatchImageReferences is a list of Glob and CELExpressions to match images. - Any image that matches one of the rules is considered for validation - Any image that does not match a rule is skipped, even when they are passed as arguments to - image verification functions - items: - description: MatchImageReference defines a Glob or a CEL expression - for matching images - oneOf: - - required: - - glob - - required: - - expression - properties: - expression: - description: Expression defines CEL Expressions for matching - images - type: string - glob: - description: Glob defines a globbing pattern for matching images - type: string - type: object - type: array - validationActions: - description: |- - ValidationAction specifies the action to be taken when the matched resource violates the policy. - Required. - items: - description: ValidationAction specifies a policy enforcement action. - enum: - - Deny - - Audit - - Warn - type: string - type: array - x-kubernetes-list-type: set - validationConfigurations: - default: {} - description: ValidationConfigurations defines settings for mutating - and verifying image digests, and enforcing image verification through - signatures. - properties: - mutateDigest: - default: true - description: |- - MutateDigest enables replacement of image tags with digests. - Defaults to true. - type: boolean - required: - default: true - description: Required validates that images are verified, i.e., - have passed a signature or attestation check. - type: boolean - verifyDigest: - default: true - description: VerifyDigest validates that images have a digest. - type: boolean - type: object - validations: - description: Validations contain CEL expressions which is used to - apply the image validation checks. - items: - description: Validation specifies the CEL expression which is used - to apply the validation. - properties: - expression: - description: "Expression represents the expression which will - be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL - expressions have access to the contents of the API request/response, - organized into CEL variables as well as some other useful - variables:\n\n- 'object' - The object from the incoming request. - The value is null for DELETE requests.\n- 'oldObject' - The - existing object. The value is null for CREATE requests.\n- - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- - 'params' - Parameter resource referred to by the policy binding - being evaluated. Only populated if the policy has a ParamKind.\n- - 'namespaceObject' - The namespace object that the incoming - object belongs to. The value is null for cluster-scoped resources.\n- - 'variables' - Map of composited variables, from its name to - its lazily evaluated value.\n For example, a variable named - 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - - A CEL Authorizer. May be used to perform authorization checks - for the principal (user or service account) of the request.\n - \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- - 'authorizer.requestResource' - A CEL ResourceCheck constructed - from the 'authorizer' and configured with the\n request resource.\n\nThe - `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` - are always accessible from the root of the\nobject. No other - metadata properties are accessible.\n\nOnly property names - of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible - property names are escaped according to the following rules - when accessed in the expression:\n- '__' escapes to '__underscores__'\n- - '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' - escapes to '__slash__'\n- Property names that exactly match - a CEL RESERVED keyword escape to '__{keyword}__'. The keywords - are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", - \"const\", \"continue\", \"else\", \"for\", \"function\", - \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", - \"return\".\nExamples:\n - Expression accessing a property - named \"namespace\": {\"Expression\": \"object.__namespace__ - > 0\"}\n - Expression accessing a property named \"x-prop\": - {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression - accessing a property named \"redact__d\": {\"Expression\": - \"object.redact__underscores__d > 0\"}\n\nEquality on arrays - with list type of 'set' or 'map' ignores element order, i.e. - [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type - use the semantics of the list type:\n - 'set': `X + Y` performs - a union where the array positions of all elements in `X` are - preserved and\n non-intersecting elements in `Y` are appended, - retaining their partial order.\n - 'map': `X + Y` performs - a merge where the array positions of all keys in `X` are preserved - but the values\n are overwritten by values in `Y` when - the key sets of `X` and `Y` intersect. Elements in `Y` with\n - \ non-intersecting keys are appended, retaining their partial - order.\nRequired." - type: string - message: - description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains - line breaks. The message must not contain line breaks. - If unset, the message is "failed rule: {Rule}". - e.g. "must be a URL with the host matching spec.host" - If the Expression contains line breaks. Message is required. - The message must not contain line breaks. - If unset, the message is "failed Expression: {Expression}". - type: string - messageExpression: - description: |- - messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. - Since messageExpression is used as a failure message, it must evaluate to a string. - If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. - If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced - as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string - that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and - the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. - messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. - Example: - "object.x must be less than max ("+string(params.max)+")" - type: string - reason: - description: |- - Reason represents a machine-readable description of why this validation failed. - If this is the first validation in the list to fail, this reason, as well as the - corresponding HTTP response code, are used in the - HTTP response to the client. - The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". - If not set, StatusReasonInvalid is used in the response to the client. - type: string - required: - - expression - type: object - type: array - x-kubernetes-list-type: atomic - variables: - description: |- - Variables contain definitions of variables that can be used in composition of other expressions. - Each variable is defined as a named CEL expression. - items: - description: Variable is the definition of a variable that is used - for composition. A variable is defined as a named expression. - properties: - expression: - description: |- - Expression is the expression that will be evaluated as the value of the variable. - The CEL expression has access to the same identifiers as the CEL expressions in Validation. - type: string - name: - description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. - The variable can be accessed in other expressions through `variables` - For example, if name is "foo", the variable will be available as `variables.foo` - type: string - required: - - expression - - name - type: object - x-kubernetes-map-type: atomic - type: array - webhookConfiguration: - description: WebhookConfiguration defines the configuration for the - webhook. - properties: - timeoutSeconds: - description: |- - TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. - After the configured time expires, the admission request may fail, or may simply ignore the policy results, - based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. - format: int32 - type: integer - type: object - required: - - attestors - - validations - type: object - status: - description: Status contains policy runtime data. - properties: - autogen: - properties: - configs: - additionalProperties: - properties: - spec: - description: ImageValidatingPolicySpec is the specification - of the desired behavior of the ImageValidatingPolicy. - properties: - attestations: - description: Attestations provides a list of image metadata - to verify - items: - description: Attestation defines the identification - details of the metadata that has to be verified - properties: - intoto: - description: InToto defines the details of attestation - attached using intoto format - properties: - type: - description: Type defines the type of attestation - contained within the statement. - type: string - required: - - type - type: object - name: - description: Name is the name for this attestation. - It is used to refer to the attestation in verification - type: string - referrer: - description: Referrer defines the details of attestation - attached using OCI 1.1 format - properties: - type: - description: Type defines the type of attestation - attached to the image. - type: string - required: - - type - type: object - required: - - name - type: object - type: array - attestors: - description: Attestors provides a list of trusted authorities. - items: - description: Attestor is an identity that confirms - or verifies the authenticity of an image or an attestation - properties: - cosign: - description: Cosign defines attestor configuration - for Cosign based signatures - properties: - annotations: - additionalProperties: - type: string - description: |- - Annotations are used for image verification. - Every specified key-value pair must exist and match in the verified payload. - The payload may contain other key-value pairs. - type: object - certificate: - description: Certificate defines the configuration - for local signature verification - properties: - cert: - description: Certificate is the to the - public certificate for local signature - verification. - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the - a CEL expression input. - type: string - value: - description: Value defines the raw - string input. - type: string - type: object - certChain: - description: |- - CertificateChain is the list of CA certificates in PEM format which will be needed - when building the certificate chain for the signing certificate. Must start with the - parent intermediate CA certificate of the signing certificate and end with the root certificate - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the - a CEL expression input. - type: string - value: - description: Value defines the raw - string input. - type: string - type: object - type: object - ctlog: - description: CTLog sets the configuration - to verify the authority against a Rekor - instance. - properties: - ctLogPubKey: - description: CTLogPubKey, if set, is used - to validate SCTs against a custom source. - type: string - insecureIgnoreSCT: - description: |- - IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate - timestamp. Default is false. Set to true if this was opted out during signing. - type: boolean - insecureIgnoreTlog: - description: InsecureIgnoreTlog skips - transparency log verification. - type: boolean - rekorPubKey: - description: |- - RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. - If set, this will be used to validate transparency log signatures from a custom Rekor. - type: string - tsaCertChain: - description: |- - TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must - contain the root CA certificate. Optionally may contain intermediate CA certificates, and - may contain the leaf TSA certificate if not present in the timestamurce. - type: string - url: - description: URL sets the url to the rekor - instance (by default the public rekor.sigstore.dev) - type: string - type: object - key: - description: Key defines the type of key to - validate the image. - properties: - data: - description: Data contains the inline - public key - type: string - expression: - description: Expression is a Expression - expression that returns the public key. - type: string - hashAlgorithm: - description: |- - HashAlgorithm specifues signature algorithm for public keys. Supported values are - sha224, sha256, sha384 and sha512. Defaults to sha256. - type: string - kms: - description: |- - KMS contains the KMS url of the public key - Supported formats differ based on the KMS system used. - type: string - type: object - keyless: - description: Keyless sets the configuration - to verify the authority against a Fulcio - instance. - properties: - identities: - description: Identities sets a list of - identities. - items: - description: |- - Identity may contain the issuer and/or the subject found in the transparency - log. - Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp - apply a regexp for matching. - properties: - issuer: - description: Issuer defines the - issuer for this identity. - type: string - issuerRegExp: - description: IssuerRegExp specifies - a regular expression to match - the issuer for this identity. - type: string - subject: - description: Subject defines the - subject for this identity. - type: string - subjectRegExp: - description: SubjectRegExp specifies - a regular expression to match - the subject for this identity. - type: string - type: object - type: array - roots: - description: |- - Roots is an optional set of PEM encoded trusted root certificates. - If not provided, the system roots are used. - type: string - required: - - identities - type: object - source: - description: Sources sets the configuration - to specify the sources from where to consume - the signature and attestations. - properties: - PullSecrets: - description: |- - SignaturePullSecrets is an optional list of references to secrets in the - same namespace as the deploying resource for pulling any of the signatures - used by this Source. - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - repository: - description: Repository defines the location - from where to pull the signature / attestations. - type: string - tagPrefix: - description: |- - TagPrefix is an optional prefix that signature and attestations have. - This is the 'tag based discovery' and in the future once references are - fully supported that should likely be the preferred way to handle these. - type: string - type: object - tuf: - description: TUF defines the configuration - to fetch sigstore root - properties: - mirror: - description: Mirror is the base URL of - Sigstore TUF repository - type: string - root: - description: Root defines the path or - data of the trusted root - properties: - data: - description: Data is the base64 encoded - TUF root - type: string - path: - description: Path is the URL or File - location of the TUF root - type: string - type: object - type: object - type: object - name: - description: Name is the name for this attestor. - It is used to refer to the attestor in verification - type: string - notary: - description: Notary defines attestor configuration - for Notary based signatures - properties: - certs: - description: Certs define the cert chain for - Notary signature verification - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the a - CEL expression input. - type: string - value: - description: Value defines the raw string - input. - type: string - type: object - tsaCerts: - description: TSACerts define the cert chain - for verifying timestamps of notary signature - oneOf: - - required: - - value - - required: - - expression - properties: - expression: - description: Expression defines the a - CEL expression input. - type: string - value: - description: Value defines the raw string - input. - type: string - type: object - type: object - required: - - name - type: object - type: array - auditAnnotations: - description: |- - auditAnnotations contains CEL expressions which are used to produce audit - annotations for the audit event of the API request. - validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is - required. - items: - description: AuditAnnotation describes how to produce - an audit annotation for an API request. - properties: - key: - description: |- - key specifies the audit annotation key. The audit annotation keys of - a ValidatingAdmissionPolicy must be unique. The key must be a qualified - name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. - - The key is combined with the resource name of the - ValidatingAdmissionPolicy to construct an audit annotation key: - "{ValidatingAdmissionPolicy name}/{key}". - - If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy - and the same audit annotation key, the annotation key will be identical. - In this case, the first annotation written with the key will be included - in the audit event and all subsequent annotations with the same key - will be discarded. - - Required. - type: string - valueExpression: - description: |- - valueExpression represents the expression which is evaluated by CEL to - produce an audit annotation value. The expression must evaluate to either - a string or null value. If the expression evaluates to a string, the - audit annotation is included with the string value. If the expression - evaluates to null or empty string the audit annotation will be omitted. - The valueExpression may be no longer than 5kb in length. - If the result of the valueExpression is more than 10kb in length, it - will be truncated to 10kb. - - If multiple ValidatingAdmissionPolicyBinding resources match an - API request, then the valueExpression will be evaluated for - each binding. All unique values produced by the valueExpressions - will be joined together in a comma-separated list. - - Required. - type: string - required: - - key - - valueExpression - type: object - type: array - x-kubernetes-list-type: atomic - autogen: - description: AutogenConfiguration defines the configuration - for the generation controller. - properties: - podControllers: - description: PodControllers specifies whether to - generate a pod controllers rules. - properties: - controllers: - items: - type: string - type: array - type: object - type: object - credentials: - description: Credentials provides credentials that will - be used for authentication with registry. - properties: - allowInsecureRegistry: - description: AllowInsecureRegistry allows insecure - access to a registry. - type: boolean - providers: - description: |- - Providers specifies a list of OCI Registry names, whose authentication providers are provided. - It can be of one of these values: default,google,azure,amazon,github. - items: - description: CredentialsProvidersType provides - the list of credential providers required. - enum: - - default - - amazon - - azure - - google - - github - type: string - type: array - secrets: - description: |- - Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. - items: - type: string - type: array - type: object - evaluation: - description: EvaluationConfiguration defines the configuration - for the policy evaluation. - properties: - admission: - description: Admission controls policy evaluation - during admission. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied during admission. - Optional. Default value is "true". - type: boolean - type: object - background: - description: Background controls policy evaluation - during background scan. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied to existing resources during a background scan. - Optional. Default value is "true". The value must be set to "false" if the policy rule - uses variables that are only available in the admission review request (e.g. user name). - type: boolean - type: object - mode: - description: |- - Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". - Optional. Default value is "Kubernetes". - type: string - type: object - failurePolicy: - description: |- - FailurePolicy defines how to handle failures for the admission policy. Failures can - occur from CEL expression parse errors, type check errors, runtime errors and invalid - or mis-configured policy definitions or bindings. - enum: - - Ignore - - Fail - type: string - images: - description: ImageExtractors is a list of CEL expression - to extract images from the resource - items: - properties: - expression: - description: Expression defines CEL expression - to extract images from the resource. - type: string - name: - description: Name is the name for this imageList. - It is used to refer to the images in verification - block as images. - type: string - required: - - expression - - name - type: object - type: array - matchConditions: - description: |- - MatchConditions is a list of conditions that must be met for a request to be validated. - Match conditions filter requests that have already been matched by the rules, - namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. - There are a maximum of 64 match conditions allowed. - items: - description: MatchCondition represents a condition - which must by fulfilled for a request to be sent - to a webhook. - properties: - expression: - description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. - CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: - - 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. - See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the - request resource. - Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ - - Required. - type: string - name: - description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, - as well as providing an identifier for logging purposes. A good name should be descriptive of - the associated expression. - Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and - must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or - '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an - optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') - - Required. - type: string - required: - - expression - - name - type: object - type: array - matchConstraints: - description: MatchConstraints specifies what resources - this policy is designed to validate. - properties: - excludeResourceRules: - description: |- - ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. - The exclude rules take precedence over include rules (if a resource matches both, it is excluded) - items: - description: NamedRuleWithOperations is a tuple - of Operations and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an - operation for a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional - white list of names that the rule applies - to. An empty set means that everything - is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - matchPolicy: - description: |- - matchPolicy defines how the "MatchResources" list is used to match incoming requests. - Allowed values are "Exact" or "Equivalent". - - - Exact: match a request only if it exactly matches a specified rule. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. - - - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. - - Defaults to "Equivalent" - type: string - namespaceSelector: - description: |- - NamespaceSelector decides whether to run the admission control policy on an object based - on whether the namespace for that object matches the selector. If the - object itself is a namespace, the matching is performed on - object.metadata.labels. If the object is another cluster scoped resource, - it never skips the policy. - - For example, to run the webhook on any objects whose namespace is not - associated with "runlevel" of "0" or "1"; you will set the selector as - follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "runlevel", - "operator": "NotIn", - "values": [ - "0", - "1" - ] - } - ] - } - - If instead you want to only run the policy on any objects whose - namespace is associated with the "environment" of "prod" or "staging"; - you will set the selector as follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "environment", - "operator": "In", - "values": [ - "prod", - "staging" - ] - } - ] - } - - See - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - for more examples of label selectors. - - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - objectSelector: - description: |- - ObjectSelector decides whether to run the validation based on if the - object has matching labels. objectSelector is evaluated against both - the oldObject and newObject that would be sent to the cel validation, and - is considered to match if either object matches the selector. A null - object (oldObject in the case of create, or newObject in the case of - delete) or an object that cannot have labels (like a - DeploymentRollback or a PodProxyOptions object) is not considered to - match. - Use the object selector only if the webhook is opt-in, because end - users may skip the admission webhook by setting the labels. - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - resourceRules: - description: |- - ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. - The policy cares about an operation if it matches _any_ Rule. - items: - description: NamedRuleWithOperations is a tuple - of Operations and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an - operation for a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional - white list of names that the rule applies - to. An empty set means that everything - is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - matchImageReferences: - description: |- - MatchImageReferences is a list of Glob and CELExpressions to match images. - Any image that matches one of the rules is considered for validation - Any image that does not match a rule is skipped, even when they are passed as arguments to - image verification functions - items: - description: MatchImageReference defines a Glob or - a CEL expression for matching images - oneOf: - - required: - - glob - - required: - - expression - properties: - expression: - description: Expression defines CEL Expressions - for matching images - type: string - glob: - description: Glob defines a globbing pattern for - matching images - type: string - type: object - type: array - validationActions: - description: |- - ValidationAction specifies the action to be taken when the matched resource violates the policy. - Required. - items: - description: ValidationAction specifies a policy enforcement - action. - enum: - - Deny - - Audit - - Warn - type: string - type: array - x-kubernetes-list-type: set - validationConfigurations: - default: {} - description: ValidationConfigurations defines settings - for mutating and verifying image digests, and enforcing - image verification through signatures. - properties: - mutateDigest: - default: true - description: |- - MutateDigest enables replacement of image tags with digests. - Defaults to true. - type: boolean - required: - default: true - description: Required validates that images are - verified, i.e., have passed a signature or attestation - check. - type: boolean - verifyDigest: - default: true - description: VerifyDigest validates that images - have a digest. - type: boolean - type: object - validations: - description: Validations contain CEL expressions which - is used to apply the image validation checks. - items: - description: Validation specifies the CEL expression - which is used to apply the validation. - properties: - expression: - description: "Expression represents the expression - which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL - expressions have access to the contents of the - API request/response, organized into CEL variables - as well as some other useful variables:\n\n- - 'object' - The object from the incoming request. - The value is null for DELETE requests.\n- 'oldObject' - - The existing object. The value is null for - CREATE requests.\n- 'request' - Attributes of - the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- - 'params' - Parameter resource referred to by - the policy binding being evaluated. Only populated - if the policy has a ParamKind.\n- 'namespaceObject' - - The namespace object that the incoming object - belongs to. The value is null for cluster-scoped - resources.\n- 'variables' - Map of composited - variables, from its name to its lazily evaluated - value.\n For example, a variable named 'foo' - can be accessed as 'variables.foo'.\n- 'authorizer' - - A CEL Authorizer. May be used to perform authorization - checks for the principal (user or service account) - of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- - 'authorizer.requestResource' - A CEL ResourceCheck - constructed from the 'authorizer' and configured - with the\n request resource.\n\nThe `apiVersion`, - `kind`, `metadata.name` and `metadata.generateName` - are always accessible from the root of the\nobject. - No other metadata properties are accessible.\n\nOnly - property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` - are accessible.\nAccessible property names are - escaped according to the following rules when - accessed in the expression:\n- '__' escapes - to '__underscores__'\n- '.' escapes to '__dot__'\n- - '-' escapes to '__dash__'\n- '/' escapes to - '__slash__'\n- Property names that exactly match - a CEL RESERVED keyword escape to '__{keyword}__'. - The keywords are:\n\t \"true\", \"false\", - \"null\", \"in\", \"as\", \"break\", \"const\", - \"continue\", \"else\", \"for\", \"function\", - \"if\",\n\t \"import\", \"let\", \"loop\", - \"package\", \"namespace\", \"return\".\nExamples:\n - \ - Expression accessing a property named \"namespace\": - {\"Expression\": \"object.__namespace__ > 0\"}\n - \ - Expression accessing a property named \"x-prop\": - {\"Expression\": \"object.x__dash__prop > 0\"}\n - \ - Expression accessing a property named \"redact__d\": - {\"Expression\": \"object.redact__underscores__d - > 0\"}\n\nEquality on arrays with list type - of 'set' or 'map' ignores element order, i.e. - [1, 2] == [2, 1].\nConcatenation on arrays with - x-kubernetes-list-type use the semantics of - the list type:\n - 'set': `X + Y` performs - a union where the array positions of all elements - in `X` are preserved and\n non-intersecting - elements in `Y` are appended, retaining their - partial order.\n - 'map': `X + Y` performs - a merge where the array positions of all keys - in `X` are preserved but the values\n are - overwritten by values in `Y` when the key sets - of `X` and `Y` intersect. Elements in `Y` with\n - \ non-intersecting keys are appended, retaining - their partial order.\nRequired." - type: string - message: - description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains - line breaks. The message must not contain line breaks. - If unset, the message is "failed rule: {Rule}". - e.g. "must be a URL with the host matching spec.host" - If the Expression contains line breaks. Message is required. - The message must not contain line breaks. - If unset, the message is "failed Expression: {Expression}". - type: string - messageExpression: - description: |- - messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. - Since messageExpression is used as a failure message, it must evaluate to a string. - If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. - If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced - as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string - that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and - the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. - messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. - Example: - "object.x must be less than max ("+string(params.max)+")" - type: string - reason: - description: |- - Reason represents a machine-readable description of why this validation failed. - If this is the first validation in the list to fail, this reason, as well as the - corresponding HTTP response code, are used in the - HTTP response to the client. - The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". - If not set, StatusReasonInvalid is used in the response to the client. - type: string - required: - - expression - type: object - type: array - x-kubernetes-list-type: atomic - variables: - description: |- - Variables contain definitions of variables that can be used in composition of other expressions. - Each variable is defined as a named CEL expression. - items: - description: Variable is the definition of a variable - that is used for composition. A variable is defined - as a named expression. - properties: - expression: - description: |- - Expression is the expression that will be evaluated as the value of the variable. - The CEL expression has access to the same identifiers as the CEL expressions in Validation. - type: string - name: - description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. - The variable can be accessed in other expressions through `variables` - For example, if name is "foo", the variable will be available as `variables.foo` - type: string - required: - - expression - - name - type: object - x-kubernetes-map-type: atomic - type: array - webhookConfiguration: - description: WebhookConfiguration defines the configuration - for the webhook. - properties: - timeoutSeconds: - description: |- - TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. - After the configured time expires, the admission request may fail, or may simply ignore the policy results, - based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. - format: int32 - type: integer - type: object - required: - - attestors - - validations - type: object - required: - - spec - type: object - type: object - type: object - conditionStatus: - description: ConditionStatus is the shared status across all policy - types - properties: - conditions: - items: - description: Condition contains details for one aspect of the - current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - message: - description: |- - Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy - It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. - type: string - ready: - description: |- - The ready of a policy is a high-level summary of where the policy is in its lifecycle. - The conditions array, the reason and message fields contain more detail about the policy's status. - type: boolean - type: object - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_policyexceptions.yaml b/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_policyexceptions.yaml deleted file mode 100644 index 436542b..0000000 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_policyexceptions.yaml +++ /dev/null @@ -1,113 +0,0 @@ -{{- if .Values.groups.policies.policyexceptions }} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - labels: - {{- include "kyverno.crds.labels" . | nindent 4 }} - annotations: - {{- with .Values.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 - name: policyexceptions.policies.kyverno.io -spec: - group: policies.kyverno.io - names: - kind: PolicyException - listKind: PolicyExceptionList - plural: policyexceptions - singular: policyexception - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: PolicyException declares resources to be excluded from specified - policies. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec declares policy exception behaviors. - properties: - matchConditions: - description: MatchConditions is a list of CEL expressions that must - be met for a resource to be excluded. - items: - description: MatchCondition represents a condition which must by - fulfilled for a request to be sent to a webhook. - properties: - expression: - description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. - CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: - - 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. - See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the - request resource. - Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ - - Required. - type: string - name: - description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, - as well as providing an identifier for logging purposes. A good name should be descriptive of - the associated expression. - Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and - must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or - '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an - optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') - - Required. - type: string - required: - - expression - - name - type: object - type: array - policyRefs: - description: PolicyRefs identifies the policies to which the exception - is applied. - items: - properties: - kind: - description: Kind is the kind of the policy - type: string - name: - description: Name is the name of the policy - type: string - required: - - kind - - name - type: object - type: array - required: - - policyRefs - type: object - required: - - spec - type: object - served: true - storage: true -{{- end }} diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_validatingpolicies.yaml b/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_validatingpolicies.yaml deleted file mode 100644 index 6668d6e..0000000 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/policies.kyverno.io/policies.kyverno.io_validatingpolicies.yaml +++ /dev/null @@ -1,1523 +0,0 @@ -{{- if .Values.groups.policies.validatingpolicies }} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - labels: - {{- include "kyverno.crds.labels" . | nindent 4 }} - annotations: - {{- with .Values.annotations }} - {{- toYaml . | nindent 4 }} - {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 - name: validatingpolicies.policies.kyverno.io -spec: - group: policies.kyverno.io - names: - categories: - - kyverno - kind: ValidatingPolicy - listKind: ValidatingPolicyList - plural: validatingpolicies - shortNames: - - vpol - singular: validatingpolicy - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .metadata.creationTimestamp - name: AGE - type: date - - jsonPath: .status.conditionStatus.ready - name: READY - type: string - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: ValidatingPolicySpec is the specification of the desired - behavior of the ValidatingPolicy. - properties: - auditAnnotations: - description: |- - auditAnnotations contains CEL expressions which are used to produce audit - annotations for the audit event of the API request. - validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is - required. - items: - description: AuditAnnotation describes how to produce an audit annotation - for an API request. - properties: - key: - description: |- - key specifies the audit annotation key. The audit annotation keys of - a ValidatingAdmissionPolicy must be unique. The key must be a qualified - name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. - - The key is combined with the resource name of the - ValidatingAdmissionPolicy to construct an audit annotation key: - "{ValidatingAdmissionPolicy name}/{key}". - - If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy - and the same audit annotation key, the annotation key will be identical. - In this case, the first annotation written with the key will be included - in the audit event and all subsequent annotations with the same key - will be discarded. - - Required. - type: string - valueExpression: - description: |- - valueExpression represents the expression which is evaluated by CEL to - produce an audit annotation value. The expression must evaluate to either - a string or null value. If the expression evaluates to a string, the - audit annotation is included with the string value. If the expression - evaluates to null or empty string the audit annotation will be omitted. - The valueExpression may be no longer than 5kb in length. - If the result of the valueExpression is more than 10kb in length, it - will be truncated to 10kb. - - If multiple ValidatingAdmissionPolicyBinding resources match an - API request, then the valueExpression will be evaluated for - each binding. All unique values produced by the valueExpressions - will be joined together in a comma-separated list. - - Required. - type: string - required: - - key - - valueExpression - type: object - type: array - x-kubernetes-list-type: atomic - autogen: - description: AutogenConfiguration defines the configuration for the - generation controller. - properties: - podControllers: - description: PodControllers specifies whether to generate a pod - controllers rules. - properties: - controllers: - items: - type: string - type: array - type: object - validatingAdmissionPolicy: - description: ValidatingAdmissionPolicy specifies whether to generate - a Kubernetes ValidatingAdmissionPolicy. - properties: - enabled: - description: |- - Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. - Optional. Defaults to "false" if not specified. - type: boolean - type: object - type: object - evaluation: - description: EvaluationConfiguration defines the configuration for - the policy evaluation. - properties: - admission: - description: Admission controls policy evaluation during admission. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied during admission. - Optional. Default value is "true". - type: boolean - type: object - background: - description: Background controls policy evaluation during background - scan. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied to existing resources during a background scan. - Optional. Default value is "true". The value must be set to "false" if the policy rule - uses variables that are only available in the admission review request (e.g. user name). - type: boolean - type: object - mode: - description: |- - Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". - Optional. Default value is "Kubernetes". - type: string - type: object - failurePolicy: - description: |- - failurePolicy defines how to handle failures for the admission policy. Failures can - occur from CEL expression parse errors, type check errors, runtime errors and invalid - or mis-configured policy definitions or bindings. - - failurePolicy does not define how validations that evaluate to false are handled. - - When failurePolicy is set to Fail, the validationActions field define how failures are enforced. - - Allowed values are Ignore or Fail. Defaults to Fail. - enum: - - Ignore - - Fail - type: string - matchConditions: - description: |- - MatchConditions is a list of conditions that must be met for a request to be validated. - Match conditions filter requests that have already been matched by the rules, - namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. - There are a maximum of 64 match conditions allowed. - - If a parameter object is provided, it can be accessed via the `params` handle in the same - manner as validation expressions. - - The exact matching logic is (in order): - 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. - 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. - 3. If any matchCondition evaluates to an error (but none are FALSE): - - If failurePolicy=Fail, reject the request - - If failurePolicy=Ignore, the policy is skipped - items: - description: MatchCondition represents a condition which must by - fulfilled for a request to be sent to a webhook. - properties: - expression: - description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. - CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: - - 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. - See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the - request resource. - Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ - - Required. - type: string - name: - description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, - as well as providing an identifier for logging purposes. A good name should be descriptive of - the associated expression. - Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and - must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or - '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an - optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') - - Required. - type: string - required: - - expression - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - matchConstraints: - description: |- - MatchConstraints specifies what resources this policy is designed to validate. - The AdmissionPolicy cares about a request if it matches _all_ Constraints. - Required. - properties: - excludeResourceRules: - description: |- - ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. - The exclude rules take precedence over include rules (if a resource matches both, it is excluded) - items: - description: NamedRuleWithOperations is a tuple of Operations - and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an operation for - a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional white list of - names that the rule applies to. An empty set means that - everything is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - matchPolicy: - description: |- - matchPolicy defines how the "MatchResources" list is used to match incoming requests. - Allowed values are "Exact" or "Equivalent". - - - Exact: match a request only if it exactly matches a specified rule. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. - - - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. - - Defaults to "Equivalent" - type: string - namespaceSelector: - description: |- - NamespaceSelector decides whether to run the admission control policy on an object based - on whether the namespace for that object matches the selector. If the - object itself is a namespace, the matching is performed on - object.metadata.labels. If the object is another cluster scoped resource, - it never skips the policy. - - For example, to run the webhook on any objects whose namespace is not - associated with "runlevel" of "0" or "1"; you will set the selector as - follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "runlevel", - "operator": "NotIn", - "values": [ - "0", - "1" - ] - } - ] - } - - If instead you want to only run the policy on any objects whose - namespace is associated with the "environment" of "prod" or "staging"; - you will set the selector as follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "environment", - "operator": "In", - "values": [ - "prod", - "staging" - ] - } - ] - } - - See - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - for more examples of label selectors. - - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - objectSelector: - description: |- - ObjectSelector decides whether to run the validation based on if the - object has matching labels. objectSelector is evaluated against both - the oldObject and newObject that would be sent to the cel validation, and - is considered to match if either object matches the selector. A null - object (oldObject in the case of create, or newObject in the case of - delete) or an object that cannot have labels (like a - DeploymentRollback or a PodProxyOptions object) is not considered to - match. - Use the object selector only if the webhook is opt-in, because end - users may skip the admission webhook by setting the labels. - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label selector - requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector - applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - resourceRules: - description: |- - ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. - The policy cares about an operation if it matches _any_ Rule. - items: - description: NamedRuleWithOperations is a tuple of Operations - and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an operation for - a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional white list of - names that the rule applies to. An empty set means that - everything is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - validationActions: - description: |- - ValidationAction specifies the action to be taken when the matched resource violates the policy. - Required. - items: - description: ValidationAction specifies a policy enforcement action. - enum: - - Deny - - Audit - - Warn - type: string - type: array - x-kubernetes-list-type: set - validations: - description: |- - Validations contain CEL expressions which is used to apply the validation. - Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is - required. - items: - description: Validation specifies the CEL expression which is used - to apply the validation. - properties: - expression: - description: "Expression represents the expression which will - be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL - expressions have access to the contents of the API request/response, - organized into CEL variables as well as some other useful - variables:\n\n- 'object' - The object from the incoming request. - The value is null for DELETE requests.\n- 'oldObject' - The - existing object. The value is null for CREATE requests.\n- - 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- - 'params' - Parameter resource referred to by the policy binding - being evaluated. Only populated if the policy has a ParamKind.\n- - 'namespaceObject' - The namespace object that the incoming - object belongs to. The value is null for cluster-scoped resources.\n- - 'variables' - Map of composited variables, from its name to - its lazily evaluated value.\n For example, a variable named - 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' - - A CEL Authorizer. May be used to perform authorization checks - for the principal (user or service account) of the request.\n - \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- - 'authorizer.requestResource' - A CEL ResourceCheck constructed - from the 'authorizer' and configured with the\n request resource.\n\nThe - `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` - are always accessible from the root of the\nobject. No other - metadata properties are accessible.\n\nOnly property names - of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible - property names are escaped according to the following rules - when accessed in the expression:\n- '__' escapes to '__underscores__'\n- - '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' - escapes to '__slash__'\n- Property names that exactly match - a CEL RESERVED keyword escape to '__{keyword}__'. The keywords - are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", - \"const\", \"continue\", \"else\", \"for\", \"function\", - \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", - \"return\".\nExamples:\n - Expression accessing a property - named \"namespace\": {\"Expression\": \"object.__namespace__ - > 0\"}\n - Expression accessing a property named \"x-prop\": - {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression - accessing a property named \"redact__d\": {\"Expression\": - \"object.redact__underscores__d > 0\"}\n\nEquality on arrays - with list type of 'set' or 'map' ignores element order, i.e. - [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type - use the semantics of the list type:\n - 'set': `X + Y` performs - a union where the array positions of all elements in `X` are - preserved and\n non-intersecting elements in `Y` are appended, - retaining their partial order.\n - 'map': `X + Y` performs - a merge where the array positions of all keys in `X` are preserved - but the values\n are overwritten by values in `Y` when - the key sets of `X` and `Y` intersect. Elements in `Y` with\n - \ non-intersecting keys are appended, retaining their partial - order.\nRequired." - type: string - message: - description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains - line breaks. The message must not contain line breaks. - If unset, the message is "failed rule: {Rule}". - e.g. "must be a URL with the host matching spec.host" - If the Expression contains line breaks. Message is required. - The message must not contain line breaks. - If unset, the message is "failed Expression: {Expression}". - type: string - messageExpression: - description: |- - messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. - Since messageExpression is used as a failure message, it must evaluate to a string. - If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. - If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced - as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string - that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and - the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. - messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. - Example: - "object.x must be less than max ("+string(params.max)+")" - type: string - reason: - description: |- - Reason represents a machine-readable description of why this validation failed. - If this is the first validation in the list to fail, this reason, as well as the - corresponding HTTP response code, are used in the - HTTP response to the client. - The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". - If not set, StatusReasonInvalid is used in the response to the client. - type: string - required: - - expression - type: object - type: array - x-kubernetes-list-type: atomic - variables: - description: |- - Variables contain definitions of variables that can be used in composition of other expressions. - Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. - - The expression of a variable can refer to other variables defined earlier in the list but not those after. - Thus, Variables must be sorted by the order of first appearance and acyclic. - items: - description: Variable is the definition of a variable that is used - for composition. A variable is defined as a named expression. - properties: - expression: - description: |- - Expression is the expression that will be evaluated as the value of the variable. - The CEL expression has access to the same identifiers as the CEL expressions in Validation. - type: string - name: - description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. - The variable can be accessed in other expressions through `variables` - For example, if name is "foo", the variable will be available as `variables.foo` - type: string - required: - - expression - - name - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - webhookConfiguration: - description: WebhookConfiguration defines the configuration for the - webhook. - properties: - timeoutSeconds: - description: |- - TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. - After the configured time expires, the admission request may fail, or may simply ignore the policy results, - based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. - format: int32 - type: integer - type: object - type: object - status: - description: Status contains policy runtime data. - properties: - autogen: - properties: - configs: - additionalProperties: - properties: - spec: - description: ValidatingPolicySpec is the specification of - the desired behavior of the ValidatingPolicy. - properties: - auditAnnotations: - description: |- - auditAnnotations contains CEL expressions which are used to produce audit - annotations for the audit event of the API request. - validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is - required. - items: - description: AuditAnnotation describes how to produce - an audit annotation for an API request. - properties: - key: - description: |- - key specifies the audit annotation key. The audit annotation keys of - a ValidatingAdmissionPolicy must be unique. The key must be a qualified - name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. - - The key is combined with the resource name of the - ValidatingAdmissionPolicy to construct an audit annotation key: - "{ValidatingAdmissionPolicy name}/{key}". - - If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy - and the same audit annotation key, the annotation key will be identical. - In this case, the first annotation written with the key will be included - in the audit event and all subsequent annotations with the same key - will be discarded. - - Required. - type: string - valueExpression: - description: |- - valueExpression represents the expression which is evaluated by CEL to - produce an audit annotation value. The expression must evaluate to either - a string or null value. If the expression evaluates to a string, the - audit annotation is included with the string value. If the expression - evaluates to null or empty string the audit annotation will be omitted. - The valueExpression may be no longer than 5kb in length. - If the result of the valueExpression is more than 10kb in length, it - will be truncated to 10kb. - - If multiple ValidatingAdmissionPolicyBinding resources match an - API request, then the valueExpression will be evaluated for - each binding. All unique values produced by the valueExpressions - will be joined together in a comma-separated list. - - Required. - type: string - required: - - key - - valueExpression - type: object - type: array - x-kubernetes-list-type: atomic - autogen: - description: AutogenConfiguration defines the configuration - for the generation controller. - properties: - podControllers: - description: PodControllers specifies whether to - generate a pod controllers rules. - properties: - controllers: - items: - type: string - type: array - type: object - validatingAdmissionPolicy: - description: ValidatingAdmissionPolicy specifies - whether to generate a Kubernetes ValidatingAdmissionPolicy. - properties: - enabled: - description: |- - Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. - Optional. Defaults to "false" if not specified. - type: boolean - type: object - type: object - evaluation: - description: EvaluationConfiguration defines the configuration - for the policy evaluation. - properties: - admission: - description: Admission controls policy evaluation - during admission. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied during admission. - Optional. Default value is "true". - type: boolean - type: object - background: - description: Background controls policy evaluation - during background scan. - properties: - enabled: - default: true - description: |- - Enabled controls if rules are applied to existing resources during a background scan. - Optional. Default value is "true". The value must be set to "false" if the policy rule - uses variables that are only available in the admission review request (e.g. user name). - type: boolean - type: object - mode: - description: |- - Mode is the mode of policy evaluation. - Allowed values are "Kubernetes" or "JSON". - Optional. Default value is "Kubernetes". - type: string - type: object - failurePolicy: - description: |- - failurePolicy defines how to handle failures for the admission policy. Failures can - occur from CEL expression parse errors, type check errors, runtime errors and invalid - or mis-configured policy definitions or bindings. - - failurePolicy does not define how validations that evaluate to false are handled. - - When failurePolicy is set to Fail, the validationActions field define how failures are enforced. - - Allowed values are Ignore or Fail. Defaults to Fail. - enum: - - Ignore - - Fail - type: string - matchConditions: - description: |- - MatchConditions is a list of conditions that must be met for a request to be validated. - Match conditions filter requests that have already been matched by the rules, - namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. - There are a maximum of 64 match conditions allowed. - - If a parameter object is provided, it can be accessed via the `params` handle in the same - manner as validation expressions. - - The exact matching logic is (in order): - 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. - 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. - 3. If any matchCondition evaluates to an error (but none are FALSE): - - If failurePolicy=Fail, reject the request - - If failurePolicy=Ignore, the policy is skipped - items: - description: MatchCondition represents a condition - which must by fulfilled for a request to be sent - to a webhook. - properties: - expression: - description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. - CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: - - 'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). - 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. - See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz - 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the - request resource. - Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ - - Required. - type: string - name: - description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, - as well as providing an identifier for logging purposes. A good name should be descriptive of - the associated expression. - Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and - must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or - '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an - optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') - - Required. - type: string - required: - - expression - - name - type: object - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - matchConstraints: - description: |- - MatchConstraints specifies what resources this policy is designed to validate. - The AdmissionPolicy cares about a request if it matches _all_ Constraints. - Required. - properties: - excludeResourceRules: - description: |- - ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. - The exclude rules take precedence over include rules (if a resource matches both, it is excluded) - items: - description: NamedRuleWithOperations is a tuple - of Operations and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an - operation for a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional - white list of names that the rule applies - to. An empty set means that everything - is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - matchPolicy: - description: |- - matchPolicy defines how the "MatchResources" list is used to match incoming requests. - Allowed values are "Exact" or "Equivalent". - - - Exact: match a request only if it exactly matches a specified rule. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. - - - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. - For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, - and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, - a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. - - Defaults to "Equivalent" - type: string - namespaceSelector: - description: |- - NamespaceSelector decides whether to run the admission control policy on an object based - on whether the namespace for that object matches the selector. If the - object itself is a namespace, the matching is performed on - object.metadata.labels. If the object is another cluster scoped resource, - it never skips the policy. - - For example, to run the webhook on any objects whose namespace is not - associated with "runlevel" of "0" or "1"; you will set the selector as - follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "runlevel", - "operator": "NotIn", - "values": [ - "0", - "1" - ] - } - ] - } - - If instead you want to only run the policy on any objects whose - namespace is associated with the "environment" of "prod" or "staging"; - you will set the selector as follows: - "namespaceSelector": { - "matchExpressions": [ - { - "key": "environment", - "operator": "In", - "values": [ - "prod", - "staging" - ] - } - ] - } - - See - https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ - for more examples of label selectors. - - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - objectSelector: - description: |- - ObjectSelector decides whether to run the validation based on if the - object has matching labels. objectSelector is evaluated against both - the oldObject and newObject that would be sent to the cel validation, and - is considered to match if either object matches the selector. A null - object (oldObject in the case of create, or newObject in the case of - delete) or an object that cannot have labels (like a - DeploymentRollback or a PodProxyOptions object) is not considered to - match. - Use the object selector only if the webhook is opt-in, because end - users may skip the admission webhook by setting the labels. - Default to the empty LabelSelector, which matches everything. - properties: - matchExpressions: - description: matchExpressions is a list of label - selector requirements. The requirements are - ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that - the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - resourceRules: - description: |- - ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. - The policy cares about an operation if it matches _any_ Rule. - items: - description: NamedRuleWithOperations is a tuple - of Operations and Resources with ResourceNames. - properties: - apiGroups: - description: |- - APIGroups is the API groups the resources belong to. '*' is all groups. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - apiVersions: - description: |- - APIVersions is the API versions the resources belong to. '*' is all versions. - If '*' is present, the length of the slice must be one. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - operations: - description: |- - Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * - for all of those operations and any future admission operations that are added. - If '*' is present, the length of the slice must be one. - Required. - items: - description: OperationType specifies an - operation for a request. - type: string - type: array - x-kubernetes-list-type: atomic - resourceNames: - description: ResourceNames is an optional - white list of names that the rule applies - to. An empty set means that everything - is allowed. - items: - type: string - type: array - x-kubernetes-list-type: atomic - resources: - description: |- - Resources is a list of resources this rule applies to. - - For example: - 'pods' means pods. - 'pods/log' means the log subresource of pods. - '*' means all resources, but not subresources. - 'pods/*' means all subresources of pods. - '*/scale' means all scale subresources. - '*/*' means all resources and their subresources. - - If wildcard is present, the validation rule will ensure resources do not - overlap with each other. - - Depending on the enclosing object, subresources might not be allowed. - Required. - items: - type: string - type: array - x-kubernetes-list-type: atomic - scope: - description: |- - scope specifies the scope of this rule. - Valid values are "Cluster", "Namespaced", and "*" - "Cluster" means that only cluster-scoped resources will match this rule. - Namespace API objects are cluster-scoped. - "Namespaced" means that only namespaced resources will match this rule. - "*" means that there are no scope restrictions. - Subresources match the scope of their parent resource. - Default is "*". - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - validationActions: - description: |- - ValidationAction specifies the action to be taken when the matched resource violates the policy. - Required. - items: - description: ValidationAction specifies a policy enforcement - action. - enum: - - Deny - - Audit - - Warn - type: string - type: array - x-kubernetes-list-type: set - validations: - description: |- - Validations contain CEL expressions which is used to apply the validation. - Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is - required. - items: - description: Validation specifies the CEL expression - which is used to apply the validation. - properties: - expression: - description: "Expression represents the expression - which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL - expressions have access to the contents of the - API request/response, organized into CEL variables - as well as some other useful variables:\n\n- - 'object' - The object from the incoming request. - The value is null for DELETE requests.\n- 'oldObject' - - The existing object. The value is null for - CREATE requests.\n- 'request' - Attributes of - the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- - 'params' - Parameter resource referred to by - the policy binding being evaluated. Only populated - if the policy has a ParamKind.\n- 'namespaceObject' - - The namespace object that the incoming object - belongs to. The value is null for cluster-scoped - resources.\n- 'variables' - Map of composited - variables, from its name to its lazily evaluated - value.\n For example, a variable named 'foo' - can be accessed as 'variables.foo'.\n- 'authorizer' - - A CEL Authorizer. May be used to perform authorization - checks for the principal (user or service account) - of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- - 'authorizer.requestResource' - A CEL ResourceCheck - constructed from the 'authorizer' and configured - with the\n request resource.\n\nThe `apiVersion`, - `kind`, `metadata.name` and `metadata.generateName` - are always accessible from the root of the\nobject. - No other metadata properties are accessible.\n\nOnly - property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` - are accessible.\nAccessible property names are - escaped according to the following rules when - accessed in the expression:\n- '__' escapes - to '__underscores__'\n- '.' escapes to '__dot__'\n- - '-' escapes to '__dash__'\n- '/' escapes to - '__slash__'\n- Property names that exactly match - a CEL RESERVED keyword escape to '__{keyword}__'. - The keywords are:\n\t \"true\", \"false\", - \"null\", \"in\", \"as\", \"break\", \"const\", - \"continue\", \"else\", \"for\", \"function\", - \"if\",\n\t \"import\", \"let\", \"loop\", - \"package\", \"namespace\", \"return\".\nExamples:\n - \ - Expression accessing a property named \"namespace\": - {\"Expression\": \"object.__namespace__ > 0\"}\n - \ - Expression accessing a property named \"x-prop\": - {\"Expression\": \"object.x__dash__prop > 0\"}\n - \ - Expression accessing a property named \"redact__d\": - {\"Expression\": \"object.redact__underscores__d - > 0\"}\n\nEquality on arrays with list type - of 'set' or 'map' ignores element order, i.e. - [1, 2] == [2, 1].\nConcatenation on arrays with - x-kubernetes-list-type use the semantics of - the list type:\n - 'set': `X + Y` performs - a union where the array positions of all elements - in `X` are preserved and\n non-intersecting - elements in `Y` are appended, retaining their - partial order.\n - 'map': `X + Y` performs - a merge where the array positions of all keys - in `X` are preserved but the values\n are - overwritten by values in `Y` when the key sets - of `X` and `Y` intersect. Elements in `Y` with\n - \ non-intersecting keys are appended, retaining - their partial order.\nRequired." - type: string - message: - description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains - line breaks. The message must not contain line breaks. - If unset, the message is "failed rule: {Rule}". - e.g. "must be a URL with the host matching spec.host" - If the Expression contains line breaks. Message is required. - The message must not contain line breaks. - If unset, the message is "failed Expression: {Expression}". - type: string - messageExpression: - description: |- - messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. - Since messageExpression is used as a failure message, it must evaluate to a string. - If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. - If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced - as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string - that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and - the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. - messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. - Example: - "object.x must be less than max ("+string(params.max)+")" - type: string - reason: - description: |- - Reason represents a machine-readable description of why this validation failed. - If this is the first validation in the list to fail, this reason, as well as the - corresponding HTTP response code, are used in the - HTTP response to the client. - The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". - If not set, StatusReasonInvalid is used in the response to the client. - type: string - required: - - expression - type: object - type: array - x-kubernetes-list-type: atomic - variables: - description: |- - Variables contain definitions of variables that can be used in composition of other expressions. - Each variable is defined as a named CEL expression. - The variables defined here will be available under `variables` in other expressions of the policy - except MatchConditions because MatchConditions are evaluated before the rest of the policy. - - The expression of a variable can refer to other variables defined earlier in the list but not those after. - Thus, Variables must be sorted by the order of first appearance and acyclic. - items: - description: Variable is the definition of a variable - that is used for composition. A variable is defined - as a named expression. - properties: - expression: - description: |- - Expression is the expression that will be evaluated as the value of the variable. - The CEL expression has access to the same identifiers as the CEL expressions in Validation. - type: string - name: - description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. - The variable can be accessed in other expressions through `variables` - For example, if name is "foo", the variable will be available as `variables.foo` - type: string - required: - - expression - - name - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - webhookConfiguration: - description: WebhookConfiguration defines the configuration - for the webhook. - properties: - timeoutSeconds: - description: |- - TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. - After the configured time expires, the admission request may fail, or may simply ignore the policy results, - based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. - format: int32 - type: integer - type: object - type: object - required: - - spec - type: object - type: object - type: object - conditionStatus: - description: ConditionStatus is the shared status across all policy - types - properties: - conditions: - items: - description: Condition contains details for one aspect of the - current state of this API Resource. - properties: - lastTransitionTime: - description: |- - lastTransitionTime is the last time the condition transitioned from one status to another. - This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - format: date-time - type: string - message: - description: |- - message is a human readable message indicating details about the transition. - This may be an empty string. - maxLength: 32768 - type: string - observedGeneration: - description: |- - observedGeneration represents the .metadata.generation that the condition was set based upon. - For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the instance. - format: int64 - minimum: 0 - type: integer - reason: - description: |- - reason contains a programmatic identifier indicating the reason for the condition's last transition. - Producers of specific condition types may define expected values and meanings for this field, - and whether the values are considered a guaranteed API. - The value should be a CamelCase string. - This field may not be empty. - maxLength: 1024 - minLength: 1 - pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ - type: string - status: - description: status of the condition, one of True, False, - Unknown. - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: type of condition in CamelCase or in foo.example.com/CamelCase. - maxLength: 316 - pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ - type: string - required: - - lastTransitionTime - - message - - reason - - status - - type - type: object - type: array - message: - description: |- - Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy - It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. - type: string - ready: - description: |- - The ready of a policy is a high-level summary of where the policy is in its lifecycle. - The conditions array, the reason and message fields contain more detail about the policy's status. - type: boolean - type: object - generated: - description: Generated indicates whether a ValidatingAdmissionPolicy/MutatingAdmissionPolicy - is generated from the policy or not - type: boolean - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} -{{- end }} diff --git a/manifests/helm/kyverno/3.4.1/custom-values.yaml b/manifests/helm/kyverno/3.4.1/custom-values.yaml deleted file mode 100644 index 1b8adf9..0000000 --- a/manifests/helm/kyverno/3.4.1/custom-values.yaml +++ /dev/null @@ -1,13 +0,0 @@ -# PaaSup custom-values — kyverno -# -# webhooks/policy-reports 정리 훅이 쓰는 kubectl 이미지가 docker.io/bitnami/kubectl 를 -# 가리키는데, bitnami→bitnamilegacy 이전으로 해당 좌표가 제거됨. 미러 없이 이미지 목록으로 -# 오프라인 패키징하므로 존재하는 좌표(bitnamilegacy)로 지정한다. -# 상세: doc/sbom-pipeline.md, change-bitnami-image.md -webhooksCleanup: - image: - repository: bitnamilegacy/kubectl - -policyReportsCleanup: - image: - repository: bitnamilegacy/kubectl diff --git a/manifests/helm/kyverno/3.4.1/templates/NOTES.txt b/manifests/helm/kyverno/3.4.1/templates/NOTES.txt deleted file mode 100644 index 4ee09d7..0000000 --- a/manifests/helm/kyverno/3.4.1/templates/NOTES.txt +++ /dev/null @@ -1,50 +0,0 @@ -Chart version: {{ .Chart.Version }} -Kyverno version: {{ default .Chart.AppVersion (default .Values.admissionController.container.image.tag .Values.admissionController.initContainer.image.tag) }} - -Thank you for installing {{ .Chart.Name }}! Your release is named {{ .Release.Name }}. - -The following components have been installed in your cluster: -{{- if .Values.crds.install }} -- CRDs -{{- end }} -- Admission controller -{{- if .Values.reportsController.enabled }} -- Reports controller -{{- end }} -{{- if .Values.cleanupController.enabled }} -- Cleanup controller -{{- end }} -{{- if .Values.backgroundController.enabled }} -- Background controller -{{- end }} -{{- if .Values.grafana.enabled }} -- Grafana dashboard -{{- end }} - -{{ if not .Values.admissionController.replicas }} -⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode. -{{- else if lt (int .Values.admissionController.replicas) 2 }} -⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode. -{{- end }} - -{{- if semverCompare "<1.21.0" .Capabilities.KubeVersion.Version }} -⚠️ WARNING: The minimal Kubernetes version officially supported by Kyverno is 1.21. Earlier versions are untested and Kyverno is not guaranteed to work with Kubernetes {{ .Capabilities.KubeVersion.Version }}. -{{- end }} - -{{- with .Values.config.matchConditions }} -⚠️ WARNING: Match conditions require a Kubernetes 1.27+ cluster with `AdmissionWebhookMatchConditions` feature gate enabled. -{{- end }} - -{{- with .Values.features.generateValidatingAdmissionPolicy.enabled }} -⚠️ WARNING: Generating ValidatingAdmissionPolicy requires a Kubernetes 1.27+ cluster with `ValidatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled. -{{- end }} - -{{- with .Values.features.validatingAdmissionPolicyReports.enabled }} -⚠️ WARNING: Generating reports from ValidatingAdmissionPolicies requires a Kubernetes 1.27+ cluster with `ValidatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled. -{{- end }} - -{{ if not .Values.features.policyExceptions.enabled }} -⚠️ WARNING: PolicyExceptions are disabled by default. To enable them, set '--enablePolicyException' to true. -{{- end }} - -💡 Note: There is a trade-off when deciding which approach to take regarding Namespace exclusions. Please see the documentation at https://kyverno.io/docs/installation/#security-vs-operability to understand the risks. diff --git a/manifests/helm/kyverno/3.4.1/templates/hooks/post-upgrade-clean-reports.yaml b/manifests/helm/kyverno/3.4.1/templates/hooks/post-upgrade-clean-reports.yaml deleted file mode 100644 index 28fa2ef..0000000 --- a/manifests/helm/kyverno/3.4.1/templates/hooks/post-upgrade-clean-reports.yaml +++ /dev/null @@ -1,99 +0,0 @@ -{{- if .Values.policyReportsCleanup.enabled -}} -{{- if not .Values.templating.enabled -}} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "kyverno.fullname" . }}-clean-reports - namespace: {{ template "kyverno.namespace" . }} - labels: - {{- include "kyverno.hooks.labels" . | nindent 4 }} - annotations: - helm.sh/hook: post-upgrade - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed -spec: - backoffLimit: 2 - template: - metadata: - {{- with .Values.policyReportsCleanup.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.policyReportsCleanup.podLabels }} - labels: - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }} - {{- with .Values.policyReportsCleanup.podSecurityContext }} - securityContext: - {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - restartPolicy: Never - containers: - - name: kubectl - image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.policyReportsCleanup.image "defaultTag" (default .Chart.AppVersion .Values.policyReportsCleanup.image.tag))) | quote }} - imagePullPolicy: {{ .Values.policyReportsCleanup.image.pullPolicy }} - command: - - /bin/bash - - -c - - | - set -euo pipefail - NAMESPACES=$(kubectl get namespaces --no-headers=true | awk '{print $1}') - - for ns in ${NAMESPACES[@]}; - do - COUNT=$(kubectl get policyreports.wgpolicyk8s.io -n $ns --no-headers=true | awk '/pol/{print $1}' | wc -l) - - if [ $COUNT -gt 0 ]; then - echo "deleting $COUNT policyreports in namespace $ns" - kubectl get policyreports.wgpolicyk8s.io -n $ns --no-headers=true | awk '/pol/{print $1}' | xargs kubectl delete -n $ns policyreports.wgpolicyk8s.io - else - echo "no policyreports in namespace $ns" - fi - done - - COUNT=$(kubectl get clusterpolicyreports.wgpolicyk8s.io --no-headers=true | awk '/pol/{print $1}' | wc -l) - - if [ $COUNT -gt 0 ]; then - echo "deleting $COUNT clusterpolicyreports" - kubectl get clusterpolicyreports.wgpolicyk8s.io --no-headers=true | awk '/pol/{print $1}' | xargs kubectl delete clusterpolicyreports.wgpolicyk8s.io - else - echo "no clusterpolicyreports" - fi - {{- with .Values.policyReportsCleanup.resources }} - resources: - {{- tpl (toYaml .) $ | nindent 12 }} - {{- end }} - {{- with .Values.policyReportsCleanup.securityContext }} - securityContext: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.policyReportsCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }} - imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - {{- with .Values.policyReportsCleanup.tolerations | default .Values.global.tolerations}} - tolerations: - {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - {{- with .Values.policyReportsCleanup.nodeSelector | default .Values.global.nodeSelector }} - nodeSelector: - {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - {{- if or .Values.policyReportsCleanup.podAntiAffinity .Values.policyReportsCleanup.podAffinity .Values.policyReportsCleanup.nodeAffinity }} - affinity: - {{- with .Values.policyReportsCleanup.podAntiAffinity }} - podAntiAffinity: - {{- tpl (toYaml .) $ | nindent 10 }} - {{- end }} - {{- with .Values.policyReportsCleanup.podAffinity }} - podAffinity: - {{- tpl (toYaml .) $ | nindent 10 }} - {{- end }} - {{- with .Values.policyReportsCleanup.nodeAffinity }} - nodeAffinity: - {{- tpl (toYaml .) $ | nindent 10 }} - {{- end }} - {{- end }} -{{- end -}} -{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/rbac/policies.yaml b/manifests/helm/kyverno/3.4.1/templates/rbac/policies.yaml deleted file mode 100644 index c949f80..0000000 --- a/manifests/helm/kyverno/3.4.1/templates/rbac/policies.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if .Values.admissionController.rbac.create -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "kyverno.rbac.roleName" . }}:admin:policies - labels: - {{- include "kyverno.rbac.labels.admin" . | nindent 4 }} -rules: - - apiGroups: - - kyverno.io - resources: - - cleanuppolicies - - clustercleanuppolicies - - policies - - clusterpolicies - verbs: - - create - - delete - - get - - list - - patch - - update - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "kyverno.rbac.roleName" . }}:view:policies - labels: - {{- include "kyverno.rbac.labels.view" . | nindent 4 }} -rules: - - apiGroups: - - kyverno.io - resources: - - cleanuppolicies - - clustercleanuppolicies - - policies - - clusterpolicies - verbs: - - get - - list - - watch -{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-liveness.yaml b/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-liveness.yaml deleted file mode 100644 index 756a309..0000000 --- a/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-liveness.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{- if .Values.admissionController.enabled -}} -apiVersion: v1 -kind: Pod -metadata: - name: {{ template "kyverno.fullname" . }}-admission-controller-liveness - namespace: {{ template "kyverno.namespace" . }} - labels: - {{- include "kyverno.test.labels" . | nindent 4 }} - annotations: - {{- include "kyverno.test.annotations" . | nindent 4 }} -spec: - restartPolicy: Never - {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} - imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 4 }} - {{- end }} - containers: - - name: test - image: {{ template "kyverno.test.image" . }} - imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }} - {{- with .Values.test.resources }} - resources: - {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - {{- with .Values.test.securityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - command: - - /bin/sh - - -c - - sleep {{ .Values.test.sleep }} ; wget -O- -S --no-check-certificate https://{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}:{{ .Values.admissionController.service.port }}/health/liveness -{{- end -}} \ No newline at end of file diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-readiness.yaml b/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-readiness.yaml deleted file mode 100644 index 093a0a2..0000000 --- a/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-readiness.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{- if .Values.admissionController.enabled -}} -apiVersion: v1 -kind: Pod -metadata: - name: {{ template "kyverno.fullname" . }}-admission-controller-readiness - namespace: {{ template "kyverno.namespace" . }} - labels: - {{- include "kyverno.test.labels" . | nindent 4 }} - annotations: - {{- include "kyverno.test.annotations" . | nindent 4 }} -spec: - restartPolicy: Never - {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} - imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 4 }} - {{- end }} - containers: - - name: test - image: {{ template "kyverno.test.image" . }} - imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }} - {{- with .Values.test.resources }} - resources: - {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - {{- with .Values.test.securityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - command: - - /bin/sh - - -c - - sleep {{ .Values.test.sleep }} ; wget -O- -S --no-check-certificate https://{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}:{{ .Values.admissionController.service.port }}/health/readiness -{{- end -}} \ No newline at end of file diff --git a/manifests/helm/kyverno/3.4.1/BUILD-README.md b/manifests/helm/kyverno/3.9.0/BUILD-README.md similarity index 100% rename from manifests/helm/kyverno/3.4.1/BUILD-README.md rename to manifests/helm/kyverno/3.9.0/BUILD-README.md diff --git a/manifests/helm/kyverno/3.9.0/CUSTOM-README.md b/manifests/helm/kyverno/3.9.0/CUSTOM-README.md new file mode 100644 index 0000000..ea5c3da --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/CUSTOM-README.md @@ -0,0 +1,34 @@ +# Upgrade History + +## 3.8.2 → 3.9.0 +### 변경 요약 +- from_version: 3.8.2 +- to_version: 3.9.0 +- Chart `kyverno` 3.8.2 → 3.9.0 업데이트 +- Values: +11 / -4 / ~0 / type~0 +- Templates: +0 / -0 +- Dependencies: +0 / -0 / ~3 + +### custom-values.yaml 수정 필요 항목 +없음 + +### 배포 시 주의사항 +- **values_key_removed** admissionController.nodeSelector.kubernetes.io/os: custom-values.yaml에서 사용하지 않는 key 삭제 — 수정 불필요 +- **values_key_removed** backgroundController.nodeSelector.kubernetes.io/os: custom-values.yaml에서 사용하지 않는 key 삭제 — 수정 불필요 +- **values_key_removed** cleanupController.nodeSelector.kubernetes.io/os: custom-values.yaml에서 사용하지 않는 key 삭제 — 수정 불필요 +- **values_key_removed** reportsController.nodeSelector.kubernetes.io/os: custom-values.yaml에서 사용하지 않는 key 삭제 — 수정 불필요 + +### 참고 +- severity: warning +- breaking: false + + +# Kyverno 배포 + +## 1. 배포 방법 + +``` sh +git clone https://github.com/paasup/dip-catalog.git +cd charts/kyverno +helm upgrade kyverno --install ./ -n kyverno --create-namespace +``` diff --git a/manifests/helm/kyverno/3.9.0/Chart.lock b/manifests/helm/kyverno/3.9.0/Chart.lock new file mode 100644 index 0000000..f35c490 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/Chart.lock @@ -0,0 +1,18 @@ +dependencies: +- name: grafana + repository: "" + version: 3.9.0 +- name: crds + repository: "" + version: 3.9.0 +- name: kyverno-api + repository: https://kyverno.github.io/api + version: 0.0.1-alpha.4 +- name: openreports + repository: https://openreports.github.io/reports-api + version: 0.1.0 +- name: reports-server + repository: https://kyverno.github.io/reports-server/ + version: 0.1.6 +digest: sha256:f20b04d6c8741b0cab6ed36a1b210b8a3dd6ff61081f5b667eb0e486698374f7 +generated: "2026-08-20T13:48:54.407602+08:00" diff --git a/manifests/helm/kyverno/3.9.0/Chart.yaml b/manifests/helm/kyverno/3.9.0/Chart.yaml new file mode 100644 index 0000000..b79e674 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/Chart.yaml @@ -0,0 +1,62 @@ +annotations: + artifacthub.io/changes: | + - kind: fixed + description: Ensure spec.template.metadata isn't null + - kind: removed + description: Remove the `delete` permission for policyexceptions in the admission controller + - kind: changed + description: Enable the flag `--generateValidatingAdmissionPolicy` by default in the admission controller. + - kind: changed + description: Enable the flag `--validatingAdmissionPolicyReports` by default in the reports controller. + - kind: added + description: Add support for configuring container lifecycle hooks (e.g. a preStop sleep) on the admission, background, cleanup and reports controllers. + artifacthub.io/license: Apache-2.0 + artifacthub.io/links: | + - name: Documentation + url: https://kyverno.io/docs + artifacthub.io/operator: "false" + artifacthub.io/prerelease: "false" +apiVersion: v2 +appVersion: v1.19.0 +dependencies: +- condition: grafana.enabled + name: grafana + repository: "" + version: 3.9.0 +- condition: crds.install + name: crds + repository: "" + version: 3.9.0 +- condition: crds.install + name: kyverno-api + repository: https://kyverno.github.io/api + version: 0.0.1-alpha.4 +- condition: openreports.installCrds + name: openreports + repository: https://openreports.github.io/reports-api + version: 0.1.0 +- condition: reportsServer.enabled + name: reports-server + repository: https://kyverno.github.io/reports-server/ + version: 0.1.6 +description: Kubernetes Native Policy Management +home: https://kyverno.io/ +icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png +keywords: +- kubernetes +- policy agent +- policy +- validating webhook +- admission controller +- mutation +- mutate +- validate +- generate +- supply chain +- security +kubeVersion: '>=1.25.0-0' +name: kyverno +sources: +- https://github.com/kyverno/kyverno +type: application +version: 3.9.0 diff --git a/manifests/helm/kyverno/3.4.1/README.md b/manifests/helm/kyverno/3.9.0/README.md similarity index 72% rename from manifests/helm/kyverno/3.4.1/README.md rename to manifests/helm/kyverno/3.9.0/README.md index adfb0b7..ef419e3 100644 --- a/manifests/helm/kyverno/3.4.1/README.md +++ b/manifests/helm/kyverno/3.9.0/README.md @@ -2,7 +2,7 @@ Kubernetes Native Policy Management -![Version: 3.4.1](https://img.shields.io/badge/Version-3.4.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.14.1](https://img.shields.io/badge/AppVersion-v1.14.1-informational?style=flat-square) +![Version: 3.9.0](https://img.shields.io/badge/Version-3.9.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.19.0](https://img.shields.io/badge/AppVersion-v1.19.0-informational?style=flat-square) ## About @@ -252,19 +252,31 @@ The command removes all the Kubernetes components associated with the chart and The chart values are organised per component. +### Outbound API call token + +Kyverno projects a dedicated ServiceAccount token for outbound APICall and CEL HTTP requests. +Configure this token with `apiCallToken.*`: + +- `apiCallToken.audience` (default: `kyverno-svc.kyverno.io`) sets the OIDC `aud` claim expected by your receiving service. +- `apiCallToken.expirationSeconds` (default: `3600`) sets token lifetime before kubelet rotation. + +The default audience is Kyverno-specific so leaked tokens are not accepted by the Kubernetes API server. + ### Custom resource definitions | Key | Type | Default | Description | |-----|------|---------|-------------| | crds.install | bool | `true` | Whether to have Helm install the Kyverno CRDs, if the CRDs are not installed by Helm, they must be added before policies can be created | -| crds.groups.kyverno | object | `{"cleanuppolicies":true,"clustercleanuppolicies":true,"clusterpolicies":true,"globalcontextentries":true,"policies":true,"policyexceptions":true,"updaterequests":true,"validatingpolicies":true}` | Install CRDs in group `kyverno.io` | -| crds.groups.policies | object | `{"imagevalidatingpolicies":true,"policyexceptions":true,"validatingpolicies":true}` | Install CRDs in group `policies.kyverno.io` | +| crds.reportsServer.enabled | bool | `false` | Kyverno reports-server is used in your cluster | +| crds.groups.kyverno | object | `{"cleanuppolicies":true,"clustercleanuppolicies":true,"clusterpolicies":true,"globalcontextentries":true,"policies":true,"policyexceptions":true,"updaterequests":true}` | Install CRDs in group `kyverno.io`. Note: the legacy policy types in this group (`ClusterPolicy`, `Policy`, `ClusterCleanupPolicy`, `CleanupPolicy`, `PolicyException`) are deprecated and will be removed in a future release, migrate to the `policies.kyverno.io` policy types (see https://kyverno.io/docs/guides/migration-to-cel/). | +| crds.groups.policies | object | `{"deletingpolicies":true,"generatingpolicies":true,"imagevalidatingpolicies":true,"mutatingpolicies":true,"namespaceddeletingpolicies":true,"namespacedimagevalidatingpolicies":true,"namespacedmutatingpolicies":true,"namespacedvalidatingpolicies":true,"policyexceptions":true,"validatingpolicies":true}` | Install CRDs in group `policies.kyverno.io` | | crds.groups.reports | object | `{"clusterephemeralreports":true,"ephemeralreports":true}` | Install CRDs in group `reports.kyverno.io` | | crds.groups.wgpolicyk8s | object | `{"clusterpolicyreports":true,"policyreports":true}` | Install CRDs in group `wgpolicyk8s.io` | | crds.annotations | object | `{}` | Additional CRDs annotations | | crds.customLabels | object | `{}` | Additional CRDs labels | | crds.migration.enabled | bool | `true` | Enable CRDs migration using helm post upgrade hook | -| crds.migration.resources | list | `["cleanuppolicies.kyverno.io","clustercleanuppolicies.kyverno.io","clusterpolicies.kyverno.io","globalcontextentries.kyverno.io","policies.kyverno.io","policyexceptions.kyverno.io","updaterequests.kyverno.io"]` | Resources to migrate | +| crds.migration.extraArgs | object | `{}` | Additional CLI flags passed to the migration job | +| crds.migration.resources | list | `["cleanuppolicies.kyverno.io","clustercleanuppolicies.kyverno.io","clusterpolicies.kyverno.io","globalcontextentries.kyverno.io","policies.kyverno.io","policyexceptions.kyverno.io","updaterequests.kyverno.io","deletingpolicies.policies.kyverno.io","generatingpolicies.policies.kyverno.io","imagevalidatingpolicies.policies.kyverno.io","mutatingpolicies.policies.kyverno.io","namespaceddeletingpolicies.policies.kyverno.io","namespacedgeneratingpolicies.policies.kyverno.io","namespacedimagevalidatingpolicies.policies.kyverno.io","namespacedmutatingpolicies.policies.kyverno.io","namespacedvalidatingpolicies.policies.kyverno.io","policyexceptions.policies.kyverno.io","validatingpolicies.policies.kyverno.io"]` | Resources to migrate | | crds.migration.image.registry | string | `nil` | Image registry | | crds.migration.image.defaultRegistry | string | `"reg.kyverno.io"` | | | crds.migration.image.repository | string | `"kyverno/kyverno-cli"` | Image repository | @@ -272,7 +284,7 @@ The chart values are organised per component. | crds.migration.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | | crds.migration.imagePullSecrets | list | `[]` | Image pull secrets | | crds.migration.podSecurityContext | object | `{}` | Security context for the pod | -| crds.migration.nodeSelector | object | `{}` | Node labels for pod assignment | +| crds.migration.nodeSelector | object | `{}` | Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. | | crds.migration.tolerations | list | `[]` | List of node taints to tolerate | | crds.migration.podAntiAffinity | object | `{}` | Pod anti affinity constraints. | | crds.migration.podAffinity | object | `{}` | Pod affinity constraints. | @@ -282,6 +294,10 @@ The chart values are organised per component. | crds.migration.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the hook containers | | crds.migration.podResources.limits | object | `{"cpu":"100m","memory":"256Mi"}` | Pod resource limits | | crds.migration.podResources.requests | object | `{"cpu":"10m","memory":"64Mi"}` | Pod resource requests | +| crds.migration.serviceAccount.automountServiceAccountToken | bool | `true` | Toggle automounting of the ServiceAccount. When set to false, a projected service account token is used instead which provides time-limited and audience-bound tokens for improved security. | +| crds.migration.serviceAccount.projectedServiceAccountToken | object | `{"audience":"","expirationSeconds":3600}` | Projected service account token configuration (only used when automountServiceAccountToken is false) | +| crds.migration.serviceAccount.projectedServiceAccountToken.expirationSeconds | int | `3600` | Token expiration time in seconds. The kubelet will request a new token before the token expires. | +| crds.migration.serviceAccount.projectedServiceAccountToken.audience | string | `""` | Audience for the projected service account token. If not set, the token will have no audience restriction. | ### Config @@ -298,6 +314,8 @@ The chart values are organised per component. | config.excludeRoles | list | `[]` | Exclude roles | | config.excludeClusterRoles | list | `[]` | Exclude roles | | config.generateSuccessEvents | bool | `false` | Generate success events. | +| config.successEventActions | string | "" (empty, all success events are emitted when generateSuccessEvents is true) | Comma-separated list of event actions for which success events should be generated. When set, only success events matching the specified actions are emitted. Requires `generateSuccessEvents` to be `true`. Valid values: "Resource Mutated", "Resource Passed", "Resource Generated", "Resource Cleaned Up". Example: "Resource Mutated" or "Resource Mutated,Resource Generated". | +| config.maxContextSize | string | 2Mi | Maximum cumulative size of context data during policy evaluation. Supports Kubernetes quantity format (e.g., 100Mi, 2Gi) or plain bytes (e.g., 2097152). Limits memory used by context variables to prevent unbounded growth. Increase if policies legitimately need large context data (e.g., processing large ConfigMaps). Set to 0 to disable the limit (not recommended for production). | | config.resourceFilters | list | See [values.yaml](values.yaml) | Resource types to be skipped by the Kyverno policy engine. Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list. These are joined together without spaces, run through `tpl`, and the result is set in the config map. | | config.updateRequestThreshold | int | `1000` | Sets the threshold for the total number of UpdateRequests generated for mutateExisitng and generate policies. | | config.webhooks | object | `{"namespaceSelector":{"matchExpressions":[{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kube-system"]}]}}` | Defines the `namespaceSelector`/`objectSelector` in the webhook configurations. The Kyverno namespace is excluded if `excludeKyvernoNamespace` is `true` (default) | @@ -321,7 +339,7 @@ The chart values are organised per component. | metricsConfig.namespaces.exclude | list | `[]` | list of namespaces to NOT capture metrics for. | | metricsConfig.metricsRefreshInterval | string | `nil` | Rate at which metrics should reset so as to clean up the memory footprint of kyverno metrics, if you might be expecting high memory footprint of Kyverno's metrics. Default: 0, no refresh of metrics. WARNING: This flag is not working since Kyverno 1.8.0 | | metricsConfig.bucketBoundaries | list | `[0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10,15,20,25,30]` | Configures the bucket boundaries for all Histogram metrics, changing this configuration requires restart of the kyverno admission controller | -| metricsConfig.metricsExposure | map | `{"kyverno_admission_requests_total":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_admission_review_duration_seconds":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_cleanup_controller_deletedobjects_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_policy_rule_info_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]}}` | Configures the exposure of individual metrics, by default all metrics and all labels are exported, changing this configuration requires restart of the kyverno admission controller | +| metricsConfig.metricsExposure | map | `{"kyverno_admission_requests_total":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_admission_review_duration_seconds":{"disabledLabelDimensions":["resource_namespace"]},"kyverno_cleanup_controller_deletedobjects_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_generating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_generating_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_image_validating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_image_validating_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_mutating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_mutating_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_policy_rule_info_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]},"kyverno_validating_policy_execution_duration_seconds":{"disabledLabelDimensions":["resource_namespace","resource_request_operation"]},"kyverno_validating_policy_results_total":{"disabledLabelDimensions":["resource_namespace","policy_namespace"]}}` | Configures the exposure of individual metrics, by default all metrics and all labels are exported, changing this configuration requires restart of the kyverno admission controller | ### Features @@ -330,24 +348,30 @@ The chart values are organised per component. | features.admissionReports.enabled | bool | `true` | Enables the feature | | features.aggregateReports.enabled | bool | `true` | Enables the feature | | features.policyReports.enabled | bool | `true` | Enables the feature | -| features.validatingAdmissionPolicyReports.enabled | bool | `false` | Enables the feature | +| features.validatingAdmissionPolicyReports.enabled | bool | `true` | Enables the feature | +| features.mutatingAdmissionPolicyReports.enabled | bool | `false` | Enables the feature | | features.reporting.validate | bool | `true` | Enables the feature | | features.reporting.mutate | bool | `true` | Enables the feature | | features.reporting.mutateExisting | bool | `true` | Enables the feature | | features.reporting.imageVerify | bool | `true` | Enables the feature | | features.reporting.generate | bool | `true` | Enables the feature | | features.autoUpdateWebhooks.enabled | bool | `true` | Enables the feature | +| features.excludeBootstrapResources.enabled | bool | `false` | Excludes cluster bootstrap resources (Node, CertificateSigningRequest) from Fail resource webhooks to avoid a webhook deadlock when the cluster restarts with no Kyverno pods running. Policies targeting these resources are not enforced while enabled. | | features.backgroundScan.enabled | bool | `true` | Enables the feature | | features.backgroundScan.backgroundScanWorkers | int | `2` | Number of background scan workers | | features.backgroundScan.backgroundScanInterval | string | `"1h"` | Background scan interval | | features.backgroundScan.skipResourceFilters | bool | `true` | Skips resource filters in background scan | | features.configMapCaching.enabled | bool | `true` | Enables the feature | +| features.controllerRuntimeMetrics.bindAddress | string | `":8080"` | Bind address for controller-runtime metrics (use "0" to disable it) | | features.deferredLoading.enabled | bool | `true` | Enables the feature | | features.dumpPayload.enabled | bool | `false` | Enables the feature | | features.forceFailurePolicyIgnore.enabled | bool | `false` | Enables the feature | -| features.generateValidatingAdmissionPolicy.enabled | bool | `false` | Enables the feature | +| features.generateValidatingAdmissionPolicy.enabled | bool | `true` | Enables the feature | +| features.generateMutatingAdmissionPolicy.enabled | bool | `false` | Enables the feature | | features.dumpPatches.enabled | bool | `false` | Enables the feature | | features.globalContext.maxApiCallResponseLength | int | `2000000` | Maximum allowed response size from API Calls. A value of 0 bypasses checks (not recommended) | +| features.globalContext.apiCallTimeout | string | `"30s"` | Timeout for HTTP API calls made by policies. A value of 0s means no timeout. | +| features.globalContext.maxGlobalContextEntries | int | `0` | Maximum number of entries in the global context store. A value of 0 means unbounded. | | features.logging.format | string | `"text"` | Logging format | | features.logging.verbosity | int | `2` | Logging verbosity | | features.omitEvents.eventTypes | list | `["PolicyApplied","PolicySkipped"]` | Events which should not be emitted (possible values `PolicyViolation`, `PolicyApplied`, `PolicyError`, and `PolicySkipped`) | @@ -370,6 +394,7 @@ The chart values are organised per component. | admissionController.autoscaling.minReplicas | int | `1` | Minimum number of pods | | admissionController.autoscaling.maxReplicas | int | `10` | Maximum number of pods | | admissionController.autoscaling.targetCPUUtilizationPercentage | int | `80` | Target CPU utilization percentage | +| admissionController.autoscaling.targetMemoryUtilizationPercentage | int | `nil` | Target memory utilization percentage | | admissionController.autoscaling.behavior | object | `{}` | Configurable scaling behavior | | admissionController.featuresOverride | object | `{"admissionReports":{"backPressureThreshold":1000}}` | Overrides features defined at the root level | | admissionController.featuresOverride.admissionReports.backPressureThreshold | int | `1000` | Max number of admission reports allowed in flight until the admission controller stops creating new ones | @@ -378,14 +403,36 @@ The chart values are organised per component. | admissionController.rbac.viewRoleName | string | `"view"` | The view role to use in the rolebinding | | admissionController.rbac.serviceAccount.name | string | `nil` | The ServiceAccount name | | admissionController.rbac.serviceAccount.annotations | object | `{}` | Annotations for the ServiceAccount | +| admissionController.rbac.serviceAccount.automountServiceAccountToken | bool | `true` | Toggle automounting of the ServiceAccount. When set to false, a projected service account token is used instead which provides time-limited and audience-bound tokens for improved security. | +| admissionController.rbac.serviceAccount.projectedServiceAccountToken | object | `{"audience":"","expirationSeconds":3600}` | Projected service account token configuration (only used when automountServiceAccountToken is false) | +| admissionController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | int | `3600` | Token expiration time in seconds. The kubelet will request a new token before the token expires. | +| admissionController.rbac.serviceAccount.projectedServiceAccountToken.audience | string | `""` | Audience for the projected service account token. If not set, the token will have no audience restriction. | | admissionController.rbac.coreClusterRole.extraResources | list | See [values.yaml](values.yaml) | Extra resource permissions to add in the core cluster role. This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. | | admissionController.rbac.clusterRole.extraResources | list | `[]` | Extra resource permissions to add in the cluster role | | admissionController.createSelfSignedCert | bool | `false` | Create self-signed certificates at deployment time. The certificates won't be automatically renewed if this is set to `true`. | +| admissionController.tlsKeyAlgorithm | string | `"RSA"` | Key algorithm for self-signed TLS certificates. Supported values: RSA, ECDSA, Ed25519 Only used when createSelfSignedCert is false (Kyverno-managed certificates). | +| admissionController.certManager | object | `{"algorithm":"RSA","ca":{"duration":"87600h","renewBefore":"720h"},"createSelfSignedIssuer":true,"enabled":false,"issuerRef":{"group":"cert-manager.io","kind":"ClusterIssuer","name":""},"size":2048,"tls":{"duration":"8760h","renewBefore":"720h"}}` | Configure cert-manager to manage TLS certificates. When enabled, cert-manager Certificate resources will be created to provision the TLS certificates for the admission controller. Requires cert-manager to be installed in the cluster. Takes precedence over createSelfSignedCert when enabled. | +| admissionController.certManager.enabled | bool | `false` | Enable cert-manager integration for certificate management | +| admissionController.certManager.createSelfSignedIssuer | bool | `true` | Create a self-signed ClusterIssuer for CA generation. Set to false if you want to use an existing issuer specified in issuerRef. | +| admissionController.certManager.issuerRef | object | `{"group":"cert-manager.io","kind":"ClusterIssuer","name":""}` | Reference to an existing issuer for signing CA certificates. Only used when createSelfSignedIssuer is false. | +| admissionController.certManager.issuerRef.name | string | `""` | Name of the issuer | +| admissionController.certManager.issuerRef.kind | string | `"ClusterIssuer"` | Kind of the issuer (ClusterIssuer or Issuer) | +| admissionController.certManager.issuerRef.group | string | `"cert-manager.io"` | Group of the issuer | +| admissionController.certManager.algorithm | string | `"RSA"` | Key algorithm for certificates (RSA, ECDSA, Ed25519) | +| admissionController.certManager.size | int | `2048` | Key size for RSA (2048, 4096) or ECDSA (256, 384). Ignored for Ed25519. | +| admissionController.certManager.ca | object | `{"duration":"87600h","renewBefore":"720h"}` | CA certificate configuration | +| admissionController.certManager.ca.duration | string | `"87600h"` | Duration of the CA certificate (default 10 years) | +| admissionController.certManager.ca.renewBefore | string | `"720h"` | Time before expiry to renew the CA certificate (default 30 days) | +| admissionController.certManager.tls | object | `{"duration":"8760h","renewBefore":"720h"}` | TLS certificate configuration | +| admissionController.certManager.tls.duration | string | `"8760h"` | Duration of the TLS certificate (default 1 year) | +| admissionController.certManager.tls.renewBefore | string | `"720h"` | Time before expiry to renew the TLS certificate (default 30 days) | | admissionController.replicas | int | `nil` | Desired number of pods | | admissionController.revisionHistoryLimit | int | `10` | The number of revisions to keep | | admissionController.resyncPeriod | string | `"15m"` | Resync period for informers | +| admissionController.crdWatcher | bool | `false` | Enable/Disable custom resource watcher to invalidate cache | | admissionController.podLabels | object | `{}` | Additional labels to add to each pod | | admissionController.podAnnotations | object | `{}` | Additional annotations to add to each pod | +| admissionController.labels | object | `{}` | Deployment labels. | | admissionController.annotations | object | `{}` | Deployment annotations. | | admissionController.updateStrategy | object | See [values.yaml](values.yaml) | Deployment update strategy. Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy | | admissionController.priorityClassName | string | `""` | Optional priority class | @@ -398,7 +445,7 @@ The chart values are organised per component. | admissionController.startupProbe | object | See [values.yaml](values.yaml) | Startup probe. The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want. ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ | | admissionController.livenessProbe | object | See [values.yaml](values.yaml) | Liveness probe. The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want. ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ | | admissionController.readinessProbe | object | See [values.yaml](values.yaml) | Readiness Probe. The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want. ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ | -| admissionController.nodeSelector | object | `{}` | Node labels for pod assignment | +| admissionController.nodeSelector | object | `{}` | Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. | | admissionController.tolerations | list | `[]` | List of node taints to tolerate | | admissionController.antiAffinity.enabled | bool | `true` | Pod antiAffinities toggle. Enabled by default but can be disabled if you want to schedule pods to the same node. | | admissionController.podAntiAffinity | object | See [values.yaml](values.yaml) | Pod anti affinity constraints. | @@ -409,6 +456,7 @@ The chart values are organised per component. | admissionController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | admissionController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | admissionController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | +| admissionController.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | Unhealthy pod eviction policy to be used. Possible values are `IfHealthyBudget` or `AlwaysAllow`. | | admissionController.tufRootMountPath | string | `"/.sigstore"` | A writable volume to use for the TUF root initialization. | | admissionController.sigstoreVolume | object | `{"emptyDir":{}}` | Volume to be mounted in pods for TUF/cosign work. | | admissionController.caCertificates.data | string | `nil` | CA certificates to use with Kyverno deployments This value is expected to be one large string of CA certificates | @@ -421,7 +469,7 @@ The chart values are organised per component. | admissionController.initContainer.image.pullPolicy | string | `nil` | Image pull policy If missing, defaults to image.pullPolicy | | admissionController.initContainer.resources.limits | object | `{"cpu":"100m","memory":"256Mi"}` | Pod resource limits | | admissionController.initContainer.resources.requests | object | `{"cpu":"10m","memory":"64Mi"}` | Pod resource requests | -| admissionController.initContainer.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context | +| admissionController.initContainer.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context | | admissionController.initContainer.extraArgs | object | `{}` | Additional container args. | | admissionController.initContainer.extraEnvVars | list | `[]` | Additional container environment variables. | | admissionController.container.image.registry | string | `nil` | Image registry | @@ -431,23 +479,29 @@ The chart values are organised per component. | admissionController.container.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | | admissionController.container.resources.limits | object | `{"memory":"384Mi"}` | Pod resource limits | | admissionController.container.resources.requests | object | `{"cpu":"100m","memory":"128Mi"}` | Pod resource requests | -| admissionController.container.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context | +| admissionController.container.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context | +| admissionController.container.lifecycle | object | `{}` | Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. | | admissionController.container.extraArgs | object | `{}` | Additional container args. | | admissionController.container.extraEnvVars | list | `[]` | Additional container environment variables. | | admissionController.extraInitContainers | list | `[]` | Array of extra init containers | | admissionController.extraContainers | list | `[]` | Array of extra containers to run alongside kyverno | +| admissionController.extraVolumes | list | `[]` | Additional volumes to be mounted in the pod | +| admissionController.extraVolumeMounts | list | `[]` | Additional volumeMounts to be mounted to the main container | | admissionController.service.port | int | `443` | Service port. | | admissionController.service.type | string | `"ClusterIP"` | Service type. | | admissionController.service.nodePort | string | `nil` | Service node port. Only used if `type` is `NodePort`. | | admissionController.service.annotations | object | `{}` | Service annotations. | +| admissionController.service.trafficDistribution | string | `nil` | Service traffic distribution policy. Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. | | admissionController.metricsService.create | bool | `true` | Create service. | | admissionController.metricsService.port | int | `8000` | Service port. Kyverno's metrics server will be exposed at this port. | | admissionController.metricsService.type | string | `"ClusterIP"` | Service type. | | admissionController.metricsService.nodePort | string | `nil` | Service node port. Only used if `type` is `NodePort`. | | admissionController.metricsService.annotations | object | `{}` | Service annotations. | +| admissionController.metricsService.trafficDistribution | string | `nil` | Service traffic distribution policy. Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. | | admissionController.networkPolicy.enabled | bool | `false` | When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. | | admissionController.networkPolicy.ingressFrom | list | `[]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. | | admissionController.serviceMonitor.enabled | bool | `false` | Create a `ServiceMonitor` to collect Prometheus metrics. | +| admissionController.serviceMonitor.additionalAnnotations | object | `{}` | Additional annotations | | admissionController.serviceMonitor.additionalLabels | object | `{}` | Additional labels | | admissionController.serviceMonitor.namespace | string | `nil` | Override namespace | | admissionController.serviceMonitor.interval | string | `"30s"` | Interval to scrape metrics | @@ -463,6 +517,8 @@ The chart values are organised per component. | admissionController.metering.disabled | bool | `false` | Disable metrics export | | admissionController.metering.config | string | `"prometheus"` | Otel configuration, can be `prometheus` or `grpc` | | admissionController.metering.port | int | `8000` | Prometheus endpoint port | +| admissionController.metering.secure | bool | `false` | Is TLS required for endpoint | +| admissionController.metering.tlsKeyAlgorithm | string | `"RSA"` | Key algorithm for self-signed TLS certificates. Supported values: RSA, ECDSA, Ed25519 | | admissionController.metering.collector | string | `""` | Otel collector endpoint | | admissionController.metering.creds | string | `""` | Otel collector credentials | | admissionController.profiling.enabled | bool | `false` | Enable profiling | @@ -481,6 +537,10 @@ The chart values are organised per component. | backgroundController.rbac.viewRoleName | string | `"view"` | The view role to use in the rolebinding | | backgroundController.rbac.serviceAccount.name | string | `nil` | Service account name | | backgroundController.rbac.serviceAccount.annotations | object | `{}` | Annotations for the ServiceAccount | +| backgroundController.rbac.serviceAccount.automountServiceAccountToken | bool | `true` | Toggle automounting of the ServiceAccount. When set to false, a projected service account token is used instead which provides time-limited and audience-bound tokens for improved security. | +| backgroundController.rbac.serviceAccount.projectedServiceAccountToken | object | `{"audience":"","expirationSeconds":3600}` | Projected service account token configuration (only used when automountServiceAccountToken is false) | +| backgroundController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | int | `3600` | Token expiration time in seconds. The kubelet will request a new token before the token expires. | +| backgroundController.rbac.serviceAccount.projectedServiceAccountToken.audience | string | `""` | Audience for the projected service account token. If not set, the token will have no audience restriction. | | backgroundController.rbac.coreClusterRole.extraResources | list | See [values.yaml](values.yaml) | Extra resource permissions to add in the core cluster role. This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. | | backgroundController.rbac.clusterRole.extraResources | list | `[]` | Extra resource permissions to add in the cluster role | | backgroundController.image.registry | string | `nil` | Image registry | @@ -494,6 +554,7 @@ The chart values are organised per component. | backgroundController.resyncPeriod | string | `"15m"` | Resync period for informers | | backgroundController.podLabels | object | `{}` | Additional labels to add to each pod | | backgroundController.podAnnotations | object | `{}` | Additional annotations to add to each pod | +| backgroundController.labels | object | `{}` | Deployment labels. | | backgroundController.annotations | object | `{}` | Deployment annotations. | | backgroundController.updateStrategy | object | See [values.yaml](values.yaml) | Deployment update strategy. Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy | | backgroundController.priorityClassName | string | `""` | Optional priority class | @@ -504,7 +565,7 @@ The chart values are organised per component. | backgroundController.extraEnvVars | list | `[]` | Additional container environment variables. | | backgroundController.resources.limits | object | `{"memory":"128Mi"}` | Pod resource limits | | backgroundController.resources.requests | object | `{"cpu":"100m","memory":"64Mi"}` | Pod resource requests | -| backgroundController.nodeSelector | object | `{}` | Node labels for pod assignment | +| backgroundController.nodeSelector | object | `{}` | Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. | | backgroundController.tolerations | list | `[]` | List of node taints to tolerate | | backgroundController.antiAffinity.enabled | bool | `true` | Pod antiAffinities toggle. Enabled by default but can be disabled if you want to schedule pods to the same node. | | backgroundController.podAntiAffinity | object | See [values.yaml](values.yaml) | Pod anti affinity constraints. | @@ -512,20 +573,26 @@ The chart values are organised per component. | backgroundController.nodeAffinity | object | `{}` | Node affinity constraints. | | backgroundController.topologySpreadConstraints | list | `[]` | Topology spread constraints. | | backgroundController.podSecurityContext | object | `{}` | Security context for the pod | -| backgroundController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| backgroundController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| backgroundController.lifecycle | object | `{}` | Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. | | backgroundController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | backgroundController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | backgroundController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | +| backgroundController.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | Unhealthy pod eviction policy to be used. Possible values are `IfHealthyBudget` or `AlwaysAllow`. | | backgroundController.caCertificates.data | string | `nil` | CA certificates to use with Kyverno deployments This value is expected to be one large string of CA certificates | | backgroundController.caCertificates.volume | object | `{}` | Volume to be mounted for CA certificates Not used when `.Values.backgroundController.caCertificates.data` is defined | +| backgroundController.extraVolumes | list | `[]` | Additional volumes to be mounted in the pod | +| backgroundController.extraVolumeMounts | list | `[]` | Additional volumeMounts to be mounted to the main container | | backgroundController.metricsService.create | bool | `true` | Create service. | | backgroundController.metricsService.port | int | `8000` | Service port. Metrics server will be exposed at this port. | | backgroundController.metricsService.type | string | `"ClusterIP"` | Service type. | | backgroundController.metricsService.nodePort | string | `nil` | Service node port. Only used if `metricsService.type` is `NodePort`. | | backgroundController.metricsService.annotations | object | `{}` | Service annotations. | +| backgroundController.metricsService.trafficDistribution | string | `nil` | Service traffic distribution policy. Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. | | backgroundController.networkPolicy.enabled | bool | `false` | When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. | | backgroundController.networkPolicy.ingressFrom | list | `[]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. | | backgroundController.serviceMonitor.enabled | bool | `false` | Create a `ServiceMonitor` to collect Prometheus metrics. | +| backgroundController.serviceMonitor.additionalAnnotations | object | `{}` | Additional annotations | | backgroundController.serviceMonitor.additionalLabels | object | `{}` | Additional labels | | backgroundController.serviceMonitor.namespace | string | `nil` | Override namespace | | backgroundController.serviceMonitor.interval | string | `"30s"` | Interval to scrape metrics | @@ -541,6 +608,8 @@ The chart values are organised per component. | backgroundController.metering.disabled | bool | `false` | Disable metrics export | | backgroundController.metering.config | string | `"prometheus"` | Otel configuration, can be `prometheus` or `grpc` | | backgroundController.metering.port | int | `8000` | Prometheus endpoint port | +| backgroundController.metering.secure | bool | `false` | Is TLS required for endpoint | +| backgroundController.metering.tlsKeyAlgorithm | string | `"RSA"` | Key algorithm for self-signed TLS certificates. Supported values: RSA, ECDSA, Ed25519 | | backgroundController.metering.collector | string | `""` | Otel collector endpoint | | backgroundController.metering.creds | string | `""` | Otel collector credentials | | backgroundController.server | object | `{"port":9443}` | backgroundController server port in case you are using hostNetwork: true, you might want to change the port the backgroundController is listening to | @@ -558,8 +627,29 @@ The chart values are organised per component. | cleanupController.rbac.create | bool | `true` | Create RBAC resources | | cleanupController.rbac.serviceAccount.name | string | `nil` | Service account name | | cleanupController.rbac.serviceAccount.annotations | object | `{}` | Annotations for the ServiceAccount | +| cleanupController.rbac.serviceAccount.automountServiceAccountToken | bool | `true` | Toggle automounting of the ServiceAccount. When set to false, a projected service account token is used instead which provides time-limited and audience-bound tokens for improved security. | +| cleanupController.rbac.serviceAccount.projectedServiceAccountToken | object | `{"audience":"","expirationSeconds":3600}` | Projected service account token configuration (only used when automountServiceAccountToken is false) | +| cleanupController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | int | `3600` | Token expiration time in seconds. The kubelet will request a new token before the token expires. | +| cleanupController.rbac.serviceAccount.projectedServiceAccountToken.audience | string | `""` | Audience for the projected service account token. If not set, the token will have no audience restriction. | +| cleanupController.rbac.coreClusterRole.extraResources | list | See [values.yaml](values.yaml) | Extra resource permissions to add in the core cluster role. This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. | | cleanupController.rbac.clusterRole.extraResources | list | `[]` | Extra resource permissions to add in the cluster role | | cleanupController.createSelfSignedCert | bool | `false` | Create self-signed certificates at deployment time. The certificates won't be automatically renewed if this is set to `true`. | +| cleanupController.tlsKeyAlgorithm | string | `"RSA"` | Key algorithm for self-signed TLS certificates. Supported values: RSA, ECDSA, Ed25519 Only used when createSelfSignedCert is false (Kyverno-managed certificates). | +| cleanupController.certManager | object | `{"algorithm":"RSA","ca":{"duration":"87600h","renewBefore":"720h"},"createSelfSignedIssuer":true,"enabled":false,"issuerRef":{"group":"cert-manager.io","kind":"ClusterIssuer","name":""},"size":2048,"tls":{"duration":"8760h","renewBefore":"720h"}}` | Configure cert-manager to manage TLS certificates. When enabled, cert-manager Certificate resources will be created to provision the TLS certificates for the cleanup controller. Requires cert-manager to be installed in the cluster. Takes precedence over createSelfSignedCert when enabled. | +| cleanupController.certManager.enabled | bool | `false` | Enable cert-manager integration for certificate management | +| cleanupController.certManager.createSelfSignedIssuer | bool | `true` | Create a self-signed ClusterIssuer for CA generation. Set to false if you want to use an existing issuer specified in issuerRef. | +| cleanupController.certManager.issuerRef | object | `{"group":"cert-manager.io","kind":"ClusterIssuer","name":""}` | Reference to an existing issuer for signing CA certificates. Only used when createSelfSignedIssuer is false. | +| cleanupController.certManager.issuerRef.name | string | `""` | Name of the issuer | +| cleanupController.certManager.issuerRef.kind | string | `"ClusterIssuer"` | Kind of the issuer (ClusterIssuer or Issuer) | +| cleanupController.certManager.issuerRef.group | string | `"cert-manager.io"` | Group of the issuer | +| cleanupController.certManager.algorithm | string | `"RSA"` | Key algorithm for certificates (RSA, ECDSA, Ed25519) | +| cleanupController.certManager.size | int | `2048` | Key size for RSA (2048, 4096) or ECDSA (256, 384). Ignored for Ed25519. | +| cleanupController.certManager.ca | object | `{"duration":"87600h","renewBefore":"720h"}` | CA certificate configuration | +| cleanupController.certManager.ca.duration | string | `"87600h"` | Duration of the CA certificate (default 10 years) | +| cleanupController.certManager.ca.renewBefore | string | `"720h"` | Time before expiry to renew the CA certificate (default 30 days) | +| cleanupController.certManager.tls | object | `{"duration":"8760h","renewBefore":"720h"}` | TLS certificate configuration | +| cleanupController.certManager.tls.duration | string | `"8760h"` | Duration of the TLS certificate (default 1 year) | +| cleanupController.certManager.tls.renewBefore | string | `"720h"` | Time before expiry to renew the TLS certificate (default 30 days) | | cleanupController.image.registry | string | `nil` | Image registry | | cleanupController.image.defaultRegistry | string | `"reg.kyverno.io"` | | | cleanupController.image.repository | string | `"kyverno/cleanup-controller"` | Image repository | @@ -571,12 +661,12 @@ The chart values are organised per component. | cleanupController.resyncPeriod | string | `"15m"` | Resync period for informers | | cleanupController.podLabels | object | `{}` | Additional labels to add to each pod | | cleanupController.podAnnotations | object | `{}` | Additional annotations to add to each pod | +| cleanupController.labels | object | `{}` | Deployment labels. | | cleanupController.annotations | object | `{}` | Deployment annotations. | | cleanupController.updateStrategy | object | See [values.yaml](values.yaml) | Deployment update strategy. Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy | | cleanupController.priorityClassName | string | `""` | Optional priority class | | cleanupController.hostNetwork | bool | `false` | Change `hostNetwork` to `true` when you want the pod to share its host's network namespace. Useful for situations like when you end up dealing with a custom CNI over Amazon EKS. Update the `dnsPolicy` accordingly as well to suit the host network mode. | | cleanupController.server | object | `{"port":9443}` | cleanupController server port in case you are using hostNetwork: true, you might want to change the port the cleanupController is listening to | -| cleanupController.webhookServer | object | `{"port":9443}` | cleanupController webhook server port in case you are using hostNetwork: true, you might want to change the port the webhookServer is listening to | | cleanupController.dnsPolicy | string | `"ClusterFirst"` | `dnsPolicy` determines the manner in which DNS resolution happens in the cluster. In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`. For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. | | cleanupController.dnsConfig | object | `{}` | `dnsConfig` allows to specify DNS configuration for the pod. For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config. | | cleanupController.extraArgs | object | `{}` | Extra arguments passed to the container on the command line | @@ -586,7 +676,7 @@ The chart values are organised per component. | cleanupController.startupProbe | object | See [values.yaml](values.yaml) | Startup probe. The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want. ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ | | cleanupController.livenessProbe | object | See [values.yaml](values.yaml) | Liveness probe. The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want. ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ | | cleanupController.readinessProbe | object | See [values.yaml](values.yaml) | Readiness Probe. The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want. ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ | -| cleanupController.nodeSelector | object | `{}` | Node labels for pod assignment | +| cleanupController.nodeSelector | object | `{}` | Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. | | cleanupController.tolerations | list | `[]` | List of node taints to tolerate | | cleanupController.antiAffinity.enabled | bool | `true` | Pod antiAffinities toggle. Enabled by default but can be disabled if you want to schedule pods to the same node. | | cleanupController.podAntiAffinity | object | See [values.yaml](values.yaml) | Pod anti affinity constraints. | @@ -594,22 +684,29 @@ The chart values are organised per component. | cleanupController.nodeAffinity | object | `{}` | Node affinity constraints. | | cleanupController.topologySpreadConstraints | list | `[]` | Topology spread constraints. | | cleanupController.podSecurityContext | object | `{}` | Security context for the pod | -| cleanupController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| cleanupController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| cleanupController.lifecycle | object | `{}` | Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. | | cleanupController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | cleanupController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | cleanupController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | +| cleanupController.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | Unhealthy pod eviction policy to be used. Possible values are `IfHealthyBudget` or `AlwaysAllow`. | +| cleanupController.extraVolumes | list | `[]` | Additional volumes to be mounted in the pod | +| cleanupController.extraVolumeMounts | list | `[]` | Additional volumeMounts to be mounted to the main container | | cleanupController.service.port | int | `443` | Service port. | | cleanupController.service.type | string | `"ClusterIP"` | Service type. | | cleanupController.service.nodePort | string | `nil` | Service node port. Only used if `service.type` is `NodePort`. | | cleanupController.service.annotations | object | `{}` | Service annotations. | +| cleanupController.service.trafficDistribution | string | `nil` | Service traffic distribution policy. Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. | | cleanupController.metricsService.create | bool | `true` | Create service. | | cleanupController.metricsService.port | int | `8000` | Service port. Metrics server will be exposed at this port. | | cleanupController.metricsService.type | string | `"ClusterIP"` | Service type. | | cleanupController.metricsService.nodePort | string | `nil` | Service node port. Only used if `metricsService.type` is `NodePort`. | | cleanupController.metricsService.annotations | object | `{}` | Service annotations. | +| cleanupController.metricsService.trafficDistribution | string | `nil` | Service traffic distribution policy. Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. | | cleanupController.networkPolicy.enabled | bool | `false` | When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. | | cleanupController.networkPolicy.ingressFrom | list | `[]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. | | cleanupController.serviceMonitor.enabled | bool | `false` | Create a `ServiceMonitor` to collect Prometheus metrics. | +| cleanupController.serviceMonitor.additionalAnnotations | object | `{}` | Additional annotations | | cleanupController.serviceMonitor.additionalLabels | object | `{}` | Additional labels | | cleanupController.serviceMonitor.namespace | string | `nil` | Override namespace | | cleanupController.serviceMonitor.interval | string | `"30s"` | Interval to scrape metrics | @@ -625,6 +722,8 @@ The chart values are organised per component. | cleanupController.metering.disabled | bool | `false` | Disable metrics export | | cleanupController.metering.config | string | `"prometheus"` | Otel configuration, can be `prometheus` or `grpc` | | cleanupController.metering.port | int | `8000` | Prometheus endpoint port | +| cleanupController.metering.secure | bool | `false` | Is TLS required for endpoint | +| cleanupController.metering.tlsKeyAlgorithm | string | `"RSA"` | Key algorithm for self-signed TLS certificates. Supported values: RSA, ECDSA, Ed25519 | | cleanupController.metering.collector | string | `""` | Otel collector endpoint | | cleanupController.metering.creds | string | `""` | Otel collector credentials | | cleanupController.profiling.enabled | bool | `false` | Enable profiling | @@ -643,6 +742,10 @@ The chart values are organised per component. | reportsController.rbac.viewRoleName | string | `"view"` | The view role to use in the rolebinding | | reportsController.rbac.serviceAccount.name | string | `nil` | Service account name | | reportsController.rbac.serviceAccount.annotations | object | `{}` | Annotations for the ServiceAccount | +| reportsController.rbac.serviceAccount.automountServiceAccountToken | bool | `true` | Toggle automounting of the ServiceAccount. When set to false, a projected service account token is used instead which provides time-limited and audience-bound tokens for improved security. | +| reportsController.rbac.serviceAccount.projectedServiceAccountToken | object | `{"audience":"","expirationSeconds":3600}` | Projected service account token configuration (only used when automountServiceAccountToken is false) | +| reportsController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | int | `3600` | Token expiration time in seconds. The kubelet will request a new token before the token expires. | +| reportsController.rbac.serviceAccount.projectedServiceAccountToken.audience | string | `""` | Audience for the projected service account token. If not set, the token will have no audience restriction. | | reportsController.rbac.coreClusterRole.extraResources | list | See [values.yaml](values.yaml) | Extra resource permissions to add in the core cluster role. This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. | | reportsController.rbac.clusterRole.extraResources | list | `[]` | Extra resource permissions to add in the cluster role | | reportsController.image.registry | string | `nil` | Image registry | @@ -656,6 +759,7 @@ The chart values are organised per component. | reportsController.resyncPeriod | string | `"15m"` | Resync period for informers | | reportsController.podLabels | object | `{}` | Additional labels to add to each pod | | reportsController.podAnnotations | object | `{}` | Additional annotations to add to each pod | +| reportsController.labels | object | `{}` | Deployment labels. | | reportsController.annotations | object | `{}` | Deployment annotations. | | reportsController.updateStrategy | object | See [values.yaml](values.yaml) | Deployment update strategy. Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy | | reportsController.priorityClassName | string | `""` | Optional priority class | @@ -668,7 +772,7 @@ The chart values are organised per component. | reportsController.extraEnvVars | list | `[]` | Additional container environment variables. | | reportsController.resources.limits | object | `{"memory":"128Mi"}` | Pod resource limits | | reportsController.resources.requests | object | `{"cpu":"100m","memory":"64Mi"}` | Pod resource requests | -| reportsController.nodeSelector | object | `{}` | Node labels for pod assignment | +| reportsController.nodeSelector | object | `{}` | Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. | | reportsController.tolerations | list | `[]` | List of node taints to tolerate | | reportsController.antiAffinity.enabled | bool | `true` | Pod antiAffinities toggle. Enabled by default but can be disabled if you want to schedule pods to the same node. | | reportsController.podAntiAffinity | object | See [values.yaml](values.yaml) | Pod anti affinity constraints. | @@ -676,22 +780,28 @@ The chart values are organised per component. | reportsController.nodeAffinity | object | `{}` | Node affinity constraints. | | reportsController.topologySpreadConstraints | list | `[]` | Topology spread constraints. | | reportsController.podSecurityContext | object | `{}` | Security context for the pod | -| reportsController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| reportsController.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers | +| reportsController.lifecycle | object | `{}` | Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. | | reportsController.podDisruptionBudget.enabled | bool | `false` | Enable PodDisruptionBudget. Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. | | reportsController.podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for disruptions. Cannot be used if `maxUnavailable` is set. | | reportsController.podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for disruptions. Cannot be used if `minAvailable` is set. | +| reportsController.podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | Unhealthy pod eviction policy to be used. Possible values are `IfHealthyBudget` or `AlwaysAllow`. | | reportsController.tufRootMountPath | string | `"/.sigstore"` | A writable volume to use for the TUF root initialization. | | reportsController.sigstoreVolume | object | `{"emptyDir":{}}` | Volume to be mounted in pods for TUF/cosign work. | | reportsController.caCertificates.data | string | `nil` | CA certificates to use with Kyverno deployments This value is expected to be one large string of CA certificates | | reportsController.caCertificates.volume | object | `{}` | Volume to be mounted for CA certificates Not used when `.Values.reportsController.caCertificates.data` is defined | +| reportsController.extraVolumes | list | `[]` | Additional volumes to be mounted in the pod | +| reportsController.extraVolumeMounts | list | `[]` | Additional volumeMounts to be mounted to the main container | | reportsController.metricsService.create | bool | `true` | Create service. | | reportsController.metricsService.port | int | `8000` | Service port. Metrics server will be exposed at this port. | | reportsController.metricsService.type | string | `"ClusterIP"` | Service type. | | reportsController.metricsService.nodePort | string | `nil` | Service node port. Only used if `type` is `NodePort`. | | reportsController.metricsService.annotations | object | `{}` | Service annotations. | +| reportsController.metricsService.trafficDistribution | string | `nil` | Service traffic distribution policy. Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. | | reportsController.networkPolicy.enabled | bool | `false` | When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. | | reportsController.networkPolicy.ingressFrom | list | `[]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. | | reportsController.serviceMonitor.enabled | bool | `false` | Create a `ServiceMonitor` to collect Prometheus metrics. | +| reportsController.serviceMonitor.additionalAnnotations | object | `{}` | Additional annotations | | reportsController.serviceMonitor.additionalLabels | object | `{}` | Additional labels | | reportsController.serviceMonitor.namespace | string | `nil` | Override namespace | | reportsController.serviceMonitor.interval | string | `"30s"` | Interval to scrape metrics | @@ -707,6 +817,8 @@ The chart values are organised per component. | reportsController.metering.disabled | bool | `false` | Disable metrics export | | reportsController.metering.config | string | `"prometheus"` | Otel configuration, can be `prometheus` or `grpc` | | reportsController.metering.port | int | `8000` | Prometheus endpoint port | +| reportsController.metering.secure | bool | `false` | Is TLS required for endpoint | +| reportsController.metering.tlsKeyAlgorithm | string | `"RSA"` | Key algorithm for self-signed TLS certificates. Supported values: RSA, ECDSA, Ed25519 | | reportsController.metering.collector | string | `nil` | Otel collector endpoint | | reportsController.metering.creds | string | `nil` | Otel collector credentials | | reportsController.server | object | `{"port":9443}` | reportsController server port in case you are using hostNetwork: true, you might want to change the port the reportsController is listening to | @@ -732,14 +844,13 @@ The chart values are organised per component. | Key | Type | Default | Description | |-----|------|---------|-------------| | webhooksCleanup.enabled | bool | `true` | Create a helm pre-delete hook to cleanup webhooks. | -| webhooksCleanup.autoDeleteWebhooks.enabled | bool | `false` | Allow webhooks controller to delete webhooks using finalizers | -| webhooksCleanup.image.registry | string | `nil` | Image registry | -| webhooksCleanup.image.repository | string | `"bitnami/kubectl"` | Image repository | -| webhooksCleanup.image.tag | string | `"1.32.3"` | Image tag Defaults to `latest` if omitted | +| webhooksCleanup.image.registry | string | `"ghcr.io"` | Image registry | +| webhooksCleanup.image.repository | string | `"kyverno/readiness-checker"` | Image repository | +| webhooksCleanup.image.tag | string | `nil` | Image tag Defaults to `latest` if omitted | | webhooksCleanup.image.pullPolicy | string | `nil` | Image pull policy Defaults to image.pullPolicy if omitted | | webhooksCleanup.imagePullSecrets | list | `[]` | Image pull secrets | | webhooksCleanup.podSecurityContext | object | `{}` | Security context for the pod | -| webhooksCleanup.nodeSelector | object | `{}` | Node labels for pod assignment | +| webhooksCleanup.nodeSelector | object | `{}` | Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. | | webhooksCleanup.tolerations | list | `[]` | List of node taints to tolerate | | webhooksCleanup.podAntiAffinity | object | `{}` | Pod anti affinity constraints. | | webhooksCleanup.podAffinity | object | `{}` | Pod affinity constraints. | @@ -749,20 +860,31 @@ The chart values are organised per component. | webhooksCleanup.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the hook containers | | webhooksCleanup.resources.limits | object | `{"cpu":"100m","memory":"256Mi"}` | Pod resource limits | | webhooksCleanup.resources.requests | object | `{"cpu":"10m","memory":"64Mi"}` | Pod resource requests | +| webhooksCleanup.serviceAccount.automountServiceAccountToken | bool | `true` | Toggle automounting of the ServiceAccount. When set to false, a projected service account token is used instead which provides time-limited and audience-bound tokens for improved security. | +| webhooksCleanup.serviceAccount.projectedServiceAccountToken | object | `{"audience":"","expirationSeconds":3600}` | Projected service account token configuration (only used when automountServiceAccountToken is false) | +| webhooksCleanup.serviceAccount.projectedServiceAccountToken.expirationSeconds | int | `3600` | Token expiration time in seconds. The kubelet will request a new token before the token expires. | +| webhooksCleanup.serviceAccount.projectedServiceAccountToken.audience | string | `""` | Audience for the projected service account token. If not set, the token will have no audience restriction. | ### Test | Key | Type | Default | Description | |-----|------|---------|-------------| | test.sleep | int | `20` | Sleep time before running test | -| test.image.registry | string | `nil` | Image registry | -| test.image.repository | string | `"busybox"` | Image repository | -| test.image.tag | string | `"1.35"` | Image tag Defaults to `latest` if omitted | +| test.image.registry | string | `"ghcr.io"` | Image registry | +| test.image.repository | string | `"kyverno/readiness-checker"` | Image repository | +| test.image.tag | string | `nil` | Image tag Defaults to `latest` if omitted | | test.image.pullPolicy | string | `nil` | Image pull policy Defaults to image.pullPolicy if omitted | | test.imagePullSecrets | list | `[]` | Image pull secrets | | test.resources.limits | object | `{"cpu":"100m","memory":"256Mi"}` | Pod resource limits | | test.resources.requests | object | `{"cpu":"10m","memory":"64Mi"}` | Pod resource requests | | test.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the test containers | +| test.automountServiceAccountToken | bool | `true` | Toggle automounting of the ServiceAccount. When set to false, a projected service account token is used instead which provides time-limited and audience-bound tokens for improved security. | +| test.projectedServiceAccountToken | object | `{"audience":"","expirationSeconds":3600}` | Projected service account token configuration (only used when automountServiceAccountToken is false) | +| test.projectedServiceAccountToken.expirationSeconds | int | `3600` | Token expiration time in seconds. The kubelet will request a new token before the token expires. | +| test.projectedServiceAccountToken.audience | string | `""` | Audience for the projected service account token. If not set, the token will have no audience restriction. | +| test.nodeSelector | object | `{}` | Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. | +| test.podAnnotations | object | `{}` | Additional Pod annotations | +| test.tolerations | list | `[]` | List of node taints to tolerate | ### Api version override @@ -777,36 +899,34 @@ The chart values are organised per component. | global.image.registry | string | `nil` | Global value that allows to set a single image registry across all deployments. When set, it will override any values set under `.image.registry` across the chart. | | global.imagePullSecrets | list | `[]` | Global list of Image pull secrets When set, it will override any values set under `imagePullSecrets` under different components across the chart. | | global.resyncPeriod | string | `"15m"` | Resync period for informers | +| global.crdWatcher | bool | `false` | Enable/Disable custom resource watcher to invalidate cache | | global.caCertificates.data | string | `nil` | Global CA certificates to use with Kyverno deployments This value is expected to be one large string of CA certificates Individual controller values will override this global value | | global.caCertificates.volume | object | `{}` | Global value to set single volume to be mounted for CA certificates for all deployments. Not used when `.Values.global.caCertificates.data` is defined Individual controller values will override this global value | +| global.priorityClassName | string | `""` | Global priority class name for pod priority. Non-global values will override the global value. | | global.extraEnvVars | list | `[]` | Additional container environment variables to apply to all containers and init containers | -| global.nodeSelector | object | `{}` | Global node labels for pod assignment. Non-global values will override the global value. | +| global.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Global node labels for pod assignment, applied to all chart workloads including controller Deployments, hook Jobs, and Helm test Pods. Non-global (controller) values will override the global value when non-empty. The default `kubernetes.io/os: linux` key is always merged into any user-supplied value and cannot be unset by design, because Kyverno images only run on Linux nodes. | | global.tolerations | list | `[]` | Global List of node taints to tolerate. Non-global values will override the global value. | | nameOverride | string | `nil` | Override the name of the chart | | fullnameOverride | string | `nil` | Override the expanded name of the chart | | namespaceOverride | string | `nil` | Override the namespace the chart deploys to | | upgrade.fromV2 | bool | `false` | Upgrading from v2 to v3 is not allowed by default, set this to true once changes have been reviewed. | | rbac.roles.aggregate | object | `{"admin":true,"view":true}` | Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) | +| openreports.enabled | bool | `false` | Enable OpenReports feature in controllers | +| openreports.installCrds | bool | `false` | Whether to install CRDs from the upstream OpenReports chart. Setting this to true requires enabled to also be true. | +| reportsServer.enabled | bool | `false` | Enable reports-server deployment alongside Kyverno | +| reportsServer.waitForReady | bool | `true` | Wait for reports-server to be ready before starting Kyverno components | +| reportsServer.readinessTimeout | string | `"300s"` | Timeout for waiting for reports-server readiness (as duration string, e.g. 300s, 5m) | +| apiCallToken | object | `{"audience":"kyverno-svc.kyverno.io","expirationSeconds":3600}` | Scoped token injected into outbound APICall and CEL http requests. This token carries a custom audience so that if leaked to an external service it cannot be replayed against the Kubernetes API server. | +| apiCallToken.audience | string | `"kyverno-svc.kyverno.io"` | Audience for the projected token used in outbound requests. Set this to the audience your receiving service validates in the OIDC token's `aud` claim. The default is `kyverno-svc.kyverno.io`, which is a Kyverno-specific audience and prevents the token from being accepted by the Kubernetes API server. | +| apiCallToken.expirationSeconds | int | `3600` | Token lifetime in seconds for the projected outbound API call token. The default is `3600` (1 hour). The kubelet requests a replacement before the token expires, so lowering this reduces token lifetime while increasing rotation frequency. | | imagePullSecrets | object | `{}` | Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument | | existingImagePullSecrets | list | `[]` | Existing Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument | | customLabels | object | `{}` | Additional labels | -| policyReportsCleanup.enabled | bool | `true` | Create a helm post-upgrade hook to cleanup the old policy reports. | -| policyReportsCleanup.image.registry | string | `nil` | Image registry | -| policyReportsCleanup.image.repository | string | `"bitnami/kubectl"` | Image repository | -| policyReportsCleanup.image.tag | string | `"1.32.3"` | Image tag Defaults to `latest` if omitted | -| policyReportsCleanup.image.pullPolicy | string | `nil` | Image pull policy Defaults to image.pullPolicy if omitted | -| policyReportsCleanup.imagePullSecrets | list | `[]` | Image pull secrets | -| policyReportsCleanup.podSecurityContext | object | `{}` | Security context for the pod | -| policyReportsCleanup.nodeSelector | object | `{}` | Node labels for pod assignment | -| policyReportsCleanup.tolerations | list | `[]` | List of node taints to tolerate | -| policyReportsCleanup.podAntiAffinity | object | `{}` | Pod anti affinity constraints. | -| policyReportsCleanup.podAffinity | object | `{}` | Pod affinity constraints. | -| policyReportsCleanup.podLabels | object | `{}` | Pod labels. | -| policyReportsCleanup.podAnnotations | object | `{}` | Pod annotations. | -| policyReportsCleanup.nodeAffinity | object | `{}` | Node affinity constraints. | -| policyReportsCleanup.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the hook containers | -| policyReportsCleanup.resources.limits | object | `{"cpu":"100m","memory":"256Mi"}` | Pod resource limits | -| policyReportsCleanup.resources.requests | object | `{"cpu":"10m","memory":"64Mi"}` | Pod resource requests | +| prometheusRule.enabled | bool | `false` | Enable PrometheusRule resource creation. Requires prometheus-operator (monitoring.coreos.com/v1 CRD) to be installed — the same prerequisite as serviceMonitor.enabled. The resource is only created when `enabled: true` and `spec` is non-empty. | +| prometheusRule.namespace | string | `nil` | Namespace to create the PrometheusRule in. If not set, it will be created in the same namespace as the chart. | +| prometheusRule.additionalAnnotations | object | `{}` | Additional annotations to add to the PrometheusRule. | +| prometheusRule.additionalLabels | object | `{}` | Additional labels to add to the PrometheusRule. Must match the `ruleSelector` configured on your Prometheus instance (e.g. `release: prometheus` for kube-prometheus-stack). | +| prometheusRule.spec | list | `[]` | Alert rule groups. Provide your own rules here; the examples below use Kyverno's histogram metrics and can serve as starting points. Thresholds MUST be tuned to your environment's measured baseline — see https://kyverno.io/docs/guides/monitoring/#alerting for guidance. | ## TLS Configuration @@ -867,14 +987,11 @@ Kubernetes: `>=1.25.0-0` | Repository | Name | Version | |------------|------|---------| -| | crds | 3.4.1 | -| | grafana | 3.4.1 | - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Nirmata | | | +| | crds | 3.9.0 | +| | grafana | 3.9.0 | +| https://kyverno.github.io/api | kyverno-api | 0.0.1-alpha.4 | +| https://kyverno.github.io/reports-server/ | reports-server | 0.1.6 | +| https://openreports.github.io/reports-api | openreports | 0.1.0 | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/Chart.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/Chart.yaml similarity index 63% rename from manifests/helm/kyverno/3.4.1/charts/crds/Chart.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/Chart.yaml index caa4f69..9e6a735 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/Chart.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/Chart.yaml @@ -1,3 +1,3 @@ apiVersion: v2 name: crds -version: 3.4.1 +version: 3.9.0 diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/README.md b/manifests/helm/kyverno/3.9.0/charts/crds/README.md similarity index 60% rename from manifests/helm/kyverno/3.4.1/charts/crds/README.md rename to manifests/helm/kyverno/3.9.0/charts/crds/README.md index c870a24..5d89d8e 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/README.md +++ b/manifests/helm/kyverno/3.9.0/charts/crds/README.md @@ -1,17 +1,18 @@ # crds -![Version: 3.4.1](https://img.shields.io/badge/Version-3.4.1-informational?style=flat-square) +![Version: 3.9.0](https://img.shields.io/badge/Version-3.9.0-informational?style=flat-square) ## Values | Key | Type | Default | Description | |-----|------|---------|-------------| +| reportsServer.enabled | bool | `false` | Kyverno reports-server is used in your cluster | | groups.kyverno | object | `{"cleanuppolicies":true,"clustercleanuppolicies":true,"clusterpolicies":true,"globalcontextentries":true,"policies":true,"policyexceptions":true,"updaterequests":true}` | This field can be overwritten by setting crds.labels in the parent chart | -| groups.policies | object | `{"imagevalidatingpolicies":true,"policyexceptions":true,"validatingpolicies":true}` | Install CRDs in group `reports.kyverno.io` | +| groups.policies | object | `{"deletingpolicies":true,"generatingpolicies":true,"imagevalidatingpolicies":true,"mutatingpolicies":true,"namespaceddeletingpolicies":true,"namespacedgeneratingpolicies":true,"namespacedimagevalidatingpolicies":true,"namespacedvalidatingpolicies":true,"policyexceptions":true,"validatingpolicies":true}` | Install CRDs in group `reports.kyverno.io` | | groups.reports | object | `{"clusterephemeralreports":true,"ephemeralreports":true}` | This field can be overwritten by setting crds.labels in the parent chart | | groups.wgpolicyk8s | object | `{"clusterpolicyreports":true,"policyreports":true}` | This field can be overwritten by setting crds.labels in the parent chart | | annotations | object | `{}` | This field can be overwritten by setting crds.annotations in the parent chart | | customLabels | object | `{}` | This field can be overwritten by setting crds.labels in the parent chart | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/_helpers.tpl b/manifests/helm/kyverno/3.9.0/charts/crds/templates/_helpers.tpl similarity index 100% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/_helpers.tpl diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_cleanuppolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_cleanuppolicies.yaml similarity index 99% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_cleanuppolicies.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_cleanuppolicies.yaml index 8b64620..90c6080 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_cleanuppolicies.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_cleanuppolicies.yaml @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: cleanuppolicies.kyverno.io spec: group: kyverno.io @@ -319,7 +319,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1612,7 +1613,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_clustercleanuppolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_clustercleanuppolicies.yaml similarity index 99% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_clustercleanuppolicies.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_clustercleanuppolicies.yaml index 833b2b5..657e353 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_clustercleanuppolicies.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_clustercleanuppolicies.yaml @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: clustercleanuppolicies.kyverno.io spec: group: kyverno.io @@ -319,7 +319,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1612,7 +1613,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_clusterpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_clusterpolicies.yaml similarity index 99% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_clusterpolicies.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_clusterpolicies.yaml index a0f96a4..0dd7117 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_clusterpolicies.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_clusterpolicies.yaml @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: clusterpolicies.kyverno.io spec: group: kyverno.io @@ -153,7 +153,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -169,7 +169,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -356,7 +356,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1396,7 +1397,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1589,8 +1591,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -2481,7 +2483,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -2864,7 +2867,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -3020,8 +3024,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common @@ -3084,7 +3089,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables @@ -3149,7 +3154,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -3172,7 +3177,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -3195,13 +3200,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -3239,7 +3244,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -3319,12 +3324,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -3621,7 +3626,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -4199,7 +4205,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -4212,6 +4218,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -4959,7 +4968,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -5163,7 +5173,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -5179,7 +5189,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -5233,7 +5243,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -5249,7 +5259,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -5437,7 +5447,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6488,7 +6499,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6685,8 +6697,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -7585,7 +7597,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -7977,7 +7990,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -8136,9 +8150,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion - tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the @@ -8201,7 +8215,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into @@ -8271,7 +8285,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -8294,7 +8308,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -8317,13 +8331,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -8361,7 +8375,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -8441,12 +8455,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -8747,7 +8761,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -9332,7 +9347,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -9345,6 +9360,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -10109,7 +10127,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -10437,7 +10456,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -10453,7 +10472,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -10640,7 +10659,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -11474,7 +11494,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -11667,8 +11688,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -12353,7 +12374,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12736,7 +12758,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12952,6 +12975,12 @@ spec: type: object type: array type: object + reportProperties: + additionalProperties: + type: string + description: ReportProperties are the additional properties + from the rule that will be added to the policy report result + type: object skipBackgroundRequests: default: true description: |- @@ -12968,8 +12997,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common @@ -13032,7 +13062,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables @@ -13097,7 +13127,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -13120,7 +13150,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -13143,13 +13173,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -13187,7 +13217,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -13267,12 +13297,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -13658,7 +13688,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -14236,7 +14267,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -14249,6 +14280,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -14977,7 +15011,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -15169,7 +15204,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -15185,7 +15220,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -15239,7 +15274,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -15255,7 +15290,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -15443,7 +15478,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16494,7 +16530,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16691,8 +16728,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -17591,7 +17628,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -17983,7 +18021,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -18142,9 +18181,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion - tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the @@ -18207,7 +18246,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into @@ -18277,7 +18316,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -18300,7 +18339,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -18323,13 +18362,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -18367,7 +18406,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -18447,12 +18486,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -18753,7 +18792,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -19338,7 +19378,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -19351,6 +19391,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -20115,7 +20158,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array diff --git a/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_globalcontextentries.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_globalcontextentries.yaml new file mode 100644 index 0000000..febb07e --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_globalcontextentries.yaml @@ -0,0 +1,784 @@ +{{- if .Values.groups.kyverno.globalcontextentries }} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno.crds.labels" . | nindent 4 }} + annotations: + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + controller-gen.kubebuilder.io/version: v0.20.0 + name: globalcontextentries.kyverno.io +spec: + group: kyverno.io + names: + categories: + - kyverno + kind: GlobalContextEntry + listKind: GlobalContextEntryList + plural: globalcontextentries + shortNames: + - gctxentry + singular: globalcontextentry + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .spec.apiCall.refreshInterval + name: REFRESH INTERVAL + type: string + - jsonPath: .status.lastRefreshTime + name: LAST REFRESH + type: date + name: v2 + schema: + openAPIV3Schema: + description: GlobalContextEntry declares resources to be cached. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec declares policy exception behaviors. + oneOf: + - required: + - kubernetesResource + - required: + - apiCall + properties: + apiCall: + description: |- + Stores results from an API call which will be cached. + Mutually exclusive with KubernetesResource. + This can be used to make calls to external (non-Kubernetes API server) services. + It can also be used to make calls to the Kubernetes API server in such cases: + 1. A POST is needed to create a resource. + 2. Finer-grained control is needed. Example: To restrict the number of resources cached. + properties: + data: + description: |- + The data object specifies the POST data sent to the server. + Only applicable when the method field is set to POST. + items: + description: RequestData contains the HTTP POST data + properties: + key: + description: Key is a unique identifier for the data value + type: string + value: + description: Value is the data value + x-kubernetes-preserve-unknown-fields: true + required: + - key + - value + type: object + type: array + method: + default: GET + description: Method is the HTTP request type (GET or POST). Defaults + to GET. + enum: + - GET + - POST + type: string + refreshInterval: + default: 10m + description: |- + RefreshInterval defines the interval in duration at which to poll the APICall. + The duration is a sequence of decimal numbers, each with optional fraction and a unit suffix, + such as "300ms", "1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + format: duration + type: string + retryLimit: + default: 3 + description: RetryLimit defines the number of times the APICall + should be retried in case of failure. + minimum: 1 + type: integer + service: + description: |- + Service is an API call to a JSON web service. + This is used for non-Kubernetes API server calls. + It's mutually exclusive with the URLPath field. + properties: + caBundle: + description: |- + CABundle is a PEM encoded CA bundle which will be used to validate + the server certificate. + type: string + headers: + description: Headers is a list of optional HTTP headers to + be included in the request. + items: + properties: + key: + description: Key is the header key + type: string + value: + description: Value is the header value + type: string + required: + - key + - value + type: object + type: array + url: + description: |- + URL is the JSON web service URL. A typical form is + `https://{service}.{namespace}:{port}/{path}`. + type: string + required: + - url + type: object + urlPath: + description: |- + URLPath is the URL path to be used in the HTTP GET or POST request to the + Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments"). + The format required is the same format used by the `kubectl get --raw` command. + See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls + for details. + It's mutually exclusive with the Service field. + type: string + type: object + kubernetesResource: + description: |- + Stores a list of Kubernetes resources which will be cached. + Mutually exclusive with APICall. + properties: + group: + description: Group defines the group of the resource. + type: string + namespace: + description: |- + Namespace defines the namespace of the resource. Leave empty for cluster scoped resources. + If left empty for namespaced resources, all resources from all namespaces will be cached. + type: string + resource: + description: |- + Resource defines the type of the resource. + Requires the pluralized form of the resource kind in lowercase. (Ex., "deployments") + type: string + version: + description: Version defines the version of the resource. + type: string + required: + - resource + - version + type: object + projections: + description: Projections defines the list of JMESPath expressions + to extract values from the cached resource. + items: + properties: + jmesPath: + description: JMESPath is the JMESPath expression to extract + the value from the cached resource. + type: string + name: + description: Name is the name to use for the extracted value + in the context. + type: string + required: + - jmesPath + - name + type: object + type: array + type: object + status: + description: Status contains globalcontextentry runtime data. + properties: + conditions: + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastRefreshTime: + description: Indicates the time when the globalcontextentry was last + refreshed successfully for the API Call + format: date-time + type: string + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .spec.apiCall.refreshInterval + name: REFRESH INTERVAL + type: string + - jsonPath: .status.lastRefreshTime + name: LAST REFRESH + type: date + deprecated: true + name: v2alpha1 + schema: + openAPIV3Schema: + description: GlobalContextEntry declares resources to be cached. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec declares policy exception behaviors. + oneOf: + - required: + - kubernetesResource + - required: + - apiCall + properties: + apiCall: + description: |- + Stores results from an API call which will be cached. + Mutually exclusive with KubernetesResource. + This can be used to make calls to external (non-Kubernetes API server) services. + It can also be used to make calls to the Kubernetes API server in such cases: + 1. A POST is needed to create a resource. + 2. Finer-grained control is needed. Example: To restrict the number of resources cached. + properties: + data: + description: |- + The data object specifies the POST data sent to the server. + Only applicable when the method field is set to POST. + items: + description: RequestData contains the HTTP POST data + properties: + key: + description: Key is a unique identifier for the data value + type: string + value: + description: Value is the data value + x-kubernetes-preserve-unknown-fields: true + required: + - key + - value + type: object + type: array + method: + default: GET + description: Method is the HTTP request type (GET or POST). Defaults + to GET. + enum: + - GET + - POST + type: string + refreshInterval: + default: 10m + description: |- + RefreshInterval defines the interval in duration at which to poll the APICall. + The duration is a sequence of decimal numbers, each with optional fraction and a unit suffix, + such as "300ms", "1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + format: duration + type: string + retryLimit: + default: 3 + description: RetryLimit defines the number of times the APICall + should be retried in case of failure. + minimum: 1 + type: integer + service: + description: |- + Service is an API call to a JSON web service. + This is used for non-Kubernetes API server calls. + It's mutually exclusive with the URLPath field. + properties: + caBundle: + description: |- + CABundle is a PEM encoded CA bundle which will be used to validate + the server certificate. + type: string + headers: + description: Headers is a list of optional HTTP headers to + be included in the request. + items: + properties: + key: + description: Key is the header key + type: string + value: + description: Value is the header value + type: string + required: + - key + - value + type: object + type: array + url: + description: |- + URL is the JSON web service URL. A typical form is + `https://{service}.{namespace}:{port}/{path}`. + type: string + required: + - url + type: object + urlPath: + description: |- + URLPath is the URL path to be used in the HTTP GET or POST request to the + Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments"). + The format required is the same format used by the `kubectl get --raw` command. + See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls + for details. + It's mutually exclusive with the Service field. + type: string + type: object + kubernetesResource: + description: |- + Stores a list of Kubernetes resources which will be cached. + Mutually exclusive with APICall. + properties: + group: + description: Group defines the group of the resource. + type: string + namespace: + description: |- + Namespace defines the namespace of the resource. Leave empty for cluster scoped resources. + If left empty for namespaced resources, all resources from all namespaces will be cached. + type: string + resource: + description: |- + Resource defines the type of the resource. + Requires the pluralized form of the resource kind in lowercase. (Ex., "deployments") + type: string + version: + description: Version defines the version of the resource. + type: string + required: + - resource + - version + type: object + projections: + description: Projections defines the list of JMESPath expressions + to extract values from the cached resource. + items: + properties: + jmesPath: + description: JMESPath is the JMESPath expression to extract + the value from the cached resource. + type: string + name: + description: Name is the name to use for the extracted value + in the context. + type: string + required: + - jmesPath + - name + type: object + type: array + type: object + status: + description: Status contains globalcontextentry runtime data. + properties: + conditions: + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastRefreshTime: + description: Indicates the time when the globalcontextentry was last + refreshed successfully for the API Call + format: date-time + type: string + ready: + description: Deprecated in favor of Conditions + type: boolean + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .spec.apiCall.refreshInterval + name: REFRESH INTERVAL + type: string + - jsonPath: .status.lastRefreshTime + name: LAST REFRESH + type: date + name: v2beta1 + schema: + openAPIV3Schema: + description: GlobalContextEntry declares resources to be cached. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec declares policy exception behaviors. + oneOf: + - required: + - kubernetesResource + - required: + - apiCall + properties: + apiCall: + description: |- + Stores results from an API call which will be cached. + Mutually exclusive with KubernetesResource. + This can be used to make calls to external (non-Kubernetes API server) services. + It can also be used to make calls to the Kubernetes API server in such cases: + 1. A POST is needed to create a resource. + 2. Finer-grained control is needed. Example: To restrict the number of resources cached. + properties: + data: + description: |- + The data object specifies the POST data sent to the server. + Only applicable when the method field is set to POST. + items: + description: RequestData contains the HTTP POST data + properties: + key: + description: Key is a unique identifier for the data value + type: string + value: + description: Value is the data value + x-kubernetes-preserve-unknown-fields: true + required: + - key + - value + type: object + type: array + method: + default: GET + description: Method is the HTTP request type (GET or POST). Defaults + to GET. + enum: + - GET + - POST + type: string + refreshInterval: + default: 10m + description: |- + RefreshInterval defines the interval in duration at which to poll the APICall. + The duration is a sequence of decimal numbers, each with optional fraction and a unit suffix, + such as "300ms", "1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + format: duration + type: string + retryLimit: + default: 3 + description: RetryLimit defines the number of times the APICall + should be retried in case of failure. + minimum: 1 + type: integer + service: + description: |- + Service is an API call to a JSON web service. + This is used for non-Kubernetes API server calls. + It's mutually exclusive with the URLPath field. + properties: + caBundle: + description: |- + CABundle is a PEM encoded CA bundle which will be used to validate + the server certificate. + type: string + headers: + description: Headers is a list of optional HTTP headers to + be included in the request. + items: + properties: + key: + description: Key is the header key + type: string + value: + description: Value is the header value + type: string + required: + - key + - value + type: object + type: array + url: + description: |- + URL is the JSON web service URL. A typical form is + `https://{service}.{namespace}:{port}/{path}`. + type: string + required: + - url + type: object + urlPath: + description: |- + URLPath is the URL path to be used in the HTTP GET or POST request to the + Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments"). + The format required is the same format used by the `kubectl get --raw` command. + See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls + for details. + It's mutually exclusive with the Service field. + type: string + type: object + kubernetesResource: + description: |- + Stores a list of Kubernetes resources which will be cached. + Mutually exclusive with APICall. + properties: + group: + description: Group defines the group of the resource. + type: string + namespace: + description: |- + Namespace defines the namespace of the resource. Leave empty for cluster scoped resources. + If left empty for namespaced resources, all resources from all namespaces will be cached. + type: string + resource: + description: |- + Resource defines the type of the resource. + Requires the pluralized form of the resource kind in lowercase. (Ex., "deployments") + type: string + version: + description: Version defines the version of the resource. + type: string + required: + - resource + - version + type: object + projections: + description: Projections defines the list of JMESPath expressions + to extract values from the cached resource. + items: + properties: + jmesPath: + description: JMESPath is the JMESPath expression to extract + the value from the cached resource. + type: string + name: + description: Name is the name to use for the extracted value + in the context. + type: string + required: + - jmesPath + - name + type: object + type: array + type: object + status: + description: Status contains globalcontextentry runtime data. + properties: + conditions: + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastRefreshTime: + description: Indicates the time when the globalcontextentry was last + refreshed successfully for the API Call + format: date-time + type: string + ready: + description: Deprecated in favor of Conditions + type: boolean + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} +{{- end }} diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml similarity index 99% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml index 22270dd..c2b8465 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: policies.kyverno.io spec: group: kyverno.io @@ -154,7 +154,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -170,7 +170,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -357,7 +357,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1397,7 +1398,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -1590,8 +1592,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -2482,7 +2484,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -2865,7 +2868,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -3021,8 +3025,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common @@ -3085,7 +3090,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables @@ -3150,7 +3155,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -3173,7 +3178,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -3196,13 +3201,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -3240,7 +3245,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -3320,12 +3325,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -3622,7 +3627,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -4200,7 +4206,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -4213,6 +4219,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -4960,7 +4969,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -5164,7 +5174,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -5180,7 +5190,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -5235,7 +5245,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -5251,7 +5261,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -5439,7 +5449,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6490,7 +6501,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -6687,8 +6699,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -7587,7 +7599,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -7979,7 +7992,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -8138,9 +8152,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion - tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the @@ -8203,7 +8217,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into @@ -8273,7 +8287,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -8296,7 +8310,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -8319,13 +8333,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -8363,7 +8377,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -8443,12 +8457,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -8749,7 +8763,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -9334,7 +9349,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -9347,6 +9362,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -10111,7 +10129,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -10440,7 +10459,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -10456,7 +10475,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -10643,7 +10662,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -11477,7 +11497,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -11670,8 +11691,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -12356,7 +12377,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12739,7 +12761,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -12955,6 +12978,12 @@ spec: type: object type: array type: object + reportProperties: + additionalProperties: + type: string + description: ReportProperties are the additional properties + from the rule that will be added to the policy report result + type: object skipBackgroundRequests: default: true description: |- @@ -12971,8 +13000,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the Common @@ -13035,7 +13065,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into CEL variables @@ -13100,7 +13130,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -13123,7 +13153,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -13146,13 +13176,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -13190,7 +13220,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -13270,12 +13300,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -13661,7 +13691,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -14239,7 +14270,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -14252,6 +14283,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -14980,7 +15014,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -15172,7 +15207,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -15188,7 +15223,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -15242,7 +15277,7 @@ spec: properties: expression: description: |- - Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: 'object' - The object from the incoming request. The value is null for DELETE requests. @@ -15258,7 +15293,7 @@ spec: type: string name: description: |- - Name is an identifier for this match condition, used for strategic merging of MatchConditions, + name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and @@ -15446,7 +15481,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16497,7 +16533,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -16694,8 +16731,8 @@ spec: orphanDownstreamOnPolicyDelete: description: |- OrphanDownstreamOnPolicyDelete controls whether generated resources should be deleted when the rule that generated - them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. - See https://kyverno.io/docs/writing-policies/generate/#data-examples. + them is deleted with synchronization enabled. + See https://kyverno.io/docs/writing-policies/generate/. Defaults to "false" if not specified. type: boolean synchronize: @@ -17594,7 +17631,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -17986,7 +18024,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -18145,9 +18184,9 @@ spec: must be satisfied for the validation rule to succeed. x-kubernetes-preserve-unknown-fields: true assert: - description: Assert defines a kyverno-json assertion - tree. - type: object + description: |- + Assert defines a kyverno-json assertion tree. + Deprecated, kept only for backward compatibility but has no effect since 1.19. x-kubernetes-preserve-unknown-fields: true cel: description: CEL allows validation checks using the @@ -18210,7 +18249,7 @@ spec: which is used to apply the validation. properties: expression: - description: "Expression represents the expression + description: "expression represents the expression which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL expressions have access to the contents of the API request/response, organized into @@ -18280,7 +18319,7 @@ spec: type: string message: description: |- - Message represents the message displayed when validation fails. The message is required if the Expression contains + message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" @@ -18303,7 +18342,7 @@ spec: type: string reason: description: |- - Reason represents a machine-readable description of why this validation failed. + reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. @@ -18326,13 +18365,13 @@ spec: properties: apiVersion: description: |- - APIVersion is the API group version the resources belong to. + apiVersion is the API group version the resources belong to. In format of "group/version". Required. type: string kind: description: |- - Kind is the API kind the resources belong to. + kind is the API kind the resources belong to. Required. type: string type: object @@ -18370,7 +18409,7 @@ spec: type: string parameterNotFoundAction: description: |- - `parameterNotFoundAction` controls the behavior of the binding when the resource + parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to `Allow`, then no matched parameters will be treated as successful validation by the binding. @@ -18450,12 +18489,12 @@ spec: properties: expression: description: |- - Expression is the expression that will be evaluated as the value of the variable. + expression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation. type: string name: description: |- - Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through `variables` For example, if name is "foo", the variable will be available as `variables.foo` type: string @@ -18756,7 +18795,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array @@ -19341,7 +19381,7 @@ spec: version: description: |- Version defines the Pod Security Standard versions that Kubernetes supports. - Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, latest. Defaults to latest. + Allowed values are v1.19, v1.20, v1.21, v1.22, v1.23, v1.24, v1.25, v1.26, v1.27, v1.28, v1.29, v1.30, v1.31, v1.32, latest. Defaults to latest. enum: - v1.19 - v1.20 @@ -19354,6 +19394,9 @@ spec: - v1.27 - v1.28 - v1.29 + - v1.30 + - v1.31 + - v1.32 - latest type: string type: object @@ -20118,7 +20161,8 @@ spec: secrets: description: |- Secrets specifies a list of secrets that are provided for credentials. - Secrets must live in the Kyverno namespace. + Secrets can be specified as a name (Kyverno namespace) or namespace/name. + imagePullSecrets from the resource namespace are also used. items: type: string type: array diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_policyexceptions.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_policyexceptions.yaml similarity index 99% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_policyexceptions.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_policyexceptions.yaml index f5b1fb6..ef03ab2 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_policyexceptions.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_policyexceptions.yaml @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: policyexceptions.kyverno.io spec: group: kyverno.io diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_updaterequests.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_updaterequests.yaml similarity index 89% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_updaterequests.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_updaterequests.yaml index 738caed..f16ac0b 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/kyverno.io/kyverno.io_updaterequests.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/kyverno.io/kyverno.io_updaterequests.yaml @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: updaterequests.kyverno.io spec: group: kyverno.io @@ -89,11 +89,11 @@ spec: properties: dryRun: description: |- - DryRun indicates that modifications will definitely not be persisted for this request. + dryRun indicates that modifications will definitely not be persisted for this request. Defaults to false. type: boolean kind: - description: Kind is the fully-qualified type of object + description: kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) properties: group: @@ -109,30 +109,30 @@ spec: type: object name: description: |- - Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and + name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this field will contain an empty string. type: string namespace: - description: Namespace is the namespace associated with + description: namespace is the namespace associated with the request (if any). type: string object: - description: Object is the object from the incoming request. + description: object is the object from the incoming request. type: object x-kubernetes-preserve-unknown-fields: true oldObject: - description: OldObject is the existing object. Only populated + description: oldObject is the existing object. Only populated for DELETE and UPDATE requests. type: object x-kubernetes-preserve-unknown-fields: true operation: description: |- - Operation is the operation being performed. This may be different than the operation + operation is the operation being performed. This may be different than the operation requested. e.g. a patch can result in either a CREATE or UPDATE Operation. type: string options: description: |- - Options is the operation option structure of the operation being performed. + options is the operation option structure of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be different than the options the caller provided. e.g. for a patch request the performed Operation might be a CREATE, in which case the Options will a @@ -141,7 +141,7 @@ spec: x-kubernetes-preserve-unknown-fields: true requestKind: description: |- - RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). + requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in "kind", an equivalent match and conversion was performed. For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of @@ -165,7 +165,7 @@ spec: type: object requestResource: description: |- - RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). + requestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in "resource", an equivalent match and conversion was performed. For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of @@ -189,12 +189,12 @@ spec: type: object requestSubResource: description: |- - RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale") + requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale") If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed. See documentation for the "matchPolicy" field in the webhook configuration type. type: string resource: - description: Resource is the fully-qualified resource + description: resource is the fully-qualified resource being requested (for example, v1.pods) properties: group: @@ -209,18 +209,18 @@ spec: - version type: object subResource: - description: SubResource is the subresource being requested, + description: subResource is the subresource being requested, if any (for example, "status" or "scale") type: string uid: description: |- - UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are + uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. type: string userInfo: - description: UserInfo is information about the requesting + description: userInfo is information about the requesting user properties: extra: @@ -230,33 +230,27 @@ spec: items: type: string type: array - description: Any additional information provided by - the authenticator. + description: extra is any additional information provided + by the authenticator. type: object groups: - description: The names of groups this user is a part - of. + description: groups is the names of groups this user + is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this - user among all active users. + description: username is the name that uniquely identifies + this user among all active users. type: string type: object - required: - - kind - - operation - - resource - - uid - - userInfo type: object operation: description: Operation is the type of resource operation being @@ -291,24 +285,25 @@ spec: items: type: string type: array - description: Any additional information provided by the - authenticator. + description: extra is any additional information provided + by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is + a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user - among all active users. + description: username is the name that uniquely identifies + this user among all active users. type: string type: object type: object @@ -402,7 +397,7 @@ spec: - state type: object type: object - served: true + served: false storage: false subresources: status: {} @@ -469,11 +464,11 @@ spec: properties: dryRun: description: |- - DryRun indicates that modifications will definitely not be persisted for this request. + dryRun indicates that modifications will definitely not be persisted for this request. Defaults to false. type: boolean kind: - description: Kind is the fully-qualified type of object + description: kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) properties: group: @@ -489,30 +484,30 @@ spec: type: object name: description: |- - Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and + name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this field will contain an empty string. type: string namespace: - description: Namespace is the namespace associated with + description: namespace is the namespace associated with the request (if any). type: string object: - description: Object is the object from the incoming request. + description: object is the object from the incoming request. type: object x-kubernetes-preserve-unknown-fields: true oldObject: - description: OldObject is the existing object. Only populated + description: oldObject is the existing object. Only populated for DELETE and UPDATE requests. type: object x-kubernetes-preserve-unknown-fields: true operation: description: |- - Operation is the operation being performed. This may be different than the operation + operation is the operation being performed. This may be different than the operation requested. e.g. a patch can result in either a CREATE or UPDATE Operation. type: string options: description: |- - Options is the operation option structure of the operation being performed. + options is the operation option structure of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be different than the options the caller provided. e.g. for a patch request the performed Operation might be a CREATE, in which case the Options will a @@ -521,7 +516,7 @@ spec: x-kubernetes-preserve-unknown-fields: true requestKind: description: |- - RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). + requestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in "kind", an equivalent match and conversion was performed. For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of @@ -545,7 +540,7 @@ spec: type: object requestResource: description: |- - RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). + requestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in "resource", an equivalent match and conversion was performed. For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of @@ -569,12 +564,12 @@ spec: type: object requestSubResource: description: |- - RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale") + requestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale") If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed. See documentation for the "matchPolicy" field in the webhook configuration type. type: string resource: - description: Resource is the fully-qualified resource + description: resource is the fully-qualified resource being requested (for example, v1.pods) properties: group: @@ -589,18 +584,18 @@ spec: - version type: object subResource: - description: SubResource is the subresource being requested, + description: subResource is the subresource being requested, if any (for example, "status" or "scale") type: string uid: description: |- - UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are + uid is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging. type: string userInfo: - description: UserInfo is information about the requesting + description: userInfo is information about the requesting user properties: extra: @@ -610,33 +605,27 @@ spec: items: type: string type: array - description: Any additional information provided by - the authenticator. + description: extra is any additional information provided + by the authenticator. type: object groups: - description: The names of groups this user is a part - of. + description: groups is the names of groups this user + is a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this - user among all active users. + description: username is the name that uniquely identifies + this user among all active users. type: string type: object - required: - - kind - - operation - - resource - - uid - - userInfo type: object operation: description: Operation is the type of resource operation being @@ -676,24 +665,25 @@ spec: items: type: string type: array - description: Any additional information provided by the - authenticator. + description: extra is any additional information provided + by the authenticator. type: object groups: - description: The names of groups this user is a part of. + description: groups is the names of groups this user is + a part of. items: type: string type: array x-kubernetes-list-type: atomic uid: description: |- - A unique value that identifies this user across time. If this user is + uid is a unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs. type: string username: - description: The name that uniquely identifies this user - among all active users. + description: username is the name that uniquely identifies + this user among all active users. type: string type: object type: object @@ -711,6 +701,8 @@ spec: enum: - mutate - generate + - cel-generate + - cel-mutate type: string resource: description: ResourceSpec is the information to identify the trigger @@ -741,6 +733,10 @@ spec: optional items: properties: + cacheRestore: + description: CacheRestore indicates whether the cache should + be restored. + type: boolean deleteDownstream: description: DeleteDownstream represents whether the downstream needs to be deleted. diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_clusterephemeralreports.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_clusterephemeralreports.yaml similarity index 95% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_clusterephemeralreports.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_clusterephemeralreports.yaml index de4c67f..83a26e0 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_clusterephemeralreports.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_clusterephemeralreports.yaml @@ -1,4 +1,4 @@ -{{- if .Values.groups.reports.clusterephemeralreports }} +{{- if and .Values.groups.reports.clusterephemeralreports (not .Values.reportsServer.enabled) }} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: clusterephemeralreports.reports.kyverno.io spec: group: reports.kyverno.io @@ -133,7 +133,7 @@ spec: results: description: PolicyReportResult provides result details items: - description: PolicyReportResult provides the result for an individual + description: ReportResult provides the result for an individual policy properties: category: @@ -154,10 +154,10 @@ spec: type: object resourceSelector: description: |- - SubjectSelector is an optional label selector for checked Kubernetes resources. + ResourceSelector is an optional label selector for checked Kubernetes resources. For example, a policy result may apply to all pods that match a label. - Either a Subject or a SubjectSelector can be specified. - If neither are provided, the result is assumed to be for the policy report scope. + Either a Subject or a ResourceSelector can be specified. If neither are provided, the + result is assumed to be for the policy report scope. properties: matchExpressions: description: matchExpressions is a list of label selector @@ -277,8 +277,10 @@ spec: - info type: string source: - description: Source is an identifier for the policy engine that - manages this report + description: |- + Source is an identifier for the policy engine that manages this report + If the Source is specified at this level, it will override the Source + field set at the Report level type: string timestamp: description: Timestamp indicates the time the result was found diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_ephemeralreports.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_ephemeralreports.yaml similarity index 95% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_ephemeralreports.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_ephemeralreports.yaml index 8a994e1..0a29f1a 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_ephemeralreports.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/reports.kyverno.io/reports.kyverno.io_ephemeralreports.yaml @@ -1,4 +1,4 @@ -{{- if .Values.groups.reports.ephemeralreports }} +{{- if and .Values.groups.reports.ephemeralreports (not .Values.reportsServer.enabled) }} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: ephemeralreports.reports.kyverno.io spec: group: reports.kyverno.io @@ -133,7 +133,7 @@ spec: results: description: PolicyReportResult provides result details items: - description: PolicyReportResult provides the result for an individual + description: ReportResult provides the result for an individual policy properties: category: @@ -154,10 +154,10 @@ spec: type: object resourceSelector: description: |- - SubjectSelector is an optional label selector for checked Kubernetes resources. + ResourceSelector is an optional label selector for checked Kubernetes resources. For example, a policy result may apply to all pods that match a label. - Either a Subject or a SubjectSelector can be specified. - If neither are provided, the result is assumed to be for the policy report scope. + Either a Subject or a ResourceSelector can be specified. If neither are provided, the + result is assumed to be for the policy report scope. properties: matchExpressions: description: matchExpressions is a list of label selector @@ -277,8 +277,10 @@ spec: - info type: string source: - description: Source is an identifier for the policy engine that - manages this report + description: |- + Source is an identifier for the policy engine that manages this report + If the Source is specified at this level, it will override the Source + field set at the Report level type: string timestamp: description: Timestamp indicates the time the result was found diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_clusterpolicyreports.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_clusterpolicyreports.yaml similarity index 99% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_clusterpolicyreports.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_clusterpolicyreports.yaml index a656677..78a90d8 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_clusterpolicyreports.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_clusterpolicyreports.yaml @@ -1,4 +1,4 @@ -{{- if .Values.groups.wgpolicyk8s.clusterpolicyreports }} +{{- if and .Values.groups.wgpolicyk8s.clusterpolicyreports (not .Values.reportsServer.enabled) }} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: clusterpolicyreports.wgpolicyk8s.io spec: group: wgpolicyk8s.io diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_policyreports.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_policyreports.yaml similarity index 99% rename from manifests/helm/kyverno/3.4.1/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_policyreports.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_policyreports.yaml index b5bd0c4..2c17190 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_policyreports.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/templates/wgpolicyk8s.io/wgpolicyk8s.io_policyreports.yaml @@ -1,4 +1,4 @@ -{{- if .Values.groups.wgpolicyk8s.policyreports }} +{{- if and .Values.groups.wgpolicyk8s.policyreports (not .Values.reportsServer.enabled) }} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -9,7 +9,7 @@ metadata: {{- with .Values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} - controller-gen.kubebuilder.io/version: v0.17.3 + controller-gen.kubebuilder.io/version: v0.20.0 name: policyreports.wgpolicyk8s.io spec: group: wgpolicyk8s.io diff --git a/manifests/helm/kyverno/3.4.1/charts/crds/values.yaml b/manifests/helm/kyverno/3.9.0/charts/crds/values.yaml similarity index 80% rename from manifests/helm/kyverno/3.4.1/charts/crds/values.yaml rename to manifests/helm/kyverno/3.9.0/charts/crds/values.yaml index b4a213e..2a211fc 100644 --- a/manifests/helm/kyverno/3.4.1/charts/crds/values.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/crds/values.yaml @@ -5,6 +5,10 @@ templating: debug: false version: ~ +reportsServer: + # -- Kyverno reports-server is used in your cluster + enabled: false + groups: # -- Install CRDs in group `kyverno.io` # -- This field can be overwritten by setting crds.labels in the parent chart @@ -21,7 +25,14 @@ groups: policies: validatingpolicies: true imagevalidatingpolicies: true + namespacedimagevalidatingpolicies: true + namespacedvalidatingpolicies: true + namespaceddeletingpolicies: true policyexceptions: true + mutatingpolicies: true + generatingpolicies: true + namespacedgeneratingpolicies: true + deletingpolicies: true # -- This field can be overwritten by setting crds.labels in the parent chart reports: diff --git a/manifests/helm/kyverno/3.4.1/charts/grafana/Chart.yaml b/manifests/helm/kyverno/3.9.0/charts/grafana/Chart.yaml similarity index 65% rename from manifests/helm/kyverno/3.4.1/charts/grafana/Chart.yaml rename to manifests/helm/kyverno/3.9.0/charts/grafana/Chart.yaml index 445be12..6301b28 100644 --- a/manifests/helm/kyverno/3.4.1/charts/grafana/Chart.yaml +++ b/manifests/helm/kyverno/3.9.0/charts/grafana/Chart.yaml @@ -1,3 +1,3 @@ apiVersion: v2 name: grafana -version: 3.4.1 +version: 3.9.0 diff --git a/manifests/helm/kyverno/3.4.1/charts/grafana/README.md b/manifests/helm/kyverno/3.9.0/charts/grafana/README.md similarity index 83% rename from manifests/helm/kyverno/3.4.1/charts/grafana/README.md rename to manifests/helm/kyverno/3.9.0/charts/grafana/README.md index 1616732..79f22f2 100644 --- a/manifests/helm/kyverno/3.4.1/charts/grafana/README.md +++ b/manifests/helm/kyverno/3.9.0/charts/grafana/README.md @@ -1,6 +1,6 @@ # grafana -![Version: 3.4.1](https://img.shields.io/badge/Version-3.4.1-informational?style=flat-square) +![Version: 3.9.0](https://img.shields.io/badge/Version-3.9.0-informational?style=flat-square) ## Values @@ -13,4 +13,4 @@ | grafanaDashboard | object | `{"create":false,"matchLabels":{"dashboards":"grafana"}}` | create GrafanaDashboard custom resource referencing to the configMap. according to https://grafana-operator.github.io/grafana-operator/docs/examples/dashboard_from_configmap/readme/ | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/manifests/helm/kyverno/3.4.1/charts/grafana/dashboard/kyverno-dashboard.json b/manifests/helm/kyverno/3.9.0/charts/grafana/dashboard/kyverno-dashboard.json similarity index 74% rename from manifests/helm/kyverno/3.4.1/charts/grafana/dashboard/kyverno-dashboard.json rename to manifests/helm/kyverno/3.9.0/charts/grafana/dashboard/kyverno-dashboard.json index 660a535..f79bd64 100644 --- a/manifests/helm/kyverno/3.4.1/charts/grafana/dashboard/kyverno-dashboard.json +++ b/manifests/helm/kyverno/3.9.0/charts/grafana/dashboard/kyverno-dashboard.json @@ -3375,6 +3375,1050 @@ ], "title": "Total Admission Requests (Last 24 Hours)", "type": "stat" + }, + { + "collapsed": false, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 86 + }, + "id": 500, + "panels": [], + "title": "CEL Policy Results", + "type": "row" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "short" + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "pass" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "rgb(43, 219, 23)", + "mode": "fixed" + } + }, + { + "id": "custom.lineStyle", + "value": { + "dash": [ + 10, + 10 + ], + "fill": "dash" + } + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "fail" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "#F2495C", + "mode": "fixed" + } + } + ] + } + ] + }, + "gridPos": { + "h": 8, + "w": 8, + "x": 0, + "y": 87 + }, + "id": 501, + "options": { + "legend": { + "calcs": [ + "lastNotNull", + "max", + "min" + ], + "displayMode": "table", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "8.1.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(increase({__name__=~\"kyverno_validating_policy_results_total|kyverno_mutating_policy_results_total|kyverno_image_validating_policy_results_total\", execution_cause=\"admission_request\", cluster=~\"$cluster\"}[5m])) by (result)", + "interval": "", + "legendFormat": "{{result}}", + "refId": "A" + } + ], + "title": "Admission Review Results (CEL)", + "type": "timeseries" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "short" + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "pass" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "rgb(43, 219, 23)", + "mode": "fixed" + } + }, + { + "id": "custom.lineStyle", + "value": { + "dash": [ + 10, + 10 + ], + "fill": "dash" + } + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "fail" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "#F2495C", + "mode": "fixed" + } + } + ] + } + ] + }, + "gridPos": { + "h": 8, + "w": 8, + "x": 8, + "y": 87 + }, + "id": 502, + "options": { + "legend": { + "calcs": [ + "lastNotNull", + "max", + "min" + ], + "displayMode": "table", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "8.1.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(increase({__name__=~\"kyverno_validating_policy_results_total|kyverno_mutating_policy_results_total|kyverno_image_validating_policy_results_total\", execution_cause=\"background_scan\", cluster=~\"$cluster\"}[5m])) by (result)", + "interval": "", + "legendFormat": "{{result}}", + "refId": "A" + } + ], + "title": "Background Scan Results (CEL)", + "type": "timeseries" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "short" + }, + "overrides": [] + }, + "gridPos": { + "h": 8, + "w": 8, + "x": 16, + "y": 87 + }, + "id": 503, + "options": { + "legend": { + "calcs": [ + "lastNotNull", + "max", + "min" + ], + "displayMode": "table", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "8.1.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(increase(kyverno_validating_policy_results_total{result=\"fail\", cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Validating Policy", + "refId": "A" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(increase(kyverno_mutating_policy_results_total{result=\"fail\", cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Mutating Policy", + "refId": "B" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(increase(kyverno_generating_policy_results_total{result=\"fail\", cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Generating Policy", + "refId": "C" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(increase(kyverno_image_validating_policy_results_total{result=\"fail\", cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Image Validating Policy", + "refId": "D" + } + ], + "title": "Policy Failures by Type (CEL)", + "type": "timeseries" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "short" + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "pass" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "rgb(43, 219, 23)", + "mode": "fixed" + } + }, + { + "id": "custom.lineStyle", + "value": { + "dash": [ + 10, + 10 + ], + "fill": "dash" + } + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "fail" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "#F2495C", + "mode": "fixed" + } + } + ] + } + ] + }, + "gridPos": { + "h": 8, + "w": 12, + "x": 0, + "y": 95 + }, + "id": 504, + "options": { + "legend": { + "calcs": [ + "lastNotNull", + "max", + "min" + ], + "displayMode": "table", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "8.1.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum by (policy_name, result) (increase({__name__=~\"kyverno_validating_policy_results_total|kyverno_mutating_policy_results_total|kyverno_image_validating_policy_results_total\", execution_cause=\"admission_request\", cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "{{policy_name}} - {{result}}", + "refId": "A" + } + ], + "title": "Admission Review Results per-policy (CEL)", + "type": "timeseries" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "min": 0, + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "short" + }, + "overrides": [ + { + "matcher": { + "id": "byName", + "options": "pass" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "rgb(43, 219, 23)", + "mode": "fixed" + } + }, + { + "id": "custom.lineStyle", + "value": { + "dash": [ + 10, + 10 + ], + "fill": "dash" + } + } + ] + }, + { + "matcher": { + "id": "byName", + "options": "fail" + }, + "properties": [ + { + "id": "color", + "value": { + "fixedColor": "#F2495C", + "mode": "fixed" + } + } + ] + } + ] + }, + "gridPos": { + "h": 8, + "w": 12, + "x": 12, + "y": 95 + }, + "id": 505, + "options": { + "legend": { + "calcs": [ + "lastNotNull", + "max", + "min" + ], + "displayMode": "table", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "8.1.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum by (policy_name, result) (increase({__name__=~\"kyverno_validating_policy_results_total|kyverno_mutating_policy_results_total|kyverno_image_validating_policy_results_total\", execution_cause=\"background_scan\", cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "{{policy_name}} - {{result}}", + "refId": "A" + } + ], + "title": "Background Scan Results per-policy (CEL)", + "type": "timeseries" + }, + { + "collapsed": false, + "datasource": null, + "gridPos": { + "h": 1, + "w": 24, + "x": 0, + "y": 103 + }, + "id": 506, + "panels": [], + "title": "CEL Policy Execution Latency", + "type": "row" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "s" + }, + "overrides": [] + }, + "gridPos": { + "h": 8, + "w": 8, + "x": 0, + "y": 104 + }, + "id": 507, + "options": { + "legend": { + "calcs": [ + "lastNotNull", + "max", + "min" + ], + "displayMode": "table", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "8.1.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_validating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) / sum(rate(kyverno_validating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Validating", + "refId": "A" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_mutating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) / sum(rate(kyverno_mutating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Mutating", + "refId": "B" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_generating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) / sum(rate(kyverno_generating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Generating", + "refId": "C" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_image_validating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) / sum(rate(kyverno_image_validating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m]))", + "interval": "", + "legendFormat": "Image Validating", + "refId": "D" + } + ], + "title": "Avg Latency by Policy Type (CEL)", + "type": "timeseries" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "thresholds" + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "blue", + "value": null + } + ] + }, + "unit": "s" + }, + "overrides": [] + }, + "gridPos": { + "h": 8, + "w": 4, + "x": 8, + "y": 104 + }, + "id": 508, + "options": { + "colorMode": "value", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "auto", + "percentChangeColorMode": "standard", + "reduceOptions": { + "calcs": [ + "lastNotNull" + ], + "fields": "", + "values": false + }, + "showPercentChange": false, + "text": {}, + "textMode": "auto", + "wideLayout": true + }, + "pluginVersion": "11.2.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "(sum(kyverno_validating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}) + sum(kyverno_mutating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}) + sum(kyverno_generating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}) + sum(kyverno_image_validating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"})) / (sum(kyverno_validating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}) + sum(kyverno_mutating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}) + sum(kyverno_generating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}) + sum(kyverno_image_validating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}))", + "interval": "", + "legendFormat": "", + "refId": "A" + } + ], + "title": "Overall Avg CEL Policy Latency", + "type": "stat" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "fieldConfig": { + "defaults": { + "color": { + "mode": "palette-classic" + }, + "custom": { + "axisBorderShow": false, + "axisCenteredZero": false, + "axisColorMode": "text", + "axisLabel": "", + "axisPlacement": "auto", + "barAlignment": 0, + "barWidthFactor": 0.6, + "drawStyle": "line", + "fillOpacity": 10, + "gradientMode": "none", + "hideFrom": { + "legend": false, + "tooltip": false, + "viz": false + }, + "insertNulls": false, + "lineInterpolation": "linear", + "lineWidth": 1, + "pointSize": 5, + "scaleDistribution": { + "type": "linear" + }, + "showPoints": "never", + "spanNulls": false, + "stacking": { + "group": "A", + "mode": "none" + }, + "thresholdsStyle": { + "mode": "off" + } + }, + "mappings": [], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "s" + }, + "overrides": [] + }, + "gridPos": { + "h": 8, + "w": 12, + "x": 12, + "y": 104 + }, + "id": 509, + "options": { + "legend": { + "calcs": [ + "lastNotNull", + "max", + "min" + ], + "displayMode": "table", + "placement": "bottom", + "showLegend": true + }, + "tooltip": { + "mode": "multi", + "sort": "none" + } + }, + "pluginVersion": "8.1.0", + "targets": [ + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_validating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) by (policy_name) / sum(rate(kyverno_validating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m])) by (policy_name)", + "interval": "", + "legendFormat": "{{policy_name}} (vpol)", + "refId": "A" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_mutating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) by (policy_name) / sum(rate(kyverno_mutating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m])) by (policy_name)", + "interval": "", + "legendFormat": "{{policy_name}} (mpol)", + "refId": "B" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_generating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) by (policy_name) / sum(rate(kyverno_generating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m])) by (policy_name)", + "interval": "", + "legendFormat": "{{policy_name}} (gpol)", + "refId": "C" + }, + { + "datasource": { + "uid": "${DS_PROMETHEUS_KYVERNO}" + }, + "exemplar": true, + "expr": "sum(rate(kyverno_image_validating_policy_execution_duration_seconds_sum{cluster=~\"$cluster\"}[5m])) by (policy_name) / sum(rate(kyverno_image_validating_policy_execution_duration_seconds_count{cluster=~\"$cluster\"}[5m])) by (policy_name)", + "interval": "", + "legendFormat": "{{policy_name}} (ivpol)", + "refId": "D" + } + ], + "title": "Avg Latency per Policy Name (CEL)", + "type": "timeseries" } ], "refresh": false, diff --git a/manifests/helm/kyverno/3.4.1/charts/grafana/templates/dashboard.yaml b/manifests/helm/kyverno/3.9.0/charts/grafana/templates/dashboard.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/charts/grafana/templates/dashboard.yaml rename to manifests/helm/kyverno/3.9.0/charts/grafana/templates/dashboard.yaml diff --git a/manifests/helm/kyverno/3.4.1/charts/grafana/values.yaml b/manifests/helm/kyverno/3.9.0/charts/grafana/values.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/charts/grafana/values.yaml rename to manifests/helm/kyverno/3.9.0/charts/grafana/values.yaml diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/Chart.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/Chart.yaml new file mode 100644 index 0000000..e1f3ff6 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/Chart.yaml @@ -0,0 +1,4 @@ +apiVersion: v2 +appVersion: 0.0.1-alpha.4 +name: kyverno-api +version: 0.0.1-alpha.4 diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/README.md b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/README.md new file mode 100644 index 0000000..8674c05 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/README.md @@ -0,0 +1,17 @@ +# kyverno-api + +![Version: v0.0.0](https://img.shields.io/badge/Version-v0.0.0-informational?style=flat-square) + +## About + +TODO + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| annotations | object | `{}` | Additional CRDs annotations | +| labels | object | `{}` | Additional CRDs labels | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/README.md.gotmpl b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/README.md.gotmpl new file mode 100644 index 0000000..ebbfe57 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} +{{ template "chart.deprecationWarning" . }} +{{ template "chart.description" . }} + +{{ template "chart.badgesSection" . }} + +## About + +TODO + +## Values + +{{ template "chart.valuesTable" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "helm-docs.versionFooter" . }} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/_helpers.tpl b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/_helpers.tpl new file mode 100644 index 0000000..90e673e --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/_helpers.tpl @@ -0,0 +1,13 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "kyverno-api.chartVersion" -}} +{{- .Chart.Version | replace "+" "_" -}} +{{- end -}} + +{{- define "kyverno-api.labels" -}} +{{- tpl (toYaml .Values.labels) . -}} +{{- end -}} + +{{- define "kyverno-api.annotations" -}} +{{- tpl (toYaml .Values.annotations) . -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_deletingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_deletingpolicies.yaml new file mode 100644 index 0000000..3efe283 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_deletingpolicies.yaml @@ -0,0 +1,1679 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: deletingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: DeletingPolicy + listKind: DeletingPolicyList + plural: deletingpolicies + shortNames: + - dpol + singular: deletingpolicy + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: DeletingPolicySpec is the specification of the desired behavior + of the DeletingPolicy. + properties: + conditions: + description: |- + Conditions is a list of conditions that must be met for a resource to be deleted. + Conditions filter resources that have already been matched by the match constraints, + namespaceSelector, and objectSelector. An empty list of conditions matches all resources. + There are a maximum of 64 conditions allowed. + + The exact matching logic is (in order): + 1. If ANY condition evaluates to FALSE, the policy is skipped. + 2. If ALL conditions evaluate to TRUE, the policy is executed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + deletionPropagationPolicy: + description: DeletionPropagationPolicy defines how resources will + be deleted (Foreground, Background, Orphan). + enum: + - Foreground + - Background + - Orphan + type: string + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + schedule: + description: |- + The schedule in Cron format + Required. + type: string + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + required: + - schedule + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + lastExecutionTime: + format: date-time + type: string + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: DeletingPolicySpec is the specification of the desired behavior + of the DeletingPolicy. + properties: + conditions: + description: |- + Conditions is a list of conditions that must be met for a resource to be deleted. + Conditions filter resources that have already been matched by the match constraints, + namespaceSelector, and objectSelector. An empty list of conditions matches all resources. + There are a maximum of 64 conditions allowed. + + The exact matching logic is (in order): + 1. If ANY condition evaluates to FALSE, the policy is skipped. + 2. If ALL conditions evaluate to TRUE, the policy is executed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + deletionPropagationPolicy: + description: DeletionPropagationPolicy defines how resources will + be deleted (Foreground, Background, Orphan). + enum: + - Foreground + - Background + - Orphan + type: string + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + schedule: + description: |- + The schedule in Cron format + Required. + type: string + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + required: + - schedule + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + lastExecutionTime: + format: date-time + type: string + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: DeletingPolicySpec is the specification of the desired behavior + of the DeletingPolicy. + properties: + conditions: + description: |- + Conditions is a list of conditions that must be met for a resource to be deleted. + Conditions filter resources that have already been matched by the match constraints, + namespaceSelector, and objectSelector. An empty list of conditions matches all resources. + There are a maximum of 64 conditions allowed. + + The exact matching logic is (in order): + 1. If ANY condition evaluates to FALSE, the policy is skipped. + 2. If ALL conditions evaluate to TRUE, the policy is executed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + deletionPropagationPolicy: + description: DeletionPropagationPolicy defines how resources will + be deleted (Foreground, Background, Orphan). + enum: + - Foreground + - Background + - Orphan + type: string + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + schedule: + description: |- + The schedule in Cron format + Required. + type: string + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + required: + - schedule + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + lastExecutionTime: + format: date-time + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_generatingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_generatingpolicies.yaml new file mode 100644 index 0000000..0d60353 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_generatingpolicies.yaml @@ -0,0 +1,2147 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: generatingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: GeneratingPolicy + listKind: GeneratingPolicyList + plural: generatingpolicies + shortNames: + - gpol + singular: generatingpolicy + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GeneratingPolicySpec is the specification of the desired + behavior of the GeneratingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + generateExisting: + description: GenerateExisting defines the configuration for generating + resources for existing triggeres. + properties: + enabled: + default: false + description: |- + Enabled controls whether to trigger the policy for existing resources + If is set to "true" the policy will be triggered and applied to existing matched resources. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + orphanDownstreamOnPolicyDelete: + description: OrphanDownstreamOnPolicyDelete defines the configuration + for orphaning downstream resources on policy delete. + properties: + enabled: + default: false + description: |- + Enabled controls whether generated resources should be deleted when the policy that generated + them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean + synchronize: + description: Synchronization defines the configuration for the + synchronization of generated resources. + properties: + enabled: + default: false + description: |- + Enabled controls if generated resources should be kept in-sync with their source resource. + If Synchronize is set to "true" changes to generated resources will be overwritten with resource + data from Data or the resource specified in the Clone declaration. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + generate: + description: |- + Generation defines a set of CEL expressions that will be evaluated to generate resources. + Required. + items: + description: Generation defines the configuration for the generation + of resources. + properties: + expression: + description: Expression is a CEL expression that takes a list + of resources to be generated. + type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object + type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) + && has(self.template)) + minItems: 1 + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources will trigger this policy. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - generate + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GeneratingPolicySpec is the specification of the desired + behavior of the GeneratingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + generateExisting: + description: GenerateExisting defines the configuration for generating + resources for existing triggeres. + properties: + enabled: + default: false + description: |- + Enabled controls whether to trigger the policy for existing resources + If is set to "true" the policy will be triggered and applied to existing matched resources. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + orphanDownstreamOnPolicyDelete: + description: OrphanDownstreamOnPolicyDelete defines the configuration + for orphaning downstream resources on policy delete. + properties: + enabled: + default: false + description: |- + Enabled controls whether generated resources should be deleted when the policy that generated + them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean + synchronize: + description: Synchronization defines the configuration for the + synchronization of generated resources. + properties: + enabled: + default: false + description: |- + Enabled controls if generated resources should be kept in-sync with their source resource. + If Synchronize is set to "true" changes to generated resources will be overwritten with resource + data from Data or the resource specified in the Clone declaration. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + generate: + description: |- + Generation defines a set of CEL expressions that will be evaluated to generate resources. + Required. + items: + description: Generation defines the configuration for the generation + of resources. + properties: + expression: + description: Expression is a CEL expression that takes a list + of resources to be generated. + type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object + type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) + && has(self.template)) + minItems: 1 + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources will trigger this policy. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - generate + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GeneratingPolicySpec is the specification of the desired + behavior of the GeneratingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + generateExisting: + description: GenerateExisting defines the configuration for generating + resources for existing triggeres. + properties: + enabled: + default: false + description: |- + Enabled controls whether to trigger the policy for existing resources + If is set to "true" the policy will be triggered and applied to existing matched resources. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + orphanDownstreamOnPolicyDelete: + description: OrphanDownstreamOnPolicyDelete defines the configuration + for orphaning downstream resources on policy delete. + properties: + enabled: + default: false + description: |- + Enabled controls whether generated resources should be deleted when the policy that generated + them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean + synchronize: + description: Synchronization defines the configuration for the + synchronization of generated resources. + properties: + enabled: + default: false + description: |- + Enabled controls if generated resources should be kept in-sync with their source resource. + If Synchronize is set to "true" changes to generated resources will be overwritten with resource + data from Data or the resource specified in the Clone declaration. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + generate: + description: |- + Generation defines a set of CEL expressions that will be evaluated to generate resources. + Required. + items: + description: Generation defines the configuration for the generation + of resources. + properties: + expression: + description: Expression is a CEL expression that takes a list + of resources to be generated. + type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object + type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) + && has(self.template)) + minItems: 1 + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources will trigger this policy. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - generate + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_imagevalidatingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_imagevalidatingpolicies.yaml new file mode 100644 index 0000000..578cafc --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_imagevalidatingpolicies.yaml @@ -0,0 +1,7133 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: imagevalidatingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: ImageValidatingPolicy + listKind: ImageValidatingPolicyList + plural: imagevalidatingpolicies + shortNames: + - ivpol + singular: imagevalidatingpolicy + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ImageValidatingPolicySpec is the specification of the desired + behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata to verify + items: + description: Attestation defines the identification details of the metadata + that has to be verified + properties: + intoto: + description: InToto defines the details of attestation attached + using intoto format + properties: + type: + description: Type defines the type of attestation contained + within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. It is used + to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation attached + using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation attached + to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms or verifies the + authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration for Cosign + based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration for local + signature verification + properties: + cert: + description: Certificate is the to the public certificate + for local signature verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration to verify the + authority against a Rekor instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used to validate + SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips transparency log + verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor instance + (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to validate the + image. + properties: + data: + description: Data contains the inline public key + type: string + expression: + description: Expression is a Expression expression that + returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration to verify the + authority against a Fulcio instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions + used for keyless signing. + type: object + identities: + description: Identities sets a list of identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the issuer for this + identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies a regular + expression to match the issuer for this identity. + type: string + subject: + description: Subject defines the subject for this + identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies a regular + expression to match the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration to specify the + sources from where to consume the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location from where + to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tuf: + description: TUF defines the configuration to fetch sigstore + root + properties: + mirror: + description: Mirror is the base URL of Sigstore TUF + repository + type: string + root: + description: Root defines the path or data of the trusted + root + properties: + data: + description: Data is the base64 encoded TUF root + type: string + path: + description: Path is the URL or File location of + the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. It is used + to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration for Notary + based signatures + properties: + certs: + description: Certs define the cert chain for Notary signature + verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain for verifying + timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will be used for + authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure access to a + registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides the list of credential + providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression to extract + images from the resource + items: + properties: + expression: + description: Expression defines CEL expression to extract images + from the resource. + type: string + name: + description: Name is the name for this imageList. It is used + to refer to the images in verification block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources this policy + is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or a CEL expression + for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions for matching + images + type: string + glob: + description: Glob defines a globbing pattern for matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings for mutating + and verifying image digests, and enforcing image verification through + signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are verified, i.e., + have passed a signature or attestation check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which is used to + apply the image validation checks. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ImageValidatingPolicySpec is the specification + of the desired behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata + to verify + items: + description: Attestation defines the identification + details of the metadata that has to be verified + properties: + intoto: + description: InToto defines the details of attestation + attached using intoto format + properties: + type: + description: Type defines the type of attestation + contained within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. + It is used to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation + attached using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation + attached to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms + or verifies the authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration + for Cosign based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration + for local signature verification + properties: + cert: + description: Certificate is the to the + public certificate for local signature + verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration + to verify the authority against a Rekor + instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used + to validate SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips + transparency log verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor + instance (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to + validate the image. + properties: + data: + description: Data contains the inline + public key + type: string + expression: + description: Expression is a Expression + expression that returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration + to verify the authority against a Fulcio + instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are + certificate-extensions used for keyless + signing. + type: object + identities: + description: Identities sets a list of + identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the + issuer for this identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies + a regular expression to match + the issuer for this identity. + type: string + subject: + description: Subject defines the + subject for this identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies + a regular expression to match + the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration + to specify the sources from where to consume + the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location + from where to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tuf: + description: TUF defines the configuration + to fetch sigstore root + properties: + mirror: + description: Mirror is the base URL of + Sigstore TUF repository + type: string + root: + description: Root defines the path or + data of the trusted root + properties: + data: + description: Data is the base64 encoded + TUF root + type: string + path: + description: Path is the URL or File + location of the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. + It is used to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration + for Notary based signatures + properties: + certs: + description: Certs define the cert chain for + Notary signature verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain + for verifying timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will + be used for authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure + access to a registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides + the list of credential providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression + to extract images from the resource + items: + properties: + expression: + description: Expression defines CEL expression + to extract images from the resource. + type: string + name: + description: Name is the name for this imageList. + It is used to refer to the images in verification + block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources + this policy is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or + a CEL expression for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions + for matching images + type: string + glob: + description: Glob defines a globbing pattern for + matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings + for mutating and verifying image digests, and enforcing + image verification through signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are + verified, i.e., have passed a signature or attestation + check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images + have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which + is used to apply the image validation checks. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ImageValidatingPolicySpec is the specification of the desired + behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata to verify + items: + description: Attestation defines the identification details of the metadata + that has to be verified + properties: + intoto: + description: InToto defines the details of attestation attached + using intoto format + properties: + type: + description: Type defines the type of attestation contained + within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. It is used + to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation attached + using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation attached + to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms or verifies the + authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration for Cosign + based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration for local + signature verification + properties: + cert: + description: Certificate is the to the public certificate + for local signature verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration to verify the + authority against a Rekor instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used to validate + SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips transparency log + verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor instance + (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to validate the + image. + properties: + data: + description: Data contains the inline public key + type: string + expression: + description: Expression is a Expression expression that + returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration to verify the + authority against a Fulcio instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions + used for keyless signing. + type: object + identities: + description: Identities sets a list of identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the issuer for this + identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies a regular + expression to match the issuer for this identity. + type: string + subject: + description: Subject defines the subject for this + identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies a regular + expression to match the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration to specify the + sources from where to consume the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location from where + to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tuf: + description: TUF defines the configuration to fetch sigstore + root + properties: + mirror: + description: Mirror is the base URL of Sigstore TUF + repository + type: string + root: + description: Root defines the path or data of the trusted + root + properties: + data: + description: Data is the base64 encoded TUF root + type: string + path: + description: Path is the URL or File location of + the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. It is used + to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration for Notary + based signatures + properties: + certs: + description: Certs define the cert chain for Notary signature + verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain for verifying + timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will be used for + authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure access to a + registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides the list of credential + providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression to extract + images from the resource + items: + properties: + expression: + description: Expression defines CEL expression to extract images + from the resource. + type: string + name: + description: Name is the name for this imageList. It is used + to refer to the images in verification block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources this policy + is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or a CEL expression + for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions for matching + images + type: string + glob: + description: Glob defines a globbing pattern for matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings for mutating + and verifying image digests, and enforcing image verification through + signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are verified, i.e., + have passed a signature or attestation check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which is used to + apply the image validation checks. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ImageValidatingPolicySpec is the specification + of the desired behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata + to verify + items: + description: Attestation defines the identification + details of the metadata that has to be verified + properties: + intoto: + description: InToto defines the details of attestation + attached using intoto format + properties: + type: + description: Type defines the type of attestation + contained within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. + It is used to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation + attached using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation + attached to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms + or verifies the authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration + for Cosign based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration + for local signature verification + properties: + cert: + description: Certificate is the to the + public certificate for local signature + verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration + to verify the authority against a Rekor + instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used + to validate SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips + transparency log verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor + instance (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to + validate the image. + properties: + data: + description: Data contains the inline + public key + type: string + expression: + description: Expression is a Expression + expression that returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration + to verify the authority against a Fulcio + instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are + certificate-extensions used for keyless + signing. + type: object + identities: + description: Identities sets a list of + identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the + issuer for this identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies + a regular expression to match + the issuer for this identity. + type: string + subject: + description: Subject defines the + subject for this identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies + a regular expression to match + the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration + to specify the sources from where to consume + the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location + from where to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tuf: + description: TUF defines the configuration + to fetch sigstore root + properties: + mirror: + description: Mirror is the base URL of + Sigstore TUF repository + type: string + root: + description: Root defines the path or + data of the trusted root + properties: + data: + description: Data is the base64 encoded + TUF root + type: string + path: + description: Path is the URL or File + location of the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. + It is used to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration + for Notary based signatures + properties: + certs: + description: Certs define the cert chain for + Notary signature verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain + for verifying timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will + be used for authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure + access to a registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides + the list of credential providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression + to extract images from the resource + items: + properties: + expression: + description: Expression defines CEL expression + to extract images from the resource. + type: string + name: + description: Name is the name for this imageList. + It is used to refer to the images in verification + block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources + this policy is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or + a CEL expression for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions + for matching images + type: string + glob: + description: Glob defines a globbing pattern for + matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings + for mutating and verifying image digests, and enforcing + image verification through signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are + verified, i.e., have passed a signature or attestation + check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images + have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which + is used to apply the image validation checks. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ImageValidatingPolicySpec is the specification of the desired + behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata to verify + items: + description: Attestation defines the identification details of the metadata + that has to be verified + properties: + intoto: + description: InToto defines the details of attestation attached + using intoto format + properties: + type: + description: Type defines the type of attestation contained + within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. It is used + to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation attached + using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation attached + to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms or verifies the + authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration for Cosign + based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration for local + signature verification + properties: + cert: + description: Certificate is the to the public certificate + for local signature verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration to verify the + authority against a Rekor instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used to validate + SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips transparency log + verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor instance + (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to validate the + image. + properties: + data: + description: Data contains the inline public key + type: string + expression: + description: Expression is a Expression expression that + returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration to verify the + authority against a Fulcio instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions + used for keyless signing. + type: object + identities: + description: Identities sets a list of identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the issuer for this + identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies a regular + expression to match the issuer for this identity. + type: string + subject: + description: Subject defines the subject for this + identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies a regular + expression to match the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration to specify the + sources from where to consume the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location from where + to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tuf: + description: TUF defines the configuration to fetch sigstore + root + properties: + mirror: + description: Mirror is the base URL of Sigstore TUF + repository + type: string + root: + description: Root defines the path or data of the trusted + root + properties: + data: + description: Data is the base64 encoded TUF root + type: string + path: + description: Path is the URL or File location of + the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. It is used + to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration for Notary + based signatures + properties: + certs: + description: Certs define the cert chain for Notary signature + verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain for verifying + timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will be used for + authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure access to a + registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides the list of credential + providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression to extract + images from the resource + items: + properties: + expression: + description: Expression defines CEL expression to extract images + from the resource. + type: string + name: + description: Name is the name for this imageList. It is used + to refer to the images in verification block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources this policy + is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or a CEL expression + for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions for matching + images + type: string + glob: + description: Glob defines a globbing pattern for matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings for mutating + and verifying image digests, and enforcing image verification through + signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are verified, i.e., + have passed a signature or attestation check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which is used to + apply the image validation checks. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ImageValidatingPolicySpec is the specification + of the desired behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata + to verify + items: + description: Attestation defines the identification + details of the metadata that has to be verified + properties: + intoto: + description: InToto defines the details of attestation + attached using intoto format + properties: + type: + description: Type defines the type of attestation + contained within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. + It is used to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation + attached using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation + attached to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms + or verifies the authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration + for Cosign based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration + for local signature verification + properties: + cert: + description: Certificate is the to the + public certificate for local signature + verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration + to verify the authority against a Rekor + instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used + to validate SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips + transparency log verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor + instance (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to + validate the image. + properties: + data: + description: Data contains the inline + public key + type: string + expression: + description: Expression is a Expression + expression that returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration + to verify the authority against a Fulcio + instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are + certificate-extensions used for keyless + signing. + type: object + identities: + description: Identities sets a list of + identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the + issuer for this identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies + a regular expression to match + the issuer for this identity. + type: string + subject: + description: Subject defines the + subject for this identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies + a regular expression to match + the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration + to specify the sources from where to consume + the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location + from where to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tuf: + description: TUF defines the configuration + to fetch sigstore root + properties: + mirror: + description: Mirror is the base URL of + Sigstore TUF repository + type: string + root: + description: Root defines the path or + data of the trusted root + properties: + data: + description: Data is the base64 encoded + TUF root + type: string + path: + description: Path is the URL or File + location of the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. + It is used to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration + for Notary based signatures + properties: + certs: + description: Certs define the cert chain for + Notary signature verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain + for verifying timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will + be used for authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure + access to a registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides + the list of credential providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression + to extract images from the resource + items: + properties: + expression: + description: Expression defines CEL expression + to extract images from the resource. + type: string + name: + description: Name is the name for this imageList. + It is used to refer to the images in verification + block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources + this policy is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or + a CEL expression for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions + for matching images + type: string + glob: + description: Glob defines a globbing pattern for + matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings + for mutating and verifying image digests, and enforcing + image verification through signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are + verified, i.e., have passed a signature or attestation + check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images + have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which + is used to apply the image validation checks. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_mutatingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_mutatingpolicies.yaml new file mode 100644 index 0000000..04059f0 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_mutatingpolicies.yaml @@ -0,0 +1,7292 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: mutatingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: MutatingPolicy + listKind: MutatingPolicyList + plural: mutatingpolicies + shortNames: + - mpol + singular: mutatingpolicy + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MutatingPolicySpec is the specification of the desired behavior + of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether to generate + a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing resources + are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression which is used + to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated by CEL to create + an apply configuration.\nref: https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using object initialization. + For example, this CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t spec: Object.spec{\n\t + \ serviceAccountName: \"example\"\n\t }\n\t}\n\nApply + configurations may not modify atomic structs, maps or + arrays due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL expressions + have access to the object types needed to create apply + configurations:\n\n- 'Object' - CEL type of the resource + object.\n- 'Object.' - CEL type of object field + (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nThe `apiVersion`, `kind`, `metadata.name` + and `metadata.generateName` are always accessible from + the root of the\nobject. No other metadata properties + are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated by CEL to create + a [JSON patch](https://jsonpatch.com/).\nref: https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor example, + this CEL expression returns a JSON patch to conditionally + modify a value:\n\n\t [\n\t JSONPatch{op: \"test\", + path: \"/spec/example\", value: \"Red\"},\n\t JSONPatch{op: + \"replace\", path: \"/spec/example\", value: \"Green\"}\n\t + \ ]\n\nTo define an object for the patch value, use Object + types. For example:\n\n\t [\n\t JSONPatch{\n\t op: + \"add\",\n\t path: \"/spec/selector\",\n\t value: + Object.spec.selector{matchLabels: {\"environment\": \"test\"}}\n\t + \ }\n\t ]\n\nTo use strings containing '/' and '~' + as JSONPatch path keys, use \"jsonpatch.escapeKey\". For + example:\n\n\t [\n\t JSONPatch{\n\t op: \"add\",\n\t + \ path: \"/metadata/labels/\" + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL expressions + have access to the types needed to create JSON patches + and objects:\n\n- 'JSONPatch' - CEL type of JSON Patch + operations. JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may be set to any + of: string,\n integer, array, map or object. If set, + the 'path' and 'from' fields must be set to a\n [JSON + pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' CEL\n function + may be used to escape path keys containing '/' and '~'.\n- + 'Object' - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` - CEL + type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nCEL expressions have access to [Kubernetes + CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs JSONPatch + key escaping. '~' and '/' are escaped as '~0' and `~1' + respectively).\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources to mutate + after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: MutatingPolicySpec is the specification of + the desired behavior of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether + to generate a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing + resources are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression + which is used to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated + by CEL to create an apply configuration.\nref: + https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using + object initialization. For example, this + CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t + \ spec: Object.spec{\n\t serviceAccountName: + \"example\"\n\t }\n\t}\n\nApply configurations + may not modify atomic structs, maps or arrays + due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL + expressions have access to the object types + needed to create apply configurations:\n\n- + 'Object' - CEL type of the resource object.\n- + 'Object.' - CEL type of object + field (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated + by CEL to create a [JSON patch](https://jsonpatch.com/).\nref: + https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor + example, this CEL expression returns a JSON + patch to conditionally modify a value:\n\n\t + \ [\n\t JSONPatch{op: \"test\", path: + \"/spec/example\", value: \"Red\"},\n\t + \ JSONPatch{op: \"replace\", path: \"/spec/example\", + value: \"Green\"}\n\t ]\n\nTo define an + object for the patch value, use Object types. + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/spec/selector\",\n\t + \ value: Object.spec.selector{matchLabels: + {\"environment\": \"test\"}}\n\t }\n\t + \ ]\n\nTo use strings containing '/' and + '~' as JSONPatch path keys, use \"jsonpatch.escapeKey\". + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/metadata/labels/\" + + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL + expressions have access to the types needed + to create JSON patches and objects:\n\n- + 'JSONPatch' - CEL type of JSON Patch operations. + JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may + be set to any of: string,\n integer, array, + map or object. If set, the 'path' and 'from' + fields must be set to a\n [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' + CEL\n function may be used to escape path + keys containing '/' and '~'.\n- 'Object' + - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nCEL expressions + have access to [Kubernetes CEL function + libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs + JSONPatch key escaping. '~' and '/' are + escaped as '~0' and `~1' respectively).\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources + to mutate after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MutatingPolicySpec is the specification of the desired behavior + of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether to generate + a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing resources + are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression which is used + to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated by CEL to create + an apply configuration.\nref: https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using object initialization. + For example, this CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t spec: Object.spec{\n\t + \ serviceAccountName: \"example\"\n\t }\n\t}\n\nApply + configurations may not modify atomic structs, maps or + arrays due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL expressions + have access to the object types needed to create apply + configurations:\n\n- 'Object' - CEL type of the resource + object.\n- 'Object.' - CEL type of object field + (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nThe `apiVersion`, `kind`, `metadata.name` + and `metadata.generateName` are always accessible from + the root of the\nobject. No other metadata properties + are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated by CEL to create + a [JSON patch](https://jsonpatch.com/).\nref: https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor example, + this CEL expression returns a JSON patch to conditionally + modify a value:\n\n\t [\n\t JSONPatch{op: \"test\", + path: \"/spec/example\", value: \"Red\"},\n\t JSONPatch{op: + \"replace\", path: \"/spec/example\", value: \"Green\"}\n\t + \ ]\n\nTo define an object for the patch value, use Object + types. For example:\n\n\t [\n\t JSONPatch{\n\t op: + \"add\",\n\t path: \"/spec/selector\",\n\t value: + Object.spec.selector{matchLabels: {\"environment\": \"test\"}}\n\t + \ }\n\t ]\n\nTo use strings containing '/' and '~' + as JSONPatch path keys, use \"jsonpatch.escapeKey\". For + example:\n\n\t [\n\t JSONPatch{\n\t op: \"add\",\n\t + \ path: \"/metadata/labels/\" + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL expressions + have access to the types needed to create JSON patches + and objects:\n\n- 'JSONPatch' - CEL type of JSON Patch + operations. JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may be set to any + of: string,\n integer, array, map or object. If set, + the 'path' and 'from' fields must be set to a\n [JSON + pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' CEL\n function + may be used to escape path keys containing '/' and '~'.\n- + 'Object' - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` - CEL + type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nCEL expressions have access to [Kubernetes + CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs JSONPatch + key escaping. '~' and '/' are escaped as '~0' and `~1' + respectively).\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources to mutate + after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: MutatingPolicySpec is the specification of + the desired behavior of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether + to generate a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing + resources are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression + which is used to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated + by CEL to create an apply configuration.\nref: + https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using + object initialization. For example, this + CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t + \ spec: Object.spec{\n\t serviceAccountName: + \"example\"\n\t }\n\t}\n\nApply configurations + may not modify atomic structs, maps or arrays + due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL + expressions have access to the object types + needed to create apply configurations:\n\n- + 'Object' - CEL type of the resource object.\n- + 'Object.' - CEL type of object + field (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated + by CEL to create a [JSON patch](https://jsonpatch.com/).\nref: + https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor + example, this CEL expression returns a JSON + patch to conditionally modify a value:\n\n\t + \ [\n\t JSONPatch{op: \"test\", path: + \"/spec/example\", value: \"Red\"},\n\t + \ JSONPatch{op: \"replace\", path: \"/spec/example\", + value: \"Green\"}\n\t ]\n\nTo define an + object for the patch value, use Object types. + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/spec/selector\",\n\t + \ value: Object.spec.selector{matchLabels: + {\"environment\": \"test\"}}\n\t }\n\t + \ ]\n\nTo use strings containing '/' and + '~' as JSONPatch path keys, use \"jsonpatch.escapeKey\". + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/metadata/labels/\" + + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL + expressions have access to the types needed + to create JSON patches and objects:\n\n- + 'JSONPatch' - CEL type of JSON Patch operations. + JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may + be set to any of: string,\n integer, array, + map or object. If set, the 'path' and 'from' + fields must be set to a\n [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' + CEL\n function may be used to escape path + keys containing '/' and '~'.\n- 'Object' + - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nCEL expressions + have access to [Kubernetes CEL function + libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs + JSONPatch key escaping. '~' and '/' are + escaped as '~0' and `~1' respectively).\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources + to mutate after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MutatingPolicySpec is the specification of the desired behavior + of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether to generate + a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing resources + are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression which is used + to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated by CEL to create + an apply configuration.\nref: https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using object initialization. + For example, this CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t spec: Object.spec{\n\t + \ serviceAccountName: \"example\"\n\t }\n\t}\n\nApply + configurations may not modify atomic structs, maps or + arrays due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL expressions + have access to the object types needed to create apply + configurations:\n\n- 'Object' - CEL type of the resource + object.\n- 'Object.' - CEL type of object field + (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nThe `apiVersion`, `kind`, `metadata.name` + and `metadata.generateName` are always accessible from + the root of the\nobject. No other metadata properties + are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated by CEL to create + a [JSON patch](https://jsonpatch.com/).\nref: https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor example, + this CEL expression returns a JSON patch to conditionally + modify a value:\n\n\t [\n\t JSONPatch{op: \"test\", + path: \"/spec/example\", value: \"Red\"},\n\t JSONPatch{op: + \"replace\", path: \"/spec/example\", value: \"Green\"}\n\t + \ ]\n\nTo define an object for the patch value, use Object + types. For example:\n\n\t [\n\t JSONPatch{\n\t op: + \"add\",\n\t path: \"/spec/selector\",\n\t value: + Object.spec.selector{matchLabels: {\"environment\": \"test\"}}\n\t + \ }\n\t ]\n\nTo use strings containing '/' and '~' + as JSONPatch path keys, use \"jsonpatch.escapeKey\". For + example:\n\n\t [\n\t JSONPatch{\n\t op: \"add\",\n\t + \ path: \"/metadata/labels/\" + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL expressions + have access to the types needed to create JSON patches + and objects:\n\n- 'JSONPatch' - CEL type of JSON Patch + operations. JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may be set to any + of: string,\n integer, array, map or object. If set, + the 'path' and 'from' fields must be set to a\n [JSON + pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' CEL\n function + may be used to escape path keys containing '/' and '~'.\n- + 'Object' - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` - CEL + type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nCEL expressions have access to [Kubernetes + CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs JSONPatch + key escaping. '~' and '/' are escaped as '~0' and `~1' + respectively).\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources to mutate + after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: MutatingPolicySpec is the specification of + the desired behavior of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether + to generate a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing + resources are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression + which is used to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated + by CEL to create an apply configuration.\nref: + https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using + object initialization. For example, this + CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t + \ spec: Object.spec{\n\t serviceAccountName: + \"example\"\n\t }\n\t}\n\nApply configurations + may not modify atomic structs, maps or arrays + due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL + expressions have access to the object types + needed to create apply configurations:\n\n- + 'Object' - CEL type of the resource object.\n- + 'Object.' - CEL type of object + field (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated + by CEL to create a [JSON patch](https://jsonpatch.com/).\nref: + https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor + example, this CEL expression returns a JSON + patch to conditionally modify a value:\n\n\t + \ [\n\t JSONPatch{op: \"test\", path: + \"/spec/example\", value: \"Red\"},\n\t + \ JSONPatch{op: \"replace\", path: \"/spec/example\", + value: \"Green\"}\n\t ]\n\nTo define an + object for the patch value, use Object types. + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/spec/selector\",\n\t + \ value: Object.spec.selector{matchLabels: + {\"environment\": \"test\"}}\n\t }\n\t + \ ]\n\nTo use strings containing '/' and + '~' as JSONPatch path keys, use \"jsonpatch.escapeKey\". + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/metadata/labels/\" + + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL + expressions have access to the types needed + to create JSON patches and objects:\n\n- + 'JSONPatch' - CEL type of JSON Patch operations. + JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may + be set to any of: string,\n integer, array, + map or object. If set, the 'path' and 'from' + fields must be set to a\n [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' + CEL\n function may be used to escape path + keys containing '/' and '~'.\n- 'Object' + - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nCEL expressions + have access to [Kubernetes CEL function + libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs + JSONPatch key escaping. '~' and '/' are + escaped as '~0' and `~1' respectively).\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources + to mutate after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespaceddeletingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespaceddeletingpolicies.yaml new file mode 100644 index 0000000..69eacaf --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespaceddeletingpolicies.yaml @@ -0,0 +1,1126 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: namespaceddeletingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: NamespacedDeletingPolicy + listKind: NamespacedDeletingPolicyList + plural: namespaceddeletingpolicies + shortNames: + - ndpol + singular: namespaceddeletingpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: DeletingPolicySpec is the specification of the desired behavior + of the DeletingPolicy. + properties: + conditions: + description: |- + Conditions is a list of conditions that must be met for a resource to be deleted. + Conditions filter resources that have already been matched by the match constraints, + namespaceSelector, and objectSelector. An empty list of conditions matches all resources. + There are a maximum of 64 conditions allowed. + + The exact matching logic is (in order): + 1. If ANY condition evaluates to FALSE, the policy is skipped. + 2. If ALL conditions evaluate to TRUE, the policy is executed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + deletionPropagationPolicy: + description: DeletionPropagationPolicy defines how resources will + be deleted (Foreground, Background, Orphan). + enum: + - Foreground + - Background + - Orphan + type: string + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + schedule: + description: |- + The schedule in Cron format + Required. + type: string + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + required: + - schedule + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + lastExecutionTime: + format: date-time + type: string + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: DeletingPolicySpec is the specification of the desired behavior + of the DeletingPolicy. + properties: + conditions: + description: |- + Conditions is a list of conditions that must be met for a resource to be deleted. + Conditions filter resources that have already been matched by the match constraints, + namespaceSelector, and objectSelector. An empty list of conditions matches all resources. + There are a maximum of 64 conditions allowed. + + The exact matching logic is (in order): + 1. If ANY condition evaluates to FALSE, the policy is skipped. + 2. If ALL conditions evaluate to TRUE, the policy is executed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + deletionPropagationPolicy: + description: DeletionPropagationPolicy defines how resources will + be deleted (Foreground, Background, Orphan). + enum: + - Foreground + - Background + - Orphan + type: string + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + schedule: + description: |- + The schedule in Cron format + Required. + type: string + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + required: + - schedule + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + lastExecutionTime: + format: date-time + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedgeneratingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedgeneratingpolicies.yaml new file mode 100644 index 0000000..7a57565 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedgeneratingpolicies.yaml @@ -0,0 +1,1442 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: namespacedgeneratingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: NamespacedGeneratingPolicy + listKind: NamespacedGeneratingPolicyList + plural: namespacedgeneratingpolicies + shortNames: + - ngpol + singular: namespacedgeneratingpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1 + schema: + openAPIV3Schema: + description: NamespacedGeneratingPolicy is the namespaced CEL-based generating + policy. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GeneratingPolicySpec is the specification of the desired + behavior of the GeneratingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + generateExisting: + description: GenerateExisting defines the configuration for generating + resources for existing triggeres. + properties: + enabled: + default: false + description: |- + Enabled controls whether to trigger the policy for existing resources + If is set to "true" the policy will be triggered and applied to existing matched resources. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + orphanDownstreamOnPolicyDelete: + description: OrphanDownstreamOnPolicyDelete defines the configuration + for orphaning downstream resources on policy delete. + properties: + enabled: + default: false + description: |- + Enabled controls whether generated resources should be deleted when the policy that generated + them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean + synchronize: + description: Synchronization defines the configuration for the + synchronization of generated resources. + properties: + enabled: + default: false + description: |- + Enabled controls if generated resources should be kept in-sync with their source resource. + If Synchronize is set to "true" changes to generated resources will be overwritten with resource + data from Data or the resource specified in the Clone declaration. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + generate: + description: |- + Generation defines a set of CEL expressions that will be evaluated to generate resources. + Required. + items: + description: Generation defines the configuration for the generation + of resources. + properties: + expression: + description: Expression is a CEL expression that takes a list + of resources to be generated. + type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object + type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) + && has(self.template)) + minItems: 1 + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources will trigger this policy. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - generate + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: NamespacedGeneratingPolicy is the namespaced CEL-based generating + policy. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GeneratingPolicySpec is the specification of the desired + behavior of the GeneratingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the + API server. auditAnnotations are evaluated after the policy has been evaluated but before the decision is logged. + The results of evaluating the expressions are attached to the audit event as annotations with the key + "/". + If the expression evaluates to an empty string or null the annotation will not be included in the audit event. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + generateExisting: + description: GenerateExisting defines the configuration for generating + resources for existing triggeres. + properties: + enabled: + default: false + description: |- + Enabled controls whether to trigger the policy for existing resources + If is set to "true" the policy will be triggered and applied to existing matched resources. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + orphanDownstreamOnPolicyDelete: + description: OrphanDownstreamOnPolicyDelete defines the configuration + for orphaning downstream resources on policy delete. + properties: + enabled: + default: false + description: |- + Enabled controls whether generated resources should be deleted when the policy that generated + them is deleted with synchronization enabled. This option is only applicable to generate rules of the data type. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply generateExisting rules to those requests. + type: boolean + synchronize: + description: Synchronization defines the configuration for the + synchronization of generated resources. + properties: + enabled: + default: false + description: |- + Enabled controls if generated resources should be kept in-sync with their source resource. + If Synchronize is set to "true" changes to generated resources will be overwritten with resource + data from Data or the resource specified in the Clone declaration. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + generate: + description: |- + Generation defines a set of CEL expressions that will be evaluated to generate resources. + Required. + items: + description: Generation defines the configuration for the generation + of resources. + properties: + expression: + description: Expression is a CEL expression that takes a list + of resources to be generated. + type: string + template: + description: |- + Template declares the resources to be generated as a YAML document, + with optional CEL interpolation. + properties: + interpolate: + default: none + description: |- + Interpolate controls placeholder evaluation in Value: + "none" (default) treats Value as plain YAML; + "cel" evaluates `(( ... ))` placeholders as CEL expressions before the YAML is parsed. + enum: + - none + - cel + type: string + value: + description: |- + Value is a YAML string, single or multi-document, defining the resources to generate. + The namespace of each generated resource is taken from its rendered metadata.namespace, + resources without a namespace are treated as cluster-scoped. + minLength: 1 + type: string + required: + - value + type: object + type: object + x-kubernetes-validations: + - message: exactly one of expression or template must be set + rule: (has(self.expression) && !has(self.template)) || (!has(self.expression) + && has(self.template)) + minItems: 1 + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources will trigger this policy. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + useServerSideApply: + description: |- + UseServerSideApply controls whether to use server-side apply for generate rules. + If set to "true", create & update for generated resources will use apply instead of create/update. + Defaults to "false" if not specified. + type: boolean + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - generate + type: object + status: + description: Status contains policy runtime data. + properties: + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedimagevalidatingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedimagevalidatingpolicies.yaml new file mode 100644 index 0000000..63bcfcf --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedimagevalidatingpolicies.yaml @@ -0,0 +1,4762 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: namespacedimagevalidatingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: NamespacedImageValidatingPolicy + listKind: NamespacedImageValidatingPolicyList + plural: namespacedimagevalidatingpolicies + shortNames: + - nivpol + singular: namespacedimagevalidatingpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ImageValidatingPolicySpec is the specification of the desired + behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata to verify + items: + description: Attestation defines the identification details of the metadata + that has to be verified + properties: + intoto: + description: InToto defines the details of attestation attached + using intoto format + properties: + type: + description: Type defines the type of attestation contained + within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. It is used + to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation attached + using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation attached + to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms or verifies the + authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration for Cosign + based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration for local + signature verification + properties: + cert: + description: Certificate is the to the public certificate + for local signature verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration to verify the + authority against a Rekor instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used to validate + SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips transparency log + verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor instance + (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to validate the + image. + properties: + data: + description: Data contains the inline public key + type: string + expression: + description: Expression is a Expression expression that + returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration to verify the + authority against a Fulcio instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions + used for keyless signing. + type: object + identities: + description: Identities sets a list of identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the issuer for this + identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies a regular + expression to match the issuer for this identity. + type: string + subject: + description: Subject defines the subject for this + identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies a regular + expression to match the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration to specify the + sources from where to consume the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location from where + to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tuf: + description: TUF defines the configuration to fetch sigstore + root + properties: + mirror: + description: Mirror is the base URL of Sigstore TUF + repository + type: string + root: + description: Root defines the path or data of the trusted + root + properties: + data: + description: Data is the base64 encoded TUF root + type: string + path: + description: Path is the URL or File location of + the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. It is used + to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration for Notary + based signatures + properties: + certs: + description: Certs define the cert chain for Notary signature + verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain for verifying + timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will be used for + authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure access to a + registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides the list of credential + providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression to extract + images from the resource + items: + properties: + expression: + description: Expression defines CEL expression to extract images + from the resource. + type: string + name: + description: Name is the name for this imageList. It is used + to refer to the images in verification block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources this policy + is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or a CEL expression + for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions for matching + images + type: string + glob: + description: Glob defines a globbing pattern for matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings for mutating + and verifying image digests, and enforcing image verification through + signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are verified, i.e., + have passed a signature or attestation check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which is used to + apply the image validation checks. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ImageValidatingPolicySpec is the specification + of the desired behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata + to verify + items: + description: Attestation defines the identification + details of the metadata that has to be verified + properties: + intoto: + description: InToto defines the details of attestation + attached using intoto format + properties: + type: + description: Type defines the type of attestation + contained within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. + It is used to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation + attached using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation + attached to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms + or verifies the authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration + for Cosign based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration + for local signature verification + properties: + cert: + description: Certificate is the to the + public certificate for local signature + verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration + to verify the authority against a Rekor + instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used + to validate SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips + transparency log verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor + instance (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to + validate the image. + properties: + data: + description: Data contains the inline + public key + type: string + expression: + description: Expression is a Expression + expression that returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration + to verify the authority against a Fulcio + instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are + certificate-extensions used for keyless + signing. + type: object + identities: + description: Identities sets a list of + identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the + issuer for this identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies + a regular expression to match + the issuer for this identity. + type: string + subject: + description: Subject defines the + subject for this identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies + a regular expression to match + the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration + to specify the sources from where to consume + the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location + from where to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tuf: + description: TUF defines the configuration + to fetch sigstore root + properties: + mirror: + description: Mirror is the base URL of + Sigstore TUF repository + type: string + root: + description: Root defines the path or + data of the trusted root + properties: + data: + description: Data is the base64 encoded + TUF root + type: string + path: + description: Path is the URL or File + location of the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. + It is used to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration + for Notary based signatures + properties: + certs: + description: Certs define the cert chain for + Notary signature verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain + for verifying timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will + be used for authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure + access to a registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides + the list of credential providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression + to extract images from the resource + items: + properties: + expression: + description: Expression defines CEL expression + to extract images from the resource. + type: string + name: + description: Name is the name for this imageList. + It is used to refer to the images in verification + block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources + this policy is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or + a CEL expression for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions + for matching images + type: string + glob: + description: Glob defines a globbing pattern for + matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings + for mutating and verifying image digests, and enforcing + image verification through signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are + verified, i.e., have passed a signature or attestation + check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images + have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which + is used to apply the image validation checks. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ImageValidatingPolicySpec is the specification of the desired + behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata to verify + items: + description: Attestation defines the identification details of the metadata + that has to be verified + properties: + intoto: + description: InToto defines the details of attestation attached + using intoto format + properties: + type: + description: Type defines the type of attestation contained + within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. It is used + to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation attached + using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation attached + to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms or verifies the + authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration for Cosign + based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration for local + signature verification + properties: + cert: + description: Certificate is the to the public certificate + for local signature verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration to verify the + authority against a Rekor instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used to validate + SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips transparency log + verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor instance + (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to validate the + image. + properties: + data: + description: Data contains the inline public key + type: string + expression: + description: Expression is a Expression expression that + returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration to verify the + authority against a Fulcio instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are certificate-extensions + used for keyless signing. + type: object + identities: + description: Identities sets a list of identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the issuer for this + identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies a regular + expression to match the issuer for this identity. + type: string + subject: + description: Subject defines the subject for this + identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies a regular + expression to match the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration to specify the + sources from where to consume the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location from where + to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tuf: + description: TUF defines the configuration to fetch sigstore + root + properties: + mirror: + description: Mirror is the base URL of Sigstore TUF + repository + type: string + root: + description: Root defines the path or data of the trusted + root + properties: + data: + description: Data is the base64 encoded TUF root + type: string + path: + description: Path is the URL or File location of + the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. It is used + to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration for Notary + based signatures + properties: + certs: + description: Certs define the cert chain for Notary signature + verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain for verifying + timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a CEL expression + input. + type: string + value: + description: Value defines the raw string input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will be used for + authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure access to a + registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides the list of credential + providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression to extract + images from the resource + items: + properties: + expression: + description: Expression defines CEL expression to extract images + from the resource. + type: string + name: + description: Name is the name for this imageList. It is used + to refer to the images in verification block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources this policy + is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or a CEL expression + for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions for matching + images + type: string + glob: + description: Glob defines a globbing pattern for matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings for mutating + and verifying image digests, and enforcing image verification through + signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are verified, i.e., + have passed a signature or attestation check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which is used to + apply the image validation checks. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ImageValidatingPolicySpec is the specification + of the desired behavior of the ImageValidatingPolicy. + properties: + attestations: + description: Attestations provides a list of image metadata + to verify + items: + description: Attestation defines the identification + details of the metadata that has to be verified + properties: + intoto: + description: InToto defines the details of attestation + attached using intoto format + properties: + type: + description: Type defines the type of attestation + contained within the statement. + type: string + required: + - type + type: object + name: + description: Name is the name for this attestation. + It is used to refer to the attestation in verification + type: string + referrer: + description: Referrer defines the details of attestation + attached using OCI 1.1 format + properties: + type: + description: Type defines the type of attestation + attached to the image. + type: string + required: + - type + type: object + required: + - name + type: object + type: array + attestors: + description: Attestors provides a list of trusted authorities. + items: + description: Attestor is an identity that confirms + or verifies the authenticity of an image or an attestation + oneOf: + - required: + - cosign + - required: + - notary + properties: + cosign: + description: Cosign defines attestor configuration + for Cosign based signatures + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations are used for image verification. + Every specified key-value pair must exist and match in the verified payload. + The payload may contain other key-value pairs. + type: object + certificate: + description: Certificate defines the configuration + for local signature verification + properties: + cert: + description: Certificate is the to the + public certificate for local signature + verification. + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + certChain: + description: |- + CertificateChain is the list of CA certificates in PEM format which will be needed + when building the certificate chain for the signing certificate. Must start with the + parent intermediate CA certificate of the signing certificate and end with the root certificate + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the + a CEL expression input. + type: string + value: + description: Value defines the raw + string input. + type: string + type: object + type: object + ctlog: + description: CTLog sets the configuration + to verify the authority against a Rekor + instance. + properties: + ctLogPubKey: + description: CTLogPubKey, if set, is used + to validate SCTs against a custom source. + type: string + insecureIgnoreSCT: + description: |- + IgnoreSCT defines whether to use the Signed Certificate Timestamp (SCT) log to check for a certificate + timestamp. Default is false. Set to true if this was opted out during signing. + type: boolean + insecureIgnoreTlog: + description: InsecureIgnoreTlog skips + transparency log verification. + type: boolean + rekorPubKey: + description: |- + RekorPubKey is an optional PEM-encoded public key to use for a custom Rekor. + If set, this will be used to validate transparency log signatures from a custom Rekor. + type: string + tsaCertChain: + description: |- + TSACertChain, if set, is the PEM-encoded certificate chain file for the RFC3161 timestamp authority. Must + contain the root CA certificate. Optionally may contain intermediate CA certificates, and + may contain the leaf TSA certificate if not present in the timestamurce. + type: string + url: + description: URL sets the url to the rekor + instance (by default the public rekor.sigstore.dev) + type: string + type: object + key: + description: Key defines the type of key to + validate the image. + properties: + data: + description: Data contains the inline + public key + type: string + expression: + description: Expression is a Expression + expression that returns the public key. + type: string + hashAlgorithm: + description: |- + HashAlgorithm specifues signature algorithm for public keys. Supported values are + sha224, sha256, sha384 and sha512. Defaults to sha256. + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + type: string + type: object + keyless: + description: Keyless sets the configuration + to verify the authority against a Fulcio + instance. + properties: + additionalExtensions: + additionalProperties: + type: string + description: AdditionalExtensions are + certificate-extensions used for keyless + signing. + type: object + identities: + description: Identities sets a list of + identities. + items: + description: |- + Identity may contain the issuer and/or the subject found in the transparency + log. + Issuer/Subject uses a strict match, while IssuerRegExp and SubjectRegExp + apply a regexp for matching. + For a dynamic subject, use SubjectExpression which accepts a CEL expression + evaluated at admission time. The result is used as a regexp match against the + certificate SAN URI, so it can be either a literal string or a regexp pattern. + properties: + issuer: + description: Issuer defines the + issuer for this identity. + type: string + issuerRegExp: + description: IssuerRegExp specifies + a regular expression to match + the issuer for this identity. + type: string + subject: + description: Subject defines the + subject for this identity. + type: string + subjectExpression: + description: |- + SubjectExpression defines a CEL expression that evaluates to the subject string, + matched as a regexp against the certificate SAN URI. Mutually exclusive with SubjectRegExp. + type: string + subjectRegExp: + description: SubjectRegExp specifies + a regular expression to match + the subject for this identity. + type: string + type: object + type: array + roots: + description: |- + Roots is an optional set of PEM encoded trusted root certificates. + If not provided, the system roots are used. + type: string + required: + - identities + type: object + source: + description: Sources sets the configuration + to specify the sources from where to consume + the signature and attestations. + properties: + PullSecrets: + description: |- + SignaturePullSecrets is an optional list of references to secrets in the + same namespace as the deploying resource for pulling any of the signatures + used by this Source. + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + repository: + description: Repository defines the location + from where to pull the signature / attestations. + type: string + tagPrefix: + description: |- + TagPrefix is an optional prefix that signature and attestations have. + This is the 'tag based discovery' and in the future once references are + fully supported that should likely be the preferred way to handle these. + type: string + type: object + trustedRoot: + description: |- + TrustedRoot is the sigstore-go TrustedRoot JSON + (mediaType application/vnd.dev.sigstore.trustedroot+json;version=0.1). + When set, Kyverno uses this trust material directly instead of fetching + trusted_root.json from the Sigstore TUF repository. Use this field when + verifying attestations from providers that do not operate a TUF server, + such as GitHub Actions. Takes precedence over the tuf field. + Supports an inline JSON value or a CEL expression (e.g. variables.myRoot). + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tuf: + description: TUF defines the configuration + to fetch sigstore root + properties: + mirror: + description: Mirror is the base URL of + Sigstore TUF repository + type: string + root: + description: Root defines the path or + data of the trusted root + properties: + data: + description: Data is the base64 encoded + TUF root + type: string + path: + description: Path is the URL or File + location of the TUF root + type: string + type: object + type: object + type: object + name: + description: Name is the name for this attestor. + It is used to refer to the attestor in verification + type: string + notary: + description: Notary defines attestor configuration + for Notary based signatures + properties: + certs: + description: Certs define the cert chain for + Notary signature verification + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + tsaCerts: + description: TSACerts define the cert chain + for verifying timestamps of notary signature + oneOf: + - required: + - value + - required: + - expression + properties: + expression: + description: Expression defines the a + CEL expression input. + type: string + value: + description: Value defines the raw string + input. + type: string + type: object + type: object + required: + - name + type: object + type: array + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + credentials: + description: Credentials provides credentials that will + be used for authentication with registry. + properties: + allowInsecureRegistry: + description: AllowInsecureRegistry allows insecure + access to a registry. + type: boolean + providers: + description: |- + Providers specifies a list of OCI Registry names, whose authentication providers are provided. + It can be of one of these values: default,google,azure,amazon,github. + items: + description: CredentialsProvidersType provides + the list of credential providers required. + enum: + - default + - amazon + - azure + - google + - github + type: string + type: array + secrets: + description: |- + Secrets specifies a list of secrets that are provided for credentials. + Secrets must live in the Kyverno namespace. + items: + type: string + type: array + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + FailurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + enum: + - Ignore + - Fail + type: string + images: + description: ImageExtractors is a list of CEL expression + to extract images from the resource + items: + properties: + expression: + description: Expression defines CEL expression + to extract images from the resource. + type: string + name: + description: Name is the name for this imageList. + It is used to refer to the images in verification + block as images. + type: string + required: + - expression + - name + type: object + type: array + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + matchConstraints: + description: MatchConstraints specifies what resources + this policy is designed to validate. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + matchImageReferences: + description: |- + MatchImageReferences is a list of Glob and CELExpressions to match images. + Any image that matches one of the rules is considered for validation + Any image that does not match a rule is skipped, even when they are passed as arguments to + image verification functions + items: + description: MatchImageReference defines a Glob or + a CEL expression for matching images + oneOf: + - required: + - glob + - required: + - expression + properties: + expression: + description: Expression defines CEL Expressions + for matching images + type: string + glob: + description: Glob defines a globbing pattern for + matching images + type: string + type: object + type: array + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validationConfigurations: + default: {} + description: ValidationConfigurations defines settings + for mutating and verifying image digests, and enforcing + image verification through signatures. + properties: + mutateDigest: + default: true + description: |- + MutateDigest enables replacement of image tags with digests. + Defaults to true. + type: boolean + required: + default: true + description: Required validates that images are + verified, i.e., have passed a signature or attestation + check. + type: boolean + verifyDigest: + default: true + description: VerifyDigest validates that images + have a digest. + type: boolean + type: object + validations: + description: Validations contain CEL expressions which + is used to apply the image validation checks. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + required: + - attestors + - validations + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedmutatingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedmutatingpolicies.yaml new file mode 100644 index 0000000..e2b3419 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedmutatingpolicies.yaml @@ -0,0 +1,4868 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: namespacedmutatingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: NamespacedMutatingPolicy + listKind: NamespacedMutatingPolicyList + plural: namespacedmutatingpolicies + shortNames: + - nmpol + singular: namespacedmutatingpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MutatingPolicySpec is the specification of the desired behavior + of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether to generate + a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing resources + are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression which is used + to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated by CEL to create + an apply configuration.\nref: https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using object initialization. + For example, this CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t spec: Object.spec{\n\t + \ serviceAccountName: \"example\"\n\t }\n\t}\n\nApply + configurations may not modify atomic structs, maps or + arrays due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL expressions + have access to the object types needed to create apply + configurations:\n\n- 'Object' - CEL type of the resource + object.\n- 'Object.' - CEL type of object field + (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nThe `apiVersion`, `kind`, `metadata.name` + and `metadata.generateName` are always accessible from + the root of the\nobject. No other metadata properties + are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated by CEL to create + a [JSON patch](https://jsonpatch.com/).\nref: https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor example, + this CEL expression returns a JSON patch to conditionally + modify a value:\n\n\t [\n\t JSONPatch{op: \"test\", + path: \"/spec/example\", value: \"Red\"},\n\t JSONPatch{op: + \"replace\", path: \"/spec/example\", value: \"Green\"}\n\t + \ ]\n\nTo define an object for the patch value, use Object + types. For example:\n\n\t [\n\t JSONPatch{\n\t op: + \"add\",\n\t path: \"/spec/selector\",\n\t value: + Object.spec.selector{matchLabels: {\"environment\": \"test\"}}\n\t + \ }\n\t ]\n\nTo use strings containing '/' and '~' + as JSONPatch path keys, use \"jsonpatch.escapeKey\". For + example:\n\n\t [\n\t JSONPatch{\n\t op: \"add\",\n\t + \ path: \"/metadata/labels/\" + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL expressions + have access to the types needed to create JSON patches + and objects:\n\n- 'JSONPatch' - CEL type of JSON Patch + operations. JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may be set to any + of: string,\n integer, array, map or object. If set, + the 'path' and 'from' fields must be set to a\n [JSON + pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' CEL\n function + may be used to escape path keys containing '/' and '~'.\n- + 'Object' - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` - CEL + type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nCEL expressions have access to [Kubernetes + CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs JSONPatch + key escaping. '~' and '/' are escaped as '~0' and `~1' + respectively).\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources to mutate + after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: MutatingPolicySpec is the specification of + the desired behavior of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether + to generate a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing + resources are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression + which is used to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated + by CEL to create an apply configuration.\nref: + https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using + object initialization. For example, this + CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t + \ spec: Object.spec{\n\t serviceAccountName: + \"example\"\n\t }\n\t}\n\nApply configurations + may not modify atomic structs, maps or arrays + due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL + expressions have access to the object types + needed to create apply configurations:\n\n- + 'Object' - CEL type of the resource object.\n- + 'Object.' - CEL type of object + field (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated + by CEL to create a [JSON patch](https://jsonpatch.com/).\nref: + https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor + example, this CEL expression returns a JSON + patch to conditionally modify a value:\n\n\t + \ [\n\t JSONPatch{op: \"test\", path: + \"/spec/example\", value: \"Red\"},\n\t + \ JSONPatch{op: \"replace\", path: \"/spec/example\", + value: \"Green\"}\n\t ]\n\nTo define an + object for the patch value, use Object types. + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/spec/selector\",\n\t + \ value: Object.spec.selector{matchLabels: + {\"environment\": \"test\"}}\n\t }\n\t + \ ]\n\nTo use strings containing '/' and + '~' as JSONPatch path keys, use \"jsonpatch.escapeKey\". + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/metadata/labels/\" + + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL + expressions have access to the types needed + to create JSON patches and objects:\n\n- + 'JSONPatch' - CEL type of JSON Patch operations. + JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may + be set to any of: string,\n integer, array, + map or object. If set, the 'path' and 'from' + fields must be set to a\n [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' + CEL\n function may be used to escape path + keys containing '/' and '~'.\n- 'Object' + - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nCEL expressions + have access to [Kubernetes CEL function + libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs + JSONPatch key escaping. '~' and '/' are + escaped as '~0' and `~1' respectively).\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources + to mutate after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MutatingPolicySpec is the specification of the desired behavior + of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether to generate + a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing resources + are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression which is used + to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated by CEL to create + an apply configuration.\nref: https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using object initialization. + For example, this CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t spec: Object.spec{\n\t + \ serviceAccountName: \"example\"\n\t }\n\t}\n\nApply + configurations may not modify atomic structs, maps or + arrays due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL expressions + have access to the object types needed to create apply + configurations:\n\n- 'Object' - CEL type of the resource + object.\n- 'Object.' - CEL type of object field + (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nThe `apiVersion`, `kind`, `metadata.name` + and `metadata.generateName` are always accessible from + the root of the\nobject. No other metadata properties + are accessible.\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated by CEL to create + a [JSON patch](https://jsonpatch.com/).\nref: https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor example, + this CEL expression returns a JSON patch to conditionally + modify a value:\n\n\t [\n\t JSONPatch{op: \"test\", + path: \"/spec/example\", value: \"Red\"},\n\t JSONPatch{op: + \"replace\", path: \"/spec/example\", value: \"Green\"}\n\t + \ ]\n\nTo define an object for the patch value, use Object + types. For example:\n\n\t [\n\t JSONPatch{\n\t op: + \"add\",\n\t path: \"/spec/selector\",\n\t value: + Object.spec.selector{matchLabels: {\"environment\": \"test\"}}\n\t + \ }\n\t ]\n\nTo use strings containing '/' and '~' + as JSONPatch path keys, use \"jsonpatch.escapeKey\". For + example:\n\n\t [\n\t JSONPatch{\n\t op: \"add\",\n\t + \ path: \"/metadata/labels/\" + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL expressions + have access to the types needed to create JSON patches + and objects:\n\n- 'JSONPatch' - CEL type of JSON Patch + operations. JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may be set to any + of: string,\n integer, array, map or object. If set, + the 'path' and 'from' fields must be set to a\n [JSON + pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' CEL\n function + may be used to escape path keys containing '/' and '~'.\n- + 'Object' - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` - CEL + type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents of the API request, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy + binding being evaluated. Only populated if the policy + has a ParamKind.\n- 'namespaceObject' - The namespace + object that the incoming object belongs to. The value + is null for cluster-scoped resources.\n- 'variables' - + Map of composited variables, from its name to its lazily + evaluated value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' - + A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) of + the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request + resource.\n\nCEL expressions have access to [Kubernetes + CEL function libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs JSONPatch + key escaping. '~' and '/' are escaped as '~0' and `~1' + respectively).\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources to mutate + after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: MutatingPolicySpec is the specification of + the desired behavior of the MutatingPolicy. + properties: + auditAnnotations: + description: |- + AuditAnnotations contains CEL expressions which are used to produce audit annotations that are surfaced + as properties in policy report results. auditAnnotations are evaluated after the mutations have been + applied successfully. The results of evaluating the expressions are attached to the report result as + properties with the annotation key. + If the expression evaluates to an empty string or null the annotation will not be included. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + mutatingAdmissionPolicy: + description: MutatingAdmissionPolicy specifies whether + to generate a Kubernetes MutatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes MutatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for mutating policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes" or "JSON". + Optional. Default value is "Kubernetes". + type: string + mutateExisting: + description: MutateExisting controls whether existing + resources are mutated. + properties: + enabled: + default: false + description: |- + Enabled enables mutation of existing resources. Default is false. + When spec.targetMatchConstraints is not defined, Kyverno mutates existing resources matched in spec.matchConstraints. + type: boolean + type: object + skipBackgroundRequests: + default: true + description: |- + SkipBackgroundRequests bypasses admission requests that are sent by the background controller. + The default value is set to "true", it must be set to "false" to apply mutateExisting rules to those requests. + type: boolean + useServerSideApply: + description: |- + UseServerSideApply applies ApplyConfiguration patches with Server-Side Apply semantics, + which allows setting atomic fields (for example a container's args or a projected volume) + that the default MutatingAdmissionPolicy behaviour rejects. When true, an atomic value is + replaced as a whole, so any field the object owner set but the patch does not is dropped. + The default is false, which keeps parity with a native MutatingAdmissionPolicy. + type: boolean + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies the trigger resources this policy is designed to evaluate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Trigger constraints and MatchConditions are evaluated before target resolution. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + mutations: + description: |- + mutations contain operations to perform on matching objects. + mutations may not be empty; a minimum of one mutation is required. + mutations are evaluated in order, and are reinvoked according to + the reinvocationPolicy. + The mutations of a policy are invoked for each binding of this policy + and reinvocation of mutations occurs on a per binding basis. + items: + description: Mutation specifies the CEL expression + which is used to apply the Mutation. + properties: + applyConfiguration: + description: |- + applyConfiguration defines the desired configuration values of an object. + The configuration is applied to the admission object using + [structured merge diff](https://github.com/kubernetes-sigs/structured-merge-diff). + A CEL expression is used to create apply configuration. + properties: + expression: + description: "expression will be evaluated + by CEL to create an apply configuration.\nref: + https://github.com/google/cel-spec\n\nApply + configurations are declared in CEL using + object initialization. For example, this + CEL expression\nreturns an apply configuration + to set a single field:\n\n\tObject{\n\t + \ spec: Object.spec{\n\t serviceAccountName: + \"example\"\n\t }\n\t}\n\nApply configurations + may not modify atomic structs, maps or arrays + due to the risk of accidental deletion of\nvalues + not included in the apply configuration.\n\nCEL + expressions have access to the object types + needed to create apply configurations:\n\n- + 'Object' - CEL type of the resource object.\n- + 'Object.' - CEL type of object + field (such as 'Object.spec')\n- 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + jsonPatch: + description: |- + jsonPatch defines a [JSON patch](https://jsonpatch.com/) operation to perform a mutation to the object. + A CEL expression is used to create the JSON patch. + properties: + expression: + description: "expression will be evaluated + by CEL to create a [JSON patch](https://jsonpatch.com/).\nref: + https://github.com/google/cel-spec\n\nexpression + must return an array of JSONPatch values.\n\nFor + example, this CEL expression returns a JSON + patch to conditionally modify a value:\n\n\t + \ [\n\t JSONPatch{op: \"test\", path: + \"/spec/example\", value: \"Red\"},\n\t + \ JSONPatch{op: \"replace\", path: \"/spec/example\", + value: \"Green\"}\n\t ]\n\nTo define an + object for the patch value, use Object types. + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/spec/selector\",\n\t + \ value: Object.spec.selector{matchLabels: + {\"environment\": \"test\"}}\n\t }\n\t + \ ]\n\nTo use strings containing '/' and + '~' as JSONPatch path keys, use \"jsonpatch.escapeKey\". + For example:\n\n\t [\n\t JSONPatch{\n\t + \ op: \"add\",\n\t path: \"/metadata/labels/\" + + jsonpatch.escapeKey(\"example.com/environment\"),\n\t + \ value: \"test\"\n\t },\n\t ]\n\nCEL + expressions have access to the types needed + to create JSON patches and objects:\n\n- + 'JSONPatch' - CEL type of JSON Patch operations. + JSONPatch has the fields 'op', 'from', 'path' + and 'value'.\n See [JSON patch](https://jsonpatch.com/) + for more details. The 'value' field may + be set to any of: string,\n integer, array, + map or object. If set, the 'path' and 'from' + fields must be set to a\n [JSON pointer](https://datatracker.ietf.org/doc/html/rfc6901/) + string, where the 'jsonpatch.escapeKey()' + CEL\n function may be used to escape path + keys containing '/' and '~'.\n- 'Object' + - CEL type of the resource object.\n- 'Object.' + - CEL type of object field (such as 'Object.spec')\n- + 'Object.....` + - CEL type of nested field (such as 'Object.spec.containers')\n\nCEL + expressions have access to the contents + of the API request, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming + request. The value is null for DELETE requests.\n- + 'oldObject' - The existing object. The value + is null for CREATE requests.\n- 'request' + - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to + by the policy binding being evaluated. Only + populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object + that the incoming object belongs to. The + value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, + from its name to its lazily evaluated value.\n + \ For example, a variable named 'foo' can + be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform + authorization checks for the principal (user + or service account) of the request.\n See + https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nCEL expressions + have access to [Kubernetes CEL function + libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-options-language-features-and-libraries)\nas + well as:\n\n- 'jsonpatch.escapeKey' - Performs + JSONPatch key escaping. '~' and '/' are + escaped as '~0' and `~1' respectively).\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nRequired." + type: string + type: object + patchType: + description: |- + patchType indicates the patch strategy used. + Allowed values are "ApplyConfiguration" and "JSONPatch". + Required. + type: string + required: + - patchType + type: object + type: array + x-kubernetes-list-type: atomic + reinvocationPolicy: + description: |- + reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding + as part of a single admission evaluation. + Allowed values are "Never" and "IfNeeded". + + Never: These mutations will not be called more than once per binding in a single admission evaluation. + + IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of + order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only + reinvoked when mutations change the object after this mutation is invoked. + Required. + type: string + targetMatchConditions: + description: |- + TargetMatchConditions is a list of conditions that must be met for a resolved target resource. + Target match conditions are evaluated after variables and target resolution. They can reference + variables and use Object to refer to the target resource. + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + targetMatchConstraints: + description: TargetMatchConstraints resolves the resources + to mutate after Variables are evaluated. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + expression: + description: |- + Expression resolves one target object or a list of target objects. The expression can use + variables computed from the trigger request. + type: string + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy, + including MatchConditions where they are evaluated lazily on first reference. + Note that a native Kubernetes MutatingAdmissionPolicy does not support variables in match + conditions; policies that generate a MutatingAdmissionPolicy through autogen should not + reference variables in MatchConditions. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedvalidatingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedvalidatingpolicies.yaml new file mode 100644 index 0000000..f391b11 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_namespacedvalidatingpolicies.yaml @@ -0,0 +1,3146 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: namespacedvalidatingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: NamespacedValidatingPolicy + listKind: NamespacedValidatingPolicyList + plural: namespacedvalidatingpolicies + shortNames: + - nvpol + singular: namespacedvalidatingpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ValidatingPolicySpec is the specification of the desired + behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies whether to generate + a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ValidatingPolicySpec is the specification of + the desired behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies + whether to generate a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a ValidatingAdmissionPolicy/MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ValidatingPolicySpec is the specification of the desired + behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies whether to generate + a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ValidatingPolicySpec is the specification of + the desired behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies + whether to generate a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a ValidatingAdmissionPolicy/MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_policyexceptions.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_policyexceptions.yaml new file mode 100644 index 0000000..56719c5 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_policyexceptions.yaml @@ -0,0 +1,421 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: policyexceptions.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + kind: PolicyException + listKind: PolicyExceptionList + plural: policyexceptions + singular: policyexception + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: PolicyException declares resources to be excluded from specified + policies. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec declares policy exception behaviors. + properties: + allowedValues: + description: |- + AllowedValues specifies values that can be used in CEL expressions to bypass policy checks. + These values can be referenced in CEL expressions via `exceptions.allowedValues`. + items: + type: string + type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge + of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string + images: + description: |- + Images specifies container images to be excluded from policy evaluation. + These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`. + items: + type: string + type: array + matchConditions: + description: MatchConditions is a list of CEL expressions that must + be met for a resource to be excluded. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + policyRefs: + description: PolicyRefs identifies the policies to which the exception + is applied. + items: + properties: + kind: + description: Kind is the kind of the policy + type: string + name: + description: Name is the name of the policy + type: string + required: + - kind + - name + type: object + type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object + reportResult: + default: skip + description: |- + ReportResult indicates whether the policy exception should be reported in the policy report + as a skip result or pass result. Defaults to "skip". + enum: + - skip + - pass + type: string + required: + - policyRefs + type: object + required: + - spec + type: object + served: true + storage: false + - deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: PolicyException declares resources to be excluded from specified + policies. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec declares policy exception behaviors. + properties: + allowedValues: + description: |- + AllowedValues specifies values that can be used in CEL expressions to bypass policy checks. + These values can be referenced in CEL expressions via `exceptions.allowedValues`. + items: + type: string + type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge + of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string + images: + description: |- + Images specifies container images to be excluded from policy evaluation. + These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`. + items: + type: string + type: array + matchConditions: + description: MatchConditions is a list of CEL expressions that must + be met for a resource to be excluded. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + policyRefs: + description: PolicyRefs identifies the policies to which the exception + is applied. + items: + properties: + kind: + description: Kind is the kind of the policy + type: string + name: + description: Name is the name of the policy + type: string + required: + - kind + - name + type: object + type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object + reportResult: + default: skip + description: |- + ReportResult indicates whether the policy exception should be reported in the policy report + as a skip result or pass result. Defaults to "skip". + enum: + - skip + - pass + type: string + required: + - policyRefs + type: object + required: + - spec + type: object + served: true + storage: false + - name: v1beta1 + schema: + openAPIV3Schema: + description: PolicyException declares resources to be excluded from specified + policies. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec declares policy exception behaviors. + properties: + allowedValues: + description: |- + AllowedValues specifies values that can be used in CEL expressions to bypass policy checks. + These values can be referenced in CEL expressions via `exceptions.allowedValues`. + items: + type: string + type: array + evaluationMode: + description: Evaluation mode denotes which controller is in charge + of compiling and handling this exception. + type: string + expiresAt: + description: |- + ExpiresAt specifies the time when the policy exception expires. + Once expired, the exception will no longer be applied to incoming requests. + The expected format is RFC3339 date-time (for example "2026-05-01T00:00:00Z"). + format: date-time + type: string + images: + description: |- + Images specifies container images to be excluded from policy evaluation. + These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`. + items: + type: string + type: array + matchConditions: + description: MatchConditions is a list of CEL expressions that must + be met for a resource to be excluded. + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + policyRefs: + description: PolicyRefs identifies the policies to which the exception + is applied. + items: + properties: + kind: + description: Kind is the kind of the policy + type: string + name: + description: Name is the name of the policy + type: string + required: + - kind + - name + type: object + type: array + properties: + additionalProperties: + type: string + description: |- + Properties is an optional map for additional metadata attached to this exception. + For example: + - reason: why this exception is needed + - ticket: external approval/request identifier + - approved-by: comma-separated approver list + type: object + reportResult: + default: skip + description: |- + ReportResult indicates whether the policy exception should be reported in the policy report + as a skip result or pass result. Defaults to "skip". + enum: + - skip + - pass + type: string + required: + - policyRefs + type: object + required: + - spec + type: object + served: true + storage: true diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_validatingpolicies.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_validatingpolicies.yaml new file mode 100644 index 0000000..0660142 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/templates/crds/policies.kyverno.io_validatingpolicies.yaml @@ -0,0 +1,4709 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + labels: + {{- include "kyverno-api.labels" . | nindent 4 }} + annotations: + {{- include "kyverno-api.annotations" . | nindent 4 }} + name: validatingpolicies.policies.kyverno.io +spec: + group: policies.kyverno.io + names: + categories: + - kyverno + kind: ValidatingPolicy + listKind: ValidatingPolicyList + plural: validatingpolicies + shortNames: + - vpol + singular: validatingpolicy + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ValidatingPolicySpec is the specification of the desired + behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies whether to generate + a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ValidatingPolicySpec is the specification of + the desired behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies + whether to generate a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a ValidatingAdmissionPolicy/MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ValidatingPolicySpec is the specification of the desired + behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies whether to generate + a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ValidatingPolicySpec is the specification of + the desired behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies + whether to generate a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a ValidatingAdmissionPolicy/MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditionStatus.ready + name: READY + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ValidatingPolicySpec is the specification of the desired + behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce an audit annotation + for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration for the + generation controller. + properties: + podControllers: + description: PodControllers specifies whether to generate a pod + controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies whether to generate + a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration for + the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation during background + scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition which must by + fulfilled for a request to be sent to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple of Operations + and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an operation for + a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional white list of + names that the rule applies to. An empty set means that + everything is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression which is used + to apply the validation. + properties: + expression: + description: "Expression represents the expression which will + be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the API request/response, + organized into CEL variables as well as some other useful + variables:\n\n- 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' - The + existing object. The value is null for CREATE requests.\n- + 'request' - Attributes of the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by the policy binding + being evaluated. Only populated if the policy has a ParamKind.\n- + 'namespaceObject' - The namespace object that the incoming + object belongs to. The value is null for cluster-scoped resources.\n- + 'variables' - Map of composited variables, from its name to + its lazily evaluated value.\n For example, a variable named + 'foo' can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization checks + for the principal (user or service account) of the request.\n + \ See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck constructed + from the 'authorizer' and configured with the\n request resource.\n\nThe + `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. No other + metadata properties are accessible.\n\nOnly property names + of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible.\nAccessible + property names are escaped according to the following rules + when accessed in the expression:\n- '__' escapes to '__underscores__'\n- + '.' escapes to '__dot__'\n- '-' escapes to '__dash__'\n- '/' + escapes to '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. The keywords + are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", + \"const\", \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", + \"return\".\nExamples:\n - Expression accessing a property + named \"namespace\": {\"Expression\": \"object.__namespace__ + > 0\"}\n - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n - Expression + accessing a property named \"redact__d\": {\"Expression\": + \"object.redact__underscores__d > 0\"}\n\nEquality on arrays + with list type of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with x-kubernetes-list-type + use the semantics of the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements in `X` are + preserved and\n non-intersecting elements in `Y` are appended, + retaining their partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys in `X` are preserved + but the values\n are overwritten by values in `Y` when + the key sets of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining their partial + order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable that is used + for composition. A variable is defined as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration for the + webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + status: + description: Status contains policy runtime data. + properties: + autogen: + properties: + configs: + additionalProperties: + properties: + spec: + description: ValidatingPolicySpec is the specification of + the desired behavior of the ValidatingPolicy. + properties: + auditAnnotations: + description: |- + auditAnnotations contains CEL expressions which are used to produce audit + annotations for the audit event of the API request. + validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is + required. + items: + description: AuditAnnotation describes how to produce + an audit annotation for an API request. + properties: + key: + description: |- + key specifies the audit annotation key. The audit annotation keys of + a ValidatingAdmissionPolicy must be unique. The key must be a qualified + name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length. + + The key is combined with the resource name of the + ValidatingAdmissionPolicy to construct an audit annotation key: + "{ValidatingAdmissionPolicy name}/{key}". + + If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy + and the same audit annotation key, the annotation key will be identical. + In this case, the first annotation written with the key will be included + in the audit event and all subsequent annotations with the same key + will be discarded. + + Required. + type: string + valueExpression: + description: |- + valueExpression represents the expression which is evaluated by CEL to + produce an audit annotation value. The expression must evaluate to either + a string or null value. If the expression evaluates to a string, the + audit annotation is included with the string value. If the expression + evaluates to null or empty string the audit annotation will be omitted. + The valueExpression may be no longer than 5kb in length. + If the result of the valueExpression is more than 10kb in length, it + will be truncated to 10kb. + + If multiple ValidatingAdmissionPolicyBinding resources match an + API request, then the valueExpression will be evaluated for + each binding. All unique values produced by the valueExpressions + will be joined together in a comma-separated list. + + Required. + type: string + required: + - key + - valueExpression + type: object + type: array + x-kubernetes-list-type: atomic + autogen: + description: AutogenConfiguration defines the configuration + for the generation controller. + properties: + podControllers: + description: PodControllers specifies whether to + generate a pod controllers rules. + properties: + controllers: + items: + type: string + type: array + type: object + validatingAdmissionPolicy: + description: ValidatingAdmissionPolicy specifies + whether to generate a Kubernetes ValidatingAdmissionPolicy. + properties: + enabled: + description: |- + Enabled specifies whether to generate a Kubernetes ValidatingAdmissionPolicy. + Optional. Defaults to "false" if not specified. + type: boolean + type: object + type: object + evaluation: + description: EvaluationConfiguration defines the configuration + for the policy evaluation. + properties: + admission: + description: Admission controls policy evaluation + during admission. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied during admission. + Optional. Default value is "true". + type: boolean + type: object + background: + description: Background controls policy evaluation + during background scan. + properties: + enabled: + default: true + description: |- + Enabled controls if rules are applied to existing resources during a background scan. + Optional. Default value is "true". The value must be set to "false" if the policy rule + uses variables that are only available in the admission review request (e.g. user name). + type: boolean + type: object + mode: + description: |- + Mode is the mode of policy evaluation. + Allowed values are "Kubernetes", "HTTP" or "Envoy". + Optional. Default value is "Kubernetes". + type: string + type: object + failurePolicy: + description: |- + failurePolicy defines how to handle failures for the admission policy. Failures can + occur from CEL expression parse errors, type check errors, runtime errors and invalid + or mis-configured policy definitions or bindings. + + failurePolicy does not define how validations that evaluate to false are handled. + + When failurePolicy is set to Fail, the validationActions field define how failures are enforced. + + Allowed values are Ignore or Fail. Defaults to Fail. + enum: + - Ignore + - Fail + type: string + matchConditions: + description: |- + MatchConditions is a list of conditions that must be met for a request to be validated. + Match conditions filter requests that have already been matched by the rules, + namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. + There are a maximum of 64 match conditions allowed. + + The exact matching logic is (in order): + 1. If ANY matchCondition evaluates to FALSE, the policy is skipped. + 2. If ALL matchConditions evaluate to TRUE, the policy is evaluated. + 3. If any matchCondition evaluates to an error (but none are FALSE): + - If failurePolicy=Fail, reject the request + - If failurePolicy=Ignore, the policy is skipped + items: + description: MatchCondition represents a condition + which must by fulfilled for a request to be sent + to a webhook. + properties: + expression: + description: |- + Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. + CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables: + + 'object' - The object from the incoming request. The value is null for DELETE requests. + 'oldObject' - The existing object. The value is null for CREATE requests. + 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). + 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. + See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz + 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the + request resource. + Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + + Required. + type: string + name: + description: |- + Name is an identifier for this match condition, used for strategic merging of MatchConditions, + as well as providing an identifier for logging purposes. A good name should be descriptive of + the associated expression. + Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and + must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or + '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an + optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName') + + Required. + type: string + required: + - expression + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + matchConstraints: + description: |- + MatchConstraints specifies what resources this policy is designed to validate. + The AdmissionPolicy cares about a request if it matches _all_ Constraints. + Required. + properties: + excludeResourceRules: + description: |- + ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. + The exclude rules take precedence over include rules (if a resource matches both, it is excluded) + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + matchPolicy: + description: |- + matchPolicy defines how the "MatchResources" list is used to match incoming requests. + Allowed values are "Exact" or "Equivalent". + + - Exact: match a request only if it exactly matches a specified rule. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy. + + - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. + For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, + and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, + a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy. + + Defaults to "Equivalent" + type: string + namespaceSelector: + description: |- + NamespaceSelector decides whether to run the admission control policy on an object based + on whether the namespace for that object matches the selector. If the + object itself is a namespace, the matching is performed on + object.metadata.labels. If the object is another cluster scoped resource, + it never skips the policy. + + For example, to run the webhook on any objects whose namespace is not + associated with "runlevel" of "0" or "1"; you will set the selector as + follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "runlevel", + "operator": "NotIn", + "values": [ + "0", + "1" + ] + } + ] + } + + If instead you want to only run the policy on any objects whose + namespace is associated with the "environment" of "prod" or "staging"; + you will set the selector as follows: + "namespaceSelector": { + "matchExpressions": [ + { + "key": "environment", + "operator": "In", + "values": [ + "prod", + "staging" + ] + } + ] + } + + See + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + for more examples of label selectors. + + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + objectSelector: + description: |- + ObjectSelector decides whether to run the validation based on if the + object has matching labels. objectSelector is evaluated against both + the oldObject and newObject that would be sent to the cel validation, and + is considered to match if either object matches the selector. A null + object (oldObject in the case of create, or newObject in the case of + delete) or an object that cannot have labels (like a + DeploymentRollback or a PodProxyOptions object) is not considered to + match. + Use the object selector only if the webhook is opt-in, because end + users may skip the admission webhook by setting the labels. + Default to the empty LabelSelector, which matches everything. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resourceRules: + description: |- + ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. + The policy cares about an operation if it matches _any_ Rule. + items: + description: NamedRuleWithOperations is a tuple + of Operations and Resources with ResourceNames. + properties: + apiGroups: + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + apiVersions: + description: |- + APIVersions is the API versions the resources belong to. '*' is all versions. + If '*' is present, the length of the slice must be one. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + operations: + description: |- + Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * + for all of those operations and any future admission operations that are added. + If '*' is present, the length of the slice must be one. + Required. + items: + description: OperationType specifies an + operation for a request. + type: string + type: array + x-kubernetes-list-type: atomic + resourceNames: + description: ResourceNames is an optional + white list of names that the rule applies + to. An empty set means that everything + is allowed. + items: + type: string + type: array + x-kubernetes-list-type: atomic + resources: + description: |- + Resources is a list of resources this rule applies to. + + For example: + 'pods' means pods. + 'pods/log' means the log subresource of pods. + '*' means all resources, but not subresources. + 'pods/*' means all subresources of pods. + '*/scale' means all scale subresources. + '*/*' means all resources and their subresources. + + If wildcard is present, the validation rule will ensure resources do not + overlap with each other. + + Depending on the enclosing object, subresources might not be allowed. + Required. + items: + type: string + type: array + x-kubernetes-list-type: atomic + scope: + description: |- + scope specifies the scope of this rule. + Valid values are "Cluster", "Namespaced", and "*" + "Cluster" means that only cluster-scoped resources will match this rule. + Namespace API objects are cluster-scoped. + "Namespaced" means that only namespaced resources will match this rule. + "*" means that there are no scope restrictions. + Subresources match the scope of their parent resource. + Default is "*". + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + validationActions: + description: |- + ValidationAction specifies the action to be taken when the matched resource violates the policy. + If a validation evaluates to false it is always enforced according to these actions. + + Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according + to these actions only if the FailurePolicy is set to Fail, otherwise the failures are + ignored. This includes compilation errors, runtime errors and misconfigurations of the policy. + + validationActions is declared as a set of action values. Order does + not matter. validationActions may not contain duplicates of the same action. + + The supported actions values are: + + "Deny" specifies that a validation failure results in a denied request. + + "Warn" specifies that a validation failure is reported to the request client + in HTTP Warning headers, with a warning code of 299. Warnings can be sent + both for allowed or denied admission responses. + + "Audit" specifies that a validation failure is recorded in the created reports. + + Clients should expect to handle additional values by ignoring + any values not recognized. + + "Deny" and "Warn" may not be used together since this combination + needlessly duplicates the validation failure both in the + API response body and the HTTP warning headers. + + Required. + items: + description: ValidationAction specifies a policy enforcement + action. + enum: + - Deny + - Audit + - Warn + type: string + type: array + x-kubernetes-list-type: set + validations: + description: |- + Validations contain CEL expressions which is used to apply the validation. + Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is + required. + items: + description: Validation specifies the CEL expression + which is used to apply the validation. + properties: + expression: + description: "Expression represents the expression + which will be evaluated by CEL.\nref: https://github.com/google/cel-spec\nCEL + expressions have access to the contents of the + API request/response, organized into CEL variables + as well as some other useful variables:\n\n- + 'object' - The object from the incoming request. + The value is null for DELETE requests.\n- 'oldObject' + - The existing object. The value is null for + CREATE requests.\n- 'request' - Attributes of + the API request([ref](/pkg/apis/admission/types.go#AdmissionRequest)).\n- + 'params' - Parameter resource referred to by + the policy binding being evaluated. Only populated + if the policy has a ParamKind.\n- 'namespaceObject' + - The namespace object that the incoming object + belongs to. The value is null for cluster-scoped + resources.\n- 'variables' - Map of composited + variables, from its name to its lazily evaluated + value.\n For example, a variable named 'foo' + can be accessed as 'variables.foo'.\n- 'authorizer' + - A CEL Authorizer. May be used to perform authorization + checks for the principal (user or service account) + of the request.\n See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz\n- + 'authorizer.requestResource' - A CEL ResourceCheck + constructed from the 'authorizer' and configured + with the\n request resource.\n\nThe `apiVersion`, + `kind`, `metadata.name` and `metadata.generateName` + are always accessible from the root of the\nobject. + No other metadata properties are accessible.\n\nOnly + property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` + are accessible.\nAccessible property names are + escaped according to the following rules when + accessed in the expression:\n- '__' escapes + to '__underscores__'\n- '.' escapes to '__dot__'\n- + '-' escapes to '__dash__'\n- '/' escapes to + '__slash__'\n- Property names that exactly match + a CEL RESERVED keyword escape to '__{keyword}__'. + The keywords are:\n\t \"true\", \"false\", + \"null\", \"in\", \"as\", \"break\", \"const\", + \"continue\", \"else\", \"for\", \"function\", + \"if\",\n\t \"import\", \"let\", \"loop\", + \"package\", \"namespace\", \"return\".\nExamples:\n + \ - Expression accessing a property named \"namespace\": + {\"Expression\": \"object.__namespace__ > 0\"}\n + \ - Expression accessing a property named \"x-prop\": + {\"Expression\": \"object.x__dash__prop > 0\"}\n + \ - Expression accessing a property named \"redact__d\": + {\"Expression\": \"object.redact__underscores__d + > 0\"}\n\nEquality on arrays with list type + of 'set' or 'map' ignores element order, i.e. + [1, 2] == [2, 1].\nConcatenation on arrays with + x-kubernetes-list-type use the semantics of + the list type:\n - 'set': `X + Y` performs + a union where the array positions of all elements + in `X` are preserved and\n non-intersecting + elements in `Y` are appended, retaining their + partial order.\n - 'map': `X + Y` performs + a merge where the array positions of all keys + in `X` are preserved but the values\n are + overwritten by values in `Y` when the key sets + of `X` and `Y` intersect. Elements in `Y` with\n + \ non-intersecting keys are appended, retaining + their partial order.\nRequired." + type: string + message: + description: |- + Message represents the message displayed when validation fails. The message is required if the Expression contains + line breaks. The message must not contain line breaks. + If unset, the message is "failed rule: {Rule}". + e.g. "must be a URL with the host matching spec.host" + If the Expression contains line breaks. Message is required. + The message must not contain line breaks. + If unset, the message is "failed Expression: {Expression}". + type: string + messageExpression: + description: |- + messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. + Since messageExpression is used as a failure message, it must evaluate to a string. + If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. + If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced + as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string + that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and + the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. + messageExpression has access to all the same variables as the `expression` except for 'authorizer' and 'authorizer.requestResource'. + Example: + "object.x must be less than max ("+string(params.max)+")" + type: string + reason: + description: |- + Reason represents a machine-readable description of why this validation failed. + If this is the first validation in the list to fail, this reason, as well as the + corresponding HTTP response code, are used in the + HTTP response to the client. + The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". + If not set, StatusReasonInvalid is used in the response to the client. + type: string + required: + - expression + type: object + type: array + x-kubernetes-list-type: atomic + variables: + description: |- + Variables contain definitions of variables that can be used in composition of other expressions. + Each variable is defined as a named CEL expression. + The variables defined here will be available under `variables` in other expressions of the policy + except MatchConditions because MatchConditions are evaluated before the rest of the policy. + + The expression of a variable can refer to other variables defined earlier in the list but not those after. + Thus, Variables must be sorted by the order of first appearance and acyclic. + items: + description: Variable is the definition of a variable + that is used for composition. A variable is defined + as a named expression. + properties: + expression: + description: |- + Expression is the expression that will be evaluated as the value of the variable. + The CEL expression has access to the same identifiers as the CEL expressions in Validation. + type: string + name: + description: |- + Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables. + The variable can be accessed in other expressions through `variables` + For example, if name is "foo", the variable will be available as `variables.foo` + type: string + required: + - expression + - name + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + webhookConfiguration: + description: WebhookConfiguration defines the configuration + for the webhook. + properties: + timeoutSeconds: + description: |- + TimeoutSeconds specifies the maximum time in seconds allowed to apply this policy. + After the configured time expires, the admission request may fail, or may simply ignore the policy results, + based on the failure policy. The default timeout is 10s, the value must be between 1 and 30 seconds. + format: int32 + type: integer + type: object + type: object + targets: + items: + properties: + group: + type: string + kind: + type: string + resource: + type: string + version: + type: string + required: + - kind + - resource + - version + type: object + type: array + required: + - spec + - targets + type: object + type: object + type: object + conditionStatus: + description: ConditionStatus is the shared status across all policy + types + properties: + conditions: + items: + description: Condition contains details for one aspect of the + current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + message: + description: |- + Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy + It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated. + type: string + ready: + description: |- + The ready of a policy is a high-level summary of where the policy is in its lifecycle. + The conditions array, the reason and message fields contain more detail about the policy's status. + type: boolean + type: object + generated: + description: Generated indicates whether a ValidatingAdmissionPolicy/MutatingAdmissionPolicy + is generated from the policy or not + type: boolean + type: object + required: + - spec + type: object + selectableFields: + - jsonPath: .spec.evaluation.mode + served: true + storage: true + subresources: + status: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/kyverno-api/values.yaml b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/values.yaml new file mode 100644 index 0000000..750bd5e --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/kyverno-api/values.yaml @@ -0,0 +1,7 @@ +# -- Additional CRDs annotations +annotations: {} + # argocd.argoproj.io/sync-options: Replace=true + # strategy.spinnaker.io/replace: 'true' + +# -- Additional CRDs labels +labels: {} diff --git a/manifests/helm/kyverno/3.9.0/charts/openreports/Chart.yaml b/manifests/helm/kyverno/3.9.0/charts/openreports/Chart.yaml new file mode 100644 index 0000000..3553699 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/openreports/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v2 +appVersion: 1.0.0 +description: A Helm chart for installing openreports APIs. +name: openreports +version: 0.1.0 diff --git a/manifests/helm/kyverno/3.9.0/charts/openreports/templates/openreports.io_clusterreports.yaml b/manifests/helm/kyverno/3.9.0/charts/openreports/templates/openreports.io_clusterreports.yaml new file mode 100644 index 0000000..55711d3 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/openreports/templates/openreports.io_clusterreports.yaml @@ -0,0 +1,418 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + name: clusterreports.openreports.io +spec: + group: openreports.io + names: + kind: ClusterReport + listKind: ClusterReportList + plural: clusterreports + shortNames: + - creps + singular: clusterreport + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .scope.kind + name: Kind + priority: 1 + type: string + - jsonPath: .scope.name + name: Name + priority: 1 + type: string + - jsonPath: .summary.pass + name: Pass + type: integer + - jsonPath: .summary.fail + name: Fail + type: integer + - jsonPath: .summary.warn + name: Warn + type: integer + - jsonPath: .summary.error + name: Error + type: integer + - jsonPath: .summary.skip + name: Skip + type: integer + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterReport is the Schema for the ClusterReport API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + configuration: + description: |- + Configuration is an optional field which can be used to specify + a contract between Report generators and consumers + properties: + limits: + properties: + maxResults: + description: MaxResults is the maximum number of results contained + in the report + type: integer + statusFilter: + description: StatusFilter indicates that the Report contains only + those reports with statuses specified in this list + items: + description: StatusFilter is used by Report generators to write + only those reports whose status is specified by the filters + enum: + - pass + - fail + - warn + - error + - skip + type: string + type: array + type: object + required: + - limits + type: object + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + results: + description: ReportResult provides result details + items: + description: ReportResult provides the result for an individual policy + properties: + category: + description: Category indicates policy category + type: string + message: + description: Description is a short user friendly message for the + policy rule + type: string + policy: + description: Policy is the name or identifier of the policy + type: string + properties: + additionalProperties: + type: string + description: Properties provides additional information for the + policy rule + type: object + resourceSelector: + description: |- + ResourceSelector is an optional label selector for checked Kubernetes resources. + For example, a policy result may apply to all pods that match a label. + Either a Subject or a ResourceSelector can be specified. If neither are provided, the + result is assumed to be for the policy report scope. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resources: + description: Subjects is an optional reference to the checked Kubernetes + resources + items: + description: |- + ObjectReference contains enough information to let you inspect or modify the referred object. + --- + New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs. + 1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage. + 2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular + restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted". + Those cannot be well described when embedded. + 3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen. + 4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity + during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple + and the version of the actual struct is irrelevant. + 5. We cannot easily change it. Because this type is embedded in many locations, updates to this type + will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control. + + + Instead of using this type, create a locally provided and used type that is well-focused on your reference. + For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 . + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + result: + description: Result indicates the outcome of the policy rule execution + enum: + - pass + - fail + - warn + - error + - skip + type: string + rule: + description: Rule is the name or identifier of the rule within the + policy + type: string + scored: + description: Scored indicates if this result is scored + type: boolean + severity: + description: Severity indicates policy check result criticality + enum: + - critical + - high + - low + - medium + - info + type: string + source: + description: |- + Source is an identifier for the policy engine that manages this report + If the Source is specified at this level, it will override the Source + field set at the Report level + type: string + timestamp: + description: Timestamp indicates the time the result was found + properties: + nanos: + description: |- + Non-negative fractions of a second at nanosecond resolution. Negative + second values with fractions must still have non-negative nanos values + that count forward in time. Must be from 0 to 999,999,999 + inclusive. This field may be limited in precision depending on context. + format: int32 + type: integer + seconds: + description: |- + Represents seconds of UTC time since Unix epoch + 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to + 9999-12-31T23:59:59Z inclusive. + format: int64 + type: integer + required: + - nanos + - seconds + type: object + required: + - policy + type: object + type: array + scope: + description: Scope is an optional reference to the report scope (e.g. + a Deployment, Namespace, or Node) + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + scopeSelector: + description: |- + ScopeSelector is an optional selector for multiple scopes (e.g. Pods). + Either one of, or none of, but not both of, Scope or ScopeSelector should be specified. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + source: + description: |- + Source is an identifier for the source e.g. a policy engine that manages this report. + Use this field if all the results are produced by a single policy engine. + If the results are produced by multiple sources e.g. different engines or scanners, + then use the Source field at the ReportResult level. + type: string + summary: + description: ReportSummary provides a summary of results + properties: + error: + description: Error provides the count of policies that could not be + evaluated + type: integer + fail: + description: Fail provides the count of policies whose requirements + were not met + type: integer + pass: + description: Pass provides the count of policies whose requirements + were met + type: integer + skip: + description: Skip indicates the count of policies that were not selected + for evaluation + type: integer + warn: + description: Warn provides the count of non-scored policies whose + requirements were not met + type: integer + type: object + type: object + served: true + storage: true + subresources: {} + diff --git a/manifests/helm/kyverno/3.9.0/charts/openreports/templates/openreports.io_reports.yaml b/manifests/helm/kyverno/3.9.0/charts/openreports/templates/openreports.io_reports.yaml new file mode 100644 index 0000000..3c6b381 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/openreports/templates/openreports.io_reports.yaml @@ -0,0 +1,418 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + name: reports.openreports.io +spec: + group: openreports.io + names: + kind: Report + listKind: ReportList + plural: reports + shortNames: + - reps + singular: report + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .scope.kind + name: Kind + priority: 1 + type: string + - jsonPath: .scope.name + name: Name + priority: 1 + type: string + - jsonPath: .summary.pass + name: Pass + type: integer + - jsonPath: .summary.fail + name: Fail + type: integer + - jsonPath: .summary.warn + name: Warn + type: integer + - jsonPath: .summary.error + name: Error + type: integer + - jsonPath: .summary.skip + name: Skip + type: integer + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: Report is the Schema for the reports API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + configuration: + description: |- + Configuration is an optional field which can be used to specify + a contract between Report generators and consumers + properties: + limits: + properties: + maxResults: + description: MaxResults is the maximum number of results contained + in the report + type: integer + statusFilter: + description: StatusFilter indicates that the Report contains only + those reports with statuses specified in this list + items: + description: StatusFilter is used by Report generators to write + only those reports whose status is specified by the filters + enum: + - pass + - fail + - warn + - error + - skip + type: string + type: array + type: object + required: + - limits + type: object + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + results: + description: ReportResult provides result details + items: + description: ReportResult provides the result for an individual policy + properties: + category: + description: Category indicates policy category + type: string + message: + description: Description is a short user friendly message for the + policy rule + type: string + policy: + description: Policy is the name or identifier of the policy + type: string + properties: + additionalProperties: + type: string + description: Properties provides additional information for the + policy rule + type: object + resourceSelector: + description: |- + ResourceSelector is an optional label selector for checked Kubernetes resources. + For example, a policy result may apply to all pods that match a label. + Either a Subject or a ResourceSelector can be specified. If neither are provided, the + result is assumed to be for the policy report scope. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + resources: + description: Subjects is an optional reference to the checked Kubernetes + resources + items: + description: |- + ObjectReference contains enough information to let you inspect or modify the referred object. + --- + New uses of this type are discouraged because of difficulty describing its usage when embedded in APIs. + 1. Ignored fields. It includes many fields which are not generally honored. For instance, ResourceVersion and FieldPath are both very rarely valid in actual usage. + 2. Invalid usage help. It is impossible to add specific help for individual usage. In most embedded usages, there are particular + restrictions like, "must refer only to types A and B" or "UID not honored" or "name must be restricted". + Those cannot be well described when embedded. + 3. Inconsistent validation. Because the usages are different, the validation rules are different by usage, which makes it hard for users to predict what will happen. + 4. The fields are both imprecise and overly precise. Kind is not a precise mapping to a URL. This can produce ambiguity + during interpretation and require a REST mapping. In most cases, the dependency is on the group,resource tuple + and the version of the actual struct is irrelevant. + 5. We cannot easily change it. Because this type is embedded in many locations, updates to this type + will affect numerous schemas. Don't make new APIs embed an underspecified API type they do not control. + + + Instead of using this type, create a locally provided and used type that is well-focused on your reference. + For example, ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533 . + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: array + result: + description: Result indicates the outcome of the policy rule execution + enum: + - pass + - fail + - warn + - error + - skip + type: string + rule: + description: Rule is the name or identifier of the rule within the + policy + type: string + scored: + description: Scored indicates if this result is scored + type: boolean + severity: + description: Severity indicates policy check result criticality + enum: + - critical + - high + - low + - medium + - info + type: string + source: + description: |- + Source is an identifier for the policy engine that manages this report + If the Source is specified at this level, it will override the Source + field set at the Report level + type: string + timestamp: + description: Timestamp indicates the time the result was found + properties: + nanos: + description: |- + Non-negative fractions of a second at nanosecond resolution. Negative + second values with fractions must still have non-negative nanos values + that count forward in time. Must be from 0 to 999,999,999 + inclusive. This field may be limited in precision depending on context. + format: int32 + type: integer + seconds: + description: |- + Represents seconds of UTC time since Unix epoch + 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to + 9999-12-31T23:59:59Z inclusive. + format: int64 + type: integer + required: + - nanos + - seconds + type: object + required: + - policy + type: object + type: array + scope: + description: Scope is an optional reference to the report scope (e.g. + a Deployment, Namespace, or Node) + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + scopeSelector: + description: |- + ScopeSelector is an optional selector for multiple scopes (e.g. Pods). + Either one of, or none of, but not both of, Scope or ScopeSelector should be specified. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + source: + description: |- + Source is an identifier for the source e.g. a policy engine that manages this report. + Use this field if all the results are produced by a single policy engine. + If the results are produced by multiple sources e.g. different engines or scanners, + then use the Source field at the ReportResult level. + type: string + summary: + description: ReportSummary provides a summary of results + properties: + error: + description: Error provides the count of policies that could not be + evaluated + type: integer + fail: + description: Fail provides the count of policies whose requirements + were not met + type: integer + pass: + description: Pass provides the count of policies whose requirements + were met + type: integer + skip: + description: Skip indicates the count of policies that were not selected + for evaluation + type: integer + warn: + description: Warn provides the count of non-scored policies whose + requirements were not met + type: integer + type: object + type: object + served: true + storage: true + subresources: {} + diff --git a/manifests/helm/kyverno/3.9.0/charts/openreports/values.yaml b/manifests/helm/kyverno/3.9.0/charts/openreports/values.yaml new file mode 100644 index 0000000..e69de29 diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/.helmignore b/manifests/helm/kyverno/3.9.0/charts/reports-server/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/Chart.lock b/manifests/helm/kyverno/3.9.0/charts/reports-server/Chart.lock new file mode 100644 index 0000000..a936575 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: postgresql + repository: oci://registry-1.docker.io/bitnamicharts + version: 13.4.1 +digest: sha256:7cbc27b5bb538d7d09c4c5a5ea31bcc0628aa27fe4a5bdfb71dfca288b80bc89 +generated: "2024-01-29T15:02:16.547275+05:30" diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/Chart.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/Chart.yaml new file mode 100644 index 0000000..4335ab9 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/Chart.yaml @@ -0,0 +1,21 @@ +apiVersion: v2 +appVersion: v0.1.6 +dependencies: +- condition: postgresql.enabled + name: postgresql + repository: oci://registry-1.docker.io/bitnamicharts + version: 13.4.1 +keywords: +- kubernetes +- policy reports storage +- postgresql +kubeVersion: '>=1.16.0-0' +maintainers: +- email: cncf-kyverno-maintainers@lists.cncf.io + name: Nirmata + url: https://kyverno.io/ +name: reports-server +sources: +- https://github.com/kyverno/reports-server +type: application +version: 0.1.6 diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/README.md b/manifests/helm/kyverno/3.9.0/charts/reports-server/README.md new file mode 100644 index 0000000..43c638a --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/README.md @@ -0,0 +1,133 @@ +# reports-server + +![Version: 0.1.6](https://img.shields.io/badge/Version-0.1.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.1.6](https://img.shields.io/badge/AppVersion-v0.1.6-informational?style=flat-square) + +TODO + +## Installing the Chart + +Add `reports-server` Helm repository: + +```shell +helm repo add reports-server https://kyverno.github.io/reports-server/ +``` + +Install `reports-server` Helm chart: + +```shell +helm install reports-server --namespace reports-server --create-namespace reports-server/reports-server +``` + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| postgresql.image.registry | string | `"docker.io"` | | +| postgresql.image.repository | string | `"bitnamilegacy/postgresql"` | | +| postgresql.image.tag | string | `"16.1.0-debian-11-r22"` | | +| postgresql.image.digest | string | `""` | | +| postgresql.enabled | bool | `true` | Deploy postgresql dependency chart | +| postgresql.auth.postgresPassword | string | `"reports"` | | +| postgresql.auth.database | string | `"reportsdb"` | | +| nameOverride | string | `""` | Name override | +| fullnameOverride | string | `""` | Full name override | +| replicaCount | int | `1` | Number of pod replicas | +| clusterName | string | `""` | Optional cluster name, used to easily identify database records when querying the database directly | +| image.registry | string | `"ghcr.io"` | Image registry | +| image.repository | string | `"kyverno/reports-server"` | Image repository | +| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | +| image.tag | string | `nil` | Image tag (will default to app version if not set) | +| imagePullSecrets | list | `[]` | Image pull secrets | +| priorityClassName | string | `"system-cluster-critical"` | Priority class name | +| serviceAccount.create | bool | `true` | Create service account | +| serviceAccount.annotations | object | `{}` | Service account annotations | +| serviceAccount.name | string | `""` | Service account name (required if `serviceAccount.create` is `false`) | +| podAnnotations | object | `{}` | Pod annotations | +| commonLabels | object | `{}` | Labels to add to resources managed by the chart | +| podSecurityContext | object | `{"fsGroup":2000}` | Pod security context | +| podEnv | object | `{}` | Provide additional environment variables to the pods. Map with the same format as kubernetes deployment spec's env. | +| securityContext | object | See [values.yaml](values.yaml) | Container security context | +| livenessProbe | object | `{"failureThreshold":10,"httpGet":{"path":"/livez","port":"https","scheme":"HTTPS"},"initialDelaySeconds":20,"periodSeconds":10}` | Liveness probe | +| readinessProbe | object | `{"failureThreshold":10,"httpGet":{"path":"/readyz","port":"https","scheme":"HTTPS"},"initialDelaySeconds":30,"periodSeconds":10}` | Readiness probe | +| metrics.enabled | bool | `true` | Enable prometheus metrics | +| metrics.serviceMonitor.enabled | bool | `false` | Enable service monitor for scraping prometheus metrics | +| metrics.serviceMonitor.additionalLabels | object | `{}` | Service monitor additional labels | +| metrics.serviceMonitor.interval | string | `""` | Service monitor scrape interval | +| metrics.serviceMonitor.metricRelabelings | list | `[]` | Service monitor metric relabelings | +| metrics.serviceMonitor.relabelings | list | `[]` | Service monitor relabelings | +| metrics.serviceMonitor.scrapeTimeout | string | `""` | Service monitor scrape timeout | +| resources.limits | string | `nil` | Container resource limits | +| resources.requests | string | `nil` | Container resource requests | +| autoscaling.enabled | bool | `false` | Enable autoscaling | +| autoscaling.minReplicas | int | `1` | Min number of replicas | +| autoscaling.maxReplicas | int | `100` | Max number of replicas | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | Target CPU utilisation | +| autoscaling.targetMemoryUtilizationPercentage | string | `nil` | Target Memory utilisation | +| pdb | object | `{"enabled":true,"maxUnavailable":"50%","minAvailable":null}` | Using a PDB is highly recommended for highly available deployments. Defaults to enabled. The default configuration doesn't prevent disruption when using a single replica | +| pdb.enabled | bool | `true` | Enable PodDisruptionBudget | +| pdb.minAvailable | string | `nil` | minAvailable pods for PDB, cannot be used together with maxUnavailable | +| pdb.maxUnavailable | string | `"50%"` | maxUnavailable pods for PDB, will take precedence over minAvailable if both are defined | +| nodeSelector | object | `{}` | Node selector | +| tolerations | list | `[]` | Tolerations | +| affinity | object | `{}` | Affinity | +| service.type | string | `"ClusterIP"` | Service type | +| service.port | int | `443` | Service port | +| config.etcd.enabled | bool | `false` | | +| config.etcd.endpoints | string | `nil` | | +| config.etcd.insecure | bool | `true` | | +| config.db.secretName | string | `""` | If set, database connection information will be read from the Secret with this name. Overrides `db.host`, `db.name`, `db.user`, and `db.password`. | +| config.db.host | string | `""` | Database host | +| config.db.hostSecretKeyName | string | `"host"` | The database host will be read from this `key` in the specified Secret, when `db.secretName` is set. | +| config.db.port | int | `5432` | Database port | +| config.db.portSecretKeyName | string | `"port"` | The database port will be read from this `key` in the specified Secret, when `db.secretName` is set. | +| config.db.name | string | `"reportsdb"` | Database name | +| config.db.dbNameSecretKeyName | string | `"dbname"` | The database name will be read from this `key` in the specified Secret, when `db.secretName` is set. | +| config.db.user | string | `"postgres"` | Database user | +| config.db.userSecretKeyName | string | `"username"` | The database username will be read from this `key` in the specified Secret, when `db.secretName` is set. | +| config.db.password | string | `"reports"` | Database password | +| config.db.passwordSecretKeyName | string | `"password"` | The database password will be read from this `key` in the specified Secret, when `db.secretName` is set. | +| config.db.sslmode | string | `"disable"` | Database SSL | +| config.db.sslrootcert | string | `""` | Database SSL root cert | +| config.db.sslkey | string | `""` | Database SSL key | +| config.db.sslcert | string | `""` | Database SSL cert | +| apiServicesManagement.enabled | bool | `true` | Create a helm hooks to delete api services on uninstall | +| apiServicesManagement.installApiServices | object | `{"enabled":true,"installEphemeralReportsService":true,"installOpenreportsService":true}` | Install api services in manifest | +| apiServicesManagement.installApiServices.enabled | bool | `true` | Store reports in reports-server | +| apiServicesManagement.installApiServices.installEphemeralReportsService | bool | `true` | Store ephemeral reports in reports-server | +| apiServicesManagement.installApiServices.installOpenreportsService | bool | `true` | Store open reports in reports-server | +| apiServicesManagement.image.registry | string | `"docker.io"` | Image registry | +| apiServicesManagement.image.repository | string | `"bitnamilegacy/kubectl"` | Image repository | +| apiServicesManagement.image.tag | string | `"1.30.2"` | Image tag Defaults to `latest` if omitted | +| apiServicesManagement.image.pullPolicy | string | `nil` | Image pull policy Defaults to image.pullPolicy if omitted | +| apiServicesManagement.imagePullSecrets | list | `[]` | Image pull secrets | +| apiServicesManagement.podSecurityContext | object | `{}` | Security context for the pod | +| apiServicesManagement.nodeSelector | object | `{}` | Node labels for pod assignment | +| apiServicesManagement.tolerations | list | `[]` | List of node taints to tolerate | +| apiServicesManagement.podAntiAffinity | object | `{}` | Pod anti affinity constraints. | +| apiServicesManagement.podAffinity | object | `{}` | Pod affinity constraints. | +| apiServicesManagement.podLabels | object | `{}` | Pod labels. | +| apiServicesManagement.podAnnotations | object | `{}` | Pod annotations. | +| apiServicesManagement.nodeAffinity | object | `{}` | Node affinity constraints. | +| apiServicesManagement.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the hook containers | +| extraObjects | list | `[]` | | + +## Source Code + +* + +## Requirements + +Kubernetes: `>=1.16.0-0` + +| Repository | Name | Version | +|------------|------|---------| +| oci://registry-1.docker.io/bitnamicharts | postgresql | 13.4.1 | + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| Nirmata | | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/README.md.gotmpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/README.md.gotmpl new file mode 100644 index 0000000..2bb489e --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/README.md.gotmpl @@ -0,0 +1,31 @@ +{{ template "chart.header" . }} +{{ template "chart.deprecationWarning" . }} +{{ template "chart.description" . }} + +{{ template "chart.badgesSection" . }} + +TODO + +## Installing the Chart + +Add `reports-server` Helm repository: + +```shell +helm repo add reports-server https://kyverno.github.io/reports-server/ +``` + +Install `reports-server` Helm chart: + +```shell +helm install reports-server --namespace reports-server --create-namespace reports-server/reports-server +``` + +{{ template "chart.valuesSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "helm-docs.versionFooter" . }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/.helmignore b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/.helmignore new file mode 100644 index 0000000..f0c1319 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/Chart.lock b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/Chart.lock new file mode 100644 index 0000000..5f5e5ab --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: oci://registry-1.docker.io/bitnamicharts + version: 2.14.1 +digest: sha256:5ccbe5f1fe4459864a8c9d7329c400b678666b6cfb1450818a830bda81995bc3 +generated: "2023-12-20T20:39:13.141839286Z" diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/Chart.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/Chart.yaml new file mode 100644 index 0000000..a9bafa7 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/Chart.yaml @@ -0,0 +1,37 @@ +annotations: + category: Database + images: | + - name: os-shell + image: docker.io/bitnami/os-shell:11-debian-11-r95 + - name: postgres-exporter + image: docker.io/bitnami/postgres-exporter:0.15.0-debian-11-r6 + - name: postgresql + image: docker.io/bitnami/postgresql:16.1.0-debian-11-r22 + licenses: Apache-2.0 +apiVersion: v2 +appVersion: 16.1.0 +dependencies: +- name: common + repository: oci://registry-1.docker.io/bitnamicharts + tags: + - bitnami-common + version: 2.x.x +description: PostgreSQL (Postgres) is an open source object-relational database known + for reliability and data integrity. ACID-compliant, it supports foreign keys, joins, + views, triggers and stored procedures. +home: https://bitnami.com +icon: https://bitnami.com/assets/stacks/postgresql/img/postgresql-stack-220x234.png +keywords: +- postgresql +- postgres +- database +- sql +- replication +- cluster +maintainers: +- name: VMware, Inc. + url: https://github.com/bitnami/charts +name: postgresql +sources: +- https://github.com/bitnami/charts/tree/main/bitnami/postgresql +version: 13.4.1 diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/README.md b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/README.md new file mode 100644 index 0000000..31ce305 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/README.md @@ -0,0 +1,771 @@ + + +# Bitnami package for PostgreSQL + +PostgreSQL (Postgres) is an open source object-relational database known for reliability and data integrity. ACID-compliant, it supports foreign keys, joins, views, triggers and stored procedures. + +[Overview of PostgreSQL](http://www.postgresql.org) + +Trademarks: This software listing is packaged by Bitnami. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. + +## TL;DR + +```console +helm install my-release oci://registry-1.docker.io/bitnamicharts/postgresql +``` + +Looking to use PostgreSQL in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the enterprise edition of Bitnami Application Catalog. + +## Introduction + +This chart bootstraps a [PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +For HA, please see [this repo](https://github.com/bitnami/charts/tree/main/bitnami/postgresql-ha) + +Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.23+ +- Helm 3.8.0+ +- PV provisioner support in the underlying infrastructure + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The command deploys PostgreSQL on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +helm delete my-release +``` + +The command removes all the Kubernetes components but PVC's associated with the chart and deletes the release. + +To delete the PVC's associated with `my-release`: + +```console +kubectl delete pvc -l release=my-release +``` + +> **Note**: Deleting the PVC's will delete postgresql data as well. Please be cautious before doing it. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | +| `global.postgresql.auth.postgresPassword` | Password for the "postgres" admin user (overrides `auth.postgresPassword`) | `""` | +| `global.postgresql.auth.username` | Name for a custom user to create (overrides `auth.username`) | `""` | +| `global.postgresql.auth.password` | Password for the custom user to create (overrides `auth.password`) | `""` | +| `global.postgresql.auth.database` | Name for a custom database to create (overrides `auth.database`) | `""` | +| `global.postgresql.auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). | `""` | +| `global.postgresql.auth.secretKeys.adminPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.auth.secretKeys.userPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.auth.secretKeys.replicationPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.replicationPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | `""` | +| `global.postgresql.service.ports.postgresql` | PostgreSQL service port (overrides `service.ports.postgresql`) | `""` | + +### Common parameters + +| Name | Description | Value | +| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release (evaluated as a template) | `[]` | +| `commonLabels` | Add labels to all the deployed resources | `{}` | +| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the statefulset | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the statefulset | `["infinity"]` | + +### PostgreSQL common parameters + +| Name | Description | Value | +| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | +| `image.registry` | PostgreSQL image registry | `REGISTRY_NAME` | +| `image.repository` | PostgreSQL image repository | `REPOSITORY_NAME/postgresql` | +| `image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `image.pullPolicy` | PostgreSQL image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify image pull secrets | `[]` | +| `image.debug` | Specify if debug values should be set | `false` | +| `auth.enablePostgresUser` | Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user | `true` | +| `auth.postgresPassword` | Password for the "postgres" admin user. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.username` | Name for a custom user to create | `""` | +| `auth.password` | Password for the custom user to create. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.database` | Name for a custom database to create | `""` | +| `auth.replicationUsername` | Name of the replication user | `repl_user` | +| `auth.replicationPassword` | Password for the replication user. Ignored if `auth.existingSecret` is provided | `""` | +| `auth.existingSecret` | Name of existing secret to use for PostgreSQL credentials. `auth.postgresPassword`, `auth.password`, and `auth.replicationPassword` will be ignored and picked up from this secret. The secret might also contains the key `ldap-password` if LDAP is enabled. `ldap.bind_password` will be ignored and picked from this secret in this case. | `""` | +| `auth.secretKeys.adminPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `postgres-password` | +| `auth.secretKeys.userPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `password` | +| `auth.secretKeys.replicationPasswordKey` | Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. | `replication-password` | +| `auth.usePasswordFiles` | Mount credentials as a files instead of using an environment variable | `false` | +| `architecture` | PostgreSQL architecture (`standalone` or `replication`) | `standalone` | +| `replication.synchronousCommit` | Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` | `off` | +| `replication.numSynchronousReplicas` | Number of replicas that will have synchronous replication. Note: Cannot be greater than `readReplicas.replicaCount`. | `0` | +| `replication.applicationName` | Cluster application name. Useful for advanced replication settings | `my_application` | +| `containerPorts.postgresql` | PostgreSQL container port | `5432` | +| `audit.logHostname` | Log client hostnames | `false` | +| `audit.logConnections` | Add client log-in operations to the log file | `false` | +| `audit.logDisconnections` | Add client log-outs operations to the log file | `false` | +| `audit.pgAuditLog` | Add operations to log using the pgAudit extension | `""` | +| `audit.pgAuditLogCatalog` | Log catalog using pgAudit | `off` | +| `audit.clientMinMessages` | Message log level to share with the user | `error` | +| `audit.logLinePrefix` | Template for log line prefix (default if not set) | `""` | +| `audit.logTimezone` | Timezone for the log timestamps | `""` | +| `ldap.enabled` | Enable LDAP support | `false` | +| `ldap.server` | IP address or name of the LDAP server. | `""` | +| `ldap.port` | Port number on the LDAP server to connect to | `""` | +| `ldap.prefix` | String to prepend to the user name when forming the DN to bind | `""` | +| `ldap.suffix` | String to append to the user name when forming the DN to bind | `""` | +| `ldap.basedn` | Root DN to begin the search for the user in | `""` | +| `ldap.binddn` | DN of user to bind to LDAP | `""` | +| `ldap.bindpw` | Password for the user to bind to LDAP | `""` | +| `ldap.searchAttribute` | Attribute to match against the user name in the search | `""` | +| `ldap.searchFilter` | The search filter to use when doing search+bind authentication | `""` | +| `ldap.scheme` | Set to `ldaps` to use LDAPS | `""` | +| `ldap.tls.enabled` | Se to true to enable TLS encryption | `false` | +| `ldap.uri` | LDAP URL beginning in the form `ldap[s]://host[:port]/basedn`. If provided, all the other LDAP parameters will be ignored. | `""` | +| `postgresqlDataDir` | PostgreSQL data dir folder | `/bitnami/postgresql/data` | +| `postgresqlSharedPreloadLibraries` | Shared preload libraries (comma-separated list) | `pgaudit` | +| `shmVolume.enabled` | Enable emptyDir volume for /dev/shm for PostgreSQL pod(s) | `true` | +| `shmVolume.sizeLimit` | Set this to enable a size limit on the shm tmpfs | `""` | +| `tls.enabled` | Enable TLS traffic support | `false` | +| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | +| `tls.preferServerCiphers` | Whether to use the server's TLS cipher preferences rather than the client's | `true` | +| `tls.certificatesSecret` | Name of an existing secret that contains the certificates | `""` | +| `tls.certFilename` | Certificate filename | `""` | +| `tls.certKeyFilename` | Certificate key filename | `""` | +| `tls.certCAFilename` | CA Certificate filename | `""` | +| `tls.crlFilename` | File containing a Certificate Revocation List | `""` | + +### PostgreSQL Primary parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------------- | +| `primary.name` | Name of the primary database (eg primary, master, leader, ...) | `primary` | +| `primary.configuration` | PostgreSQL Primary main configuration to be injected as ConfigMap | `""` | +| `primary.pgHbaConfiguration` | PostgreSQL Primary client authentication configuration | `""` | +| `primary.existingConfigmap` | Name of an existing ConfigMap with PostgreSQL Primary configuration | `""` | +| `primary.extendedConfiguration` | Extended PostgreSQL Primary configuration (appended to main or default configuration) | `""` | +| `primary.existingExtendedConfigmap` | Name of an existing ConfigMap with PostgreSQL Primary extended configuration | `""` | +| `primary.initdb.args` | PostgreSQL initdb extra arguments | `""` | +| `primary.initdb.postgresqlWalDir` | Specify a custom location for the PostgreSQL transaction log | `""` | +| `primary.initdb.scripts` | Dictionary of initdb scripts | `{}` | +| `primary.initdb.scriptsConfigMap` | ConfigMap with scripts to be run at first boot | `""` | +| `primary.initdb.scriptsSecret` | Secret with scripts to be run at first boot (in case it contains sensitive information) | `""` | +| `primary.initdb.user` | Specify the PostgreSQL username to execute the initdb scripts | `""` | +| `primary.initdb.password` | Specify the PostgreSQL password to execute the initdb scripts | `""` | +| `primary.standby.enabled` | Whether to enable current cluster's primary as standby server of another cluster or not | `false` | +| `primary.standby.primaryHost` | The Host of replication primary in the other cluster | `""` | +| `primary.standby.primaryPort` | The Port of replication primary in the other cluster | `""` | +| `primary.extraEnvVars` | Array with extra environment variables to add to PostgreSQL Primary nodes | `[]` | +| `primary.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for PostgreSQL Primary nodes | `""` | +| `primary.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for PostgreSQL Primary nodes | `""` | +| `primary.command` | Override default container command (useful when using custom images) | `[]` | +| `primary.args` | Override default container args (useful when using custom images) | `[]` | +| `primary.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL Primary containers | `true` | +| `primary.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `primary.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `primary.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `primary.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `primary.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `primary.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL Primary containers | `true` | +| `primary.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `primary.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `primary.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `primary.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `primary.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `primary.startupProbe.enabled` | Enable startupProbe on PostgreSQL Primary containers | `false` | +| `primary.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` | +| `primary.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `primary.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `primary.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `primary.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `primary.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `primary.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `primary.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `primary.lifecycleHooks` | for the PostgreSQL Primary container to automate configuration before or after startup | `{}` | +| `primary.resources.limits` | The resources limits for the PostgreSQL Primary containers | `{}` | +| `primary.resources.requests.memory` | The requested memory for the PostgreSQL Primary containers | `256Mi` | +| `primary.resources.requests.cpu` | The requested cpu for the PostgreSQL Primary containers | `250m` | +| `primary.podSecurityContext.enabled` | Enable security context | `true` | +| `primary.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `primary.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `primary.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `primary.podSecurityContext.fsGroup` | Group ID for the pod | `1001` | +| `primary.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `primary.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `primary.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `primary.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `primary.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `primary.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` | +| `primary.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `primary.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `primary.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `primary.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `primary.hostAliases` | PostgreSQL primary pods host aliases | `[]` | +| `primary.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `primary.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `primary.labels` | Map of labels to add to the statefulset (postgresql primary) | `{}` | +| `primary.annotations` | Annotations for PostgreSQL primary pods | `{}` | +| `primary.podLabels` | Map of labels to add to the pods (postgresql primary) | `{}` | +| `primary.podAnnotations` | Map of annotations to add to the pods (postgresql primary) | `{}` | +| `primary.podAffinityPreset` | PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `primary.podAntiAffinityPreset` | PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `primary.nodeAffinityPreset.type` | PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `primary.nodeAffinityPreset.key` | PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. | `""` | +| `primary.nodeAffinityPreset.values` | PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. | `[]` | +| `primary.affinity` | Affinity for PostgreSQL primary pods assignment | `{}` | +| `primary.nodeSelector` | Node labels for PostgreSQL primary pods assignment | `{}` | +| `primary.tolerations` | Tolerations for PostgreSQL primary pods assignment | `[]` | +| `primary.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `primary.priorityClassName` | Priority Class to use for each pod (postgresql primary) | `""` | +| `primary.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `primary.terminationGracePeriodSeconds` | Seconds PostgreSQL primary pod needs to terminate gracefully | `""` | +| `primary.updateStrategy.type` | PostgreSQL Primary statefulset strategy type | `RollingUpdate` | +| `primary.updateStrategy.rollingUpdate` | PostgreSQL Primary statefulset rolling update configuration parameters | `{}` | +| `primary.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the PostgreSQL Primary container(s) | `[]` | +| `primary.extraVolumes` | Optionally specify extra list of additional volumes for the PostgreSQL Primary pod(s) | `[]` | +| `primary.sidecars` | Add additional sidecar containers to the PostgreSQL Primary pod(s) | `[]` | +| `primary.initContainers` | Add additional init containers to the PostgreSQL Primary pod(s) | `[]` | +| `primary.extraPodSpec` | Optionally specify extra PodSpec for the PostgreSQL Primary pod(s) | `{}` | +| `primary.service.type` | Kubernetes Service type | `ClusterIP` | +| `primary.service.ports.postgresql` | PostgreSQL service port | `5432` | +| `primary.service.nodePorts.postgresql` | Node port for PostgreSQL | `""` | +| `primary.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `primary.service.annotations` | Annotations for PostgreSQL primary service | `{}` | +| `primary.service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | +| `primary.service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `primary.service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | +| `primary.service.extraPorts` | Extra ports to expose in the PostgreSQL primary service | `[]` | +| `primary.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `primary.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `primary.service.headless.annotations` | Additional custom annotations for headless PostgreSQL primary service | `{}` | +| `primary.persistence.enabled` | Enable PostgreSQL Primary data persistence using PVC | `true` | +| `primary.persistence.existingClaim` | Name of an existing PVC to use | `""` | +| `primary.persistence.mountPath` | The path the volume will be mounted at | `/bitnami/postgresql` | +| `primary.persistence.subPath` | The subdirectory of the volume to mount to | `""` | +| `primary.persistence.storageClass` | PVC Storage Class for PostgreSQL Primary data volume | `""` | +| `primary.persistence.accessModes` | PVC Access Mode for PostgreSQL volume | `["ReadWriteOnce"]` | +| `primary.persistence.size` | PVC Storage Request for PostgreSQL volume | `8Gi` | +| `primary.persistence.annotations` | Annotations for the PVC | `{}` | +| `primary.persistence.labels` | Labels for the PVC | `{}` | +| `primary.persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | +| `primary.persistence.dataSource` | Custom PVC data source | `{}` | +| `primary.persistentVolumeClaimRetentionPolicy.enabled` | Enable Persistent volume retention policy for Primary Statefulset | `false` | +| `primary.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `primary.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### PostgreSQL read only replica parameters (only used when `architecture` is set to `replication`) + +| Name | Description | Value | +| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | --------------------- | +| `readReplicas.name` | Name of the read replicas database (eg secondary, slave, ...) | `read` | +| `readReplicas.replicaCount` | Number of PostgreSQL read only replicas | `1` | +| `readReplicas.extendedConfiguration` | Extended PostgreSQL read only replicas configuration (appended to main or default configuration) | `""` | +| `readReplicas.extraEnvVars` | Array with extra environment variables to add to PostgreSQL read only nodes | `[]` | +| `readReplicas.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for PostgreSQL read only nodes | `""` | +| `readReplicas.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for PostgreSQL read only nodes | `""` | +| `readReplicas.command` | Override default container command (useful when using custom images) | `[]` | +| `readReplicas.args` | Override default container args (useful when using custom images) | `[]` | +| `readReplicas.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL read only containers | `true` | +| `readReplicas.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `30` | +| `readReplicas.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `readReplicas.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `readReplicas.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `readReplicas.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readReplicas.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL read only containers | `true` | +| `readReplicas.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `readReplicas.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readReplicas.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `readReplicas.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `readReplicas.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `readReplicas.startupProbe.enabled` | Enable startupProbe on PostgreSQL read only containers | `false` | +| `readReplicas.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `30` | +| `readReplicas.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `readReplicas.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `readReplicas.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `readReplicas.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `readReplicas.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `readReplicas.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `readReplicas.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `readReplicas.lifecycleHooks` | for the PostgreSQL read only container to automate configuration before or after startup | `{}` | +| `readReplicas.resources.limits` | The resources limits for the PostgreSQL read only containers | `{}` | +| `readReplicas.resources.requests.memory` | The requested memory for the PostgreSQL read only containers | `256Mi` | +| `readReplicas.resources.requests.cpu` | The requested cpu for the PostgreSQL read only containers | `250m` | +| `readReplicas.podSecurityContext.enabled` | Enable security context | `true` | +| `readReplicas.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `readReplicas.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `readReplicas.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `readReplicas.podSecurityContext.fsGroup` | Group ID for the pod | `1001` | +| `readReplicas.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `readReplicas.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `readReplicas.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `readReplicas.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `readReplicas.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `readReplicas.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` | +| `readReplicas.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `readReplicas.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `readReplicas.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `readReplicas.automountServiceAccountToken` | Mount Service Account token in pod | `false` | +| `readReplicas.hostAliases` | PostgreSQL read only pods host aliases | `[]` | +| `readReplicas.hostNetwork` | Specify if host network should be enabled for PostgreSQL pod (PostgreSQL read only) | `false` | +| `readReplicas.hostIPC` | Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) | `false` | +| `readReplicas.labels` | Map of labels to add to the statefulset (PostgreSQL read only) | `{}` | +| `readReplicas.annotations` | Annotations for PostgreSQL read only pods | `{}` | +| `readReplicas.podLabels` | Map of labels to add to the pods (PostgreSQL read only) | `{}` | +| `readReplicas.podAnnotations` | Map of annotations to add to the pods (PostgreSQL read only) | `{}` | +| `readReplicas.podAffinityPreset` | PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `readReplicas.podAntiAffinityPreset` | PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `readReplicas.nodeAffinityPreset.type` | PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `readReplicas.nodeAffinityPreset.key` | PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. | `""` | +| `readReplicas.nodeAffinityPreset.values` | PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. | `[]` | +| `readReplicas.affinity` | Affinity for PostgreSQL read only pods assignment | `{}` | +| `readReplicas.nodeSelector` | Node labels for PostgreSQL read only pods assignment | `{}` | +| `readReplicas.tolerations` | Tolerations for PostgreSQL read only pods assignment | `[]` | +| `readReplicas.topologySpreadConstraints` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template | `[]` | +| `readReplicas.priorityClassName` | Priority Class to use for each pod (PostgreSQL read only) | `""` | +| `readReplicas.schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | +| `readReplicas.terminationGracePeriodSeconds` | Seconds PostgreSQL read only pod needs to terminate gracefully | `""` | +| `readReplicas.updateStrategy.type` | PostgreSQL read only statefulset strategy type | `RollingUpdate` | +| `readReplicas.updateStrategy.rollingUpdate` | PostgreSQL read only statefulset rolling update configuration parameters | `{}` | +| `readReplicas.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the PostgreSQL read only container(s) | `[]` | +| `readReplicas.extraVolumes` | Optionally specify extra list of additional volumes for the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.sidecars` | Add additional sidecar containers to the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.initContainers` | Add additional init containers to the PostgreSQL read only pod(s) | `[]` | +| `readReplicas.extraPodSpec` | Optionally specify extra PodSpec for the PostgreSQL read only pod(s) | `{}` | +| `readReplicas.service.type` | Kubernetes Service type | `ClusterIP` | +| `readReplicas.service.ports.postgresql` | PostgreSQL service port | `5432` | +| `readReplicas.service.nodePorts.postgresql` | Node port for PostgreSQL | `""` | +| `readReplicas.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `readReplicas.service.annotations` | Annotations for PostgreSQL read only service | `{}` | +| `readReplicas.service.loadBalancerIP` | Load balancer IP if service type is `LoadBalancer` | `""` | +| `readReplicas.service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `readReplicas.service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` | +| `readReplicas.service.extraPorts` | Extra ports to expose in the PostgreSQL read only service | `[]` | +| `readReplicas.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` | +| `readReplicas.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` | +| `readReplicas.service.headless.annotations` | Additional custom annotations for headless PostgreSQL read only service | `{}` | +| `readReplicas.persistence.enabled` | Enable PostgreSQL read only data persistence using PVC | `true` | +| `readReplicas.persistence.existingClaim` | Name of an existing PVC to use | `""` | +| `readReplicas.persistence.mountPath` | The path the volume will be mounted at | `/bitnami/postgresql` | +| `readReplicas.persistence.subPath` | The subdirectory of the volume to mount to | `""` | +| `readReplicas.persistence.storageClass` | PVC Storage Class for PostgreSQL read only data volume | `""` | +| `readReplicas.persistence.accessModes` | PVC Access Mode for PostgreSQL volume | `["ReadWriteOnce"]` | +| `readReplicas.persistence.size` | PVC Storage Request for PostgreSQL volume | `8Gi` | +| `readReplicas.persistence.annotations` | Annotations for the PVC | `{}` | +| `readReplicas.persistence.labels` | Labels for the PVC | `{}` | +| `readReplicas.persistence.selector` | Selector to match an existing Persistent Volume (this value is evaluated as a template) | `{}` | +| `readReplicas.persistence.dataSource` | Custom PVC data source | `{}` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.enabled` | Enable Persistent volume retention policy for read only Statefulset | `false` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled` | Volume retention behavior when the replica count of the StatefulSet is reduced | `Retain` | +| `readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted` | Volume retention behavior that applies when the StatefulSet is deleted | `Retain` | + +### Backup parameters + +| Name | Description | Value | +| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| `backup.enabled` | Enable the logical dump of the database "regularly" | `false` | +| `backup.cronjob.schedule` | Set the cronjob parameter schedule | `@daily` | +| `backup.cronjob.timeZone` | Set the cronjob parameter timeZone | `""` | +| `backup.cronjob.concurrencyPolicy` | Set the cronjob parameter concurrencyPolicy | `Allow` | +| `backup.cronjob.failedJobsHistoryLimit` | Set the cronjob parameter failedJobsHistoryLimit | `1` | +| `backup.cronjob.successfulJobsHistoryLimit` | Set the cronjob parameter successfulJobsHistoryLimit | `3` | +| `backup.cronjob.startingDeadlineSeconds` | Set the cronjob parameter startingDeadlineSeconds | `""` | +| `backup.cronjob.ttlSecondsAfterFinished` | Set the cronjob parameter ttlSecondsAfterFinished | `""` | +| `backup.cronjob.restartPolicy` | Set the cronjob parameter restartPolicy | `OnFailure` | +| `backup.cronjob.podSecurityContext.enabled` | Enable PodSecurityContext for CronJob/Backup | `true` | +| `backup.cronjob.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` | +| `backup.cronjob.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` | +| `backup.cronjob.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | +| `backup.cronjob.podSecurityContext.fsGroup` | Group ID for the CronJob | `1001` | +| `backup.cronjob.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `backup.cronjob.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `backup.cronjob.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `backup.cronjob.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `backup.cronjob.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `backup.cronjob.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` | +| `backup.cronjob.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `backup.cronjob.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `backup.cronjob.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `backup.cronjob.command` | Set backup container's command to run | `["/bin/sh","-c","pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file=${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump"]` | +| `backup.cronjob.labels` | Set the cronjob labels | `{}` | +| `backup.cronjob.annotations` | Set the cronjob annotations | `{}` | +| `backup.cronjob.nodeSelector` | Node labels for PostgreSQL backup CronJob pod assignment | `{}` | +| `backup.cronjob.storage.existingClaim` | Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) | `""` | +| `backup.cronjob.storage.resourcePolicy` | Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `""` | +| `backup.cronjob.storage.storageClass` | PVC Storage Class for the backup data volume | `""` | +| `backup.cronjob.storage.accessModes` | PV Access Mode | `["ReadWriteOnce"]` | +| `backup.cronjob.storage.size` | PVC Storage Request for the backup data volume | `8Gi` | +| `backup.cronjob.storage.annotations` | PVC annotations | `{}` | +| `backup.cronjob.storage.mountPath` | Path to mount the volume at | `/backup/pgdump` | +| `backup.cronjob.storage.subPath` | Subdirectory of the volume to mount at | `""` | +| `backup.cronjob.storage.volumeClaimTemplates.selector` | A label query over volumes to consider for binding (e.g. when using local volumes) | `{}` | + +### NetworkPolicy parameters + +| Name | Description | Value | +| ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `networkPolicy.enabled` | Enable network policies | `false` | +| `networkPolicy.metrics.enabled` | Enable network policies for metrics (prometheus) | `false` | +| `networkPolicy.metrics.namespaceSelector` | Monitoring namespace selector labels. These labels will be used to identify the prometheus' namespace. | `{}` | +| `networkPolicy.metrics.podSelector` | Monitoring pod selector labels. These labels will be used to identify the Prometheus pods. | `{}` | +| `networkPolicy.ingressRules.primaryAccessOnlyFrom.enabled` | Enable ingress rule that makes PostgreSQL primary node only accessible from a particular origin. | `false` | +| `networkPolicy.ingressRules.primaryAccessOnlyFrom.namespaceSelector` | Namespace selector label that is allowed to access the PostgreSQL primary node. This label will be used to identified the allowed namespace(s). | `{}` | +| `networkPolicy.ingressRules.primaryAccessOnlyFrom.podSelector` | Pods selector label that is allowed to access the PostgreSQL primary node. This label will be used to identified the allowed pod(s). | `{}` | +| `networkPolicy.ingressRules.primaryAccessOnlyFrom.customRules` | Custom network policy for the PostgreSQL primary node. | `[]` | +| `networkPolicy.ingressRules.readReplicasAccessOnlyFrom.enabled` | Enable ingress rule that makes PostgreSQL read-only nodes only accessible from a particular origin. | `false` | +| `networkPolicy.ingressRules.readReplicasAccessOnlyFrom.namespaceSelector` | Namespace selector label that is allowed to access the PostgreSQL read-only nodes. This label will be used to identified the allowed namespace(s). | `{}` | +| `networkPolicy.ingressRules.readReplicasAccessOnlyFrom.podSelector` | Pods selector label that is allowed to access the PostgreSQL read-only nodes. This label will be used to identified the allowed pod(s). | `{}` | +| `networkPolicy.ingressRules.readReplicasAccessOnlyFrom.customRules` | Custom network policy for the PostgreSQL read-only nodes. | `[]` | +| `networkPolicy.egressRules.denyConnectionsToExternal` | Enable egress rule that denies outgoing traffic outside the cluster, except for DNS (port 53). | `false` | +| `networkPolicy.egressRules.customRules` | Custom network policy rule | `[]` | + +### Volume Permissions parameters + +| Name | Description | Value | +| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------- | +| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `REGISTRY_NAME` | +| `volumePermissions.image.repository` | Init container volume-permissions image repository | `REPOSITORY_NAME/os-shell` | +| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | +| `volumePermissions.image.pullSecrets` | Init container volume-permissions image pull secrets | `[]` | +| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` | +| `volumePermissions.resources.requests` | Init container volume-permissions resource requests | `{}` | +| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | User ID for the init container | `0` | +| `volumePermissions.containerSecurityContext.runAsGroup` | Group ID for the init container | `0` | +| `volumePermissions.containerSecurityContext.runAsNonRoot` | runAsNonRoot for the init container | `false` | +| `volumePermissions.containerSecurityContext.seccompProfile.type` | seccompProfile.type for the init container | `RuntimeDefault` | + +### Other Parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `serviceBindings.enabled` | Create secret for service binding (Experimental) | `false` | +| `serviceAccount.create` | Enable creation of ServiceAccount for PostgreSQL pod | `true` | +| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` | +| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | +| `rbac.create` | Create Role and RoleBinding (required for PSP to work) | `false` | +| `rbac.rules` | Custom RBAC rules to set | `[]` | +| `psp.create` | Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later | `false` | + +### Metrics Parameters + +| Name | Description | Value | +| ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ----------------------------------- | +| `metrics.enabled` | Start a prometheus exporter | `false` | +| `metrics.image.registry` | PostgreSQL Prometheus Exporter image registry | `REGISTRY_NAME` | +| `metrics.image.repository` | PostgreSQL Prometheus Exporter image repository | `REPOSITORY_NAME/postgres-exporter` | +| `metrics.image.digest` | PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `metrics.image.pullPolicy` | PostgreSQL Prometheus Exporter image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify image pull secrets | `[]` | +| `metrics.collectors` | Control enabled collectors | `{}` | +| `metrics.customMetrics` | Define additional custom metrics | `{}` | +| `metrics.extraEnvVars` | Extra environment variables to add to PostgreSQL Prometheus exporter | `[]` | +| `metrics.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `metrics.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `metrics.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `metrics.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `metrics.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `metrics.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` | +| `metrics.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `metrics.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `metrics.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `metrics.livenessProbe.enabled` | Enable livenessProbe on PostgreSQL Prometheus exporter containers | `true` | +| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` | +| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `metrics.readinessProbe.enabled` | Enable readinessProbe on PostgreSQL Prometheus exporter containers | `true` | +| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `5` | +| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `6` | +| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `metrics.startupProbe.enabled` | Enable startupProbe on PostgreSQL Prometheus exporter containers | `false` | +| `metrics.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `metrics.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `metrics.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `metrics.startupProbe.failureThreshold` | Failure threshold for startupProbe | `15` | +| `metrics.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `metrics.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `metrics.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `metrics.customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `metrics.containerPorts.metrics` | PostgreSQL Prometheus exporter metrics container port | `9187` | +| `metrics.resources.limits` | The resources limits for the PostgreSQL Prometheus exporter container | `{}` | +| `metrics.resources.requests` | The requested resources for the PostgreSQL Prometheus exporter container | `{}` | +| `metrics.service.ports.metrics` | PostgreSQL Prometheus Exporter service port | `9187` | +| `metrics.service.clusterIP` | Static clusterIP or None for headless services | `""` | +| `metrics.service.sessionAffinity` | Control where client requests go, to the same pod or round-robin | `None` | +| `metrics.service.annotations` | Annotations for Prometheus to auto-discover the metrics endpoint | `{}` | +| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using Prometheus Operator | `false` | +| `metrics.serviceMonitor.namespace` | Namespace for the ServiceMonitor Resource (defaults to the Release Namespace) | `""` | +| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` | +| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `metrics.serviceMonitor.labels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | +| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | +| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` | +| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` | +| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | +| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in prometheus. | `""` | +| `metrics.prometheusRule.enabled` | Create a PrometheusRule for Prometheus Operator | `false` | +| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource (defaults to the Release Namespace) | `""` | +| `metrics.prometheusRule.labels` | Additional labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` | +| `metrics.prometheusRule.rules` | PrometheusRule definitions | `[]` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +helm install my-release \ + --set auth.postgresPassword=secretpassword + oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. + +The above command sets the PostgreSQL `postgres` account password to `secretpassword`. + +> NOTE: Once this chart is deployed, it is not possible to change the application's access credentials, such as usernames or passwords, using Helm. To change these application credentials after deployment, delete any persistent volumes (PVs) used by the chart and re-deploy it, or use the application's built-in administrative tools if available. +> **Warning** Setting a password will be ignored on new installation in case when previous PostgreSQL release was deleted through the helm command. In that case, old PVC will have an old password, and setting it through helm won't take effect. Deleting persistent volumes (PVs) will solve the issue. Refer to [issue 2061](https://github.com/bitnami/charts/issues/2061) for more details + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```console +helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/postgresql +``` + +> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`. +> **Tip**: You can use the default [values.yaml](https://github.com/bitnami/charts/tree/main/bitnami/postgresql/values.yaml) + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/tutorials/understand-rolling-tags-containers) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Customizing primary and read replica services in a replicated configuration + +At the top level, there is a service object which defines the services for both primary and readReplicas. For deeper customization, there are service objects for both the primary and read types individually. This allows you to override the values in the top level service object so that the primary and read can be of different service types and with different clusterIPs / nodePorts. Also in the case you want the primary and read to be of type nodePort, you will need to set the nodePorts to different values to prevent a collision. The values that are deeper in the primary.service or readReplicas.service objects will take precedence over the top level service object. + +### Use a different PostgreSQL version + +To modify the application version used in this chart, specify a different version of the image using the `image.tag` parameter and/or a different repository using the `image.repository` parameter. Refer to the [chart documentation for more information on these parameters and how to use them with images from a private registry](https://docs.bitnami.com/kubernetes/infrastructure/postgresql/configuration/change-image-version/). + +### postgresql.conf / pg_hba.conf files as configMap + +This helm chart also supports to customize the PostgreSQL configuration file. You can add additional PostgreSQL configuration parameters using the `primary.extendedConfiguration`/`readReplicas.extendedConfiguration` parameters as a string. Alternatively, to replace the entire default configuration use `primary.configuration`. + +You can also add a custom pg_hba.conf using the `primary.pgHbaConfiguration` parameter. + +In addition to these options, you can also set an external ConfigMap with all the configuration files. This is done by setting the `primary.existingConfigmap` parameter. Note that this will override the two previous options. + +### Initialize a fresh instance + +The [Bitnami PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, you can specify custom scripts using the `primary.initdb.scripts` parameter as a string. + +In addition, you can also set an external ConfigMap with all the initialization scripts. This is done by setting the `primary.initdb.scriptsConfigMap` parameter. Note that this will override the two previous options. If your initialization scripts contain sensitive information such as credentials or passwords, you can use the `primary.initdb.scriptsSecret` parameter. + +The allowed extensions are `.sh`, `.sql` and `.sql.gz`. + +### Securing traffic using TLS + +TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the chart: + +- `tls.enabled`: Enable TLS support. Defaults to `false` +- `tls.certificatesSecret`: Name of an existing secret that contains the certificates. No defaults. +- `tls.certFilename`: Certificate filename. No defaults. +- `tls.certKeyFilename`: Certificate key filename. No defaults. + +For example: + +- First, create the secret with the cetificates files: + + ```console + kubectl create secret generic certificates-tls-secret --from-file=./cert.crt --from-file=./cert.key --from-file=./ca.crt + ``` + +- Then, use the following parameters: + + ```console + volumePermissions.enabled=true + tls.enabled=true + tls.certificatesSecret="certificates-tls-secret" + tls.certFilename="cert.crt" + tls.certKeyFilename="cert.key" + ``` + + > Note TLS and VolumePermissions: PostgreSQL requires certain permissions on sensitive files (such as certificate keys) to start up. Due to an on-going [issue](https://github.com/kubernetes/kubernetes/issues/57923) regarding kubernetes permissions and the use of `containerSecurityContext.runAsUser`, you must enable `volumePermissions` to ensure everything works as expected. + +### Sidecars + +If you need additional containers to run within the same pod as PostgreSQL (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +# For the PostgreSQL primary +primary: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +# For the PostgreSQL replicas +readReplicas: + sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Metrics + +The chart optionally can start a metrics exporter for [prometheus](https://prometheus.io). The metrics endpoint (port 9187) is not exposed and it is expected that the metrics are collected from inside the k8s cluster using something similar as the described in the [example Prometheus scrape configuration](https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml). + +The exporter allows to create custom metrics from additional SQL queries. See the Chart's `values.yaml` for an example and consult the [exporters documentation](https://github.com/wrouesnel/postgres_exporter#adding-new-metrics-via-a-config-file) for more details. + +### Use of global variables + +In more complex scenarios, we may have the following tree of dependencies + +```text + +--------------+ + | | + +------------+ Chart 1 +-----------+ + | | | | + | --------+------+ | + | | | + | | | + | | | + | | | + v v v ++-------+------+ +--------+------+ +--------+------+ +| | | | | | +| PostgreSQL | | Sub-chart 1 | | Sub-chart 2 | +| | | | | | ++--------------+ +---------------+ +---------------+ +``` + +The three charts below depend on the parent chart Chart 1. However, subcharts 1 and 2 may need to connect to PostgreSQL as well. In order to do so, subcharts 1 and 2 need to know the PostgreSQL credentials, so one option for deploying could be deploy Chart 1 with the following parameters: + +```text +postgresql.auth.username=testuser +subchart1.postgresql.auth.username=testuser +subchart2.postgresql.auth.username=testuser +postgresql.auth.password=testpass +subchart1.postgresql.auth.password=testpass +subchart2.postgresql.auth.password=testpass +postgresql.auth.database=testdb +subchart1.postgresql.auth.database=testdb +subchart2.postgresql.auth.database=testdb +``` + +If the number of dependent sub-charts increases, installing the chart with parameters can become increasingly difficult. An alternative would be to set the credentials using global variables as follows: + +```text +global.postgresql.auth.username=testuser +global.postgresql.auth.password=testpass +global.postgresql.auth.database=testdb +``` + +This way, the credentials will be available in all of the subcharts. + +## Persistence + +The [Bitnami PostgreSQL](https://github.com/bitnami/containers/tree/main/bitnami/postgresql) image stores the PostgreSQL data and configurations at the `/bitnami/postgresql` path of the container. + +Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. +See the [Parameters](#parameters) section to configure the PVC or to disable persistence. + +If you already have data in it, you will fail to sync to standby nodes for all commits, details can refer to the [code present in the container repository](https://github.com/bitnami/containers/tree/main/bitnami/postgresql). If you need to use those data, please covert them to sql and import after `helm install` finished. + +## NetworkPolicy + +To enable network policy for PostgreSQL, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), and set `networkPolicy.enabled` to `true`. + +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: + +```console +kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" +``` + +With NetworkPolicy enabled, traffic will be limited to just port 5432. + +For more precise policy, set `networkPolicy.allowExternal=false`. This will only allow pods with the generated client label to connect to PostgreSQL. +This label will be displayed in the output of a successful install. + +## Differences between Bitnami PostgreSQL image and [Docker Official](https://hub.docker.com/_/postgres) image + +- The Docker Official PostgreSQL image does not support replication. If you pass any replication environment variable, this would be ignored. The only environment variables supported by the Docker Official image are POSTGRES_USER, POSTGRES_DB, POSTGRES_PASSWORD, POSTGRES_INITDB_ARGS, POSTGRES_INITDB_WALDIR and PGDATA. All the remaining environment variables are specific to the Bitnami PostgreSQL image. +- The Bitnami PostgreSQL image is non-root by default. This requires that you run the pod with `securityContext` and updates the permissions of the volume with an `initContainer`. A key benefit of this configuration is that the pod follows security best practices and is prepared to run on Kubernetes distributions with hard security constraints like OpenShift. +- For OpenShift up to 4.10, let set the volume permissions, security context, runAsUser and fsGroup automatically by OpenShift and disable the predefined settings of the helm chart: primary.securityContext.enabled=false,primary.containerSecurityContext.enabled=false,volumePermissions.enabled=false,shmVolume.enabled=false +- For OpenShift 4.11 and higher, let set OpenShift the runAsUser and fsGroup automatically. Configure the pod and container security context to restrictive defaults and disable the volume permissions setup: primary. + podSecurityContext.fsGroup=null,primary.podSecurityContext.seccompProfile.type=RuntimeDefault,primary.containerSecurityContext.runAsUser=null,primary.containerSecurityContext.allowPrivilegeEscalation=false,primary.containerSecurityContext.runAsNonRoot=true,primary.containerSecurityContext.seccompProfile.type=RuntimeDefault,primary.containerSecurityContext.capabilities.drop=['ALL'],volumePermissions.enabled=false,shmVolume.enabled=false + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `XXX.affinity` parameter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 13.0.0 + +This major version changes the default PostgreSQL image from 15.x to 16.x. Follow the [official instructions](https://www.postgresql.org/docs/16/upgrading.html) to upgrade to 16.x. + +### To 12.0.0 + +This major version changes the default PostgreSQL image from 14.x to 15.x. Follow the [official instructions](https://www.postgresql.org/docs/15/upgrading.html) to upgrade to 15.x. + +### To any previous version + +Refer to the [chart documentation for more information about how to upgrade from previous releases](https://docs.bitnami.com/kubernetes/infrastructure/postgresql/administration/upgrade/). + +## License + +Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. \ No newline at end of file diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/.helmignore b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/.helmignore new file mode 100644 index 0000000..50af031 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/Chart.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/Chart.yaml new file mode 100644 index 0000000..9a6aa88 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + category: Infrastructure + licenses: Apache-2.0 +apiVersion: v2 +appVersion: 2.14.1 +description: A Library Helm Chart for grouping common logic between bitnami charts. + This chart is not deployable by itself. +home: https://bitnami.com +icon: https://bitnami.com/downloads/logos/bitnami-mark.png +keywords: +- common +- helper +- template +- function +- bitnami +maintainers: +- name: VMware, Inc. + url: https://github.com/bitnami/charts +name: common +sources: +- https://github.com/bitnami/charts +type: library +version: 2.14.1 diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/README.md b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/README.md new file mode 100644 index 0000000..a76fa46 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/README.md @@ -0,0 +1,235 @@ +# Bitnami Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between Bitnami charts. + +## TL;DR + +```yaml +dependencies: + - name: common + version: 2.x.x + repository: oci://registry-1.docker.io/bitnamicharts +``` + +```console +helm dependency update +``` + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }} +data: + myvalue: "Hello World" +``` + +Looking to use our applications in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the enterprise edition of Bitnami Application Catalog. + +## Introduction + +This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.23+ +- Helm 3.8.0+ + +## Parameters + +## Special input schemas + +### ImageRoot + +```yaml +registry: + type: string + description: Docker registry where the image is located + example: docker.io + +repository: + type: string + description: Repository and image name + example: bitnami/nginx + +tag: + type: string + description: image tag + example: 1.16.1-debian-10-r63 + +pullPolicy: + type: string + description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + +pullSecrets: + type: array + items: + type: string + description: Optionally specify an array of imagePullSecrets (evaluated as templates). + +debug: + type: boolean + description: Set to true if you would like to see extra information on logs + example: false + +## An instance would be: +# registry: docker.io +# repository: bitnami/nginx +# tag: 1.16.1-debian-10-r63 +# pullPolicy: IfNotPresent +# debug: false +``` + +### Persistence + +```yaml +enabled: + type: boolean + description: Whether enable persistence. + example: true + +storageClass: + type: string + description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. + example: "-" + +accessMode: + type: string + description: Access mode for the Persistent Volume Storage. + example: ReadWriteOnce + +size: + type: string + description: Size the Persistent Volume Storage. + example: 8Gi + +path: + type: string + description: Path to be persisted. + example: /bitnami + +## An instance would be: +# enabled: true +# storageClass: "-" +# accessMode: ReadWriteOnce +# size: 8Gi +# path: /bitnami +``` + +### ExistingSecret + +```yaml +name: + type: string + description: Name of the existing secret. + example: mySecret +keyMapping: + description: Mapping between the expected key name and the name of the key in the existing secret. + type: object + +## An instance would be: +# name: mySecret +# keyMapping: +# password: myPasswordKey +``` + +#### Example of use + +When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. + +```yaml +# templates/secret.yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + labels: + app: {{ include "common.names.fullname" . }} +type: Opaque +data: + password: {{ .Values.password | b64enc | quote }} + +# templates/dpl.yaml +--- +... + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} + key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} +... + +# values.yaml +--- +name: mySecret +keyMapping: + password: myPasswordKey +``` + +### ValidateValue + +#### NOTES.txt + +```console +{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} + +{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} +``` + +If we force those values to be empty we will see some alerts + +```console +helm install test mychart --set path.to.value00="",path.to.value01="" + 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: + + export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d) + + 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: + + export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d) +``` + +## Upgrading + +### To 1.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +#### What changes were introduced in this major version? + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +#### Considerations when upgrading to this version + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +#### Useful links + +- +- +- + +## License + +Copyright © 2023 VMware, Inc. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_affinities.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_affinities.tpl new file mode 100644 index 0000000..e85b1df --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_affinities.tpl @@ -0,0 +1,139 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a soft nodeAffinity definition +{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.soft" -}} +preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} + weight: 1 +{{- end -}} + +{{/* +Return a hard nodeAffinity definition +{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.hard" -}} +requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} +{{- end -}} + +{{/* +Return a nodeAffinity definition +{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.nodes.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.nodes.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a topologyKey definition +{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}} +*/}} +{{- define "common.affinities.topologyKey" -}} +{{ .topologyKey | default "kubernetes.io/hostname" -}} +{{- end -}} + +{{/* +Return a soft podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}} +*/}} +{{- define "common.affinities.pods.soft" -}} +{{- $component := default "" .component -}} +{{- $customLabels := default (dict) .customLabels -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}} +preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + weight: 1 + {{- range $extraPodAffinityTerms }} + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := .extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + weight: {{ .weight | default 1 -}} + {{- end -}} +{{- end -}} + +{{/* +Return a hard podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}} +*/}} +{{- define "common.affinities.pods.hard" -}} +{{- $component := default "" .component -}} +{{- $customLabels := default (dict) .customLabels -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}} +requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + {{- range $extraPodAffinityTerms }} + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := .extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }} + {{- end -}} +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.pods" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.pods.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_capabilities.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_capabilities.tpl new file mode 100644 index 0000000..115674a --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_capabilities.tpl @@ -0,0 +1,229 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "common.capabilities.kubeVersion" -}} +{{- if .Values.global }} + {{- if .Values.global.kubeVersion }} + {{- .Values.global.kubeVersion -}} + {{- else }} + {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} + {{- end -}} +{{- else }} +{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for poddisruptionbudget. +*/}} +{{- define "common.capabilities.policy.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "common.capabilities.networkPolicy.apiVersion" -}} +{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for cronjob. +*/}} +{{- define "common.capabilities.cronjob.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for daemonset. +*/}} +{{- define "common.capabilities.daemonset.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "common.capabilities.deployment.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "common.capabilities.statefulset.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apps/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "common.capabilities.ingress.apiVersion" -}} +{{- if .Values.ingress -}} +{{- if .Values.ingress.apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for RBAC resources. +*/}} +{{- define "common.capabilities.rbac.apiVersion" -}} +{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "rbac.authorization.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "rbac.authorization.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for CRDs. +*/}} +{{- define "common.capabilities.crd.apiVersion" -}} +{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiextensions.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiextensions.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for APIService. +*/}} +{{- define "common.capabilities.apiService.apiVersion" -}} +{{- if semverCompare "<1.10-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiregistration.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiregistration.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for Horizontal Pod Autoscaler. +*/}} +{{- define "common.capabilities.hpa.apiVersion" -}} +{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}} +{{- if .beta2 -}} +{{- print "autoscaling/v2beta2" -}} +{{- else -}} +{{- print "autoscaling/v2beta1" -}} +{{- end -}} +{{- else -}} +{{- print "autoscaling/v2" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for Vertical Pod Autoscaler. +*/}} +{{- define "common.capabilities.vpa.apiVersion" -}} +{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}} +{{- if .beta2 -}} +{{- print "autoscaling/v2beta2" -}} +{{- else -}} +{{- print "autoscaling/v2beta1" -}} +{{- end -}} +{{- else -}} +{{- print "autoscaling/v2" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if PodSecurityPolicy is supported +*/}} +{{- define "common.capabilities.psp.supported" -}} +{{- if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if AdmissionConfiguration is supported +*/}} +{{- define "common.capabilities.admissionConfiguration.supported" -}} +{{- if semverCompare ">=1.23-0" (include "common.capabilities.kubeVersion" .) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for AdmissionConfiguration. +*/}} +{{- define "common.capabilities.admissionConfiguration.apiVersion" -}} +{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiserver.config.k8s.io/v1alpha1" -}} +{{- else if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiserver.config.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiserver.config.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for PodSecurityConfiguration. +*/}} +{{- define "common.capabilities.podSecurityConfiguration.apiVersion" -}} +{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "pod-security.admission.config.k8s.io/v1alpha1" -}} +{{- else if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "pod-security.admission.config.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "pod-security.admission.config.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the used Helm version is 3.3+. +A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. +This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. +**To be removed when the catalog's minimun Helm version is 3.3** +*/}} +{{- define "common.capabilities.supportsHelmVersion" -}} +{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_errors.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_errors.tpl new file mode 100644 index 0000000..07ded6f --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_errors.tpl @@ -0,0 +1,28 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Through error when upgrading using empty passwords values that must not be empty. + +Usage: +{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} +{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} +{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} + +Required password params: + - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. + - context - Context - Required. Parent context. +*/}} +{{- define "common.errors.upgrade.passwords.empty" -}} + {{- $validationErrors := join "" .validationErrors -}} + {{- if and $validationErrors .context.Release.IsUpgrade -}} + {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} + {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} + {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} + {{- $errorString = print $errorString "\n%s" -}} + {{- printf $errorString $validationErrors | fail -}} + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_images.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_images.tpl new file mode 100644 index 0000000..1bcb779 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_images.tpl @@ -0,0 +1,117 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper image name +{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" .Values.global ) }} +*/}} +{{- define "common.images.image" -}} +{{- $registryName := .imageRoot.registry -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- $separator := ":" -}} +{{- $termination := .imageRoot.tag | toString -}} +{{- if .global }} + {{- if .global.imageRegistry }} + {{- $registryName = .global.imageRegistry -}} + {{- end -}} +{{- end -}} +{{- if .imageRoot.digest }} + {{- $separator = "@" -}} + {{- $termination = .imageRoot.digest | toString -}} +{{- end -}} +{{- if $registryName }} + {{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}} +{{- else -}} + {{- printf "%s%s%s" $repositoryName $separator $termination -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) +{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} +*/}} +{{- define "common.images.pullSecrets" -}} + {{- $pullSecrets := list }} + + {{- if .global }} + {{- range .global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets .name -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end }} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets .name -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets | uniq }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names evaluating values as templates +{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} +*/}} +{{- define "common.images.renderPullSecrets" -}} + {{- $pullSecrets := list }} + {{- $context := .context }} + + {{- if $context.Values.global }} + {{- range $context.Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets | uniq }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper image version (ingores image revision/prerelease info & fallbacks to chart appVersion) +{{ include "common.images.version" ( dict "imageRoot" .Values.path.to.the.image "chart" .Chart ) }} +*/}} +{{- define "common.images.version" -}} +{{- $imageTag := .imageRoot.tag | toString -}} +{{/* regexp from https://github.com/Masterminds/semver/blob/23f51de38a0866c5ef0bfc42b3f735c73107b700/version.go#L41-L44 */}} +{{- if regexMatch `^([0-9]+)(\.[0-9]+)?(\.[0-9]+)?(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?$` $imageTag -}} + {{- $version := semver $imageTag -}} + {{- printf "%d.%d.%d" $version.Major $version.Minor $version.Patch -}} +{{- else -}} + {{- print .chart.AppVersion -}} +{{- end -}} +{{- end -}} + diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_ingress.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_ingress.tpl new file mode 100644 index 0000000..efa5b85 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_ingress.tpl @@ -0,0 +1,73 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Generate backend entry that is compatible with all Kubernetes API versions. + +Usage: +{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.ingress.backend" -}} +{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "common.ingress.supportsPathType" . }} +*/}} +{{- define "common.ingress.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "common.ingress.supportsIngressClassname" . }} +*/}} +{{- define "common.ingress.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if cert-manager required annotations for TLS signed +certificates are set in the Ingress annotations +Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations +Usage: +{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }} +*/}} +{{- define "common.ingress.certManagerRequest" -}} +{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_labels.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_labels.tpl new file mode 100644 index 0000000..d90a6cd --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_labels.tpl @@ -0,0 +1,46 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Kubernetes standard labels +{{ include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) -}} +*/}} +{{- define "common.labels.standard" -}} +{{- if and (hasKey . "customLabels") (hasKey . "context") -}} +{{- $default := dict "app.kubernetes.io/name" (include "common.names.name" .context) "helm.sh/chart" (include "common.names.chart" .context) "app.kubernetes.io/instance" .context.Release.Name "app.kubernetes.io/managed-by" .context.Release.Service -}} +{{- with .context.Chart.AppVersion -}} +{{- $_ := set $default "app.kubernetes.io/version" . -}} +{{- end -}} +{{ template "common.tplvalues.merge" (dict "values" (list .customLabels $default) "context" .context) }} +{{- else -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +helm.sh/chart: {{ include "common.names.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- with .Chart.AppVersion }} +app.kubernetes.io/version: {{ . | quote }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Labels used on immutable fields such as deploy.spec.selector.matchLabels or svc.spec.selector +{{ include "common.labels.matchLabels" (dict "customLabels" .Values.podLabels "context" $) -}} + +We don't want to loop over custom labels appending them to the selector +since it's very likely that it will break deployments, services, etc. +However, it's important to overwrite the standard labels if the user +overwrote them on metadata.labels fields. +*/}} +{{- define "common.labels.matchLabels" -}} +{{- if and (hasKey . "customLabels") (hasKey . "context") -}} +{{ merge (pick (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) "app.kubernetes.io/name" "app.kubernetes.io/instance") (dict "app.kubernetes.io/name" (include "common.names.name" .context) "app.kubernetes.io/instance" .context.Release.Name ) | toYaml }} +{{- else -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_names.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_names.tpl new file mode 100644 index 0000000..a222924 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_names.tpl @@ -0,0 +1,71 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "common.names.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "common.names.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "common.names.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified dependency name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +Usage: +{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }} +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts. +*/}} +{{- define "common.names.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a fully qualified app name adding the installation's namespace. +*/}} +{{- define "common.names.fullname.namespace" -}} +{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_secrets.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_secrets.tpl new file mode 100644 index 0000000..84dbe38 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_secrets.tpl @@ -0,0 +1,182 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Generate secret name. + +Usage: +{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret + - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.secrets.name" -}} +{{- $name := (include "common.names.fullname" .context) -}} + +{{- if .defaultNameSuffix -}} +{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- with .existingSecret -}} +{{- if not (typeIs "string" .) -}} +{{- with .name -}} +{{- $name = . -}} +{{- end -}} +{{- else -}} +{{- $name = . -}} +{{- end -}} +{{- end -}} + +{{- printf "%s" $name -}} +{{- end -}} + +{{/* +Generate secret key. + +Usage: +{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret + - key - String - Required. Name of the key in the secret. +*/}} +{{- define "common.secrets.key" -}} +{{- $key := .key -}} + +{{- if .existingSecret -}} + {{- if not (typeIs "string" .existingSecret) -}} + {{- if .existingSecret.keyMapping -}} + {{- $key = index .existingSecret.keyMapping $.key -}} + {{- end -}} + {{- end }} +{{- end -}} + +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Generate secret password or retrieve one if already created. + +Usage: +{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - length - int - Optional - Length of the generated random password. + - strong - Boolean - Optional - Whether to add symbols to the generated random password. + - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. + - context - Context - Required - Parent context. + - failOnNew - Boolean - Optional - Default to true. If set to false, skip errors adding new keys to existing secrets. + - skipB64enc - Boolean - Optional - Default to false. If set to true, no the secret will not be base64 encrypted. + - skipQuote - Boolean - Optional - Default to false. If set to true, no quotes will be added around the secret. +The order in which this function returns a secret password: + 1. Already existing 'Secret' resource + (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) + 2. Password provided via the values.yaml + (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) + 3. Randomly generated secret password + (A new random secret password with the length specified in the 'length' parameter will be generated and returned) + +*/}} +{{- define "common.secrets.passwords.manage" -}} + +{{- $password := "" }} +{{- $subchart := "" }} +{{- $chartName := default "" .chartName }} +{{- $passwordLength := default 10 .length }} +{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} +{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} +{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }} +{{- if $secretData }} + {{- if hasKey $secretData .key }} + {{- $password = index $secretData .key | b64dec }} + {{- else if not (eq .failOnNew false) }} + {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} + {{- else if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString }} + {{- end -}} +{{- else if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString }} +{{- else }} + + {{- if .context.Values.enabled }} + {{- $subchart = $chartName }} + {{- end -}} + + {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} + {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} + {{- $passwordValidationErrors := list $requiredPasswordError -}} + {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} + + {{- if .strong }} + {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} + {{- $password = randAscii $passwordLength }} + {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} + {{- $password = printf "%s%s" $subStr $password | toString | shuffle }} + {{- else }} + {{- $password = randAlphaNum $passwordLength }} + {{- end }} +{{- end -}} +{{- if not .skipB64enc }} +{{- $password = $password | b64enc }} +{{- end -}} +{{- if .skipQuote -}} +{{- printf "%s" $password -}} +{{- else -}} +{{- printf "%s" $password | quote -}} +{{- end -}} +{{- end -}} + +{{/* +Reuses the value from an existing secret, otherwise sets its value to a default value. + +Usage: +{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - context - Context - Required - Parent context. + +*/}} +{{- define "common.secrets.lookup" -}} +{{- $value := "" -}} +{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}} +{{- if and $secretData (hasKey $secretData .key) -}} + {{- $value = index $secretData .key -}} +{{- else if .defaultValue -}} + {{- $value = .defaultValue | toString | b64enc -}} +{{- end -}} +{{- if $value -}} +{{- printf "%s" $value -}} +{{- end -}} +{{- end -}} + +{{/* +Returns whether a previous generated secret already exists + +Usage: +{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.exists" -}} +{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }} +{{- if $secret }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_storage.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_storage.tpl new file mode 100644 index 0000000..16405a0 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_storage.tpl @@ -0,0 +1,28 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper Storage Class +{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} +*/}} +{{- define "common.storage.class" -}} + +{{- $storageClass := .persistence.storageClass -}} +{{- if .global -}} + {{- if .global.storageClass -}} + {{- $storageClass = .global.storageClass -}} + {{- end -}} +{{- end -}} + +{{- if $storageClass -}} + {{- if (eq "-" $storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" $storageClass -}} + {{- end -}} +{{- end -}} + +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_tplvalues.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_tplvalues.tpl new file mode 100644 index 0000000..a8ed763 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_tplvalues.tpl @@ -0,0 +1,38 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Renders a value that contains template perhaps with scope if the scope is present. +Usage: +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }} +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }} +*/}} +{{- define "common.tplvalues.render" -}} +{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }} +{{- if contains "{{" (toJson .value) }} + {{- if .scope }} + {{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }} + {{- else }} + {{- tpl $value .context }} + {{- end }} +{{- else }} + {{- $value }} +{{- end }} +{{- end -}} + +{{/* +Merge a list of values that contains template after rendering them. +Merge precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge +Usage: +{{ include "common.tplvalues.merge" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }} +*/}} +{{- define "common.tplvalues.merge" -}} +{{- $dst := dict -}} +{{- range .values -}} +{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | merge $dst -}} +{{- end -}} +{{ $dst | toYaml }} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_utils.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_utils.tpl new file mode 100644 index 0000000..bfbddf0 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_utils.tpl @@ -0,0 +1,77 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Print instructions to get a secret value. +Usage: +{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} +*/}} +{{- define "common.utils.secret.getvalue" -}} +{{- $varname := include "common.utils.fieldToEnvVar" . -}} +export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d) +{{- end -}} + +{{/* +Build env var name given a field +Usage: +{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} +*/}} +{{- define "common.utils.fieldToEnvVar" -}} + {{- $fieldNameSplit := splitList "-" .field -}} + {{- $upperCaseFieldNameSplit := list -}} + + {{- range $fieldNameSplit -}} + {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} + {{- end -}} + + {{ join "_" $upperCaseFieldNameSplit }} +{{- end -}} + +{{/* +Gets a value from .Values given +Usage: +{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} +*/}} +{{- define "common.utils.getValueFromKey" -}} +{{- $splitKey := splitList "." .key -}} +{{- $value := "" -}} +{{- $latestObj := $.context.Values -}} +{{- range $splitKey -}} + {{- if not $latestObj -}} + {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} + {{- end -}} + {{- $value = ( index $latestObj . ) -}} + {{- $latestObj = $value -}} +{{- end -}} +{{- printf "%v" (default "" $value) -}} +{{- end -}} + +{{/* +Returns first .Values key with a defined value or first of the list if all non-defined +Usage: +{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} +*/}} +{{- define "common.utils.getKeyFromList" -}} +{{- $key := first .keys -}} +{{- $reverseKeys := reverse .keys }} +{{- range $reverseKeys }} + {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} + {{- if $value -}} + {{- $key = . }} + {{- end -}} +{{- end -}} +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Checksum a template at "path" containing a *single* resource (ConfigMap,Secret) for use in pod annotations, excluding the metadata (see #18376). +Usage: +{{ include "common.utils.checksumTemplate" (dict "path" "/configmap.yaml" "context" $) }} +*/}} +{{- define "common.utils.checksumTemplate" -}} +{{- $obj := include (print .context.Template.BasePath .path) .context | fromYaml -}} +{{ omit $obj "apiVersion" "kind" "metadata" | toYaml | sha256sum }} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_warnings.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_warnings.tpl new file mode 100644 index 0000000..66dffc1 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/_warnings.tpl @@ -0,0 +1,19 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Warning about using rolling tag. +Usage: +{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} +*/}} +{{- define "common.warnings.rollingTag" -}} + +{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} + +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_cassandra.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_cassandra.tpl new file mode 100644 index 0000000..eda9aad --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_cassandra.tpl @@ -0,0 +1,77 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Cassandra required passwords are not empty. + +Usage: +{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.cassandra.passwords" -}} + {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} + {{- $enabled := include "common.cassandra.values.enabled" . -}} + {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} + {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.dbUser.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled cassandra. + +Usage: +{{ include "common.cassandra.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.cassandra.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.cassandra.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key dbUser + +Usage: +{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.key.dbUser" -}} + {{- if .subchart -}} + cassandra.dbUser + {{- else -}} + dbUser + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mariadb.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mariadb.tpl new file mode 100644 index 0000000..17d83a2 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mariadb.tpl @@ -0,0 +1,108 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MariaDB required passwords are not empty. + +Usage: +{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mariadb.passwords" -}} + {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mariadb.values.enabled" . -}} + {{- $architecture := include "common.mariadb.values.architecture" . -}} + {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mariadb. + +Usage: +{{ include "common.mariadb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mariadb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mariadb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.key.auth" -}} + {{- if .subchart -}} + mariadb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mongodb.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mongodb.tpl new file mode 100644 index 0000000..bbb445b --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mongodb.tpl @@ -0,0 +1,113 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MongoDB® required passwords are not empty. + +Usage: +{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mongodb.passwords" -}} + {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mongodb.values.enabled" . -}} + {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} + {{- $architecture := include "common.mongodb.values.architecture" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} + {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} + + {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} + {{- if and $valueUsername $valueDatabase -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replicaset") -}} + {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mongodb. + +Usage: +{{ include "common.mongodb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mongodb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mongodb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.key.auth" -}} + {{- if .subchart -}} + mongodb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mysql.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mysql.tpl new file mode 100644 index 0000000..ca3953f --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_mysql.tpl @@ -0,0 +1,108 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MySQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mysql.passwords" -}} + {{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mysql.values.enabled" . -}} + {{- $architecture := include "common.mysql.values.architecture" . -}} + {{- $authPrefix := include "common.mysql.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mysql.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mysql. + +Usage: +{{ include "common.mysql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mysql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mysql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mysql.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false +*/}} +{{- define "common.mysql.values.key.auth" -}} + {{- if .subchart -}} + mysql.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_postgresql.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_postgresql.tpl new file mode 100644 index 0000000..8c9aa57 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_postgresql.tpl @@ -0,0 +1,134 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate PostgreSQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.postgresql.passwords" -}} + {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} + {{- $enabled := include "common.postgresql.values.enabled" . -}} + {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} + {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} + + {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} + {{- if (eq $enabledReplication "true") -}} + {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to decide whether evaluate global values. + +Usage: +{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} +Params: + - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" +*/}} +{{- define "common.postgresql.values.use.global" -}} + {{- if .context.Values.global -}} + {{- if .context.Values.global.postgresql -}} + {{- index .context.Values.global.postgresql .key | quote -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.existingSecret" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} + + {{- if .subchart -}} + {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} + {{- else -}} + {{- default (.context.Values.existingSecret | quote) $globalValue -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled postgresql. + +Usage: +{{ include "common.postgresql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key postgressPassword. + +Usage: +{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.postgressPassword" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} + + {{- if not $globalValue -}} + {{- if .subchart -}} + postgresql.postgresqlPassword + {{- else -}} + postgresqlPassword + {{- end -}} + {{- else -}} + global.postgresql.postgresqlPassword + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled.replication. + +Usage: +{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.enabled.replication" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.replication.enabled -}} + {{- else -}} + {{- printf "%v" .context.Values.replication.enabled -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key replication.password. + +Usage: +{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.replicationPassword" -}} + {{- if .subchart -}} + postgresql.replication.password + {{- else -}} + replication.password + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_redis.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_redis.tpl new file mode 100644 index 0000000..fc0d208 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_redis.tpl @@ -0,0 +1,81 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Redis® required passwords are not empty. + +Usage: +{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.redis.passwords" -}} + {{- $enabled := include "common.redis.values.enabled" . -}} + {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} + {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} + + {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} + {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} + + {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} + {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} + {{- if eq $useAuth "true" -}} + {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled redis. + +Usage: +{{ include "common.redis.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.redis.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.redis.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right prefix path for the values + +Usage: +{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.redis.values.keys.prefix" -}} + {{- if .subchart -}}redis.{{- else -}}{{- end -}} +{{- end -}} + +{{/* +Checks whether the redis chart's includes the standarizations (version >= 14) + +Usage: +{{ include "common.redis.values.standarized.version" (dict "context" $) }} +*/}} +{{- define "common.redis.values.standarized.version" -}} + + {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} + {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} + + {{- if $standarizedAuthValues -}} + {{- true -}} + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_validations.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_validations.tpl new file mode 100644 index 0000000..31ceda8 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/templates/validations/_validations.tpl @@ -0,0 +1,51 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate values must not be empty. + +Usage: +{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} +{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" +*/}} +{{- define "common.validations.values.multiple.empty" -}} + {{- range .required -}} + {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} + {{- end -}} +{{- end -}} + +{{/* +Validate a value must not be empty. + +Usage: +{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" + - subchart - String - Optional - Name of the subchart that the validated password is part of. +*/}} +{{- define "common.validations.values.single.empty" -}} + {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} + {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} + + {{- if not $value -}} + {{- $varname := "my-value" -}} + {{- $getCurrentValue := "" -}} + {{- if and .secret .field -}} + {{- $varname = include "common.utils.fieldToEnvVar" . -}} + {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} + {{- end -}} + {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} + {{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/values.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/values.yaml new file mode 100644 index 0000000..9abe0e1 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/charts/common/values.yaml @@ -0,0 +1,8 @@ +# Copyright VMware, Inc. +# SPDX-License-Identifier: APACHE-2.0 + +## bitnami/common +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: common-chart diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/NOTES.txt b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/NOTES.txt new file mode 100644 index 0000000..73c4a34 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/NOTES.txt @@ -0,0 +1,115 @@ +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +** Please be patient while the chart is being deployed ** + +{{- if .Values.diagnosticMode.enabled }} +The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: + + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 4 }} + +Get the list of pods by executing: + + kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} + +Access the pod you want to debug by executing + + kubectl exec --namespace {{ .Release.Namespace }} -ti -- /opt/bitnami/scripts/postgresql/entrypoint.sh /bin/bash + +In order to replicate the container startup scripts execute this command: + + /opt/bitnami/scripts/postgresql/entrypoint.sh /opt/bitnami/scripts/postgresql/run.sh + +{{- else }} + +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := include "common.secrets.lookup" (dict "secret" (include "common.names.fullname" .) "key" .Values.auth.secretKeys.adminPasswordKey "defaultValue" (ternary .Values.auth.postgresPassword .Values.auth.password (eq $customUser "postgres")) "context" $) -}} +{{- $authEnabled := and (not (or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret)) (or $postgresPassword .Values.auth.enablePostgresUser (and (not (empty $customUser)) (ne $customUser "postgres"))) }} +{{- if not $authEnabled }} + +WARNING: PostgreSQL has been configured without authentication, this is not recommended for production environments. +{{- end }} + +PostgreSQL can be accessed via port {{ include "postgresql.v1.service.port" . }} on the following DNS names from within your cluster: + + {{ include "postgresql.v1.primary.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - Read/Write connection + +{{- if eq .Values.architecture "replication" }} + + {{ include "postgresql.v1.readReplica.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - Read only connection + +{{- end }} + +{{- if and (not (empty $customUser)) (ne $customUser "postgres") }} +{{- if .Values.auth.enablePostgresUser }} + +To get the password for "postgres" run: + + export POSTGRES_ADMIN_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{include "postgresql.v1.adminPasswordKey" .}}}" | base64 -d) +{{- end }} + +To get the password for "{{ $customUser }}" run: + + export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{include "postgresql.v1.userPasswordKey" .}}}" | base64 -d) +{{- else }} +{{- if .Values.auth.enablePostgresUser }} + +To get the password for "{{ default "postgres" $customUser }}" run: + + export POSTGRES_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "postgresql.v1.secretName" . }} -o jsonpath="{.data.{{ ternary "password" (include "postgresql.v1.adminPasswordKey" .) (and (not (empty $customUser)) (ne $customUser "postgres")) }}}" | base64 -d) +{{- end }} +{{- end }} + +To connect to your database run the following command: + {{- if $authEnabled }} + + kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ .Release.Namespace }} --image {{ include "postgresql.v1.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" \ + --command -- psql --host {{ include "postgresql.v1.primary.fullname" . }} -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- else }} + + kubectl run {{ include "common.names.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ .Release.Namespace }} --image {{ include "postgresql.v1.image" . }} \ + --command -- psql --host {{ include "postgresql.v1.primary.fullname" . }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- end }} + + > NOTE: If you access the container using bash, make sure that you execute "/opt/bitnami/scripts/postgresql/entrypoint.sh /bin/bash" in order to avoid the error "psql: local user with ID {{ .Values.primary.containerSecurityContext.runAsUser }}} does not exist" + +To connect to your database from outside the cluster execute the following commands: + +{{- if contains "NodePort" .Values.primary.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "postgresql.v1.primary.fullname" . }}) + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host $NODE_IP --port $NODE_PORT -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- else }} + psql --host $NODE_IP --port $NODE_PORT -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- end }} +{{- else if contains "LoadBalancer" .Values.primary.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "postgresql.v1.primary.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "postgresql.v1.primary.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}") + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host $SERVICE_IP --port {{ include "postgresql.v1.service.port" . }} -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- else }} + psql --host $SERVICE_IP --port {{ include "postgresql.v1.service.port" . }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} + {{- end }} +{{- else if contains "ClusterIP" .Values.primary.service.type }} + + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "postgresql.v1.primary.fullname" . }} {{ include "postgresql.v1.service.port" . }}:{{ include "postgresql.v1.service.port" . }} & + {{- if $authEnabled }} + PGPASSWORD="$POSTGRES_PASSWORD" psql --host 127.0.0.1 -U {{ default "postgres" $customUser }} -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- else }} + psql --host 127.0.0.1 -d {{- if include "postgresql.v1.database" . }} {{ include "postgresql.v1.database" . }}{{- else }} postgres{{- end }} -p {{ include "postgresql.v1.service.port" . }} + {{- end }} +{{- end }} +{{- end }} + +WARNING: The configured password will be ignored on new installation in case when previous PostgreSQL release was deleted through the helm command. In that case, old PVC will have an old password, and setting it through helm won't take effect. Deleting persistent volumes (PVs) will solve the issue. + +{{- include "postgresql.v1.validateValues" . -}} +{{- include "common.warnings.rollingTag" .Values.image -}} +{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/_helpers.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/_helpers.tpl new file mode 100644 index 0000000..0ab9fd0 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/_helpers.tpl @@ -0,0 +1,406 @@ +{{/* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{/* vim: set filetype=mustache: */}} + +{{/* +Create a default fully qualified app name for PostgreSQL Primary objects +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "postgresql.v1.primary.fullname" -}} +{{- if eq .Values.architecture "replication" -}} + {{- printf "%s-%s" (include "common.names.fullname" .) .Values.primary.name | trunc 63 | trimSuffix "-" -}} +{{- else -}} + {{- include "common.names.fullname" . -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified app name for PostgreSQL read-only replicas objects +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "postgresql.v1.readReplica.fullname" -}} +{{- printf "%s-%s" (include "common.names.fullname" .) .Values.readReplicas.name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the default FQDN for PostgreSQL primary headless service +We truncate at 63 chars because of the DNS naming spec. +*/}} +{{- define "postgresql.v1.primary.svc.headless" -}} +{{- printf "%s-hl" (include "postgresql.v1.primary.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the default FQDN for PostgreSQL read-only replicas headless service +We truncate at 63 chars because of the DNS naming spec. +*/}} +{{- define "postgresql.v1.readReplica.svc.headless" -}} +{{- printf "%s-hl" (include "postgresql.v1.readReplica.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper PostgreSQL image name +*/}} +{{- define "postgresql.v1.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper PostgreSQL metrics image name +*/}} +{{- define "postgresql.v1.metrics.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "postgresql.v1.volumePermissions.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "postgresql.v1.imagePullSecrets" -}} +{{ include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.metrics.image .Values.volumePermissions.image) "context" $) }} +{{- end -}} + +{{/* +Return the name for a custom user to create +*/}} +{{- define "postgresql.v1.username" -}} +{{- if .Values.global.postgresql.auth.username -}} + {{- .Values.global.postgresql.auth.username -}} +{{- else -}} + {{- .Values.auth.username -}} +{{- end -}} +{{- end -}} + +{{/* +Return the name for a custom database to create +*/}} +{{- define "postgresql.v1.database" -}} +{{- if .Values.global.postgresql.auth.database -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.database $) -}} +{{- else if .Values.auth.database -}} + {{- printf "%s" (tpl .Values.auth.database $) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the password secret. +*/}} +{{- define "postgresql.v1.secretName" -}} +{{- if .Values.global.postgresql.auth.existingSecret -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.existingSecret $) -}} +{{- else if .Values.auth.existingSecret -}} + {{- printf "%s" (tpl .Values.auth.existingSecret $) -}} +{{- else -}} + {{- printf "%s" (include "common.names.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the replication-password key. +*/}} +{{- define "postgresql.v1.replicationPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if .Values.global.postgresql.auth.secretKeys.replicationPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.replicationPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.replicationPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.replicationPasswordKey $) -}} + {{- else -}} + {{- "replication-password" -}} + {{- end -}} +{{- else -}} + {{- "replication-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Get the admin-password key. +*/}} +{{- define "postgresql.v1.adminPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if .Values.global.postgresql.auth.secretKeys.adminPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.adminPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.adminPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.adminPasswordKey $) -}} + {{- end -}} +{{- else -}} + {{- "postgres-password" -}} +{{- end -}} +{{- end -}} + +{{/* +Get the user-password key. +*/}} +{{- define "postgresql.v1.userPasswordKey" -}} +{{- if or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret -}} + {{- if or (empty (include "postgresql.v1.username" .)) (eq (include "postgresql.v1.username" .) "postgres") -}} + {{- printf "%s" (include "postgresql.v1.adminPasswordKey" .) -}} + {{- else -}} + {{- if .Values.global.postgresql.auth.secretKeys.userPasswordKey -}} + {{- printf "%s" (tpl .Values.global.postgresql.auth.secretKeys.userPasswordKey $) -}} + {{- else if .Values.auth.secretKeys.userPasswordKey -}} + {{- printf "%s" (tpl .Values.auth.secretKeys.userPasswordKey $) -}} + {{- end -}} + {{- end -}} +{{- else -}} + {{- "password" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a secret object should be created +*/}} +{{- define "postgresql.v1.createSecret" -}} +{{- $customUser := include "postgresql.v1.username" . -}} +{{- $postgresPassword := include "common.secrets.lookup" (dict "secret" (include "common.names.fullname" .) "key" .Values.auth.secretKeys.adminPasswordKey "defaultValue" (ternary (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword .Values.global.postgresql.auth.password .Values.auth.password) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) "context" $) -}} +{{- if and (not (or .Values.global.postgresql.auth.existingSecret .Values.auth.existingSecret)) (or $postgresPassword .Values.auth.enablePostgresUser (and (not (empty $customUser)) (ne $customUser "postgres")) (eq .Values.architecture "replication") (and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw))) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return PostgreSQL service port +*/}} +{{- define "postgresql.v1.service.port" -}} +{{- if .Values.global.postgresql.service.ports.postgresql -}} + {{- .Values.global.postgresql.service.ports.postgresql -}} +{{- else -}} + {{- .Values.primary.service.ports.postgresql -}} +{{- end -}} +{{- end -}} + +{{/* +Return PostgreSQL service port +*/}} +{{- define "postgresql.v1.readReplica.service.port" -}} +{{- if .Values.global.postgresql.service.ports.postgresql -}} + {{- .Values.global.postgresql.service.ports.postgresql -}} +{{- else -}} + {{- .Values.readReplicas.service.ports.postgresql -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL primary configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.primary.configmapName" -}} +{{- if .Values.primary.existingConfigmap -}} + {{- printf "%s" (tpl .Values.primary.existingConfigmap $) -}} +{{- else -}} + {{- printf "%s-configuration" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL primary with the configuration +*/}} +{{- define "postgresql.v1.primary.createConfigmap" -}} +{{- if and (or .Values.primary.configuration .Values.primary.pgHbaConfiguration) (not .Values.primary.existingConfigmap) -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL primary extended configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.primary.extendedConfigmapName" -}} +{{- if .Values.primary.existingExtendedConfigmap -}} + {{- printf "%s" (tpl .Values.primary.existingExtendedConfigmap $) -}} +{{- else -}} + {{- printf "%s-extended-configuration" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Get the PostgreSQL read replica extended configuration ConfigMap name. +*/}} +{{- define "postgresql.v1.readReplicas.extendedConfigmapName" -}} + {{- printf "%s-extended-configuration" (include "postgresql.v1.readReplica.fullname" .) -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL primary with the extended configuration +*/}} +{{- define "postgresql.v1.primary.createExtendedConfigmap" -}} +{{- if and .Values.primary.extendedConfiguration (not .Values.primary.existingExtendedConfigmap) -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap object should be created for PostgreSQL read replica with the extended configuration +*/}} +{{- define "postgresql.v1.readReplicas.createExtendedConfigmap" -}} +{{- if .Values.readReplicas.extendedConfiguration -}} + {{- true -}} +{{- else -}} +{{- end -}} +{{- end -}} + +{{/* + Create the name of the service account to use + */}} +{{- define "postgresql.v1.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return true if a configmap should be mounted with PostgreSQL configuration +*/}} +{{- define "postgresql.v1.mountConfigurationCM" -}} +{{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Get the initialization scripts ConfigMap name. +*/}} +{{- define "postgresql.v1.initdb.scriptsCM" -}} +{{- if .Values.primary.initdb.scriptsConfigMap -}} + {{- printf "%s" (tpl .Values.primary.initdb.scriptsConfigMap $) -}} +{{- else -}} + {{- printf "%s-init-scripts" (include "postgresql.v1.primary.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if TLS is enabled for LDAP connection +*/}} +{{- define "postgresql.v1.ldap.tls.enabled" -}} +{{- if and (kindIs "string" .Values.ldap.tls) (not (empty .Values.ldap.tls)) -}} + {{- true -}} +{{- else if and (kindIs "map" .Values.ldap.tls) .Values.ldap.tls.enabled -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Get the readiness probe command +*/}} +{{- define "postgresql.v1.readinessProbeCommand" -}} +{{- $customUser := include "postgresql.v1.username" . -}} +- | +{{- if (include "postgresql.v1.database" .) }} + exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if .Values.tls.enabled }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} +{{- else }} + exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if .Values.tls.enabled }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} +{{- end }} +{{- if contains "bitnami/" .Values.image.repository }} + [ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ] +{{- end }} +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "postgresql.v1.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "postgresql.v1.validateValues.ldapConfigurationMethod" .) -}} +{{- $messages := append $messages (include "postgresql.v1.validateValues.psp" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* +Validate values of Postgresql - If ldap.url is used then you don't need the other settings for ldap +*/}} +{{- define "postgresql.v1.validateValues.ldapConfigurationMethod" -}} +{{- if and .Values.ldap.enabled (and (not (empty .Values.ldap.url)) (not (empty .Values.ldap.server))) -}} +postgresql: ldap.url, ldap.server + You cannot set both `ldap.url` and `ldap.server` at the same time. + Please provide a unique way to configure LDAP. + More info at https://www.postgresql.org/docs/current/auth-ldap.html +{{- end -}} +{{- end -}} + +{{/* +Validate values of Postgresql - If PSP is enabled RBAC should be enabled too +*/}} +{{- define "postgresql.v1.validateValues.psp" -}} +{{- if and .Values.psp.create (not .Values.rbac.create) -}} +postgresql: psp.create, rbac.create + RBAC should be enabled if PSP is enabled in order for PSP to work. + More info at https://kubernetes.io/docs/concepts/policy/pod-security-policy/#authorizing-policies +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert file. +*/}} +{{- define "postgresql.v1.tlsCert" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/tls.crt" -}} +{{- else -}} + {{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the cert key file. +*/}} +{{- define "postgresql.v1.tlsCertKey" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/tls.key" -}} +{{- else -}} +{{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/postgresql/certs/%s" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql.v1.tlsCACert" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "/opt/bitnami/postgresql/certs/ca.crt" -}} +{{- else -}} + {{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.certCAFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CRL file. +*/}} +{{- define "postgresql.v1.tlsCRL" -}} +{{- if .Values.tls.crlFilename -}} +{{- printf "/opt/bitnami/postgresql/certs/%s" .Values.tls.crlFilename -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if a TLS credentials secret object should be created +*/}} +{{- define "postgresql.v1.createTlsSecret" -}} +{{- if and .Values.tls.autoGenerated (not .Values.tls.certificatesSecret) -}} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the path to the CA cert file. +*/}} +{{- define "postgresql.v1.tlsSecretName" -}} +{{- if .Values.tls.autoGenerated -}} + {{- printf "%s-crt" (include "common.names.fullname" .) -}} +{{- else -}} + {{ required "A secret containing TLS certificates is required when TLS is enabled" .Values.tls.certificatesSecret }} +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/backup/cronjob.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/backup/cronjob.yaml new file mode 100644 index 0000000..cdf87f7 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/backup/cronjob.yaml @@ -0,0 +1,114 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.backup.enabled }} +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: batch/v1 +kind: CronJob +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ .Release.Namespace | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: pg_dumpall + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }} + {{- if $annotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + schedule: {{ quote .Values.backup.cronjob.schedule }} + {{- if .Values.backup.cronjob.timezone }} + timeZone: {{ .Values.backup.cronjob.timezone | quote }} + {{- end }} + concurrencyPolicy: {{ .Values.backup.cronjob.concurrencyPolicy }} + failedJobsHistoryLimit: {{ .Values.backup.cronjob.failedJobsHistoryLimit }} + successfulJobsHistoryLimit: {{ .Values.backup.cronjob.successfulJobsHistoryLimit }} + {{- if .Values.backup.cronjob.startingDeadlineSeconds }} + startingDeadlineSeconds: {{ .Values.backup.cronjob.startingDeadlineSeconds }} + {{- end }} + jobTemplate: + spec: + {{- if .Values.backup.cronjob.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ .Values.backup.cronjob.ttlSecondsAfterFinished }} + {{- end }} + template: + metadata: + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 12 }} + app.kubernetes.io/component: pg_dumpall + {{- if $annotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 12 }} + {{- end }} + spec: + {{- include "postgresql.v1.imagePullSecrets" . | nindent 10 }} + {{- if .Values.backup.cronjob.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.nodeSelector "context" $) | nindent 12 }} + {{- end }} + containers: + - name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + env: + - name: PGUSER + {{- if .Values.auth.enablePostgresUser }} + value: postgres + {{- else }} + value: {{ $customUser | quote }} + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: PGPASSFILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: PGPASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + - name: PGHOST + value: {{ include "postgresql.v1.primary.fullname" . }} + - name: PGPORT + value: {{ include "postgresql.v1.service.port" . | quote }} + - name: PGDUMP_DIR + value: {{ .Values.backup.cronjob.storage.mountPath }} + {{- if .Values.tls.enabled }} + - name: PGSSLROOTCERT + {{- if .Values.tls.autoGenerated }} + value: /tmp/certs/ca.crt + {{- else }} + value: {{- printf "/tmp/certs/%s" .Values.tls.certCAFilename -}} + {{- end }} + {{- end }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.backup.cronjob.command "context" $) | nindent 14 }} + volumeMounts: + {{- if .Values.tls.enabled }} + - name: certs + mountPath: /certs + {{- end }} + - name: datadir + mountPath: {{ .Values.backup.cronjob.storage.mountPath }} + subPath: {{ .Values.backup.cronjob.storage.subPath }} + {{- if .Values.backup.cronjob.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.backup.cronjob.containerSecurityContext "enabled" | toYaml | nindent 14 }} + {{- end }} + restartPolicy: {{ .Values.backup.cronjob.restartPolicy }} + {{- if .Values.backup.cronjob.podSecurityContext.enabled }} + securityContext: + fsGroup: {{ .Values.backup.cronjob.podSecurityContext.fsGroup }} + {{- end }} + volumes: + {{- if .Values.tls.enabled }} + - name: raw-certificates + emptyDir: /tmp/certs + {{- end }} + {{- if .Values.backup.cronjob.storage.existingClaim }} + - name: datadir + persistentVolumeClaim: + claimName: {{ printf "%s" (tpl .Values.backup.cronjob.storage.existingClaim .) }} + {{- else }} + - name: datadir + persistentVolumeClaim: + claimName: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/backup/pvc.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/backup/pvc.yaml new file mode 100644 index 0000000..6fe9cbf --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/backup/pvc.yaml @@ -0,0 +1,34 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.backup.enabled (not .Values.backup.cronjob.storage.existingClaim) -}} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }}-pgdumpall + namespace: {{ .Release.Namespace | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: pg_dumpall + {{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations .Values.backup.cronjob.storage.resourcePolicy }} + annotations: + {{- if or .Values.backup.cronjob.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.backup.cronjob.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.backup.cronjob.storage.resourcePolicy }} + helm.sh/resource-policy: {{ .Values.backup.cronjob.storage.resourcePolicy | quote }} + {{- end }} + {{- end }} +spec: + accessModes: + {{- range .Values.backup.cronjob.storage.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.backup.cronjob.storage.size | quote }} + {{ include "common.storage.class" (dict "persistence" .Values.backup.cronjob.storage "global" .Values.global) }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/extra-list.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/extra-list.yaml new file mode 100644 index 0000000..2d35a58 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/extra-list.yaml @@ -0,0 +1,9 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/networkpolicy-egress.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/networkpolicy-egress.yaml new file mode 100644 index 0000000..b67817c --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/networkpolicy-egress.yaml @@ -0,0 +1,34 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.networkPolicy.enabled (or .Values.networkPolicy.egressRules.denyConnectionsToExternal .Values.networkPolicy.egressRules.customRules) }} +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +kind: NetworkPolicy +metadata: + name: {{ printf "%s-egress" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }} + policyTypes: + - Egress + egress: + {{- if .Values.networkPolicy.egressRules.denyConnectionsToExternal }} + - ports: + - port: 53 + protocol: UDP + - port: 53 + protocol: TCP + - to: + - namespaceSelector: {} + {{- end }} + {{- if .Values.networkPolicy.egressRules.customRules }} + {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.egressRules.customRules "context" $) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/configmap.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/configmap.yaml new file mode 100644 index 0000000..7a69891 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/configmap.yaml @@ -0,0 +1,26 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.primary.createConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-configuration" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + {{- if .Values.primary.configuration }} + postgresql.conf: | + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.configuration "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.primary.pgHbaConfiguration }} + pg_hba.conf: | + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.pgHbaConfiguration "context" $ ) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/extended-configmap.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/extended-configmap.yaml new file mode 100644 index 0000000..456f8ee --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/extended-configmap.yaml @@ -0,0 +1,20 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.primary.createExtendedConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-extended-configuration" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + override.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extendedConfiguration "context" $ ) | nindent 4 }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/initialization-configmap.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/initialization-configmap.yaml new file mode 100644 index 0000000..80d804a --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/initialization-configmap.yaml @@ -0,0 +1,17 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.primary.initdb.scripts (not .Values.primary.initdb.scriptsConfigMap) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-init-scripts" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: {{- include "common.tplvalues.render" (dict "value" .Values.primary.initdb.scripts "context" .) | nindent 2 }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/metrics-configmap.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/metrics-configmap.yaml new file mode 100644 index 0000000..7da2bcd --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/metrics-configmap.yaml @@ -0,0 +1,18 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/metrics-svc.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/metrics-svc.yaml new file mode 100644 index 0000000..3d94510 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/metrics-svc.yaml @@ -0,0 +1,31 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.metrics.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if or .Values.commonAnnotations .Values.metrics.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + sessionAffinity: {{ .Values.metrics.service.sessionAffinity }} + {{- if .Values.metrics.service.clusterIP }} + clusterIP: {{ .Values.metrics.service.clusterIP }} + {{- end }} + ports: + - name: http-metrics + port: {{ .Values.metrics.service.ports.metrics }} + targetPort: http-metrics + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/networkpolicy.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/networkpolicy.yaml new file mode 100644 index 0000000..9da3fb4 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/networkpolicy.yaml @@ -0,0 +1,61 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.networkPolicy.enabled (or .Values.networkPolicy.metrics.enabled .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.enabled) }} +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +kind: NetworkPolicy +metadata: + name: {{ printf "%s-ingress" (include "postgresql.v1.primary.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $primaryPodLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $primaryPodLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: primary + ingress: + {{- if and .Values.metrics.enabled .Values.networkPolicy.metrics.enabled (or .Values.networkPolicy.metrics.namespaceSelector .Values.networkPolicy.metrics.podSelector) }} + - from: + {{- if .Values.networkPolicy.metrics.namespaceSelector }} + - namespaceSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.metrics.namespaceSelector "context" $) | nindent 14 }} + {{- end }} + {{- if .Values.networkPolicy.metrics.podSelector }} + - podSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.metrics.podSelector "context" $) | nindent 14 }} + {{- end }} + ports: + - port: {{ .Values.metrics.containerPorts.metrics }} + {{- end }} + {{- if and .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.enabled (or .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.namespaceSelector .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.podSelector) }} + - from: + {{- if .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.namespaceSelector }} + - namespaceSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.namespaceSelector "context" $) | nindent 14 }} + {{- end }} + {{- if .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.podSelector }} + - podSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.podSelector "context" $) | nindent 14 }} + {{- end }} + ports: + - port: {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- if and .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.enabled (eq .Values.architecture "replication") }} + - from: + {{- $readPodLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + - podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $readPodLabels "context" $ ) | nindent 14 }} + app.kubernetes.io/component: read + ports: + - port: {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- if .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.customRules }} + {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.primaryAccessOnlyFrom.customRules "context" $) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/servicemonitor.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/servicemonitor.yaml new file mode 100644 index 0000000..05d54f3 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/servicemonitor.yaml @@ -0,0 +1,46 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ default .Release.Namespace .Values.metrics.serviceMonitor.namespace | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.metrics.serviceMonitor.jobLabel }} + jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} + {{- end }} + selector: + {{- $svcLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.selector .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $svcLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: metrics + endpoints: + - port: http-metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace | quote }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/statefulset.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/statefulset.yaml new file mode 100644 index 0000000..1f0c962 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/statefulset.yaml @@ -0,0 +1,662 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if or .Values.commonAnnotations .Values.primary.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + replicas: 1 + serviceName: {{ include "postgresql.v1.primary.svc.headless" . }} + {{- if .Values.primary.updateStrategy }} + updateStrategy: {{- toYaml .Values.primary.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: primary + template: + metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/component: primary + {{- if or (include "postgresql.v1.primary.createConfigmap" .) (include "postgresql.v1.primary.createExtendedConfigmap" .) .Values.primary.podAnnotations }} + annotations: + {{- if (include "postgresql.v1.primary.createConfigmap" .) }} + checksum/configuration: {{ pick (include (print $.Template.BasePath "/primary/configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if (include "postgresql.v1.primary.createExtendedConfigmap" .) }} + checksum/extended-configuration: {{ pick (include (print $.Template.BasePath "/primary/extended-configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if .Values.primary.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + spec: + {{- if .Values.primary.extraPodSpec }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraPodSpec "context" $) | nindent 6 }} + {{- end }} + serviceAccountName: {{ include "postgresql.v1.serviceAccountName" . }} + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.primary.automountServiceAccountToken }} + {{- if .Values.primary.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.primary.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.primary.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAffinityPreset "component" "primary" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.primary.podAntiAffinityPreset "component" "primary" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.primary.nodeAffinityPreset.type "key" .Values.primary.nodeAffinityPreset.key "values" .Values.primary.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.primary.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.primary.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.primary.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.primary.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.primary.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + {{- if .Values.primary.priorityClassName }} + priorityClassName: {{ .Values.primary.priorityClassName }} + {{- end }} + {{- if .Values.primary.schedulerName }} + schedulerName: {{ .Values.primary.schedulerName | quote }} + {{- end }} + {{- if .Values.primary.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.primary.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.primary.podSecurityContext.enabled }} + securityContext: {{- omit .Values.primary.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + hostNetwork: {{ .Values.primary.hostNetwork }} + hostIPC: {{ .Values.primary.hostIPC }} + {{- if or (and .Values.tls.enabled (not .Values.volumePermissions.enabled)) (and .Values.volumePermissions.enabled (or .Values.primary.persistence.enabled .Values.shmVolume.enabled)) .Values.primary.initContainers }} + initContainers: + {{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }} + - name: copy-certs + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.primary.resources }} + resources: {{- toYaml .Values.primary.resources | nindent 12 }} + {{- end }} + # We don't require a privileged container in this case + {{- if .Values.primary.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.primary.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + volumeMounts: + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- else if and .Values.volumePermissions.enabled (or .Values.primary.persistence.enabled .Values.shmVolume.enabled) }} + - name: init-chmod-data + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + {{- if .Values.primary.persistence.enabled }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.primary.persistence.mountPath }} + {{- else }} + chown {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} {{ .Values.primary.persistence.mountPath }} + {{- end }} + mkdir -p {{ .Values.primary.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.primary.persistence.mountPath }}/conf {{- end }} + chmod 700 {{ .Values.primary.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.primary.persistence.mountPath }}/conf {{- end }} + find {{ .Values.primary.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.v1.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + xargs -r chown -R `id -u`:`id -G | cut -d " " -f2` + {{- else }} + xargs -r chown -R {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + chmod -R 777 /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ + {{- else }} + chown -R {{ .Values.primary.containerSecurityContext.runAsUser }}:{{ .Values.primary.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ + {{- end }} + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.primary.persistence.enabled }} + - name: data + mountPath: {{ .Values.primary.persistence.mountPath }} + {{- if .Values.primary.persistence.subPath }} + subPath: {{ .Values.primary.persistence.subPath }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + {{- end }} + {{- if .Values.primary.initContainers }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.initContainers "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + containers: + - name: postgresql + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.primary.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.primary.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.primary.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.primary.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.primary.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.primary.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: {{ .Values.containerPorts.postgresql | quote }} + - name: POSTGRESQL_VOLUME_DIR + value: {{ .Values.primary.persistence.mountPath | quote }} + {{- if .Values.primary.persistence.mountPath }} + - name: PGDATA + value: {{ .Values.postgresqlDataDir | quote }} + {{- end }} + # Authentication + {{- if or (eq $customUser "postgres") (empty $customUser) }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "true" + {{- end }} + {{- else }} + - name: POSTGRES_USER + value: {{ $customUser | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.userPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- end }} + {{- end }} + {{- if (include "postgresql.v1.database" .) }} + - name: POSTGRES_DATABASE + value: {{ (include "postgresql.v1.database" .) | quote }} + {{- end }} + # Replication + {{- if or (eq .Values.architecture "replication") .Values.primary.standby.enabled }} + - name: POSTGRES_REPLICATION_MODE + value: {{ ternary "slave" "master" .Values.primary.standby.enabled | quote }} + - name: POSTGRES_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_REPLICATION_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.replicationPasswordKey" .) }} + {{- else }} + - name: POSTGRES_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + {{- if ne .Values.replication.synchronousCommit "off" }} + - name: POSTGRES_SYNCHRONOUS_COMMIT_MODE + value: {{ .Values.replication.synchronousCommit | quote }} + - name: POSTGRES_NUM_SYNCHRONOUS_REPLICAS + value: {{ .Values.replication.numSynchronousReplicas | quote }} + {{- end }} + - name: POSTGRES_CLUSTER_APP_NAME + value: {{ .Values.replication.applicationName }} + {{- end }} + # Initdb + {{- if .Values.primary.initdb.args }} + - name: POSTGRES_INITDB_ARGS + value: {{ .Values.primary.initdb.args | quote }} + {{- end }} + {{- if .Values.primary.initdb.postgresqlWalDir }} + - name: POSTGRES_INITDB_WALDIR + value: {{ .Values.primary.initdb.postgresqlWalDir | quote }} + {{- end }} + {{- if .Values.primary.initdb.user }} + - name: POSTGRES_INITSCRIPTS_USERNAME + value: {{ .Values.primary.initdb.user }} + {{- end }} + {{- if .Values.primary.initdb.password }} + - name: POSTGRES_INITSCRIPTS_PASSWORD + value: {{ .Values.primary.initdb.password | quote }} + {{- end }} + # Standby + {{- if .Values.primary.standby.enabled }} + - name: POSTGRES_MASTER_HOST + value: {{ .Values.primary.standby.primaryHost }} + - name: POSTGRES_MASTER_PORT_NUMBER + value: {{ .Values.primary.standby.primaryPort | quote }} + {{- end }} + # LDAP + - name: POSTGRESQL_ENABLE_LDAP + value: {{ ternary "yes" "no" .Values.ldap.enabled | quote }} + {{- if .Values.ldap.enabled }} + {{- if or .Values.ldap.url .Values.ldap.uri }} + - name: POSTGRESQL_LDAP_URL + value: {{ coalesce .Values.ldap.url .Values.ldap.uri }} + {{- else }} + - name: POSTGRESQL_LDAP_SERVER + value: {{ .Values.ldap.server }} + - name: POSTGRESQL_LDAP_PORT + value: {{ .Values.ldap.port | quote }} + - name: POSTGRESQL_LDAP_SCHEME + value: {{ .Values.ldap.scheme }} + {{- if (include "postgresql.v1.ldap.tls.enabled" .) }} + - name: POSTGRESQL_LDAP_TLS + value: "1" + {{- end }} + - name: POSTGRESQL_LDAP_PREFIX + value: {{ .Values.ldap.prefix | quote }} + - name: POSTGRESQL_LDAP_SUFFIX + value: {{ .Values.ldap.suffix | quote }} + - name: POSTGRESQL_LDAP_BASE_DN + value: {{ coalesce .Values.ldap.baseDN .Values.ldap.basedn }} + - name: POSTGRESQL_LDAP_BIND_DN + value: {{ coalesce .Values.ldap.bindDN .Values.ldap.binddn}} + {{- if or (not (empty .Values.ldap.bind_password)) (not (empty .Values.ldap.bindpw)) }} + - name: POSTGRESQL_LDAP_BIND_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: ldap-password + {{- end }} + - name: POSTGRESQL_LDAP_SEARCH_ATTR + value: {{ coalesce .Values.ldap.search_attr .Values.ldap.searchAttribute }} + - name: POSTGRESQL_LDAP_SEARCH_FILTER + value: {{ coalesce .Values.ldap.search_filter .Values.ldap.searchFilter }} + {{- end }} + {{- end }} + # TLS + - name: POSTGRESQL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} + - name: POSTGRESQL_TLS_CERT_FILE + value: {{ include "postgresql.v1.tlsCert" . }} + - name: POSTGRESQL_TLS_KEY_FILE + value: {{ include "postgresql.v1.tlsCertKey" . }} + {{- if .Values.tls.certCAFilename }} + - name: POSTGRESQL_TLS_CA_FILE + value: {{ include "postgresql.v1.tlsCACert" . }} + {{- end }} + {{- if .Values.tls.crlFilename }} + - name: POSTGRESQL_TLS_CRL_FILE + value: {{ include "postgresql.v1.tlsCRL" . }} + {{- end }} + {{- end }} + # Audit + - name: POSTGRESQL_LOG_HOSTNAME + value: {{ .Values.audit.logHostname | quote }} + - name: POSTGRESQL_LOG_CONNECTIONS + value: {{ .Values.audit.logConnections | quote }} + - name: POSTGRESQL_LOG_DISCONNECTIONS + value: {{ .Values.audit.logDisconnections | quote }} + {{- if .Values.audit.logLinePrefix }} + - name: POSTGRESQL_LOG_LINE_PREFIX + value: {{ .Values.audit.logLinePrefix | quote }} + {{- end }} + {{- if .Values.audit.logTimezone }} + - name: POSTGRESQL_LOG_TIMEZONE + value: {{ .Values.audit.logTimezone | quote }} + {{- end }} + {{- if .Values.audit.pgAuditLog }} + - name: POSTGRESQL_PGAUDIT_LOG + value: {{ .Values.audit.pgAuditLog | quote }} + {{- end }} + - name: POSTGRESQL_PGAUDIT_LOG_CATALOG + value: {{ .Values.audit.pgAuditLogCatalog | quote }} + # Others + - name: POSTGRESQL_CLIENT_MIN_MESSAGES + value: {{ .Values.audit.clientMinMessages | quote }} + - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES + value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} + {{- if .Values.primary.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.primary.extraEnvVarsCM .Values.primary.extraEnvVarsSecret }} + envFrom: + {{- if .Values.primary.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.primary.extraEnvVarsCM }} + {{- end }} + {{- if .Values.primary.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.primary.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: tcp-postgresql + containerPort: {{ .Values.containerPorts.postgresql }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.primary.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.primary.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.primary.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.primary.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.primary.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.primary.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + - -e + {{- include "postgresql.v1.readinessProbeCommand" . | nindent 16 }} + {{- end }} + {{- end }} + {{- if .Values.primary.resources }} + resources: {{- toYaml .Values.primary.resources | nindent 12 }} + {{- end }} + {{- if .Values.primary.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.primary.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + {{- if or .Values.primary.initdb.scriptsConfigMap .Values.primary.initdb.scripts }} + - name: custom-init-scripts + mountPath: /docker-entrypoint-initdb.d/ + {{- end }} + {{- if .Values.primary.initdb.scriptsSecret }} + - name: custom-init-scripts-secret + mountPath: /docker-entrypoint-initdb.d/secret + {{- end }} + {{- if or .Values.primary.extendedConfiguration .Values.primary.existingExtendedConfigmap }} + - name: postgresql-extended-config + mountPath: {{ .Values.primary.persistence.mountPath }}/conf/conf.d/ + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + readOnly: true + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.primary.persistence.enabled }} + - name: data + mountPath: {{ .Values.primary.persistence.mountPath }} + {{- if .Values.primary.persistence.subPath }} + subPath: {{ .Values.primary.persistence.subPath }} + {{- end }} + {{- end }} + {{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap }} + - name: postgresql-config + mountPath: {{ .Values.primary.persistence.mountPath }}/conf + {{- end }} + {{- if .Values.primary.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "postgresql.v1.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if or .Values.metrics.customMetrics .Values.metrics.collectors }} + args: + {{- if .Values.metrics.customMetrics }} + - --extend.query-path + - /conf/custom-metrics.yaml + {{- end }} + {{- range $name, $enabled := .Values.metrics.collectors }} + - --{{ if not $enabled }}no-{{ end }}collector.{{ $name }} + {{- end }} + {{- end }} + env: + {{- $database := required "In order to enable metrics you need to specify a database (.Values.auth.database or .Values.global.postgresql.auth.database)" (include "postgresql.v1.database" .) }} + - name: DATA_SOURCE_URI + value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (int (include "postgresql.v1.service.port" .)) $database }} + {{- $pwdKey := ternary (include "postgresql.v1.adminPasswordKey" .) (include "postgresql.v1.userPasswordKey" .) (or (eq $customUser "postgres") (empty $customUser)) }} + {{- if .Values.auth.usePasswordFiles }} + - name: DATA_SOURCE_PASS_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" $pwdKey }} + {{- else }} + - name: DATA_SOURCE_PASS + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ $pwdKey }} + {{- end }} + - name: DATA_SOURCE_USER + value: {{ default "postgres" $customUser | quote }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: http-metrics + containerPort: {{ .Values.metrics.containerPorts.metrics }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: http-metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- end }} + volumeMounts: + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.metrics.customMetrics }} + - name: custom-metrics + mountPath: /conf + readOnly: true + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.primary.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.sidecars "context" $ ) | nindent 8 }} + {{- end }} + volumes: + {{- if or .Values.primary.configuration .Values.primary.pgHbaConfiguration .Values.primary.existingConfigmap }} + - name: postgresql-config + configMap: + name: {{ include "postgresql.v1.primary.configmapName" . }} + {{- end }} + {{- if or .Values.primary.extendedConfiguration .Values.primary.existingExtendedConfigmap }} + - name: postgresql-extended-config + configMap: + name: {{ include "postgresql.v1.primary.extendedConfigmapName" . }} + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql.v1.secretName" . }} + {{- end }} + {{- if or .Values.primary.initdb.scriptsConfigMap .Values.primary.initdb.scripts }} + - name: custom-init-scripts + configMap: + name: {{ include "postgresql.v1.initdb.scriptsCM" . }} + {{- end }} + {{- if .Values.primary.initdb.scriptsSecret }} + - name: custom-init-scripts-secret + secret: + secretName: {{ tpl .Values.primary.initdb.scriptsSecret $ }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + - name: postgresql-certificates + emptyDir: {} + {{- end }} + {{- if .Values.primary.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.primary.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} + - name: custom-metrics + configMap: + name: {{ printf "%s-metrics" (include "postgresql.v1.primary.fullname" .) }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + emptyDir: + medium: Memory + {{- if .Values.shmVolume.sizeLimit }} + sizeLimit: {{ .Values.shmVolume.sizeLimit }} + {{- end }} + {{- end }} + {{- if and .Values.primary.persistence.enabled .Values.primary.persistence.existingClaim }} + - name: data + persistentVolumeClaim: + claimName: {{ tpl .Values.primary.persistence.existingClaim $ }} + {{- else if not .Values.primary.persistence.enabled }} + - name: data + emptyDir: {} + {{- else }} + {{- if .Values.primary.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.primary.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.primary.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - apiVersion: v1 + kind: PersistentVolumeClaim + metadata: + name: data + {{- if .Values.primary.persistence.annotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.annotations "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.primary.persistence.labels }} + labels: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.labels "context" $) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.primary.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + {{- if .Values.primary.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + resources: + requests: + storage: {{ .Values.primary.persistence.size | quote }} + {{- if .Values.primary.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.primary.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.primary.persistence "global" .Values.global) | nindent 8 }} + {{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/svc-headless.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/svc-headless.yaml new file mode 100644 index 0000000..b18565a --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/svc-headless.yaml @@ -0,0 +1,36 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.primary.svc.headless" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + annotations: + {{- if or .Values.primary.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} + # Use this annotation in addition to the actual publishNotReadyAddresses + # field below because the annotation will stop being respected soon but the + # field is broken in some versions of Kubernetes: + # https://github.com/kubernetes/kubernetes/issues/58662 + service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" +spec: + type: ClusterIP + clusterIP: None + # We want all pods in the StatefulSet to have their addresses published for + # the sake of the other Postgresql pods even before they're ready, since they + # have to be able to talk to each other in order to become ready. + publishNotReadyAddresses: true + ports: + - name: tcp-postgresql + port: {{ template "postgresql.v1.service.port" . }} + targetPort: tcp-postgresql + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/svc.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/svc.yaml new file mode 100644 index 0000000..90f7e46 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/primary/svc.yaml @@ -0,0 +1,51 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.primary.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary + {{- if or .Values.commonAnnotations .Values.primary.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.primary.service.type }} + {{- if or (eq .Values.primary.service.type "LoadBalancer") (eq .Values.primary.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.primary.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.primary.service.loadBalancerSourceRanges | toJson}} + {{- end }} + {{- if and (eq .Values.primary.service.type "LoadBalancer") (not (empty .Values.primary.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.primary.service.loadBalancerIP }} + {{- end }} + {{- if and .Values.primary.service.clusterIP (eq .Values.primary.service.type "ClusterIP") }} + clusterIP: {{ .Values.primary.service.clusterIP }} + {{- end }} + {{- if .Values.primary.service.sessionAffinity }} + sessionAffinity: {{ .Values.primary.service.sessionAffinity }} + {{- end }} + {{- if .Values.primary.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.primary.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + ports: + - name: tcp-postgresql + port: {{ template "postgresql.v1.service.port" . }} + targetPort: tcp-postgresql + {{- if and (or (eq .Values.primary.service.type "NodePort") (eq .Values.primary.service.type "LoadBalancer")) (not (empty .Values.primary.service.nodePorts.postgresql)) }} + nodePort: {{ .Values.primary.service.nodePorts.postgresql }} + {{- else if eq .Values.primary.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.primary.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.primary.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.primary.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: primary diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/prometheusrule.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/prometheusrule.yaml new file mode 100644 index 0000000..6cdb087 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/prometheusrule.yaml @@ -0,0 +1,22 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ default .Release.Namespace .Values.metrics.prometheusRule.namespace | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.prometheusRule.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + groups: + - name: {{ include "common.names.fullname" . }} + rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 8 }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/psp.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/psp.yaml new file mode 100644 index 0000000..2cc1bbf --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/psp.yaml @@ -0,0 +1,42 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + privileged: false + volumes: + - 'configMap' + - 'secret' + - 'persistentVolumeClaim' + - 'emptyDir' + - 'projected' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + - min: 1 + max: 65535 + readOnlyRootFilesystem: false +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/extended-configmap.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/extended-configmap.yaml new file mode 100644 index 0000000..efa87bb --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/extended-configmap.yaml @@ -0,0 +1,20 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-extended-configuration" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + override.conf: |- + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extendedConfiguration "context" $ ) | nindent 4 }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/metrics-configmap.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/metrics-configmap.yaml new file mode 100644 index 0000000..a1e06bf --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/metrics-configmap.yaml @@ -0,0 +1,18 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.customMetrics (eq .Values.architecture "replication") }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + custom-metrics.yaml: {{ toYaml .Values.metrics.customMetrics | quote }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/metrics-svc.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/metrics-svc.yaml new file mode 100644 index 0000000..e9f13e0 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/metrics-svc.yaml @@ -0,0 +1,31 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled (eq .Values.architecture "replication") }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics-read + {{- if or .Values.commonAnnotations .Values.metrics.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: ClusterIP + sessionAffinity: {{ .Values.metrics.service.sessionAffinity }} + {{- if .Values.metrics.service.clusterIP }} + clusterIP: {{ .Values.metrics.service.clusterIP }} + {{- end }} + ports: + - name: http-metrics + port: {{ .Values.metrics.service.ports.metrics }} + targetPort: http-metrics + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/networkpolicy.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/networkpolicy.yaml new file mode 100644 index 0000000..79d3a5a --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/networkpolicy.yaml @@ -0,0 +1,39 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.networkPolicy.enabled (eq .Values.architecture "replication") .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.enabled }} +apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }} +kind: NetworkPolicy +metadata: + name: {{ printf "%s-ingress" (include "postgresql.v1.readReplica.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + podSelector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: read + ingress: + {{- if and .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.enabled (or .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.namespaceSelector .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.podSelector) }} + - from: + {{- if .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.namespaceSelector }} + - namespaceSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.namespaceSelector "context" $) | nindent 14 }} + {{- end }} + {{- if .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.podSelector }} + - podSelector: + matchLabels: {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.podSelector "context" $) | nindent 14 }} + {{- end }} + ports: + - port: {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- if .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.customRules }} + {{- include "common.tplvalues.render" (dict "value" .Values.networkPolicy.ingressRules.readReplicasAccessOnlyFrom.customRules "context" $) | nindent 4 }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/servicemonitor.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/servicemonitor.yaml new file mode 100644 index 0000000..845734b --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/servicemonitor.yaml @@ -0,0 +1,46 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled (eq .Values.architecture "replication") }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ default .Release.Namespace .Values.metrics.serviceMonitor.namespace | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: metrics-read + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if .Values.metrics.serviceMonitor.jobLabel }} + jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }} + {{- end }} + selector: + {{- $svcLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.selector .Values.commonLabels ) "context" . ) }} + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $svcLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: metrics-read + endpoints: + - port: http-metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace | quote }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/statefulset.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/statefulset.yaml new file mode 100644 index 0000000..f11ae0a --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/statefulset.yaml @@ -0,0 +1,553 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +{{- $customUser := include "postgresql.v1.username" . }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.labels .Values.commonLabels ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if or .Values.commonAnnotations .Values.readReplicas.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.readReplicas.replicaCount }} + serviceName: {{ include "postgresql.v1.readReplica.svc.headless" . }} + {{- if .Values.readReplicas.updateStrategy }} + updateStrategy: {{- toYaml .Values.readReplicas.updateStrategy | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: + matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }} + app.kubernetes.io/component: read + template: + metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} + app.kubernetes.io/component: read + {{- if or (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) .Values.readReplicas.podAnnotations }} + annotations: + {{- if (include "postgresql.v1.readReplicas.createExtendedConfigmap" .) }} + checksum/extended-configuration: {{ pick (include (print $.Template.BasePath "/primary/extended-configmap.yaml") . | fromYaml) "data" | toYaml | sha256sum }} + {{- end }} + {{- if .Values.readReplicas.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + spec: + {{- if .Values.readReplicas.extraPodSpec }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraPodSpec "context" $) | nindent 6 }} + {{- end }} + serviceAccountName: {{ include "postgresql.v1.serviceAccountName" . }} + {{- include "postgresql.v1.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.readReplicas.automountServiceAccountToken }} + {{- if .Values.readReplicas.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAffinityPreset "component" "read" "customLabels" $podLabels "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.readReplicas.podAntiAffinityPreset "component" "read" "customLabels" $podLabels "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.readReplicas.nodeAffinityPreset.type "key" .Values.readReplicas.nodeAffinityPreset.key "values" .Values.readReplicas.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.readReplicas.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.topologySpreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.readReplicas.priorityClassName }} + priorityClassName: {{ .Values.readReplicas.priorityClassName }} + {{- end }} + {{- if .Values.readReplicas.schedulerName }} + schedulerName: {{ .Values.readReplicas.schedulerName | quote }} + {{- end }} + {{- if .Values.readReplicas.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.readReplicas.terminationGracePeriodSeconds }} + {{- end }} + {{- if .Values.readReplicas.podSecurityContext.enabled }} + securityContext: {{- omit .Values.readReplicas.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + hostNetwork: {{ .Values.readReplicas.hostNetwork }} + hostIPC: {{ .Values.readReplicas.hostIPC }} + {{- if or (and .Values.tls.enabled (not .Values.volumePermissions.enabled)) (and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled)) .Values.readReplicas.initContainers }} + initContainers: + {{- if and .Values.tls.enabled (not .Values.volumePermissions.enabled) }} + - name: copy-certs + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- end }} + # We don't require a privileged container in this case + {{- if .Values.readReplicas.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.readReplicas.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + volumeMounts: + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- else if and .Values.volumePermissions.enabled (or .Values.readReplicas.persistence.enabled .Values.shmVolume.enabled) }} + - name: init-chmod-data + image: {{ include "postgresql.v1.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- end }} + command: + - /bin/sh + - -ec + - | + {{- if .Values.readReplicas.persistence.enabled }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown `id -u`:`id -G | cut -d " " -f2` {{ .Values.readReplicas.persistence.mountPath }} + {{- else }} + chown {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} {{ .Values.readReplicas.persistence.mountPath }} + {{- end }} + mkdir -p {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }} + chmod 700 {{ .Values.readReplicas.persistence.mountPath }}/data {{- if (include "postgresql.v1.mountConfigurationCM" .) }} {{ .Values.readReplicas.persistence.mountPath }}/conf {{- end }} + find {{ .Values.readReplicas.persistence.mountPath }} -mindepth 1 -maxdepth 1 {{- if not (include "postgresql.v1.mountConfigurationCM" .) }} -not -name "conf" {{- end }} -not -name ".snapshot" -not -name "lost+found" | \ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + xargs -r chown -R `id -u`:`id -G | cut -d " " -f2` + {{- else }} + xargs -r chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + chmod -R 777 /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + cp /tmp/certs/* /opt/bitnami/postgresql/certs/ + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` /opt/bitnami/postgresql/certs/ + {{- else }} + chown -R {{ .Values.readReplicas.containerSecurityContext.runAsUser }}:{{ .Values.readReplicas.podSecurityContext.fsGroup }} /opt/bitnami/postgresql/certs/ + {{- end }} + chmod 600 {{ include "postgresql.v1.tlsCertKey" . }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + {{ if .Values.readReplicas.persistence.enabled }} + - name: data + mountPath: {{ .Values.readReplicas.persistence.mountPath }} + {{- if .Values.readReplicas.persistence.subPath }} + subPath: {{ .Values.readReplicas.persistence.subPath }} + {{- end }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + mountPath: /tmp/certs + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + {{- end }} + {{- end }} + {{- if .Values.readReplicas.initContainers }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.initContainers "context" $ ) | nindent 8 }} + {{- end }} + {{- end }} + containers: + - name: postgresql + image: {{ include "postgresql.v1.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.readReplicas.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.readReplicas.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.args "context" $) | nindent 12 }} + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" (or .Values.image.debug .Values.diagnosticMode.enabled) | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: {{ .Values.containerPorts.postgresql | quote }} + - name: POSTGRESQL_VOLUME_DIR + value: {{ .Values.readReplicas.persistence.mountPath | quote }} + {{- if .Values.readReplicas.persistence.mountPath }} + - name: PGDATA + value: {{ .Values.postgresqlDataDir | quote }} + {{- end }} + # Authentication + {{- if or (eq $customUser "postgres") (empty $customUser) }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "true" + {{- end }} + {{- else }} + - name: POSTGRES_USER + value: {{ $customUser | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.userPasswordKey" .) }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + {{- if .Values.auth.enablePostgresUser }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_POSTGRES_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.adminPasswordKey" .) }} + {{- else }} + - name: POSTGRES_POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.adminPasswordKey" . }} + {{- end }} + {{- end }} + {{- end }} + # Replication + - name: POSTGRES_REPLICATION_MODE + value: "slave" + - name: POSTGRES_REPLICATION_USER + value: {{ .Values.auth.replicationUsername | quote }} + {{- if .Values.auth.usePasswordFiles }} + - name: POSTGRES_REPLICATION_PASSWORD_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.replicationPasswordKey" .) }} + {{- else }} + - name: POSTGRES_REPLICATION_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.replicationPasswordKey" . }} + {{- end }} + - name: POSTGRES_CLUSTER_APP_NAME + value: {{ .Values.replication.applicationName }} + - name: POSTGRES_MASTER_HOST + value: {{ include "postgresql.v1.primary.fullname" . }} + - name: POSTGRES_MASTER_PORT_NUMBER + value: {{ include "postgresql.v1.service.port" . | quote }} + # TLS + - name: POSTGRESQL_ENABLE_TLS + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: POSTGRESQL_TLS_PREFER_SERVER_CIPHERS + value: {{ ternary "yes" "no" .Values.tls.preferServerCiphers | quote }} + - name: POSTGRESQL_TLS_CERT_FILE + value: {{ include "postgresql.v1.tlsCert" . }} + - name: POSTGRESQL_TLS_KEY_FILE + value: {{ include "postgresql.v1.tlsCertKey" . }} + {{- if .Values.tls.certCAFilename }} + - name: POSTGRESQL_TLS_CA_FILE + value: {{ include "postgresql.v1.tlsCACert" . }} + {{- end }} + {{- if .Values.tls.crlFilename }} + - name: POSTGRESQL_TLS_CRL_FILE + value: {{ include "postgresql.v1.tlsCRL" . }} + {{- end }} + {{- end }} + # Audit + - name: POSTGRESQL_LOG_HOSTNAME + value: {{ .Values.audit.logHostname | quote }} + - name: POSTGRESQL_LOG_CONNECTIONS + value: {{ .Values.audit.logConnections | quote }} + - name: POSTGRESQL_LOG_DISCONNECTIONS + value: {{ .Values.audit.logDisconnections | quote }} + {{- if .Values.audit.logLinePrefix }} + - name: POSTGRESQL_LOG_LINE_PREFIX + value: {{ .Values.audit.logLinePrefix | quote }} + {{- end }} + {{- if .Values.audit.logTimezone }} + - name: POSTGRESQL_LOG_TIMEZONE + value: {{ .Values.audit.logTimezone | quote }} + {{- end }} + {{- if .Values.audit.pgAuditLog }} + - name: POSTGRESQL_PGAUDIT_LOG + value: {{ .Values.audit.pgAuditLog | quote }} + {{- end }} + - name: POSTGRESQL_PGAUDIT_LOG_CATALOG + value: {{ .Values.audit.pgAuditLogCatalog | quote }} + # Others + - name: POSTGRESQL_CLIENT_MIN_MESSAGES + value: {{ .Values.audit.clientMinMessages | quote }} + - name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES + value: {{ .Values.postgresqlSharedPreloadLibraries | quote }} + {{- if .Values.readReplicas.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.readReplicas.extraEnvVarsCM .Values.readReplicas.extraEnvVarsSecret }} + envFrom: + {{- if .Values.readReplicas.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.readReplicas.extraEnvVarsCM }} + {{- end }} + {{- if .Values.readReplicas.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.readReplicas.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: tcp-postgresql + containerPort: {{ .Values.containerPorts.postgresql }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.readReplicas.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.startupProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser| quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.livenessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + {{- if (include "postgresql.v1.database" .) }} + - exec pg_isready -U {{ default "postgres" $customUser | quote }} -d "dbname={{ include "postgresql.v1.database" . }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}{{- end }}" -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- else }} + - exec pg_isready -U {{default "postgres" $customUser | quote }} {{- if and .Values.tls.enabled .Values.tls.certCAFilename }} -d "sslcert={{ include "postgresql.v1.tlsCert" . }} sslkey={{ include "postgresql.v1.tlsCertKey" . }}"{{- end }} -h 127.0.0.1 -p {{ .Values.containerPorts.postgresql }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.readReplicas.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.readReplicas.readinessProbe "enabled") "context" $) | nindent 12 }} + exec: + command: + - /bin/sh + - -c + - -e + {{- include "postgresql.v1.readinessProbeCommand" . | nindent 16 }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.resources }} + resources: {{- toYaml .Values.readReplicas.resources | nindent 12 }} + {{- end }} + {{- if .Values.readReplicas.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.readReplicas.extendedConfiguration }} + - name: postgresql-extended-config + mountPath: {{ .Values.readReplicas.persistence.mountPath }}/conf/conf.d/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: postgresql-certificates + mountPath: /opt/bitnami/postgresql/certs + readOnly: true + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + mountPath: /dev/shm + {{- end }} + {{- if .Values.readReplicas.persistence.enabled }} + - name: data + mountPath: {{ .Values.readReplicas.persistence.mountPath }} + {{- if .Values.readReplicas.persistence.subPath }} + subPath: {{ .Values.readReplicas.persistence.subPath }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "postgresql.v1.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.metrics.customMetrics }} + args: [ "--extend.query-path", "/conf/custom-metrics.yaml" ] + {{- end }} + env: + {{- $database := required "In order to enable metrics you need to specify a database (.Values.auth.database or .Values.global.postgresql.auth.database)" (include "postgresql.v1.database" .) }} + - name: DATA_SOURCE_URI + value: {{ printf "127.0.0.1:%d/%s?sslmode=disable" (int (include "postgresql.v1.service.port" .)) $database }} + {{- if .Values.auth.usePasswordFiles }} + - name: DATA_SOURCE_PASS_FILE + value: {{ printf "/opt/bitnami/postgresql/secrets/%s" (include "postgresql.v1.userPasswordKey" .) }} + {{- else }} + - name: DATA_SOURCE_PASS + valueFrom: + secretKeyRef: + name: {{ include "postgresql.v1.secretName" . }} + key: {{ include "postgresql.v1.userPasswordKey" . }} + {{- end }} + - name: DATA_SOURCE_USER + value: {{ default "postgres" $customUser | quote }} + {{- if .Values.metrics.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + ports: + - name: http-metrics + containerPort: {{ .Values.metrics.containerPorts.metrics }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.metrics.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customStartupProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: http-metrics + {{- end }} + {{- if .Values.metrics.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customLivenessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.livenessProbe.enabled }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- if .Values.metrics.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.customReadinessProbe "context" $) | nindent 12 }} + {{- else if .Values.metrics.readinessProbe.enabled }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.metrics.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: / + port: http-metrics + {{- end }} + {{- end }} + volumeMounts: + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + mountPath: /opt/bitnami/postgresql/secrets/ + {{- end }} + {{- if .Values.metrics.customMetrics }} + - name: custom-metrics + mountPath: /conf + readOnly: true + {{- end }} + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.sidecars "context" $ ) | nindent 8 }} + {{- end }} + volumes: + {{- if .Values.readReplicas.extendedConfiguration }} + - name: postgresql-extended-config + configMap: + name: {{ include "postgresql.v1.readReplicas.extendedConfigmapName" . }} + {{- end }} + {{- if .Values.auth.usePasswordFiles }} + - name: postgresql-password + secret: + secretName: {{ include "postgresql.v1.secretName" . }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: raw-certificates + secret: + secretName: {{ include "postgresql.v1.tlsSecretName" . }} + - name: postgresql-certificates + emptyDir: {} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.customMetrics }} + - name: custom-metrics + configMap: + name: {{ printf "%s-metrics" (include "postgresql.v1.readReplica.fullname" .) }} + {{- end }} + {{- if .Values.shmVolume.enabled }} + - name: dshm + emptyDir: + medium: Memory + {{- if .Values.shmVolume.sizeLimit }} + sizeLimit: {{ .Values.shmVolume.sizeLimit }} + {{- end }} + {{- end }} + {{- if .Values.readReplicas.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.readReplicas.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.readReplicas.persistence.enabled .Values.readReplicas.persistence.existingClaim }} + - name: data + persistentVolumeClaim: + claimName: {{ tpl .Values.readReplicas.persistence.existingClaim $ }} + {{- else if not .Values.readReplicas.persistence.enabled }} + - name: data + emptyDir: {} + {{- else }} + {{- if .Values.readReplicas.persistentVolumeClaimRetentionPolicy.enabled }} + persistentVolumeClaimRetentionPolicy: + whenDeleted: {{ .Values.readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted }} + whenScaled: {{ .Values.readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled }} + {{- end }} + volumeClaimTemplates: + - metadata: + name: data + {{- if .Values.readReplicas.persistence.annotations }} + annotations: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.annotations "context" $) | nindent 10 }} + {{- end }} + {{- if .Values.readReplicas.persistence.labels }} + labels: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.labels "context" $) | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.readReplicas.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + {{- if .Values.readReplicas.persistence.dataSource }} + dataSource: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.dataSource "context" $) | nindent 10 }} + {{- end }} + resources: + requests: + storage: {{ .Values.readReplicas.persistence.size | quote }} + {{- if .Values.readReplicas.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.persistence.selector "context" $) | nindent 10 }} + {{- end -}} + {{- include "common.storage.class" (dict "persistence" .Values.readReplicas.persistence "global" .Values.global) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/svc-headless.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/svc-headless.yaml new file mode 100644 index 0000000..249af5f --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/svc-headless.yaml @@ -0,0 +1,38 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.readReplica.svc.headless" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + annotations: + {{- if or .Values.readReplicas.service.headless.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.service.headless.annotations .Values.commonAnnotations ) "context" . ) }} + {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} + # Use this annotation in addition to the actual publishNotReadyAddresses + # field below because the annotation will stop being respected soon but the + # field is broken in some versions of Kubernetes: + # https://github.com/kubernetes/kubernetes/issues/58662 + service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" +spec: + type: ClusterIP + clusterIP: None + # We want all pods in the StatefulSet to have their addresses published for + # the sake of the other Postgresql pods even before they're ready, since they + # have to be able to talk to each other in order to become ready. + publishNotReadyAddresses: true + ports: + - name: tcp-postgresql + port: {{ include "postgresql.v1.readReplica.service.port" . }} + targetPort: tcp-postgresql + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/svc.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/svc.yaml new file mode 100644 index 0000000..d92c523 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/read/svc.yaml @@ -0,0 +1,53 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if eq .Values.architecture "replication" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "postgresql.v1.readReplica.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read + {{- if or .Values.commonAnnotations .Values.readReplicas.service.annotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.service.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.readReplicas.service.type }} + {{- if or (eq .Values.readReplicas.service.type "LoadBalancer") (eq .Values.readReplicas.service.type "NodePort") }} + externalTrafficPolicy: {{ .Values.readReplicas.service.externalTrafficPolicy | quote }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerSourceRanges)) }} + loadBalancerSourceRanges: {{ .Values.readReplicas.service.loadBalancerSourceRanges }} + {{- end }} + {{- if and (eq .Values.readReplicas.service.type "LoadBalancer") (not (empty .Values.readReplicas.service.loadBalancerIP)) }} + loadBalancerIP: {{ .Values.readReplicas.service.loadBalancerIP }} + {{- end }} + {{- if and .Values.readReplicas.service.clusterIP (eq .Values.readReplicas.service.type "ClusterIP") }} + clusterIP: {{ .Values.readReplicas.service.clusterIP }} + {{- end }} + {{- if .Values.readReplicas.service.sessionAffinity }} + sessionAffinity: {{ .Values.readReplicas.service.sessionAffinity }} + {{- end }} + {{- if .Values.readReplicas.service.sessionAffinityConfig }} + sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.service.sessionAffinityConfig "context" $) | nindent 4 }} + {{- end }} + ports: + - name: tcp-postgresql + port: {{ include "postgresql.v1.readReplica.service.port" . }} + targetPort: tcp-postgresql + {{- if and (or (eq .Values.readReplicas.service.type "NodePort") (eq .Values.readReplicas.service.type "LoadBalancer")) (not (empty .Values.readReplicas.service.nodePorts.postgresql)) }} + nodePort: {{ .Values.readReplicas.service.nodePorts.postgresql }} + {{- else if eq .Values.readReplicas.service.type "ClusterIP" }} + nodePort: null + {{- end }} + {{- if .Values.readReplicas.service.extraPorts }} + {{- include "common.tplvalues.render" (dict "value" .Values.readReplicas.service.extraPorts "context" $) | nindent 4 }} + {{- end }} + {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.readReplicas.podLabels .Values.commonLabels ) "context" . ) }} + selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: read +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/role.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/role.yaml new file mode 100644 index 0000000..0ae728a --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/role.yaml @@ -0,0 +1,32 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.rbac.create }} +kind: Role +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +# yamllint disable rule:indentation +rules: + {{- if and (include "common.capabilities.psp.supported" .) .Values.psp.create }} + - apiGroups: + - 'policy' + resources: + - 'podsecuritypolicies' + verbs: + - 'use' + resourceNames: + - {{ include "common.names.fullname" . }} + {{- end }} + {{- if .Values.rbac.rules }} + {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }} + {{- end }} +# yamllint enable rule:indentation +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/rolebinding.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/rolebinding.yaml new file mode 100644 index 0000000..04323a0 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/rolebinding.yaml @@ -0,0 +1,24 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.rbac.create }} +kind: RoleBinding +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + kind: Role + name: {{ include "common.names.fullname" . }} + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: ServiceAccount + name: {{ include "postgresql.v1.serviceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/secrets.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/secrets.yaml new file mode 100644 index 0000000..b4267ab --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/secrets.yaml @@ -0,0 +1,99 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- $host := include "postgresql.v1.primary.fullname" . }} +{{- $port := include "postgresql.v1.service.port" . }} +{{- $customUser := include "postgresql.v1.username" . }} +{{- $postgresPassword := include "common.secrets.lookup" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.adminPasswordKey .Values.auth.secretKeys.adminPasswordKey) "defaultValue" (ternary (coalesce .Values.global.postgresql.auth.password .Values.auth.password .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (coalesce .Values.global.postgresql.auth.postgresPassword .Values.auth.postgresPassword) (or (empty $customUser) (eq $customUser "postgres"))) "context" $) | trimAll "\"" | b64dec }} +{{- if and (not $postgresPassword) .Values.auth.enablePostgresUser }} +{{- $postgresPassword = randAlphaNum 10 }} +{{- end }} +{{- $replicationPassword := "" }} +{{- if eq .Values.architecture "replication" }} +{{- $replicationPassword = include "common.secrets.passwords.manage" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.replicationPasswordKey .Values.auth.secretKeys.replicationPasswordKey) "providedValues" (list "auth.replicationPassword") "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- $ldapPassword := "" }} +{{- if and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw) }} +{{- $ldapPassword = coalesce .Values.ldap.bind_password .Values.ldap.bindpw }} +{{- end }} +{{- $password := "" }} +{{- if and (not (empty $customUser)) (ne $customUser "postgres") }} +{{- $password = include "common.secrets.passwords.manage" (dict "secret" (include "postgresql.v1.secretName" .) "key" (coalesce .Values.global.postgresql.auth.secretKeys.userPasswordKey .Values.auth.secretKeys.userPasswordKey) "providedValues" (list "global.postgresql.auth.password" "auth.password") "context" $) | trimAll "\"" | b64dec }} +{{- end }} +{{- $database := include "postgresql.v1.database" . }} +{{- if (include "postgresql.v1.createSecret" .) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +data: + {{- if $postgresPassword }} + postgres-password: {{ $postgresPassword | b64enc | quote }} + {{- end }} + {{- if $password }} + password: {{ $password | b64enc | quote }} + {{- end }} + {{- if $replicationPassword }} + replication-password: {{ $replicationPassword | b64enc | quote }} + {{- end }} + # We don't auto-generate LDAP password when it's not provided as we do for other passwords + {{- if and .Values.ldap.enabled (or .Values.ldap.bind_password .Values.ldap.bindpw) }} + ldap-password: {{ $ldapPassword | b64enc | quote }} + {{- end }} +{{- end }} +{{- if .Values.serviceBindings.enabled }} +{{- if $postgresPassword }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }}-svcbind-postgres + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: servicebinding.io/postgresql +data: + provider: {{ print "bitnami" | b64enc | quote }} + type: {{ print "postgresql" | b64enc | quote }} + host: {{ $host | b64enc | quote }} + port: {{ $port | b64enc | quote }} + username: {{ print "postgres" | b64enc | quote }} + database: {{ print "postgres" | b64enc | quote }} + password: {{ $postgresPassword | b64enc | quote }} + uri: {{ printf "postgresql://postgres:%s@%s:%s/postgres" $postgresPassword $host $port | b64enc | quote }} +{{- end }} +{{- if $password }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }}-svcbind-custom-user + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: servicebinding.io/postgresql +data: + provider: {{ print "bitnami" | b64enc | quote }} + type: {{ print "postgresql" | b64enc | quote }} + host: {{ $host | b64enc | quote }} + port: {{ $port | b64enc | quote }} + username: {{ $customUser | b64enc | quote }} + password: {{ $password | b64enc | quote }} + {{- if $database }} + database: {{ $database | b64enc | quote }} + {{- end }} + uri: {{ printf "postgresql://%s:%s@%s:%s/%s" $customUser $password $host $port $database | b64enc | quote }} +{{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/serviceaccount.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/serviceaccount.yaml new file mode 100644 index 0000000..8886bff --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/serviceaccount.yaml @@ -0,0 +1,18 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "postgresql.v1.serviceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/tls-secrets.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/tls-secrets.yaml new file mode 100644 index 0000000..7e44a43 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/templates/tls-secrets.yaml @@ -0,0 +1,30 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if (include "postgresql.v1.createTlsSecret" . ) }} +{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }} +{{- $ca := genCA "postgresql-ca" 365 }} +{{- $fullname := include "common.names.fullname" . }} +{{- $releaseNamespace := .Release.Namespace }} +{{- $clusterDomain := .Values.clusterDomain }} +{{- $primaryHeadlessServiceName := include "postgresql.v1.primary.svc.headless" . }} +{{- $readHeadlessServiceName := include "postgresql.v1.readReplica.svc.headless" . }} +{{- $altNames := list (printf "*.%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $primaryHeadlessServiceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $readHeadlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $readHeadlessServiceName $releaseNamespace $clusterDomain) $fullname }} +{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $secretName }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }} + tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }} + ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/values.schema.json b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/values.schema.json new file mode 100644 index 0000000..fc41483 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/values.schema.json @@ -0,0 +1,156 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "architecture": { + "type": "string", + "title": "PostgreSQL architecture", + "form": true, + "description": "Allowed values: `standalone` or `replication`" + }, + "auth": { + "type": "object", + "title": "Authentication configuration", + "form": true, + "properties": { + "enablePostgresUser": { + "type": "boolean", + "title": "Enable \"postgres\" admin user", + "description": "Assign a password to the \"postgres\" admin user. Otherwise, remote access will be blocked for this user", + "form": true + }, + "postgresPassword": { + "type": "string", + "title": "Password for the \"postgres\" admin user", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true + }, + "database": { + "type": "string", + "title": "PostgreSQL custom database", + "description": "Name of the custom database to be created during the 1st initialization of PostgreSQL", + "form": true + }, + "username": { + "type": "string", + "title": "PostgreSQL custom user", + "description": "Name of the custom user to be created during the 1st initialization of PostgreSQL. This user only has permissions on the PostgreSQL custom database", + "form": true + }, + "password": { + "type": "string", + "title": "Password for the custom user to create", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true + }, + "replicationUsername": { + "type": "string", + "title": "PostgreSQL replication user", + "description": "Name of user used to manage replication.", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + }, + "replicationPassword": { + "type": "string", + "title": "Password for PostgreSQL replication user", + "description": "Defaults to a random 10-character alphanumeric string if not set", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + } + } + }, + "persistence": { + "type": "object", + "properties": { + "size": { + "type": "string", + "title": "Persistent Volume Size", + "form": true, + "render": "slider", + "sliderMin": 1, + "sliderMax": 100, + "sliderUnit": "Gi" + } + } + }, + "resources": { + "type": "object", + "title": "Required Resources", + "description": "Configure resource requests", + "form": true, + "properties": { + "requests": { + "type": "object", + "properties": { + "memory": { + "type": "string", + "form": true, + "render": "slider", + "title": "Memory Request", + "sliderMin": 10, + "sliderMax": 2048, + "sliderUnit": "Mi" + }, + "cpu": { + "type": "string", + "form": true, + "render": "slider", + "title": "CPU Request", + "sliderMin": 10, + "sliderMax": 2000, + "sliderUnit": "m" + } + } + } + } + }, + "replication": { + "type": "object", + "form": true, + "title": "Replication Details", + "properties": { + "enabled": { + "type": "boolean", + "title": "Enable Replication", + "form": true + }, + "readReplicas": { + "type": "integer", + "title": "read Replicas", + "form": true, + "hidden": { + "value": "standalone", + "path": "architecture" + } + } + } + }, + "volumePermissions": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "form": true, + "title": "Enable Init Containers", + "description": "Change the owner of the persist volume mountpoint to RunAsUser:fsGroup" + } + } + }, + "metrics": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean", + "title": "Configure metrics exporter", + "form": true + } + } + } + } +} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/values.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/values.yaml new file mode 100644 index 0000000..316559c --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/charts/postgresql/values.yaml @@ -0,0 +1,1647 @@ +# Copyright VMware, Inc. +# SPDX-License-Identifier: APACHE-2.0 + +## @section Global parameters +## Please, note that this will override the parameters, including dependencies, configured to use the global value +## +global: + ## @param global.imageRegistry Global Docker image registry + ## + imageRegistry: "" + ## @param global.imagePullSecrets Global Docker registry secret names as an array + ## e.g. + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + ## @param global.storageClass Global StorageClass for Persistent Volume(s) + ## + storageClass: "" + postgresql: + ## @param global.postgresql.auth.postgresPassword Password for the "postgres" admin user (overrides `auth.postgresPassword`) + ## @param global.postgresql.auth.username Name for a custom user to create (overrides `auth.username`) + ## @param global.postgresql.auth.password Password for the custom user to create (overrides `auth.password`) + ## @param global.postgresql.auth.database Name for a custom database to create (overrides `auth.database`) + ## @param global.postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). + ## @param global.postgresql.auth.secretKeys.adminPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## @param global.postgresql.auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## @param global.postgresql.auth.secretKeys.replicationPasswordKey Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.replicationPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + ## + auth: + postgresPassword: "" + username: "" + password: "" + database: "" + existingSecret: "" + secretKeys: + adminPasswordKey: "" + userPasswordKey: "" + replicationPasswordKey: "" + ## @param global.postgresql.service.ports.postgresql PostgreSQL service port (overrides `service.ports.postgresql`) + ## + service: + ports: + postgresql: "" + +## @section Common parameters +## + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.fullname template (will maintain the release name) +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname template +## +fullnameOverride: "" +## @param clusterDomain Kubernetes Cluster Domain +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template) +## +extraDeploy: [] +## @param commonLabels Add labels to all the deployed resources +## +commonLabels: {} +## @param commonAnnotations Add annotations to all the deployed resources +## +commonAnnotations: {} +## Enable diagnostic mode in the statefulset +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command Command to override all containers in the statefulset + ## + command: + - sleep + ## @param diagnosticMode.args Args to override all containers in the statefulset + ## + args: + - infinity + +## @section PostgreSQL common parameters +## + +## Bitnami PostgreSQL image version +## ref: https://hub.docker.com/r/bitnami/postgresql/tags/ +## @param image.registry [default: REGISTRY_NAME] PostgreSQL image registry +## @param image.repository [default: REPOSITORY_NAME/postgresql] PostgreSQL image repository +## @skip image.tag PostgreSQL image tag (immutable tags are recommended) +## @param image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag +## @param image.pullPolicy PostgreSQL image pull policy +## @param image.pullSecrets Specify image pull secrets +## @param image.debug Specify if debug values should be set +## +image: + registry: docker.io + repository: bitnami/postgresql + tag: 16.1.0-debian-11-r22 + digest: "" + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Set to true if you would like to see extra information on logs + ## + debug: false +## Authentication parameters +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#setting-the-root-password-on-first-run +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-on-first-run +## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-user-on-first-run +## +auth: + ## @param auth.enablePostgresUser Assign a password to the "postgres" admin user. Otherwise, remote access will be blocked for this user + ## + enablePostgresUser: true + ## @param auth.postgresPassword Password for the "postgres" admin user. Ignored if `auth.existingSecret` is provided + ## + postgresPassword: "" + ## @param auth.username Name for a custom user to create + ## + username: "" + ## @param auth.password Password for the custom user to create. Ignored if `auth.existingSecret` is provided + ## + password: "" + ## @param auth.database Name for a custom database to create + ## + database: "" + ## @param auth.replicationUsername Name of the replication user + ## + replicationUsername: repl_user + ## @param auth.replicationPassword Password for the replication user. Ignored if `auth.existingSecret` is provided + ## + replicationPassword: "" + ## @param auth.existingSecret Name of existing secret to use for PostgreSQL credentials. `auth.postgresPassword`, `auth.password`, and `auth.replicationPassword` will be ignored and picked up from this secret. The secret might also contains the key `ldap-password` if LDAP is enabled. `ldap.bind_password` will be ignored and picked from this secret in this case. + ## + existingSecret: "" + ## @param auth.secretKeys.adminPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## @param auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## @param auth.secretKeys.replicationPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set. + ## + secretKeys: + adminPasswordKey: postgres-password + userPasswordKey: password + replicationPasswordKey: replication-password + ## @param auth.usePasswordFiles Mount credentials as a files instead of using an environment variable + ## + usePasswordFiles: false +## @param architecture PostgreSQL architecture (`standalone` or `replication`) +## +architecture: standalone +## Replication configuration +## Ignored if `architecture` is `standalone` +## +replication: + ## @param replication.synchronousCommit Set synchronous commit mode. Allowed values: `on`, `remote_apply`, `remote_write`, `local` and `off` + ## @param replication.numSynchronousReplicas Number of replicas that will have synchronous replication. Note: Cannot be greater than `readReplicas.replicaCount`. + ## ref: https://www.postgresql.org/docs/current/runtime-config-wal.html#GUC-SYNCHRONOUS-COMMIT + ## + synchronousCommit: "off" + numSynchronousReplicas: 0 + ## @param replication.applicationName Cluster application name. Useful for advanced replication settings + ## + applicationName: my_application +## @param containerPorts.postgresql PostgreSQL container port +## +containerPorts: + postgresql: 5432 +## Audit settings +## https://github.com/bitnami/containers/tree/main/bitnami/postgresql#auditing +## @param audit.logHostname Log client hostnames +## @param audit.logConnections Add client log-in operations to the log file +## @param audit.logDisconnections Add client log-outs operations to the log file +## @param audit.pgAuditLog Add operations to log using the pgAudit extension +## @param audit.pgAuditLogCatalog Log catalog using pgAudit +## @param audit.clientMinMessages Message log level to share with the user +## @param audit.logLinePrefix Template for log line prefix (default if not set) +## @param audit.logTimezone Timezone for the log timestamps +## +audit: + logHostname: false + logConnections: false + logDisconnections: false + pgAuditLog: "" + pgAuditLogCatalog: "off" + clientMinMessages: error + logLinePrefix: "" + logTimezone: "" +## LDAP configuration +## @param ldap.enabled Enable LDAP support +## DEPRECATED ldap.url It will removed in a future, please use 'ldap.uri' instead +## @param ldap.server IP address or name of the LDAP server. +## @param ldap.port Port number on the LDAP server to connect to +## @param ldap.prefix String to prepend to the user name when forming the DN to bind +## @param ldap.suffix String to append to the user name when forming the DN to bind +## DEPRECATED ldap.baseDN It will removed in a future, please use 'ldap.basedn' instead +## DEPRECATED ldap.bindDN It will removed in a future, please use 'ldap.binddn' instead +## DEPRECATED ldap.bind_password It will removed in a future, please use 'ldap.bindpw' instead +## @param ldap.basedn Root DN to begin the search for the user in +## @param ldap.binddn DN of user to bind to LDAP +## @param ldap.bindpw Password for the user to bind to LDAP +## DEPRECATED ldap.search_attr It will removed in a future, please use 'ldap.searchAttribute' instead +## DEPRECATED ldap.search_filter It will removed in a future, please use 'ldap.searchFilter' instead +## @param ldap.searchAttribute Attribute to match against the user name in the search +## @param ldap.searchFilter The search filter to use when doing search+bind authentication +## @param ldap.scheme Set to `ldaps` to use LDAPS +## DEPRECATED ldap.tls as string is deprecated，please use 'ldap.tls.enabled' instead +## @param ldap.tls.enabled Se to true to enable TLS encryption +## +ldap: + enabled: false + server: "" + port: "" + prefix: "" + suffix: "" + basedn: "" + binddn: "" + bindpw: "" + searchAttribute: "" + searchFilter: "" + scheme: "" + tls: + enabled: false + ## @param ldap.uri LDAP URL beginning in the form `ldap[s]://host[:port]/basedn`. If provided, all the other LDAP parameters will be ignored. + ## Ref: https://www.postgresql.org/docs/current/auth-ldap.html + ## + uri: "" +## @param postgresqlDataDir PostgreSQL data dir folder +## +postgresqlDataDir: /bitnami/postgresql/data +## @param postgresqlSharedPreloadLibraries Shared preload libraries (comma-separated list) +## +postgresqlSharedPreloadLibraries: "pgaudit" +## Start PostgreSQL pod(s) without limitations on shm memory. +## By default docker and containerd (and possibly other container runtimes) limit `/dev/shm` to `64M` +## ref: https://github.com/docker-library/postgres/issues/416 +## ref: https://github.com/containerd/containerd/issues/3654 +## +shmVolume: + ## @param shmVolume.enabled Enable emptyDir volume for /dev/shm for PostgreSQL pod(s) + ## + enabled: true + ## @param shmVolume.sizeLimit Set this to enable a size limit on the shm tmpfs + ## Note: the size of the tmpfs counts against container's memory limit + ## e.g: + ## sizeLimit: 1Gi + ## + sizeLimit: "" +## TLS configuration +## +tls: + ## @param tls.enabled Enable TLS traffic support + ## + enabled: false + ## @param tls.autoGenerated Generate automatically self-signed TLS certificates + ## + autoGenerated: false + ## @param tls.preferServerCiphers Whether to use the server's TLS cipher preferences rather than the client's + ## + preferServerCiphers: true + ## @param tls.certificatesSecret Name of an existing secret that contains the certificates + ## + certificatesSecret: "" + ## @param tls.certFilename Certificate filename + ## + certFilename: "" + ## @param tls.certKeyFilename Certificate key filename + ## + certKeyFilename: "" + ## @param tls.certCAFilename CA Certificate filename + ## If provided, PostgreSQL will authenticate TLS/SSL clients by requesting them a certificate + ## ref: https://www.postgresql.org/docs/9.6/auth-methods.html + ## + certCAFilename: "" + ## @param tls.crlFilename File containing a Certificate Revocation List + ## + crlFilename: "" + +## @section PostgreSQL Primary parameters +## +primary: + ## @param primary.name Name of the primary database (eg primary, master, leader, ...) + ## + name: primary + ## @param primary.configuration PostgreSQL Primary main configuration to be injected as ConfigMap + ## ref: https://www.postgresql.org/docs/current/static/runtime-config.html + ## + configuration: "" + ## @param primary.pgHbaConfiguration PostgreSQL Primary client authentication configuration + ## ref: https://www.postgresql.org/docs/current/static/auth-pg-hba-conf.html + ## e.g:# + ## pgHbaConfiguration: |- + ## local all all trust + ## host all all localhost trust + ## host mydatabase mysuser 192.168.0.0/24 md5 + ## + pgHbaConfiguration: "" + ## @param primary.existingConfigmap Name of an existing ConfigMap with PostgreSQL Primary configuration + ## NOTE: `primary.configuration` and `primary.pgHbaConfiguration` will be ignored + ## + existingConfigmap: "" + ## @param primary.extendedConfiguration Extended PostgreSQL Primary configuration (appended to main or default configuration) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf + ## + extendedConfiguration: "" + ## @param primary.existingExtendedConfigmap Name of an existing ConfigMap with PostgreSQL Primary extended configuration + ## NOTE: `primary.extendedConfiguration` will be ignored + ## + existingExtendedConfigmap: "" + ## Initdb configuration + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#specifying-initdb-arguments + ## + initdb: + ## @param primary.initdb.args PostgreSQL initdb extra arguments + ## + args: "" + ## @param primary.initdb.postgresqlWalDir Specify a custom location for the PostgreSQL transaction log + ## + postgresqlWalDir: "" + ## @param primary.initdb.scripts Dictionary of initdb scripts + ## Specify dictionary of scripts to be run at first boot + ## e.g: + ## scripts: + ## my_init_script.sh: | + ## #!/bin/sh + ## echo "Do something." + ## + scripts: {} + ## @param primary.initdb.scriptsConfigMap ConfigMap with scripts to be run at first boot + ## NOTE: This will override `primary.initdb.scripts` + ## + scriptsConfigMap: "" + ## @param primary.initdb.scriptsSecret Secret with scripts to be run at first boot (in case it contains sensitive information) + ## NOTE: This can work along `primary.initdb.scripts` or `primary.initdb.scriptsConfigMap` + ## + scriptsSecret: "" + ## @param primary.initdb.user Specify the PostgreSQL username to execute the initdb scripts + ## + user: "" + ## @param primary.initdb.password Specify the PostgreSQL password to execute the initdb scripts + ## + password: "" + ## Configure current cluster's primary server to be the standby server in other cluster. + ## This will allow cross cluster replication and provide cross cluster high availability. + ## You will need to configure pgHbaConfiguration if you want to enable this feature with local cluster replication enabled. + ## @param primary.standby.enabled Whether to enable current cluster's primary as standby server of another cluster or not + ## @param primary.standby.primaryHost The Host of replication primary in the other cluster + ## @param primary.standby.primaryPort The Port of replication primary in the other cluster + ## + standby: + enabled: false + primaryHost: "" + primaryPort: "" + ## @param primary.extraEnvVars Array with extra environment variables to add to PostgreSQL Primary nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param primary.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for PostgreSQL Primary nodes + ## + extraEnvVarsCM: "" + ## @param primary.extraEnvVarsSecret Name of existing Secret containing extra env vars for PostgreSQL Primary nodes + ## + extraEnvVarsSecret: "" + ## @param primary.command Override default container command (useful when using custom images) + ## + command: [] + ## @param primary.args Override default container args (useful when using custom images) + ## + args: [] + ## Configure extra options for PostgreSQL Primary containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param primary.livenessProbe.enabled Enable livenessProbe on PostgreSQL Primary containers + ## @param primary.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param primary.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param primary.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param primary.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param primary.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param primary.readinessProbe.enabled Enable readinessProbe on PostgreSQL Primary containers + ## @param primary.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param primary.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param primary.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param primary.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param primary.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param primary.startupProbe.enabled Enable startupProbe on PostgreSQL Primary containers + ## @param primary.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param primary.startupProbe.periodSeconds Period seconds for startupProbe + ## @param primary.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param primary.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param primary.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param primary.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param primary.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param primary.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param primary.lifecycleHooks for the PostgreSQL Primary container to automate configuration before or after startup + ## + lifecycleHooks: {} + ## PostgreSQL Primary resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param primary.resources.limits The resources limits for the PostgreSQL Primary containers + ## @param primary.resources.requests.memory The requested memory for the PostgreSQL Primary containers + ## @param primary.resources.requests.cpu The requested cpu for the PostgreSQL Primary containers + ## + resources: + limits: {} + requests: + memory: 256Mi + cpu: 250m + ## Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param primary.podSecurityContext.enabled Enable security context + ## @param primary.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param primary.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param primary.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param primary.podSecurityContext.fsGroup Group ID for the pod + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param primary.containerSecurityContext.enabled Enabled containers' Security Context + ## @param primary.containerSecurityContext.seLinuxOptions Set SELinux options in container + ## @param primary.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param primary.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param primary.containerSecurityContext.privileged Set container's Security Context privileged + ## @param primary.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param primary.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param primary.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param primary.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param primary.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param primary.hostAliases PostgreSQL primary pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param primary.hostNetwork Specify if host network should be enabled for PostgreSQL pod (postgresql primary) + ## + hostNetwork: false + ## @param primary.hostIPC Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) + ## + hostIPC: false + ## @param primary.labels Map of labels to add to the statefulset (postgresql primary) + ## + labels: {} + ## @param primary.annotations Annotations for PostgreSQL primary pods + ## + annotations: {} + ## @param primary.podLabels Map of labels to add to the pods (postgresql primary) + ## + podLabels: {} + ## @param primary.podAnnotations Map of annotations to add to the pods (postgresql primary) + ## + podAnnotations: {} + ## @param primary.podAffinityPreset PostgreSQL primary pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param primary.podAntiAffinityPreset PostgreSQL primary pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## PostgreSQL Primary node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param primary.nodeAffinityPreset.type PostgreSQL primary node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param primary.nodeAffinityPreset.key PostgreSQL primary node label key to match Ignored if `primary.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param primary.nodeAffinityPreset.values PostgreSQL primary node label values to match. Ignored if `primary.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param primary.affinity Affinity for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: primary.podAffinityPreset, primary.podAntiAffinityPreset, and primary.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param primary.nodeSelector Node labels for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param primary.tolerations Tolerations for PostgreSQL primary pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param primary.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param primary.priorityClassName Priority Class to use for each pod (postgresql primary) + ## + priorityClassName: "" + ## @param primary.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param primary.terminationGracePeriodSeconds Seconds PostgreSQL primary pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param primary.updateStrategy.type PostgreSQL Primary statefulset strategy type + ## @param primary.updateStrategy.rollingUpdate PostgreSQL Primary statefulset rolling update configuration parameters + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param primary.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the PostgreSQL Primary container(s) + ## + extraVolumeMounts: [] + ## @param primary.extraVolumes Optionally specify extra list of additional volumes for the PostgreSQL Primary pod(s) + ## + extraVolumes: [] + ## @param primary.sidecars Add additional sidecar containers to the PostgreSQL Primary pod(s) + ## For example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param primary.initContainers Add additional init containers to the PostgreSQL Primary pod(s) + ## Example + ## + ## initContainers: + ## - name: do-something + ## image: busybox + ## command: ['do', 'something'] + ## + initContainers: [] + ## @param primary.extraPodSpec Optionally specify extra PodSpec for the PostgreSQL Primary pod(s) + ## + extraPodSpec: {} + ## PostgreSQL Primary service configuration + ## + service: + ## @param primary.service.type Kubernetes Service type + ## + type: ClusterIP + ## @param primary.service.ports.postgresql PostgreSQL service port + ## + ports: + postgresql: 5432 + ## Node ports to expose + ## NOTE: choose port between <30000-32767> + ## @param primary.service.nodePorts.postgresql Node port for PostgreSQL + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + postgresql: "" + ## @param primary.service.clusterIP Static clusterIP or None for headless services + ## e.g: + ## clusterIP: None + ## + clusterIP: "" + ## @param primary.service.annotations Annotations for PostgreSQL primary service + ## + annotations: {} + ## @param primary.service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` + ## Set the LoadBalancer service type to internal only + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param primary.service.externalTrafficPolicy Enable client source IP preservation + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param primary.service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param primary.service.extraPorts Extra ports to expose in the PostgreSQL primary service + ## + extraPorts: [] + ## @param primary.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param primary.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param primary.service.headless.annotations Additional custom annotations for headless PostgreSQL primary service + ## + annotations: {} + ## PostgreSQL Primary persistence configuration + ## + persistence: + ## @param primary.persistence.enabled Enable PostgreSQL Primary data persistence using PVC + ## + enabled: true + ## @param primary.persistence.existingClaim Name of an existing PVC to use + ## + existingClaim: "" + ## @param primary.persistence.mountPath The path the volume will be mounted at + ## Note: useful when using custom PostgreSQL images + ## + mountPath: /bitnami/postgresql + ## @param primary.persistence.subPath The subdirectory of the volume to mount to + ## Useful in dev environments and one PV for multiple services + ## + subPath: "" + ## @param primary.persistence.storageClass PVC Storage Class for PostgreSQL Primary data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "" + ## @param primary.persistence.accessModes PVC Access Mode for PostgreSQL volume + ## + accessModes: + - ReadWriteOnce + ## @param primary.persistence.size PVC Storage Request for PostgreSQL volume + ## + size: 8Gi + ## @param primary.persistence.annotations Annotations for the PVC + ## + annotations: {} + ## @param primary.persistence.labels Labels for the PVC + ## + labels: {} + ## @param primary.persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param primary.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## PostgreSQL Primary Persistent Volume Claim Retention Policy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## + persistentVolumeClaimRetentionPolicy: + ## @param primary.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for Primary Statefulset + ## + enabled: false + ## @param primary.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## + whenScaled: Retain + ## @param primary.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + whenDeleted: Retain + +## @section PostgreSQL read only replica parameters (only used when `architecture` is set to `replication`) +## +readReplicas: + ## @param readReplicas.name Name of the read replicas database (eg secondary, slave, ...) + ## + name: read + ## @param readReplicas.replicaCount Number of PostgreSQL read only replicas + ## + replicaCount: 1 + ## @param readReplicas.extendedConfiguration Extended PostgreSQL read only replicas configuration (appended to main or default configuration) + ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#allow-settings-to-be-loaded-from-files-other-than-the-default-postgresqlconf + ## + extendedConfiguration: "" + ## @param readReplicas.extraEnvVars Array with extra environment variables to add to PostgreSQL read only nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param readReplicas.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for PostgreSQL read only nodes + ## + extraEnvVarsCM: "" + ## @param readReplicas.extraEnvVarsSecret Name of existing Secret containing extra env vars for PostgreSQL read only nodes + ## + extraEnvVarsSecret: "" + ## @param readReplicas.command Override default container command (useful when using custom images) + ## + command: [] + ## @param readReplicas.args Override default container args (useful when using custom images) + ## + args: [] + ## Configure extra options for PostgreSQL read only containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param readReplicas.livenessProbe.enabled Enable livenessProbe on PostgreSQL read only containers + ## @param readReplicas.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param readReplicas.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param readReplicas.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param readReplicas.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param readReplicas.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param readReplicas.readinessProbe.enabled Enable readinessProbe on PostgreSQL read only containers + ## @param readReplicas.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param readReplicas.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param readReplicas.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param readReplicas.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param readReplicas.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param readReplicas.startupProbe.enabled Enable startupProbe on PostgreSQL read only containers + ## @param readReplicas.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param readReplicas.startupProbe.periodSeconds Period seconds for startupProbe + ## @param readReplicas.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param readReplicas.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param readReplicas.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param readReplicas.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param readReplicas.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param readReplicas.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param readReplicas.lifecycleHooks for the PostgreSQL read only container to automate configuration before or after startup + ## + lifecycleHooks: {} + ## PostgreSQL read only resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param readReplicas.resources.limits The resources limits for the PostgreSQL read only containers + ## @param readReplicas.resources.requests.memory The requested memory for the PostgreSQL read only containers + ## @param readReplicas.resources.requests.cpu The requested cpu for the PostgreSQL read only containers + ## + resources: + limits: {} + requests: + memory: 256Mi + cpu: 250m + ## Pod Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param readReplicas.podSecurityContext.enabled Enable security context + ## @param readReplicas.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param readReplicas.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param readReplicas.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param readReplicas.podSecurityContext.fsGroup Group ID for the pod + ## + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + ## @param readReplicas.containerSecurityContext.enabled Enabled containers' Security Context + ## @param readReplicas.containerSecurityContext.seLinuxOptions Set SELinux options in container + ## @param readReplicas.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param readReplicas.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param readReplicas.containerSecurityContext.privileged Set container's Security Context privileged + ## @param readReplicas.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param readReplicas.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param readReplicas.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param readReplicas.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param readReplicas.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false + ## @param readReplicas.hostAliases PostgreSQL read only pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param readReplicas.hostNetwork Specify if host network should be enabled for PostgreSQL pod (PostgreSQL read only) + ## + hostNetwork: false + ## @param readReplicas.hostIPC Specify if host IPC should be enabled for PostgreSQL pod (postgresql primary) + ## + hostIPC: false + ## @param readReplicas.labels Map of labels to add to the statefulset (PostgreSQL read only) + ## + labels: {} + ## @param readReplicas.annotations Annotations for PostgreSQL read only pods + ## + annotations: {} + ## @param readReplicas.podLabels Map of labels to add to the pods (PostgreSQL read only) + ## + podLabels: {} + ## @param readReplicas.podAnnotations Map of annotations to add to the pods (PostgreSQL read only) + ## + podAnnotations: {} + ## @param readReplicas.podAffinityPreset PostgreSQL read only pod affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param readReplicas.podAntiAffinityPreset PostgreSQL read only pod anti-affinity preset. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## PostgreSQL read only node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param readReplicas.nodeAffinityPreset.type PostgreSQL read only node affinity preset type. Ignored if `primary.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param readReplicas.nodeAffinityPreset.key PostgreSQL read only node label key to match Ignored if `primary.affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param readReplicas.nodeAffinityPreset.values PostgreSQL read only node label values to match. Ignored if `primary.affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param readReplicas.affinity Affinity for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## Note: primary.podAffinityPreset, primary.podAntiAffinityPreset, and primary.nodeAffinityPreset will be ignored when it's set + ## + affinity: {} + ## @param readReplicas.nodeSelector Node labels for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: {} + ## @param readReplicas.tolerations Tolerations for PostgreSQL read only pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param readReplicas.topologySpreadConstraints Topology Spread Constraints for pod assignment spread across your cluster among failure-domains. Evaluated as a template + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods + ## + topologySpreadConstraints: [] + ## @param readReplicas.priorityClassName Priority Class to use for each pod (PostgreSQL read only) + ## + priorityClassName: "" + ## @param readReplicas.schedulerName Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: "" + ## @param readReplicas.terminationGracePeriodSeconds Seconds PostgreSQL read only pod needs to terminate gracefully + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods + ## + terminationGracePeriodSeconds: "" + ## @param readReplicas.updateStrategy.type PostgreSQL read only statefulset strategy type + ## @param readReplicas.updateStrategy.rollingUpdate PostgreSQL read only statefulset rolling update configuration parameters + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + type: RollingUpdate + rollingUpdate: {} + ## @param readReplicas.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the PostgreSQL read only container(s) + ## + extraVolumeMounts: [] + ## @param readReplicas.extraVolumes Optionally specify extra list of additional volumes for the PostgreSQL read only pod(s) + ## + extraVolumes: [] + ## @param readReplicas.sidecars Add additional sidecar containers to the PostgreSQL read only pod(s) + ## For example: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: [] + ## @param readReplicas.initContainers Add additional init containers to the PostgreSQL read only pod(s) + ## Example + ## + ## initContainers: + ## - name: do-something + ## image: busybox + ## command: ['do', 'something'] + ## + initContainers: [] + ## @param readReplicas.extraPodSpec Optionally specify extra PodSpec for the PostgreSQL read only pod(s) + ## + extraPodSpec: {} + ## PostgreSQL read only service configuration + ## + service: + ## @param readReplicas.service.type Kubernetes Service type + ## + type: ClusterIP + ## @param readReplicas.service.ports.postgresql PostgreSQL service port + ## + ports: + postgresql: 5432 + ## Node ports to expose + ## NOTE: choose port between <30000-32767> + ## @param readReplicas.service.nodePorts.postgresql Node port for PostgreSQL + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## + nodePorts: + postgresql: "" + ## @param readReplicas.service.clusterIP Static clusterIP or None for headless services + ## e.g: + ## clusterIP: None + ## + clusterIP: "" + ## @param readReplicas.service.annotations Annotations for PostgreSQL read only service + ## + annotations: {} + ## @param readReplicas.service.loadBalancerIP Load balancer IP if service type is `LoadBalancer` + ## Set the LoadBalancer service type to internal only + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param readReplicas.service.externalTrafficPolicy Enable client source IP preservation + ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param readReplicas.service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param readReplicas.service.extraPorts Extra ports to expose in the PostgreSQL read only service + ## + extraPorts: [] + ## @param readReplicas.service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP" + ## If "ClientIP", consecutive client requests will be directed to the same Pod + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + ## + sessionAffinity: None + ## @param readReplicas.service.sessionAffinityConfig Additional settings for the sessionAffinity + ## sessionAffinityConfig: + ## clientIP: + ## timeoutSeconds: 300 + ## + sessionAffinityConfig: {} + ## Headless service properties + ## + headless: + ## @param readReplicas.service.headless.annotations Additional custom annotations for headless PostgreSQL read only service + ## + annotations: {} + ## PostgreSQL read only persistence configuration + ## + persistence: + ## @param readReplicas.persistence.enabled Enable PostgreSQL read only data persistence using PVC + ## + enabled: true + ## @param readReplicas.persistence.existingClaim Name of an existing PVC to use + ## + existingClaim: "" + ## @param readReplicas.persistence.mountPath The path the volume will be mounted at + ## Note: useful when using custom PostgreSQL images + ## + mountPath: /bitnami/postgresql + ## @param readReplicas.persistence.subPath The subdirectory of the volume to mount to + ## Useful in dev environments and one PV for multiple services + ## + subPath: "" + ## @param readReplicas.persistence.storageClass PVC Storage Class for PostgreSQL read only data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + storageClass: "" + ## @param readReplicas.persistence.accessModes PVC Access Mode for PostgreSQL volume + ## + accessModes: + - ReadWriteOnce + ## @param readReplicas.persistence.size PVC Storage Request for PostgreSQL volume + ## + size: 8Gi + ## @param readReplicas.persistence.annotations Annotations for the PVC + ## + annotations: {} + ## @param readReplicas.persistence.labels Labels for the PVC + ## + labels: {} + ## @param readReplicas.persistence.selector Selector to match an existing Persistent Volume (this value is evaluated as a template) + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param readReplicas.persistence.dataSource Custom PVC data source + ## + dataSource: {} + ## PostgreSQL Read only Persistent Volume Claim Retention Policy + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## + persistentVolumeClaimRetentionPolicy: + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.enabled Enable Persistent volume retention policy for read only Statefulset + ## + enabled: false + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced + ## + whenScaled: Retain + ## @param readReplicas.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted + ## + whenDeleted: Retain + + +## @section Backup parameters +## This section implements a trivial logical dump cronjob of the database. +## This only comes with the consistency guarantees of the dump program. +## This is not a snapshot based roll forward/backward recovery backup. +## ref: https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ +backup: + ## @param backup.enabled Enable the logical dump of the database "regularly" + enabled: false + cronjob: + ## @param backup.cronjob.schedule Set the cronjob parameter schedule + schedule: "@daily" + ## @param backup.cronjob.timeZone Set the cronjob parameter timeZone + timeZone: "" + ## @param backup.cronjob.concurrencyPolicy Set the cronjob parameter concurrencyPolicy + concurrencyPolicy: Allow + ## @param backup.cronjob.failedJobsHistoryLimit Set the cronjob parameter failedJobsHistoryLimit + failedJobsHistoryLimit: 1 + ## @param backup.cronjob.successfulJobsHistoryLimit Set the cronjob parameter successfulJobsHistoryLimit + successfulJobsHistoryLimit: 3 + ## @param backup.cronjob.startingDeadlineSeconds Set the cronjob parameter startingDeadlineSeconds + startingDeadlineSeconds: "" + ## @param backup.cronjob.ttlSecondsAfterFinished Set the cronjob parameter ttlSecondsAfterFinished + ttlSecondsAfterFinished: "" + ## @param backup.cronjob.restartPolicy Set the cronjob parameter restartPolicy + restartPolicy: OnFailure + ## @param backup.cronjob.podSecurityContext.enabled Enable PodSecurityContext for CronJob/Backup + ## @param backup.cronjob.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy + ## @param backup.cronjob.podSecurityContext.sysctls Set kernel settings using the sysctl interface + ## @param backup.cronjob.podSecurityContext.supplementalGroups Set filesystem extra groups + ## @param backup.cronjob.podSecurityContext.fsGroup Group ID for the CronJob + podSecurityContext: + enabled: true + fsGroupChangePolicy: Always + sysctls: [] + supplementalGroups: [] + fsGroup: 1001 + ## backup container's Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param backup.cronjob.containerSecurityContext.enabled Enabled containers' Security Context + ## @param backup.cronjob.containerSecurityContext.seLinuxOptions Set SELinux options in container + ## @param backup.cronjob.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param backup.cronjob.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param backup.cronjob.containerSecurityContext.privileged Set container's Security Context privileged + ## @param backup.cronjob.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param backup.cronjob.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param backup.cronjob.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param backup.cronjob.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## @param backup.cronjob.command Set backup container's command to run + command: + - /bin/sh + - -c + - "pg_dumpall --clean --if-exists --load-via-partition-root --quote-all-identifiers --no-password --file=${PGDUMP_DIR}/pg_dumpall-$(date '+%Y-%m-%d-%H-%M').pgdump" + + ## @param backup.cronjob.labels Set the cronjob labels + labels: {} + ## @param backup.cronjob.annotations Set the cronjob annotations + annotations: {} + ## @param backup.cronjob.nodeSelector Node labels for PostgreSQL backup CronJob pod assignment + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/ + ## + nodeSelector: {} + storage: + ## @param backup.cronjob.storage.existingClaim Provide an existing `PersistentVolumeClaim` (only when `architecture=standalone`) + ## If defined, PVC must be created manually before volume will be bound + ## + existingClaim: "" + ## @param backup.cronjob.storage.resourcePolicy Setting it to "keep" to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted + ## + resourcePolicy: "" + ## @param backup.cronjob.storage.storageClass PVC Storage Class for the backup data volume + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. + ## + storageClass: "" + ## @param backup.cronjob.storage.accessModes PV Access Mode + ## + accessModes: + - ReadWriteOnce + ## @param backup.cronjob.storage.size PVC Storage Request for the backup data volume + ## + size: 8Gi + ## @param backup.cronjob.storage.annotations PVC annotations + ## + annotations: {} + ## @param backup.cronjob.storage.mountPath Path to mount the volume at + ## + mountPath: /backup/pgdump + ## @param backup.cronjob.storage.subPath Subdirectory of the volume to mount at + ## and one PV for multiple services. + ## + subPath: "" + ## Fine tuning for volumeClaimTemplates + ## + volumeClaimTemplates: + ## @param backup.cronjob.storage.volumeClaimTemplates.selector A label query over volumes to consider for binding (e.g. when using local volumes) + ## A label query over volumes to consider for binding (e.g. when using local volumes) + ## See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#labelselector-v1-meta for more details + ## + selector: {} + +## @section NetworkPolicy parameters +## + +## Add networkpolicies +## +networkPolicy: + ## @param networkPolicy.enabled Enable network policies + ## + enabled: false + ## @param networkPolicy.metrics.enabled Enable network policies for metrics (prometheus) + ## @param networkPolicy.metrics.namespaceSelector [object] Monitoring namespace selector labels. These labels will be used to identify the prometheus' namespace. + ## @param networkPolicy.metrics.podSelector [object] Monitoring pod selector labels. These labels will be used to identify the Prometheus pods. + ## + metrics: + enabled: false + ## e.g: + ## namespaceSelector: + ## label: monitoring + ## + namespaceSelector: {} + ## e.g: + ## podSelector: + ## label: monitoring + ## + podSelector: {} + ## Ingress Rules + ## + ingressRules: + ## @param networkPolicy.ingressRules.primaryAccessOnlyFrom.enabled Enable ingress rule that makes PostgreSQL primary node only accessible from a particular origin. + ## @param networkPolicy.ingressRules.primaryAccessOnlyFrom.namespaceSelector [object] Namespace selector label that is allowed to access the PostgreSQL primary node. This label will be used to identified the allowed namespace(s). + ## @param networkPolicy.ingressRules.primaryAccessOnlyFrom.podSelector [object] Pods selector label that is allowed to access the PostgreSQL primary node. This label will be used to identified the allowed pod(s). + ## @param networkPolicy.ingressRules.primaryAccessOnlyFrom.customRules Custom network policy for the PostgreSQL primary node. + ## + primaryAccessOnlyFrom: + enabled: false + ## e.g: + ## namespaceSelector: + ## label: ingress + ## + namespaceSelector: {} + ## e.g: + ## podSelector: + ## label: access + ## + podSelector: {} + ## custom ingress rules + ## e.g: + ## customRules: + ## - from: + ## - namespaceSelector: + ## matchLabels: + ## label: example + ## + customRules: [] + ## @param networkPolicy.ingressRules.readReplicasAccessOnlyFrom.enabled Enable ingress rule that makes PostgreSQL read-only nodes only accessible from a particular origin. + ## @param networkPolicy.ingressRules.readReplicasAccessOnlyFrom.namespaceSelector [object] Namespace selector label that is allowed to access the PostgreSQL read-only nodes. This label will be used to identified the allowed namespace(s). + ## @param networkPolicy.ingressRules.readReplicasAccessOnlyFrom.podSelector [object] Pods selector label that is allowed to access the PostgreSQL read-only nodes. This label will be used to identified the allowed pod(s). + ## @param networkPolicy.ingressRules.readReplicasAccessOnlyFrom.customRules Custom network policy for the PostgreSQL read-only nodes. + ## + readReplicasAccessOnlyFrom: + enabled: false + ## e.g: + ## namespaceSelector: + ## label: ingress + ## + namespaceSelector: {} + ## e.g: + ## podSelector: + ## label: access + ## + podSelector: {} + ## custom ingress rules + ## e.g: + ## CustomRules: + ## - from: + ## - namespaceSelector: + ## matchLabels: + ## label: example + ## + customRules: [] + ## @param networkPolicy.egressRules.denyConnectionsToExternal Enable egress rule that denies outgoing traffic outside the cluster, except for DNS (port 53). + ## @param networkPolicy.egressRules.customRules Custom network policy rule + ## + egressRules: + # Deny connections to external. This is not compatible with an external database. + denyConnectionsToExternal: false + ## Additional custom egress rules + ## e.g: + ## customRules: + ## - to: + ## - namespaceSelector: + ## matchLabels: + ## label: example + ## + customRules: [] + +## @section Volume Permissions parameters +## + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each node +## +volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume + ## + enabled: false + ## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry + ## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image repository + ## @skip volumePermissions.image.tag Init container volume-permissions image tag (immutable tags are recommended) + ## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy + ## @param volumePermissions.image.pullSecrets Init container volume-permissions image pull secrets + ## + image: + registry: docker.io + repository: bitnami/os-shell + tag: 11-debian-11-r95 + digest: "" + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## Init container resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param volumePermissions.resources.limits Init container volume-permissions resource limits + ## @param volumePermissions.resources.requests Init container volume-permissions resource requests + ## + resources: + limits: {} + requests: {} + ## Init container' Security Context + ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser + ## and not the below volumePermissions.containerSecurityContext.runAsUser + ## @param volumePermissions.containerSecurityContext.seLinuxOptions Set SELinux options in container + ## @param volumePermissions.containerSecurityContext.runAsUser User ID for the init container + ## @param volumePermissions.containerSecurityContext.runAsGroup Group ID for the init container + ## @param volumePermissions.containerSecurityContext.runAsNonRoot runAsNonRoot for the init container + ## @param volumePermissions.containerSecurityContext.seccompProfile.type seccompProfile.type for the init container + ## + containerSecurityContext: + seLinuxOptions: {} + runAsUser: 0 + runAsGroup: 0 + runAsNonRoot: false + seccompProfile: + type: RuntimeDefault +## @section Other Parameters +## + +## @param serviceBindings.enabled Create secret for service binding (Experimental) +## Ref: https://servicebinding.io/service-provider/ +## +serviceBindings: + enabled: false + +## Service account for PostgreSQL to use. +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +## +serviceAccount: + ## @param serviceAccount.create Enable creation of ServiceAccount for PostgreSQL pod + ## + create: true + ## @param serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created + ## Can be set to false if pods using this serviceAccount do not need to use K8s API + ## + automountServiceAccountToken: false + ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount + ## + annotations: {} +## Creates role for ServiceAccount +## @param rbac.create Create Role and RoleBinding (required for PSP to work) +## +rbac: + create: false + ## @param rbac.rules Custom RBAC rules to set + ## e.g: + ## rules: + ## - apiGroups: + ## - "" + ## resources: + ## - pods + ## verbs: + ## - get + ## - list + ## + rules: [] +## Pod Security Policy +## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ +## @param psp.create Whether to create a PodSecurityPolicy. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later +## +psp: + create: false + +## @section Metrics Parameters +## + +metrics: + ## @param metrics.enabled Start a prometheus exporter + ## + enabled: false + ## @param metrics.image.registry [default: REGISTRY_NAME] PostgreSQL Prometheus Exporter image registry + ## @param metrics.image.repository [default: REPOSITORY_NAME/postgres-exporter] PostgreSQL Prometheus Exporter image repository + ## @skip metrics.image.tag PostgreSQL Prometheus Exporter image tag (immutable tags are recommended) + ## @param metrics.image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag + ## @param metrics.image.pullPolicy PostgreSQL Prometheus Exporter image pull policy + ## @param metrics.image.pullSecrets Specify image pull secrets + ## + image: + registry: docker.io + repository: bitnami/postgres-exporter + tag: 0.15.0-debian-11-r6 + digest: "" + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param metrics.collectors Control enabled collectors + ## ref: https://github.com/prometheus-community/postgres_exporter#flags + ## Example: + ## collectors: + ## wal: false + collectors: {} + ## @param metrics.customMetrics Define additional custom metrics + ## ref: https://github.com/prometheus-community/postgres_exporter#adding-new-metrics-via-a-config-file-deprecated + ## customMetrics: + ## pg_database: + ## query: "SELECT d.datname AS name, CASE WHEN pg_catalog.has_database_privilege(d.datname, 'CONNECT') THEN pg_catalog.pg_database_size(d.datname) ELSE 0 END AS size_bytes FROM pg_catalog.pg_database d where datname not in ('template0', 'template1', 'postgres')" + ## metrics: + ## - name: + ## usage: "LABEL" + ## description: "Name of the database" + ## - size_bytes: + ## usage: "GAUGE" + ## description: "Size of the database in bytes" + ## + customMetrics: {} + ## @param metrics.extraEnvVars Extra environment variables to add to PostgreSQL Prometheus exporter + ## see: https://github.com/prometheus-community/postgres_exporter#environment-variables + ## For example: + ## extraEnvVars: + ## - name: PG_EXPORTER_DISABLE_DEFAULT_METRICS + ## value: "true" + ## + extraEnvVars: [] + ## PostgreSQL Prometheus exporter containers' Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param metrics.containerSecurityContext.enabled Enabled containers' Security Context + ## @param metrics.containerSecurityContext.seLinuxOptions Set SELinux options in container + ## @param metrics.containerSecurityContext.runAsUser Set containers' Security Context runAsUser + ## @param metrics.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot + ## @param metrics.containerSecurityContext.privileged Set container's Security Context privileged + ## @param metrics.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem + ## @param metrics.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation + ## @param metrics.containerSecurityContext.capabilities.drop List of capabilities to be dropped + ## @param metrics.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile + ## + containerSecurityContext: + enabled: true + seLinuxOptions: {} + runAsUser: 1001 + runAsNonRoot: true + privileged: false + readOnlyRootFilesystem: false + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + seccompProfile: + type: "RuntimeDefault" + ## Configure extra options for PostgreSQL Prometheus exporter containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param metrics.livenessProbe.enabled Enable livenessProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param metrics.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param metrics.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param metrics.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param metrics.livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param metrics.readinessProbe.enabled Enable readinessProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + successThreshold: 1 + ## @param metrics.startupProbe.enabled Enable startupProbe on PostgreSQL Prometheus exporter containers + ## @param metrics.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param metrics.startupProbe.periodSeconds Period seconds for startupProbe + ## @param metrics.startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param metrics.startupProbe.failureThreshold Failure threshold for startupProbe + ## @param metrics.startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 15 + successThreshold: 1 + ## @param metrics.customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param metrics.customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param metrics.customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## @param metrics.containerPorts.metrics PostgreSQL Prometheus exporter metrics container port + ## + containerPorts: + metrics: 9187 + ## PostgreSQL Prometheus exporter resource requests and limits + ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/ + ## @param metrics.resources.limits The resources limits for the PostgreSQL Prometheus exporter container + ## @param metrics.resources.requests The requested resources for the PostgreSQL Prometheus exporter container + ## + resources: + limits: {} + requests: {} + ## Service configuration + ## + service: + ## @param metrics.service.ports.metrics PostgreSQL Prometheus Exporter service port + ## + ports: + metrics: 9187 + ## @param metrics.service.clusterIP Static clusterIP or None for headless services + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address + ## + clusterIP: "" + ## @param metrics.service.sessionAffinity Control where client requests go, to the same pod or round-robin + ## Values: ClientIP or None + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/ + ## + sessionAffinity: None + ## @param metrics.service.annotations [object] Annotations for Prometheus to auto-discover the metrics endpoint + ## + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "{{ .Values.metrics.service.ports.metrics }}" + ## Prometheus Operator ServiceMonitor configuration + ## + serviceMonitor: + ## @param metrics.serviceMonitor.enabled Create ServiceMonitor Resource for scraping metrics using Prometheus Operator + ## + enabled: false + ## @param metrics.serviceMonitor.namespace Namespace for the ServiceMonitor Resource (defaults to the Release Namespace) + ## + namespace: "" + ## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped. + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + interval: "" + ## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.labels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus + ## + labels: {} + ## @param metrics.serviceMonitor.selector Prometheus instance selector labels + ## ref: https://github.com/bitnami/charts/tree/main/bitnami/prometheus-operator#prometheus-configuration + ## + selector: {} + ## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping + ## + relabelings: [] + ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint + ## + honorLabels: false + ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus. + ## + jobLabel: "" + ## Custom PrometheusRule to be defined + ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart + ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions + ## + prometheusRule: + ## @param metrics.prometheusRule.enabled Create a PrometheusRule for Prometheus Operator + ## + enabled: false + ## @param metrics.prometheusRule.namespace Namespace for the PrometheusRule Resource (defaults to the Release Namespace) + ## + namespace: "" + ## @param metrics.prometheusRule.labels Additional labels that can be used so PrometheusRule will be discovered by Prometheus + ## + labels: {} + ## @param metrics.prometheusRule.rules PrometheusRule definitions + ## Make sure to constraint the rules to the current postgresql service. + ## rules: + ## - alert: HugeReplicationLag + ## expr: pg_replication_lag{service="{{ printf "%s-metrics" (include "common.names.fullname" .) }}"} / 3600 > 1 + ## for: 1m + ## labels: + ## severity: critical + ## annotations: + ## description: replication for {{ include "common.names.fullname" . }} PostgreSQL is lagging by {{ "{{ $value }}" }} hour(s). + ## summary: PostgreSQL replication is lagging by {{ "{{ $value }}" }} hour(s). + ## + rules: [] diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/_helpers.tpl b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/_helpers.tpl new file mode 100644 index 0000000..94def42 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/_helpers.tpl @@ -0,0 +1,133 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "reports-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "reports-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "reports-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "reports-server.labels" -}} +helm.sh/chart: {{ include "reports-server.chart" . }} +{{- if .Values.commonLabels }} +{{ include "reports-server.commonLabels" . }} +{{- end }} +{{ include "reports-server.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "reports-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "reports-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "reports-server.commonLabels" -}} +{{- with .Values.commonLabels }} +{{- toYaml . }} +{{- end }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "reports-server.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "reports-server.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Database config is injected into the environment and passed to the command line from there, if secretName is set, the values will be read from there . +*/}} +{{- define "reports-server.dbHost" -}} +{{- if .Values.config.db.secretName -}} +valueFrom: + secretKeyRef: + key: {{ .Values.config.db.hostSecretKeyName }} + name: {{ .Values.config.db.secretName }} +{{- else -}} +value: {{ default (printf "%s-postgresql.%s" $.Release.Name $.Release.Namespace ) .Values.config.db.host | quote }} +{{- end }} +{{- end }} + +{{- define "reports-server.dbPort" -}} +{{- if .Values.config.db.secretName -}} +valueFrom: + secretKeyRef: + key: {{ .Values.config.db.portSecretKeyName }} + name: {{ .Values.config.db.secretName }} +{{- else -}} +value: {{ .Values.config.db.port | quote }} +{{- end }} +{{- end }} + +{{- define "reports-server.dbName" -}} +{{- if .Values.config.db.secretName -}} +valueFrom: + secretKeyRef: + key: {{ .Values.config.db.dbNameSecretKeyName }} + name: {{ .Values.config.db.secretName }} +{{- else -}} +value: {{ .Values.config.db.name | quote }} +{{- end }} +{{- end }} + +{{- define "reports-server.dbUser" -}} +{{- if .Values.config.db.secretName -}} +valueFrom: + secretKeyRef: + key: {{ .Values.config.db.userSecretKeyName }} + name: {{ .Values.config.db.secretName }} +{{- else -}} +value: {{ .Values.config.db.user | quote }} +{{- end }} +{{- end }} + +{{- define "reports-server.dbPassword" -}} +{{- if .Values.config.db.secretName -}} +valueFrom: + secretKeyRef: + key: {{ .Values.config.db.passwordSecretKeyName }} + name: {{ .Values.config.db.secretName }} +{{- else -}} +value: {{ .Values.config.db.password | quote }} +{{- end }} +{{- end }} + diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/cluster-roles.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/cluster-roles.yaml new file mode 100644 index 0000000..2f36a0c --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/cluster-roles.yaml @@ -0,0 +1,94 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "reports-server.fullname" . }} + labels: + rbac.authorization.k8s.io/aggregate-to-admin: 'true' + rbac.authorization.k8s.io/aggregate-to-edit: 'true' + rbac.authorization.k8s.io/aggregate-to-view: 'true' + {{- include "reports-server.labels" . | nindent 4 }} +rules: +- apiGroups: + - reports.kyverno.io + resources: + - ephemeralreports + - clusterephemeralreports + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - deletecollection +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get +- apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - create +- apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - get + - delete + - update + - patch + resourceNames: + - v1.reports.kyverno.io + - v1alpha2.wgpolicyk8s.io + - v1alpha1.openreports.io +- apiGroups: + - wgpolicyk8s.io + resources: + - policyreports + - policyreports/status + - clusterpolicyreports + - clusterpolicyreports/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - deletecollection +- apiGroups: + - '' + - events.k8s.io + resources: + - events + verbs: + - create + - patch +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "reports-server.fullname" . }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "reports-server.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "reports-server.serviceAccountName" $ }} + namespace: {{ $.Release.Namespace }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/deployment.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/deployment.yaml new file mode 100644 index 0000000..cfacaa3 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/deployment.yaml @@ -0,0 +1,118 @@ +{{- $env := .Values.podEnv }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "reports-server.fullname" . }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} +spec: + strategy: + rollingUpdate: + maxUnavailable: 0 + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "reports-server.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "reports-server.labels" . | nindent 8 }} + spec: + {{- with .Values.priorityClassName }} + priorityClassName: {{ . }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "reports-server.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: reports-server + args: + {{- if .Values.config.etcd.enabled }} + - --etcd + {{- if .Values.config.etcd.insecure }} + - --etcdSkipTLS + {{- end }} + - --etcdEndpoints=https://etcd-0.etcd.{{ $.Release.Namespace }}:2379,https://etcd-1.etcd.{{ $.Release.Namespace }}:2379,https://etcd-2.etcd.{{ $.Release.Namespace }}:2379 + {{- else }} + - --dbsslmode={{ .Values.config.db.sslmode }} + - --dbsslrootcert={{ .Values.config.db.sslrootcert }} + - --dbsslkey={{ .Values.config.db.sslkey }} + - --dbsslcert={{ .Values.config.db.sslcert }} + {{- end }} + - --servicename={{ include "reports-server.fullname" . }} + - --servicens={{ $.Release.Namespace }} + - --storereports={{ .Values.apiServicesManagement.installApiServices.enabled }} + - --storeephemeralreports={{ .Values.apiServicesManagement.installApiServices.installEphemeralReportsService }} + - --storeopenreports={{ .Values.apiServicesManagement.installApiServices.installOpenreportsService }} + - --cert-dir=/tmp + - --secure-port=4443 + {{- if .Values.metrics.enabled }} + - --authorization-always-allow-paths=/metrics + {{- end }} + - --clustername={{ .Values.clusterName }} + env: + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: '1' + - name: DB_HOST + {{- include "reports-server.dbHost" . | nindent 14 }} + - name: DB_PORT + {{- include "reports-server.dbPort" . | nindent 14 }} + - name: DB_DATABASE + {{- include "reports-server.dbName" . | nindent 14 }} + - name: DB_USER + {{- include "reports-server.dbUser" . | nindent 14 }} + - name: DB_PASSWORD + {{- include "reports-server.dbPassword" . | nindent 14 }} + {{- with $env }} + {{- toYaml . | nindent 12 }} + {{- end }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + volumeMounts: + - mountPath: /tmp + name: tmp-dir + image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: https + containerPort: 4443 + protocol: TCP + {{- with .Values.livenessProbe }} + livenessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.readinessProbe }} + readinessProbe: + {{- toYaml . | nindent 12 }} + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - emptyDir: {} + name: tmp-dir diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/etcd.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/etcd.yaml new file mode 100644 index 0000000..e10a8ca --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/etcd.yaml @@ -0,0 +1,170 @@ +{{- if .Values.config.etcd.enabled }} +--- +apiVersion: v1 +kind: Service +metadata: + name: etcd + namespace: {{ $.Release.Namespace }} + labels: + app: etcd-reports-server + {{- include "reports-server.labels" . | nindent 4 }} +spec: + type: ClusterIP + clusterIP: None + selector: + app: etcd-reports-server + publishNotReadyAddresses: true + ports: + - name: etcd-client + port: 2379 + - name: etcd-server + port: 2380 + - name: etcd-metrics + port: 8080 +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + namespace: {{ include "reports-server.fullname" . }} + name: etcd + labels: + app: etcd-reports-server + {{- include "reports-server.labels" . | nindent 4 }} +spec: + serviceName: etcd + replicas: 3 + podManagementPolicy: Parallel + updateStrategy: + type: RollingUpdate + selector: + matchLabels: + app: etcd-reports-server + template: + metadata: + labels: + app: etcd-reports-server + annotations: + serviceName: etcd + spec: + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app + operator: In + values: + - etcd-reports-server + topologyKey: "kubernetes.io/hostname" + containers: + - name: etcd + image: quay.io/coreos/etcd:v3.5.15 + imagePullPolicy: IfNotPresent + ports: + - name: etcd-client + containerPort: 2379 + - name: etcd-server + containerPort: 2380 + - name: etcd-metrics + containerPort: 8080 + readinessProbe: + httpGet: + path: /readyz + port: 8080 + initialDelaySeconds: 10 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 30 + livenessProbe: + httpGet: + path: /livez + port: 8080 + initialDelaySeconds: 15 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + env: + - name: K8S_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: HOSTNAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SERVICE_NAME + valueFrom: + fieldRef: + fieldPath: metadata.annotations['serviceName'] + - name: ETCDCTL_ENDPOINTS + value: $(HOSTNAME).$(SERVICE_NAME):2379 + ## TLS client configuration for etcdctl in the container. + ## These files paths are part of the "etcd-client-certs" volume mount. + # - name: ETCDCTL_KEY + # value: /etc/etcd/certs/client/tls.key + # - name: ETCDCTL_CERT + # value: /etc/etcd/certs/client/tls.crt + # - name: ETCDCTL_CACERT + # value: /etc/etcd/certs/client/ca.crt + ## + ## Use this URI_SCHEME value for non-TLS clusters. + - name: URI_SCHEME + value: "http" + ## TLS: Use this URI_SCHEME for TLS clusters. + # - name: URI_SCHEME + # value: "https" + command: + - /usr/local/bin/etcd + args: + - --name=$(HOSTNAME) + - --data-dir=/data + - --wal-dir=/data/wal + - --listen-peer-urls=$(URI_SCHEME)://0.0.0.0:2380 + - --listen-client-urls=$(URI_SCHEME)://0.0.0.0:2379 + - --advertise-client-urls=$(URI_SCHEME)://$(HOSTNAME).$(SERVICE_NAME):2379 + - --initial-cluster-state=new + - --initial-cluster-token=etcd-$(K8S_NAMESPACE) + - --initial-cluster=etcd-0=$(URI_SCHEME)://etcd-0.$(SERVICE_NAME):2380,etcd-1=$(URI_SCHEME)://etcd-1.$(SERVICE_NAME):2380,etcd-2=$(URI_SCHEME)://etcd-2.$(SERVICE_NAME):2380 + - --initial-advertise-peer-urls=$(URI_SCHEME)://$(HOSTNAME).$(SERVICE_NAME):2380 + - --listen-metrics-urls=http://0.0.0.0:8080 + # - --auto-compaction-mode=periodic + # - --auto-compaction-retention=10m + # - --client-cert-auth + # - --trusted-ca-file=$(ETCDCTL_CACERT) + # - --cert-file=$(ETCDCTL_CERT) + # - --key-file=$(ETCDCTL_KEY) + # - --peer-client-cert-auth + # - --peer-trusted-ca-file=/etc/etcd/certs/server/ca.crt + # - --peer-cert-file=/etc/etcd/certs/server/tls.crt + # - --peer-key-file=/etc/etcd/certs/server/tls.key + volumeMounts: + - name: etcd-data + mountPath: /data + # - name: etcd-client-tls + # mountPath: "/etc/etcd/certs/client" + # readOnly: true + # - name: etcd-server-tls + # mountPath: "/etc/etcd/certs/server" + # readOnly: true + volumes: + # - name: etcd-client-tls + # secret: + # secretName: etcd-client-tls + # optional: false + # - name: etcd-server-tls + # secret: + # secretName: etcd-server-tls + # optional: false + volumeClaimTemplates: + - metadata: + name: etcd-data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 1Gi +{{- end }} + diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/extra-objects.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/extra-objects.yaml new file mode 100644 index 0000000..81c61ac --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/extra-objects.yaml @@ -0,0 +1,8 @@ +{{- range .Values.extraObjects }} +--- + {{- if kindIs "map" . }} + {{- tpl (toYaml .) $ | nindent 0 }} + {{- else if kindIs "string" . }} + {{- tpl . $ | nindent 0 }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/hooks/pre-delete-api-service-cleanup.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/hooks/pre-delete-api-service-cleanup.yaml new file mode 100644 index 0000000..9e7d362 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/hooks/pre-delete-api-service-cleanup.yaml @@ -0,0 +1,77 @@ +{{- if .Values.apiServicesManagement.enabled -}} +{{- if not .Values.templating.enabled -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "reports-server.fullname" . }}-pre-delete-api-services-cleanup + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} + annotations: + helm.sh/hook: pre-delete + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed + helm.sh/hook-weight: "100" +spec: + backoffLimit: 2 + template: + metadata: + {{- with .Values.apiServicesManagement.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- with .Values.apiServicesManagement.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- include "reports-server.labels" . | nindent 8 }} + spec: + serviceAccount: {{ include "reports-server.serviceAccountName" . }} + {{- with .Values.apiServicesManagement.podSecurityContext }} + securityContext: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + restartPolicy: Never + {{- with .Values.apiServicesManagement.imagePullSecrets | default .Values.imagePullSecrets }} + imagePullSecrets: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + containers: + - name: kubectl + image: "{{ .Values.apiServicesManagement.image.registry }}/{{ .Values.apiServicesManagement.image.repository }}:{{ .Values.apiServicesManagement.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.apiServicesManagement.image.pullPolicy }} + command: + - /bin/bash + - '-c' + - |- + set -euo pipefail + kubectl wait -n {{ $.Release.Namespace }} pod --for=condition=ready -l app.kubernetes.io/name={{ include "reports-server.name" . }} --timeout=120s + kubectl delete apiservice v1alpha2.wgpolicyk8s.io v1.reports.kyverno.io --ignore-not-found=true + {{- with .Values.apiServicesManagement.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.apiServicesManagement.tolerations | default .Values.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.apiServicesManagement.nodeSelector | default .Values.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- if or .Values.apiServicesManagement.podAntiAffinity .Values.apiServicesManagement.podAffinity .Values.apiServicesManagement.nodeAffinity }} + affinity: + {{- with .Values.apiServicesManagement.podAntiAffinity }} + podAntiAffinity: + {{- tpl (toYaml .) $ | nindent 10 }} + {{- end }} + {{- with .Values.apiServicesManagement.podAffinity }} + podAffinity: + {{- tpl (toYaml .) $ | nindent 10 }} + {{- end }} + {{- with .Values.apiServicesManagement.nodeAffinity }} + nodeAffinity: + {{- tpl (toYaml .) $ | nindent 10 }} + {{- end }} + {{- end }} +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/namespace.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/namespace.yaml new file mode 100644 index 0000000..b071097 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/namespace.yaml @@ -0,0 +1,6 @@ +{{- if .Values.templating.enabled -}} +apiVersion: v1 +kind: Namespace +metadata: + name: {{ $.Release.Namespace }} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/pod-disruption-budget.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/pod-disruption-budget.yaml new file mode 100644 index 0000000..d94cb51 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/pod-disruption-budget.yaml @@ -0,0 +1,18 @@ +{{- if eq .Values.pdb.enabled true }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "reports-server.fullname" . }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + app.kubernetes.io/name: {{ include "reports-server.name" . }} + {{- if .Values.pdb.maxUnavailable }} + maxUnavailable: {{ .Values.pdb.maxUnavailable }} + {{- else if .Values.pdb.minAvailable }} + minAvailable: {{ .Values.pdb.minAvailable }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/roles.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/roles.yaml new file mode 100644 index 0000000..abbf907 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/roles.yaml @@ -0,0 +1,47 @@ +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "reports-server.fullname" . }} + namespace: kube-system + labels: + {{- include "reports-server.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: extension-apiserver-authentication-reader +subjects: +- kind: ServiceAccount + name: {{ include "reports-server.serviceAccountName" $ }} + namespace: {{ $.Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "reports-server.fullname" . }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} +rules: +- apiGroups: + - '' + resources: + - pods + verbs: + - get + - list +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "reports-server.fullname" . }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "reports-server.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "reports-server.serviceAccountName" $ }} + namespace: {{ $.Release.Namespace }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service-account.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service-account.yaml new file mode 100644 index 0000000..338b946 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service-account.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "reports-server.serviceAccountName" . }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service-monitor.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service-monitor.yaml new file mode 100644 index 0000000..74e5fe8 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service-monitor.yaml @@ -0,0 +1,36 @@ +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "reports-server.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} + {{- with .Values.metrics.serviceMonitor.additionalLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "reports-server.selectorLabels" . | nindent 6 }} + endpoints: + - port: https + path: /metrics + scheme: https + tlsConfig: + insecureSkipVerify: true + {{- if .Values.metrics.serviceMonitor.interval}} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout}} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- with .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.metrics.serviceMonitor.relabelings }} + relabelings: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service.yaml new file mode 100644 index 0000000..53b06d2 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/templates/service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "reports-server.fullname" . }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - name: https + port: {{ .Values.service.port }} + protocol: TCP + targetPort: https + selector: + {{- include "reports-server.selectorLabels" . | nindent 4 }} diff --git a/manifests/helm/kyverno/3.9.0/charts/reports-server/values.yaml b/manifests/helm/kyverno/3.9.0/charts/reports-server/values.yaml new file mode 100644 index 0000000..a2f97a8 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/charts/reports-server/values.yaml @@ -0,0 +1,302 @@ +# -- Internal settings used with `helm template` to generate install manifest +# @ignored +templating: + enabled: false + +postgresql: + image: + registry: docker.io + repository: bitnamilegacy/postgresql + tag: 16.1.0-debian-11-r22 + digest: "" + + # -- Deploy postgresql dependency chart + enabled: true + + auth: + postgresPassword: reports + + database: reportsdb + +# -- Name override +nameOverride: "" + +# -- Full name override +fullnameOverride: "" + +# -- Number of pod replicas +replicaCount: 1 + +# -- Optional cluster name, used to easily identify database records when querying the database directly +clusterName: "" + +image: + # -- Image registry + registry: ghcr.io + # -- Image repository + repository: kyverno/reports-server + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Image tag (will default to app version if not set) + tag: ~ + +# -- Image pull secrets +imagePullSecrets: [] + +# -- Priority class name +priorityClassName: system-cluster-critical + +serviceAccount: + # -- Create service account + create: true + + # -- Service account annotations + annotations: {} + + # -- Service account name (required if `serviceAccount.create` is `false`) + name: "" + +# -- Pod annotations +podAnnotations: {} + +# -- Labels to add to resources managed by the chart +commonLabels: {} + +# -- Pod security context +podSecurityContext: + fsGroup: 2000 + +# -- Provide additional environment variables to the pods. Map with the same format as kubernetes deployment spec's env. +podEnv: {} + +# -- Container security context +# @default -- See [values.yaml](values.yaml) +securityContext: + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + privileged: false + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + +# -- Liveness probe +livenessProbe: + initialDelaySeconds: 20 + failureThreshold: 10 + periodSeconds: 10 + httpGet: + path: /livez + port: https + scheme: HTTPS + +# -- Readiness probe +readinessProbe: + initialDelaySeconds: 30 + failureThreshold: 10 + periodSeconds: 10 + httpGet: + path: /readyz + port: https + scheme: HTTPS + +metrics: + # -- Enable prometheus metrics + enabled: true + + serviceMonitor: + # -- Enable service monitor for scraping prometheus metrics + enabled: false + + # -- Service monitor additional labels + additionalLabels: {} + + # -- Service monitor scrape interval + interval: "" + + # -- Service monitor metric relabelings + metricRelabelings: [] + + # -- Service monitor relabelings + relabelings: [] + + # -- Service monitor scrape timeout + scrapeTimeout: "" + +# We usually recommend not to specify default resources and to leave this as a conscious +# choice for the user. This also increases chances charts run on environments with little +# resources, such as Minikube. If you do want to specify resources, uncomment the following +# lines, adjust them as necessary, and remove the curly braces after 'resources:'. +resources: + # -- Container resource limits + limits: + # cpu: 100m + # memory: 128Mi + + # -- Container resource requests + requests: + # cpu: 100m + # memory: 128Mi + +autoscaling: + # -- Enable autoscaling + enabled: false + + # -- Min number of replicas + minReplicas: 1 + + # -- Max number of replicas + maxReplicas: 100 + + # -- Target CPU utilisation + targetCPUUtilizationPercentage: 80 + + # -- Target Memory utilisation + targetMemoryUtilizationPercentage: ~ + +# -- Using a PDB is highly recommended for highly available deployments. Defaults to enabled. The default configuration doesn't prevent disruption when using a single replica +pdb: + # -- Enable PodDisruptionBudget + enabled: true + # -- minAvailable pods for PDB, cannot be used together with maxUnavailable + minAvailable: ~ + # -- maxUnavailable pods for PDB, will take precedence over minAvailable if both are defined + maxUnavailable: 50% + +# -- Node selector +nodeSelector: {} + +# -- Tolerations +tolerations: [] + +# -- Affinity +affinity: {} + +service: + # -- Service type + type: ClusterIP + + # -- Service port + port: 443 + +config: + etcd: + enabled: false + endpoints: ~ + insecure: true + + db: + # -- If set, database connection information will be read from the Secret with this name. Overrides `db.host`, `db.name`, `db.user`, and `db.password`. + secretName: "" + + # -- Database host + host: "" + # -- The database host will be read from this `key` in the specified Secret, when `db.secretName` is set. + hostSecretKeyName: "host" + + # -- Database port + port: 5432 + # -- The database port will be read from this `key` in the specified Secret, when `db.secretName` is set. + portSecretKeyName: "port" + + # -- Database name + name: reportsdb + # -- The database name will be read from this `key` in the specified Secret, when `db.secretName` is set. + dbNameSecretKeyName: "dbname" + + # -- Database user + user: postgres + + # -- The database username will be read from this `key` in the specified Secret, when `db.secretName` is set. + userSecretKeyName: "username" + + # -- Database password + password: reports + + # -- The database password will be read from this `key` in the specified Secret, when `db.secretName` is set. + passwordSecretKeyName: "password" + + # -- Database SSL + sslmode: disable + + # -- Database SSL root cert + sslrootcert: "" + + # -- Database SSL key + sslkey: "" + + # -- Database SSL cert + sslcert: "" + +apiServicesManagement: + # -- Create a helm hooks to delete api services on uninstall + enabled: true + + # -- Install api services in manifest + installApiServices: + # -- Store reports in reports-server + enabled: true + + # -- Store ephemeral reports in reports-server + installEphemeralReportsService: true + + # -- Store open reports in reports-server + installOpenreportsService: true + + image: + # -- (string) Image registry + registry: docker.io + # -- Image repository + repository: bitnamilegacy/kubectl + # -- Image tag + # Defaults to `latest` if omitted + tag: "1.30.2" + # -- (string) Image pull policy + # Defaults to image.pullPolicy if omitted + pullPolicy: ~ + + # -- Image pull secrets + imagePullSecrets: [] + + # -- Security context for the pod + podSecurityContext: {} + + # -- Node labels for pod assignment + nodeSelector: {} + + # -- List of node taints to tolerate + tolerations: [] + + # -- Pod anti affinity constraints. + podAntiAffinity: {} + + # -- Pod affinity constraints. + podAffinity: {} + + # -- Pod labels. + podLabels: {} + + # -- Pod annotations. + podAnnotations: {} + + # -- Node affinity constraints. + nodeAffinity: {} + + # -- Security context for the hook containers + securityContext: + runAsUser: 65534 + runAsGroup: 65534 + runAsNonRoot: true + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + +extraObjects: [] diff --git a/manifests/helm/kyverno/3.9.0/custom-values.yaml b/manifests/helm/kyverno/3.9.0/custom-values.yaml new file mode 100644 index 0000000..b7859aa --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/custom-values.yaml @@ -0,0 +1,75 @@ +# PaaSup custom-values — kyverno +# +# 3.4.1 → 3.8.2 에서 정리 훅 이미지 좌표가 업스트림에서 바뀌었다. +# 3.4.1: webhooksCleanup/policyReportsCleanup → registry: ~, repository: bitnami/kubectl +# 3.8.2: webhooksCleanup/test → registry: ghcr.io, repository: kyverno/readiness-checker +# 따라서 3.4.1 에서 쓰던 `repository: bitnamilegacy/kubectl` 오버라이드는 3.8.2 에 +# 그대로 옮기면 안 된다(ghcr.io/bitnamilegacy/kubectl 이라는 존재하지 않는 좌표가 된다). +# bitnami→bitnamilegacy 이전 대응이 더는 필요 없어졌으므로 제거한다. +# 또한 policyReportsCleanup 키는 3.8.2 에서 삭제되어 함께 제거한다. +# +# 3.9.0(appVersion v1.19.0)부터 업스트림 태그를 그대로 쓰지 않고 자체 빌드로 전환한다. +# 업스트림이 `ko`로 `ghcr.io/wolfi-dev/static:alpine`(다이제스트 없는 플로팅 태그, Alpine의 +# 스캔 불가능한 rolling edge 브랜치를 추적)에 빌드해 trivy가 이 베이스의 CVE 데이터를 전혀 +# 갖지 못한다(CoverageProbe: none, 실측 확인). 태그 교체·베이스 교체 둘 다 안 통해(모든 +# 버전이 같은 미고정 베이스를 참조) 자체 빌드로 대응했다. 빌드 정의·근거는 별도 레포 +# hardened-containers 의 images/kyverno*, images/*-controller, images/readiness-checker +# (README.md 포함) + ADR docs/decisions/0009-kyverno-self-build.md — 이 레포에는 없다. +# +# 아래 태그(v1.19.0-security-hardened-20260827)는 hardened-containers 게이트를 PASS 한 +# 실측 빌드다(CoverageProbe: ok, 실효 CRITICAL/HIGH 0건 — kyverno 자체는 golang.org/x/mod +# 강제 업그레이드로 해결). 이 커밋 시점에는 아직 docker.io/paasup 에 실제로 push 되지 +# 않았다 — hardened-containers PR 머지 + workflow_dispatch(push=true) 로 게시된 뒤에야 +# 아래 좌표가 실제로 pull 가능해진다. 차트 업그레이드 시 이 태그들도 새 appVersion 에 +# 맞춰 hardened-containers 에서 다시 빌드해 갱신할 것. +admissionController: + container: + image: + registry: docker.io + repository: paasup/kyverno + tag: v1.19.0-security-hardened-20260827 + initContainer: + image: + registry: docker.io + repository: paasup/kyvernopre + tag: v1.19.0-security-hardened-20260827 + +backgroundController: + image: + registry: docker.io + repository: paasup/background-controller + tag: v1.19.0-security-hardened-20260827 + +cleanupController: + image: + registry: docker.io + repository: paasup/cleanup-controller + tag: v1.19.0-security-hardened-20260827 + +reportsController: + image: + registry: docker.io + repository: paasup/reports-controller + tag: v1.19.0-security-hardened-20260827 + +crds: + migration: + image: + registry: docker.io + repository: paasup/kyverno-cli + tag: v1.19.0-security-hardened-20260827 + +# test(helm test 훅)·webhooksCleanup(pre-delete 훅)은 둘 다 readiness-checker 이미지를 쓴다 +# (3.8.2 에서 업스트림이 그렇게 바꿨다 — 위 히스토리 참고). 차트 기본 tag 가 비어 있어 +# `latest` 로 떨어지므로 자체 빌드 좌표로 고정한다. +test: + image: + registry: docker.io + repository: paasup/readiness-checker + tag: v1.19.0-security-hardened-20260827 + +webhooksCleanup: + image: + registry: docker.io + repository: paasup/readiness-checker + tag: v1.19.0-security-hardened-20260827 diff --git a/manifests/helm/kyverno/3.9.0/templates/NOTES.txt b/manifests/helm/kyverno/3.9.0/templates/NOTES.txt new file mode 100644 index 0000000..2e5ac91 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/NOTES.txt @@ -0,0 +1,81 @@ +Chart version: {{ .Chart.Version }} +Kyverno version: {{ default .Chart.AppVersion (default .Values.admissionController.container.image.tag .Values.admissionController.initContainer.image.tag) }} + +Thank you for installing {{ .Chart.Name }}! Your release is named {{ .Release.Name }}. + +The following components have been installed in your cluster: +{{- if .Values.crds.install }} +- CRDs +{{- end }} +- Admission controller +{{- if .Values.reportsController.enabled }} +- Reports controller +{{- end }} +{{- if .Values.cleanupController.enabled }} +- Cleanup controller +{{- end }} +{{- if .Values.backgroundController.enabled }} +- Background controller +{{- end }} +{{- if .Values.reportsServer.enabled }} +- Reports server +{{- end }} +{{- if .Values.grafana.enabled }} +- Grafana dashboard +{{- end }} + +{{- if .Values.reportsServer.enabled }} + +## Reports Server Integration + +The Kyverno chart has been configured to install reports-server alongside Kyverno components. + +Reports-server provides centralized storage for policy reports and enables advanced reporting capabilities. + +{{- if .Values.reportsServer.waitForReady }} +All Kyverno components have been configured to wait for reports-server to be ready before starting. +This ensures proper initialization sequence. +{{- end }} + +To access reports-server, use: + kubectl port-forward -n {{ include "kyverno.namespace" . }} svc/reports-server 8080:443 + + + +{{- end }} + +{{ if not .Values.admissionController.replicas }} +⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode. +{{- else if lt (int .Values.admissionController.replicas) 2 }} +⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode. +{{- end }} + +{{- if semverCompare "<1.21.0" .Capabilities.KubeVersion.Version }} +⚠️ WARNING: The minimal Kubernetes version officially supported by Kyverno is 1.21. Earlier versions are untested and Kyverno is not guaranteed to work with Kubernetes {{ .Capabilities.KubeVersion.Version }}. +{{- end }} + +{{- with .Values.config.matchConditions }} +⚠️ WARNING: Match conditions require a Kubernetes 1.27+ cluster with `AdmissionWebhookMatchConditions` feature gate enabled. +{{- end }} + +{{- with .Values.features.generateMutatingAdmissionPolicy.enabled }} +⚠️ WARNING: Generating MutatingAdmissionPolicy requires a Kubernetes 1.32+ cluster with `MutatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled. +{{- end }} + +{{- with .Values.features.mutatingAdmissionPolicyReports.enabled }} +⚠️ WARNING: Generating reports from MutatingAdmissionPolicies requires a Kubernetes 1.32+ cluster with `MutatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled. +{{- end }} + +{{ if not .Values.features.policyExceptions.enabled }} +⚠️ WARNING: PolicyExceptions are disabled by default. To enable them, set '--enablePolicyException' to true. +{{- end }} + +{{- if and .Values.crds.install (or .Values.crds.groups.kyverno.clusterpolicies .Values.crds.groups.kyverno.policies .Values.crds.groups.kyverno.cleanuppolicies .Values.crds.groups.kyverno.clustercleanuppolicies .Values.crds.groups.kyverno.policyexceptions) }} +⚠️ WARNING: The legacy kyverno.io policy types are deprecated and will be removed in a future release. Migrate to their policies.kyverno.io replacements: + - ClusterPolicy / Policy → ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy (and their namespaced variants) + - ClusterCleanupPolicy / CleanupPolicy → DeletingPolicy / NamespacedDeletingPolicy + - PolicyException (kyverno.io) → PolicyException (policies.kyverno.io) + See https://kyverno.io/docs/guides/migration-to-cel/ for the migration guide. +{{- end }} + +💡 Note: There is a trade-off when deciding which approach to take regarding Namespace exclusions. Please see the documentation at https://kyverno.io/docs/installation/#security-vs-operability to understand the risks. diff --git a/manifests/helm/kyverno/3.4.1/templates/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/_helpers.tpl similarity index 57% rename from manifests/helm/kyverno/3.4.1/templates/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/_helpers.tpl index f9918d6..9f8d6f1 100644 --- a/manifests/helm/kyverno/3.4.1/templates/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/_helpers.tpl @@ -1,8 +1,15 @@ {{/* vim: set filetype=mustache: */}} +{{/* Validate OpenReports configuration */}} +{{- define "kyverno.validateOpenReports" -}} +{{- if and (not .Values.openreports.enabled) .Values.openreports.installCrds -}} +{{- fail "OpenReports CRD installation (openreports.installCrds) cannot be enabled when the feature (openreports.enabled) is disabled" -}} +{{- end -}} +{{- end -}} + {{- define "kyverno.chartVersion" -}} -{{- if .Values.templating.enabled -}} - {{- required "templating.version is required when templating.enabled is true" .Values.templating.version | replace "+" "_" -}} +{{- if .Values.global.templating.enabled -}} + {{- required "templating.version is required when templating.enabled is true" .Values.global.templating.version | replace "+" "_" -}} {{- else -}} {{- .Chart.Version | replace "+" "_" -}} {{- end -}} @@ -25,9 +32,15 @@ {{- with .validatingAdmissionPolicyReports -}} {{- $flags = append $flags (print "--validatingAdmissionPolicyReports=" .enabled) -}} {{- end -}} +{{- with .mutatingAdmissionPolicyReports -}} + {{- $flags = append $flags (print "--mutatingAdmissionPolicyReports=" .enabled) -}} +{{- end -}} {{- with .autoUpdateWebhooks -}} {{- $flags = append $flags (print "--autoUpdateWebhooks=" .enabled) -}} {{- end -}} +{{- with .excludeBootstrapResources -}} + {{- $flags = append $flags (print "--excludeBootstrapResources=" .enabled) -}} +{{- end -}} {{- with .backgroundScan -}} {{- $flags = append $flags (print "--backgroundScan=" .enabled) -}} {{- $flags = append $flags (print "--backgroundScanWorkers=" .backgroundScanWorkers) -}} @@ -37,6 +50,9 @@ {{- with .configMapCaching -}} {{- $flags = append $flags (print "--enableConfigMapCaching=" .enabled) -}} {{- end -}} +{{- with .controllerRuntimeMetrics -}} + {{- $flags = append $flags (print "--controllerRuntimeMetricsAddress=" .bindAddress) -}} +{{- end -}} {{- with .deferredLoading -}} {{- $flags = append $flags (print "--enableDeferredLoading=" .enabled) -}} {{- end -}} @@ -49,15 +65,20 @@ {{- with .generateValidatingAdmissionPolicy -}} {{- $flags = append $flags (print "--generateValidatingAdmissionPolicy=" .enabled) -}} {{- end -}} +{{- with .generateMutatingAdmissionPolicy -}} + {{- $flags = append $flags (print "--generateMutatingAdmissionPolicy=" .enabled) -}} +{{- end -}} {{- with .dumpPatches -}} {{- $flags = append $flags (print "--dumpPatches=" .enabled) -}} {{- end -}} {{- with .globalContext -}} {{- $flags = append $flags (print "--maxAPICallResponseLength=" (int .maxApiCallResponseLength)) -}} + {{- $flags = append $flags (print "--apiCallTimeout=" .apiCallTimeout) -}} + {{- $flags = append $flags (print "--maxGlobalContextEntries=" (int .maxGlobalContextEntries)) -}} {{- end -}} {{- with .logging -}} {{- $flags = append $flags (print "--loggingFormat=" .format) -}} - {{- $flags = append $flags (print "--v=" (join "," .verbosity)) -}} + {{- $flags = append $flags (print "--v=" .verbosity) -}} {{- end -}} {{- with .omitEvents -}} {{- with .eventTypes -}} @@ -94,26 +115,64 @@ {{- $flags = append $flags (print "--tufRootRaw=" .) -}} {{- end -}} {{- end -}} -{{- with .reporting -}} - {{- $reportingConfig := list -}} - {{- with .validate -}} - {{- $reportingConfig = append $reportingConfig "validate" -}} - {{- end -}} - {{- with .mutate -}} - {{- $reportingConfig = append $reportingConfig "mutate" -}} - {{- end -}} - {{- with .mutateExisting -}} - {{- $reportingConfig = append $reportingConfig "mutateExisting" -}} - {{- end -}} - {{- with .imageVerify -}} - {{- $reportingConfig = append $reportingConfig "imageVerify" -}} - {{- end -}} - {{- with .generate -}} - {{- $reportingConfig = append $reportingConfig "generate" -}} - {{- end -}} - {{- $flags = append $flags (print "--enableReporting=" (join "," $reportingConfig)) -}} +{{- with .reporting }} + {{- $reportingConfig := list }} + {{- with .validate }} + {{- $reportingConfig = append $reportingConfig "validate" }} + {{- end }} + {{- with .mutate }} + {{- $reportingConfig = append $reportingConfig "mutate" }} + {{- end }} + {{- with .mutateExisting }} + {{- $reportingConfig = append $reportingConfig "mutateExisting" }} + {{- end }} + {{- with .imageVerify }} + {{- $reportingConfig = append $reportingConfig "imageVerify" }} + {{- end }} + {{- with .generate }} + {{- $reportingConfig = append $reportingConfig "generate" }} + {{- end }} + {{- $flags = append $flags (print "--enableReporting=" (join "," $reportingConfig)) }} + {{- with .allowedResults }} + {{- $resultsConfig := list }} + {{- with .pass }} + {{- $resultsConfig = append $resultsConfig "pass" }} + {{- end }} + {{- with .fail }} + {{- $resultsConfig = append $resultsConfig "fail" }} + {{- end }} + {{- with .error }} + {{- $resultsConfig = append $resultsConfig "error" }} + {{- end }} + {{- with .skip }} + {{- $resultsConfig = append $resultsConfig "skip" }} + {{- end }} + {{- with .warn }} + {{- $resultsConfig = append $resultsConfig "warn" }} + {{- end }} + {{- $flags = append $flags (print "--allowedResults=" (join "," $resultsConfig)) }} + {{- end }} {{- end -}} {{- with $flags -}} {{- toYaml . -}} {{- end -}} {{- end -}} + +{{/* Helper function to sort imagePullSecrets by name to ensure consistent ordering */}} +{{- define "kyverno.sortedImagePullSecrets" -}} +{{- if . -}} +{{- $secrets := list -}} +{{- range . -}} +{{- $secrets = append $secrets .name -}} +{{- end -}} +{{- $sortedSecrets := list -}} +{{- if $secrets -}} +{{- $sortedSecrets = sortAlpha $secrets -}} +{{- end -}} +{{- $sortedRefs := list -}} +{{- range $sortedSecrets -}} +{{- $sortedRefs = append $sortedRefs (dict "name" .) -}} +{{- end -}} +{{- toYaml $sortedRefs -}} +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/_helpers/_deployment.tpl b/manifests/helm/kyverno/3.9.0/templates/_helpers/_deployment.tpl similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/_helpers/_deployment.tpl rename to manifests/helm/kyverno/3.9.0/templates/_helpers/_deployment.tpl diff --git a/manifests/helm/kyverno/3.4.1/templates/_helpers/_flowcontrol.tpl b/manifests/helm/kyverno/3.9.0/templates/_helpers/_flowcontrol.tpl similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/_helpers/_flowcontrol.tpl rename to manifests/helm/kyverno/3.9.0/templates/_helpers/_flowcontrol.tpl diff --git a/manifests/helm/kyverno/3.4.1/templates/_helpers/_image.tpl b/manifests/helm/kyverno/3.9.0/templates/_helpers/_image.tpl similarity index 57% rename from manifests/helm/kyverno/3.4.1/templates/_helpers/_image.tpl rename to manifests/helm/kyverno/3.9.0/templates/_helpers/_image.tpl index 7f80491..76cbe6b 100644 --- a/manifests/helm/kyverno/3.4.1/templates/_helpers/_image.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/_helpers/_image.tpl @@ -2,8 +2,13 @@ {{- define "kyverno.image" -}} {{- $tag := default .defaultTag .image.tag -}} -{{- if not (typeIs "string" $tag) -}} - {{ fail "Image tags must be strings." }} +{{- if kindIs "invalid" $tag -}} + {{- fail "An image tag is required. Please set a tag value or ensure defaultTag is provided." -}} +{{- else if not (typeIs "string" $tag) -}} + {{- fail "Image tags must be strings." -}} +{{- end -}} +{{- if eq $tag "" -}} + {{- fail "An image tag is required. Please set a tag value or ensure defaultTag is provided." -}} {{- end -}} {{- $imageRegistry := default (default .image.defaultRegistry .globalRegistry) .image.registry -}} {{- if $imageRegistry -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/_helpers/_labels.tpl b/manifests/helm/kyverno/3.9.0/templates/_helpers/_labels.tpl similarity index 95% rename from manifests/helm/kyverno/3.4.1/templates/_helpers/_labels.tpl rename to manifests/helm/kyverno/3.9.0/templates/_helpers/_labels.tpl index 8207781..47e1dcd 100644 --- a/manifests/helm/kyverno/3.4.1/templates/_helpers/_labels.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/_helpers/_labels.tpl @@ -11,7 +11,7 @@ {{- end -}} {{- define "kyverno.labels.helm" -}} -{{- if not .Values.templating.enabled -}} +{{- if not .Values.global.templating.enabled -}} helm.sh/chart: {{ template "kyverno.chart" . }} app.kubernetes.io/managed-by: {{ .Release.Service }} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/_helpers/_names.tpl b/manifests/helm/kyverno/3.9.0/templates/_helpers/_names.tpl similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/_helpers/_names.tpl rename to manifests/helm/kyverno/3.9.0/templates/_helpers/_names.tpl diff --git a/manifests/helm/kyverno/3.4.1/templates/_helpers/_pdb.tpl b/manifests/helm/kyverno/3.9.0/templates/_helpers/_pdb.tpl similarity index 83% rename from manifests/helm/kyverno/3.4.1/templates/_helpers/_pdb.tpl rename to manifests/helm/kyverno/3.9.0/templates/_helpers/_pdb.tpl index 7453303..5a21589 100644 --- a/manifests/helm/kyverno/3.4.1/templates/_helpers/_pdb.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/_helpers/_pdb.tpl @@ -18,4 +18,7 @@ minAvailable: {{ default 1 .minAvailable }} {{- if .maxUnavailable }} maxUnavailable: {{ .maxUnavailable }} {{- end }} +{{- if .unhealthyPodEvictionPolicy }} +unhealthyPodEvictionPolicy: {{ .unhealthyPodEvictionPolicy }} +{{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/_templating/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/_templating/_helpers.tpl similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/_templating/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/_templating/_helpers.tpl diff --git a/manifests/helm/kyverno/3.4.1/templates/_templating/namespace.yaml b/manifests/helm/kyverno/3.9.0/templates/_templating/namespace.yaml similarity index 78% rename from manifests/helm/kyverno/3.4.1/templates/_templating/namespace.yaml rename to manifests/helm/kyverno/3.9.0/templates/_templating/namespace.yaml index b213c83..e405878 100644 --- a/manifests/helm/kyverno/3.4.1/templates/_templating/namespace.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/_templating/namespace.yaml @@ -1,4 +1,4 @@ -{{- if .Values.templating.enabled -}} +{{- if .Values.global.templating.enabled -}} apiVersion: v1 kind: Namespace metadata: diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/admission-controller/_helpers.tpl similarity index 93% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/_helpers.tpl index 0be041a..ed1db87 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/_helpers.tpl @@ -6,6 +6,7 @@ {{- define "kyverno.admission-controller.labels" -}} {{- template "kyverno.labels.merge" (list + (include "kyverno.labels.name" (include "kyverno.admission-controller.name" .)) (include "kyverno.labels.common" .) (include "kyverno.admission-controller.matchLabels" .) ) -}} @@ -36,4 +37,4 @@ {{- define "kyverno.admission-controller.caCertificatesConfigMapName" -}} {{ printf "%s-ca-certificates" (include "kyverno.admission-controller.name" .) }} -{{- end -}} \ No newline at end of file +{{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/templates/admission-controller/cert-manager-certificates.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/cert-manager-certificates.yaml new file mode 100644 index 0000000..37ad46e --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/cert-manager-certificates.yaml @@ -0,0 +1,99 @@ +{{- if and .Values.admissionController.certManager.enabled (not .Values.admissionController.createSelfSignedCert) -}} +{{- $ns := include "kyverno.namespace" . -}} +{{- $svcName := include "kyverno.admission-controller.serviceName" . -}} +{{- $fullSvcName := printf "%s.%s.svc" $svcName $ns -}} +{{- $algorithm := .Values.admissionController.certManager.algorithm | default "RSA" -}} +{{- $size := .Values.admissionController.certManager.size | default 2048 -}} +{{- $caIssuerName := printf "%s-ca-issuer" (include "kyverno.fullname" .) -}} +{{- $selfSignedIssuerName := printf "%s-selfsigned-issuer" (include "kyverno.fullname" .) -}} +--- +# Self-signed ClusterIssuer for generating the CA certificate +{{- if .Values.admissionController.certManager.createSelfSignedIssuer }} +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: {{ $selfSignedIssuerName }} + labels: + {{- include "kyverno.admission-controller.labels" . | nindent 4 }} +spec: + selfSigned: {} +--- +{{- end }} +# CA Certificate for signing Kyverno admission controller TLS certificates +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "kyverno.fullname" . }}-admission-controller-ca + namespace: {{ $ns }} + labels: + {{- include "kyverno.admission-controller.labels" . | nindent 4 }} +spec: + isCA: true + commonName: {{ include "kyverno.fullname" . }}-admission-controller-ca + # Use the exact secret name Kyverno expects for admission controller CA + secretName: {{ $fullSvcName }}.kyverno-tls-ca + duration: {{ .Values.admissionController.certManager.ca.duration | default "87600h" }} + renewBefore: {{ .Values.admissionController.certManager.ca.renewBefore | default "720h" }} + privateKey: + algorithm: {{ $algorithm }} + {{- if ne $algorithm "Ed25519" }} + size: {{ $size }} + {{- end }} + issuerRef: + {{- if .Values.admissionController.certManager.issuerRef.name }} + name: {{ .Values.admissionController.certManager.issuerRef.name }} + kind: {{ .Values.admissionController.certManager.issuerRef.kind | default "ClusterIssuer" }} + group: {{ .Values.admissionController.certManager.issuerRef.group | default "cert-manager.io" }} + {{- else if .Values.admissionController.certManager.createSelfSignedIssuer }} + name: {{ $selfSignedIssuerName }} + kind: ClusterIssuer + group: cert-manager.io + {{- else }} + {{- fail "Either certManager.issuerRef.name must be specified or certManager.createSelfSignedIssuer must be true" }} + {{- end }} +--- +# CA Issuer using the CA certificate for signing TLS certificates +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ $caIssuerName }} + namespace: {{ $ns }} + labels: + {{- include "kyverno.admission-controller.labels" . | nindent 4 }} +spec: + ca: + # Reference the CA secret created by the CA certificate + secretName: {{ $fullSvcName }}.kyverno-tls-ca +--- +# TLS Certificate for Kyverno Admission Controller +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "kyverno.fullname" . }}-admission-controller-tls + namespace: {{ $ns }} + labels: + {{- include "kyverno.admission-controller.labels" . | nindent 4 }} +spec: + # Use the exact secret name Kyverno expects for admission controller TLS + secretName: {{ $fullSvcName }}.kyverno-tls-pair + duration: {{ .Values.admissionController.certManager.tls.duration | default "8760h" }} + renewBefore: {{ .Values.admissionController.certManager.tls.renewBefore | default "720h" }} + privateKey: + algorithm: {{ $algorithm }} + {{- if ne $algorithm "Ed25519" }} + size: {{ $size }} + {{- end }} + usages: + - server auth + - digital signature + - key encipherment + dnsNames: + - {{ $svcName }} + - {{ $svcName }}.{{ $ns }} + - {{ $svcName }}.{{ $ns }}.svc + - {{ $svcName }}.{{ $ns }}.svc.cluster.local + issuerRef: + name: {{ $caIssuerName }} + kind: Issuer + group: cert-manager.io +{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/clusterrole.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/clusterrole.yaml similarity index 79% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/clusterrole.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/clusterrole.yaml index 4b88f57..ee64c9e 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/clusterrole.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/clusterrole.yaml @@ -16,14 +16,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ template "kyverno.admission-controller.roleName" . }}:core - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/webhooks - - kyverno.io/exceptionwebhooks - - kyverno.io/globalcontextwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.admission-controller.labels" . | nindent 4 }} rules: @@ -33,15 +25,21 @@ rules: - customresourcedefinitions verbs: - get + {{- if .Values.admissionController.crdWatcher | default .Values.global.crdWatcher }} + - list + - watch + {{- end }} - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations - {{- if .Values.features.generateValidatingAdmissionPolicy.enabled }} + # Always grant permissions for admission policies to support per-policy generation overrides + # even when global generateValidatingAdmissionPolicy/generateMutatingAdmissionPolicy flags are disabled. - validatingadmissionpolicies - validatingadmissionpolicybindings - {{- end }} + - mutatingadmissionpolicies + - mutatingadmissionpolicybindings verbs: - create - delete @@ -73,7 +71,45 @@ rules: - updaterequests/status - globalcontextentries - globalcontextentries/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - deletecollection + - apiGroups: + - kyverno.io + resources: - policyexceptions + verbs: + - create + - get + - list + - patch + - update + - watch + - apiGroups: + - policies.kyverno.io + resources: + - validatingpolicies + - validatingpolicies/status + - namespacedvalidatingpolicies + - namespacedvalidatingpolicies/status + - imagevalidatingpolicies + - imagevalidatingpolicies/status + - namespacedimagevalidatingpolicies + - namespacedimagevalidatingpolicies/status + - generatingpolicies + - generatingpolicies/status + - namespacedgeneratingpolicies + - namespacedgeneratingpolicies/status + - mutatingpolicies + - mutatingpolicies/status + - namespacedmutatingpolicies + - namespacedmutatingpolicies/status verbs: - create - delete @@ -86,20 +122,14 @@ rules: - apiGroups: - policies.kyverno.io resources: - - validatingpolicies - - validatingpolicies/status - policyexceptions - - imagevalidatingpolicies - - imagevalidatingpolicies/status verbs: - create - - delete - get - list - patch - update - watch - - deletecollection - apiGroups: - reports.kyverno.io resources: @@ -165,31 +195,6 @@ rules: - get - list - watch - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - resourceNames: - - {{ template "kyverno.admission-controller.roleName" . }} - - {{ template "kyverno.admission-controller.roleName" . }}:core - - {{ template "kyverno.admission-controller.roleName" . }}:temporary - verbs: - - get - - patch - - update - - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - verbs: - - create - - list - {{- end }} - {{- end }} {{- with .Values.admissionController.rbac.coreClusterRole.extraResources }} {{- toYaml . | nindent 2 }} {{- end }} diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/clusterrolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/clusterrolebinding.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/clusterrolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/clusterrolebinding.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/configmap.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/configmap.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/configmap.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/configmap.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/deployment.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/deployment.yaml similarity index 74% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/deployment.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/deployment.yaml index 7c61fe6..a6e9f31 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/deployment.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/deployment.yaml @@ -1,25 +1,23 @@ -{{- if not .Values.templating.debug -}} +{{- if not .Values.global.templating.debug -}} +{{- $automountSAToken := .Values.admissionController.rbac.serviceAccount.automountServiceAccountToken }} apiVersion: apps/v1 kind: Deployment metadata: name: {{ template "kyverno.admission-controller.name" . }} namespace: {{ template "kyverno.namespace" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/webhooks - - kyverno.io/exceptionwebhooks - - kyverno.io/globalcontextwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.admission-controller.labels" . | nindent 4 }} + {{- with .Values.admissionController.labels }} + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- with .Values.admissionController.annotations }} annotations: {{- tpl (toYaml .) $ | nindent 4 }} {{- end }} spec: + {{- if not .Values.admissionController.autoscaling.enabled }} replicas: {{ template "kyverno.deployment.replicas" .Values.admissionController.replicas }} + {{- end }} revisionHistoryLimit: {{ .Values.admissionController.revisionHistoryLimit }} {{- with .Values.admissionController.updateStrategy }} strategy: @@ -41,7 +39,7 @@ spec: spec: {{- with .Values.admissionController.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }} {{- end }} {{- with .Values.admissionController.podSecurityContext }} securityContext: @@ -59,7 +57,7 @@ spec: topologySpreadConstraints: {{- tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- with .Values.admissionController.priorityClassName }} + {{- with .Values.admissionController.priorityClassName | default .Values.global.priorityClassName }} priorityClassName: {{ . | quote }} {{- end }} {{- with .Values.admissionController.hostNetwork }} @@ -90,17 +88,22 @@ spec: {{- end }} {{- end }} serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }} + automountServiceAccountToken: {{ $automountSAToken }} initContainers: {{- with .Values.admissionController.extraInitContainers }} {{- toYaml . | nindent 8 }} {{- end }} + {{- if and .Values.reportsServer.enabled .Values.reportsServer.waitForReady }} + {{- include "kyverno.reportsServer.initContainer" . | nindent 8 }} + {{- end }} - name: kyverno-pre - image: {{ include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.admissionController.initContainer.image "defaultTag" (default .Chart.AppVersion .Values.admissionController.container.image.tag)) | quote }} + image: {{ include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.admissionController.initContainer.image "defaultTag" (default .Chart.AppVersion .Values.admissionController.initContainer.image.tag)) | quote }} imagePullPolicy: {{ default .Values.admissionController.container.image.pullPolicy .Values.admissionController.initContainer.image.pullPolicy }} args: {{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.admissionController.featuresOverride) "logging" ) | nindent 12 }} + - --openreportsEnabled={{ .Values.openreports.enabled }} {{- range $key, $value := .Values.admissionController.initContainer.extraArgs }} {{- if $value }} - --{{ $key }}={{ $value }} @@ -138,6 +141,12 @@ spec: {{- with (concat .Values.global.extraEnvVars .Values.admissionController.initContainer.extraEnvVars) }} {{- toYaml . | nindent 10 }} {{- end }} + {{- if not $automountSAToken }} + volumeMounts: + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} containers: {{- with .Values.admissionController.extraContainers }} {{- toYaml . | nindent 8 }} @@ -148,14 +157,20 @@ spec: args: - --caSecretName={{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca - --tlsSecretName={{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair + - --tlsKeyAlgorithm={{ .Values.admissionController.tlsKeyAlgorithm | default "RSA" }} + {{- if .Values.admissionController.certManager.enabled }} + - --disableCertManagerController=true + {{- end }} + {{- if .Values.backgroundController.enabled }} - --backgroundServiceAccountName=system:serviceaccount:{{ include "kyverno.namespace" . }}:{{ include "kyverno.background-controller.serviceAccountName" . }} + {{- end }} + {{- if .Values.reportsController.enabled }} - --reportsServiceAccountName=system:serviceaccount:{{ include "kyverno.namespace" . }}:{{ include "kyverno.reports-controller.serviceAccountName" . }} + {{- end }} - --servicePort={{ .Values.admissionController.service.port }} - --webhookServerPort={{ .Values.admissionController.webhookServer.port }} - --resyncPeriod={{ .Values.admissionController.resyncPeriod | default .Values.global.resyncPeriod }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - - --autoDeleteWebhooks - {{- end }} + - --crdWatcher={{ .Values.admissionController.crdWatcher | default .Values.global.crdWatcher }} {{- if .Values.admissionController.tracing.enabled }} - --enableTracing - --tracingAddress={{ .Values.admissionController.tracing.address }} @@ -168,6 +183,11 @@ spec: {{- if not .Values.admissionController.metering.disabled }} - --otelConfig={{ .Values.admissionController.metering.config }} - --metricsPort={{ .Values.admissionController.metering.port }} + {{- if .Values.admissionController.metering.secure }} + - --metricsCASecretName={{ template "kyverno.admission-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-ca + - --metricsTLSSecretName={{ template "kyverno.admission-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-pair + - --metricsKeyAlgorithm={{ .Values.admissionController.metering.tlsKeyAlgorithm | default "RSA" }} + {{- end }} {{- with .Values.admissionController.metering.collector }} - --otelCollector={{ . }} {{- end }} @@ -176,17 +196,20 @@ spec: {{- end }} {{- end }} {{- if or .Values.imagePullSecrets .Values.existingImagePullSecrets }} - - --imagePullSecrets={{- join "," (concat (keys .Values.imagePullSecrets) .Values.existingImagePullSecrets) }} + - --imagePullSecrets={{- $secretNames := concat (keys .Values.imagePullSecrets | sortAlpha) (.Values.existingImagePullSecrets | sortAlpha) -}} + {{- join "," $secretNames -}} {{- end }} {{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.admissionController.featuresOverride) - "reporting" "admissionReports" "autoUpdateWebhooks" "configMapCaching" + "controllerRuntimeMetrics" "deferredLoading" "dumpPayload" + "excludeBootstrapResources" "forceFailurePolicyIgnore" "generateValidatingAdmissionPolicy" + "generateMutatingAdmissionPolicy" "dumpPatches" "globalContext" "logging" @@ -194,6 +217,7 @@ spec: "policyExceptions" "protectManagedResources" "registryClient" + "reporting" "tuf" ) | nindent 12 }} {{- range $key, $value := .Values.admissionController.container.extraArgs }} @@ -263,6 +287,10 @@ spec: readinessProbe: {{- tpl (toYaml .) $ | nindent 12 }} {{- end }} + {{- with .Values.admissionController.container.lifecycle }} + lifecycle: + {{- toYaml . | nindent 12 }} + {{- end }} volumeMounts: - mountPath: {{ .Values.admissionController.tufRootMountPath }} name: sigstore @@ -273,6 +301,17 @@ spec: subPath: ca-certificates.crt {{- end }} {{- end }} + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + {{- if not $automountSAToken }} + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} + {{- with .Values.admissionController.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} volumes: - name: sigstore {{- toYaml (required "A valid .Values.admissionController.sigstoreVolume entry is required" .Values.admissionController.sigstoreVolume) | nindent 8 }} @@ -289,4 +328,40 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} {{- end }} + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: {{ .Values.apiCallToken.expirationSeconds | default 3600 }} + {{- with .Values.apiCallToken.audience }} + audience: {{ . }} + {{- end }} + {{- if not $automountSAToken }} + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.admissionController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.admissionController.rbac.serviceAccount.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} + {{- with .Values.admissionController.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/flowschema.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/flowschema.yaml similarity index 97% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/flowschema.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/flowschema.yaml index 779eeef..d5e37d3 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/flowschema.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/flowschema.yaml @@ -13,6 +13,7 @@ spec: - apiGroups: - admissionregistration.k8s.io clusterScope: true + namespaces: [] resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations @@ -28,6 +29,7 @@ spec: - apiGroups: - rbac.authorization.k8s.io clusterScope: true + namespaces: [] resources: - clusterroles - clusterrolebindings @@ -47,6 +49,7 @@ spec: - apiGroups: - kyverno.io clusterScope: true + namespaces: [] resources: - clusterpolicies - clusterpolicies/status @@ -82,6 +85,7 @@ spec: - apiGroups: - reports.kyverno.io clusterScope: true + namespaces: [] resources: - clusterephemeralreports verbs: @@ -111,6 +115,7 @@ spec: - apiGroups: - wgpolicyk8s.io clusterScope: true + namespaces: [] resources: - clusterpolicyreports - clusterpolicyreports/status @@ -153,6 +158,7 @@ spec: - apiGroups: - authorization.k8s.io clusterScope: true + namespaces: [] resources: - subjectaccessreviews verbs: diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/horizontalpodautoscaler.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/horizontalpodautoscaler.yaml similarity index 54% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/horizontalpodautoscaler.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/horizontalpodautoscaler.yaml index 3179de5..b29fc02 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/horizontalpodautoscaler.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/horizontalpodautoscaler.yaml @@ -14,15 +14,24 @@ spec: minReplicas: {{ .Values.admissionController.autoscaling.minReplicas }} maxReplicas: {{ .Values.admissionController.autoscaling.maxReplicas }} metrics: - - resource: - name: cpu - target: - averageUtilization: {{ .Values.admissionController.autoscaling.targetCPUUtilizationPercentage }} - type: Utilization - type: Resource + {{- if .Values.admissionController.autoscaling.targetCPUUtilizationPercentage }} + - resource: + name: cpu + target: + averageUtilization: {{ .Values.admissionController.autoscaling.targetCPUUtilizationPercentage }} + type: Utilization + type: Resource + {{- end }} + {{- if .Values.admissionController.autoscaling.targetMemoryUtilizationPercentage }} + - resource: + name: memory + target: + averageUtilization: {{ .Values.admissionController.autoscaling.targetMemoryUtilizationPercentage }} + type: Utilization + type: Resource + {{- end }} {{- with .Values.admissionController.autoscaling.behavior }} behavior: {{- tpl (toYaml .) $ | nindent 4 }} {{- end }} - targetCPUUtilizationPercentage: {{ .Values.admissionController.autoscaling.targetCPUUtilizationPercentage }} {{- end }} diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/networkpolicy.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/networkpolicy.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/networkpolicy.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/networkpolicy.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/poddisruptionbudget.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/poddisruptionbudget.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/poddisruptionbudget.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/poddisruptionbudget.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/prioritylevelconfiguration.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/prioritylevelconfiguration.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/prioritylevelconfiguration.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/prioritylevelconfiguration.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/role.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/role.yaml similarity index 59% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/role.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/role.yaml index c24a6ea..7fe0af3 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/role.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/role.yaml @@ -4,14 +4,6 @@ kind: Role metadata: name: {{ template "kyverno.admission-controller.roleName" . }} namespace: {{ template "kyverno.namespace" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/webhooks - - kyverno.io/exceptionwebhooks - - kyverno.io/globalcontextwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.admission-controller.labels" . | nindent 4 }} rules: @@ -49,36 +41,13 @@ rules: - get - patch - update - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - - apiGroups: - - rbac.authorization.k8s.io - resources: - - roles - - rolebindings - resourceNames: - - {{ template "kyverno.admission-controller.roleName" . }} - - {{ template "kyverno.admission-controller.roleName" . }}:temporary - verbs: - - get - - patch - - update - - apiGroups: - - rbac.authorization.k8s.io - resources: - - roles - - rolebindings - verbs: - - create - {{- end }} - {{- end }} # Allow update of Kyverno deployment annotations - apiGroups: - apps resources: - deployments {{- if .Values.webhooksCleanup.enabled }} - {{- if not .Values.templating.enabled }} + {{- if not .Values.global.templating.enabled }} - deployments/scale {{- end }} {{- end }} @@ -87,7 +56,7 @@ rules: - list - watch {{- if .Values.webhooksCleanup.enabled }} - {{- if not .Values.templating.enabled }} + {{- if not .Values.global.templating.enabled }} - patch - update {{- end }} diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/rolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/rolebinding.yaml similarity index 71% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/rolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/rolebinding.yaml index e54046c..b2045b1 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/rolebinding.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/rolebinding.yaml @@ -4,14 +4,6 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ template "kyverno.admission-controller.roleName" . }} namespace: {{ template "kyverno.namespace" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/webhooks - - kyverno.io/exceptionwebhooks - - kyverno.io/globalcontextwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.admission-controller.labels" . | nindent 4 }} roleRef: diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/secret.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/secret.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/secret.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/secret.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/service.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/service.yaml similarity index 88% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/service.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/service.yaml index 4e3f8d5..463fdbd 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/service.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/service.yaml @@ -22,6 +22,9 @@ spec: selector: {{- include "kyverno.admission-controller.matchLabels" . | nindent 4 }} type: {{ .Values.admissionController.service.type }} + {{- if .Values.admissionController.service.trafficDistribution }} + trafficDistribution: {{ .Values.admissionController.service.trafficDistribution }} + {{- end }} {{- if .Values.admissionController.metricsService.create }} --- apiVersion: v1 @@ -46,6 +49,9 @@ spec: selector: {{- include "kyverno.admission-controller.matchLabels" . | nindent 4 }} type: {{ .Values.admissionController.metricsService.type }} + {{- if .Values.admissionController.metricsService.trafficDistribution }} + trafficDistribution: {{ .Values.admissionController.metricsService.trafficDistribution }} + {{- end }} {{- end -}} {{- if .Values.admissionController.profiling.enabled }} --- diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/serviceaccount.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/serviceaccount.yaml similarity index 65% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/serviceaccount.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/serviceaccount.yaml index e6fe87c..29b70ff 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/serviceaccount.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/serviceaccount.yaml @@ -4,18 +4,11 @@ kind: ServiceAccount metadata: name: {{ template "kyverno.admission-controller.serviceAccountName" . }} namespace: {{ template "kyverno.namespace" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/webhooks - - kyverno.io/exceptionwebhooks - - kyverno.io/globalcontextwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.admission-controller.labels" . | nindent 4 }} {{- with .Values.admissionController.rbac.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: false {{- end }} diff --git a/manifests/helm/kyverno/3.4.1/templates/admission-controller/servicemonitor.yaml b/manifests/helm/kyverno/3.9.0/templates/admission-controller/servicemonitor.yaml similarity index 91% rename from manifests/helm/kyverno/3.4.1/templates/admission-controller/servicemonitor.yaml rename to manifests/helm/kyverno/3.9.0/templates/admission-controller/servicemonitor.yaml index d97ab2f..814089b 100644 --- a/manifests/helm/kyverno/3.4.1/templates/admission-controller/servicemonitor.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/admission-controller/servicemonitor.yaml @@ -8,6 +8,10 @@ metadata: {{- else }} namespace: {{ template "kyverno.namespace" . }} {{- end }} + {{- with .Values.admissionController.serviceMonitor.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} labels: {{- include "kyverno.admission-controller.labels" . | nindent 4 }} {{- with .Values.admissionController.serviceMonitor.additionalLabels }} diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/background-controller/_helpers.tpl similarity index 95% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/background-controller/_helpers.tpl index 10aac22..99b4590 100644 --- a/manifests/helm/kyverno/3.4.1/templates/background-controller/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/background-controller/_helpers.tpl @@ -6,6 +6,7 @@ {{- define "kyverno.background-controller.labels" -}} {{- template "kyverno.labels.merge" (list + (include "kyverno.labels.name" (include "kyverno.background-controller.name" .)) (include "kyverno.labels.common" .) (include "kyverno.background-controller.matchLabels" .) ) -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/clusterrole.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/clusterrole.yaml similarity index 81% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/clusterrole.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/clusterrole.yaml index 2b2ade2..588ea65 100644 --- a/manifests/helm/kyverno/3.4.1/templates/background-controller/clusterrole.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/background-controller/clusterrole.yaml @@ -47,6 +47,34 @@ rules: - update - watch - deletecollection + - apiGroups: + - policies.kyverno.io + resources: + - generatingpolicies + - namespacedgeneratingpolicies + - mutatingpolicies + - namespacedmutatingpolicies + - policyexceptions + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - deletecollection + - apiGroups: + - policies.kyverno.io + resources: + - policyexceptions + verbs: + - create + - get + - list + - patch + - update + - watch - apiGroups: - '' resources: diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/clusterrolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/clusterrolebinding.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/clusterrolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/clusterrolebinding.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/configmap.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/configmap.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/configmap.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/configmap.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/deployment.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/deployment.yaml similarity index 69% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/deployment.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/deployment.yaml index e3c9979..1893459 100644 --- a/manifests/helm/kyverno/3.4.1/templates/background-controller/deployment.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/background-controller/deployment.yaml @@ -1,5 +1,6 @@ {{- if .Values.backgroundController.enabled -}} -{{- if not .Values.templating.debug -}} +{{- if not .Values.global.templating.debug -}} +{{- $automountSAToken := .Values.backgroundController.rbac.serviceAccount.automountServiceAccountToken -}} apiVersion: apps/v1 kind: Deployment metadata: @@ -7,6 +8,9 @@ metadata: namespace: {{ template "kyverno.namespace" . }} labels: {{- include "kyverno.background-controller.labels" . | nindent 4 }} + {{- with .Values.backgroundController.labels }} + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- with .Values.backgroundController.annotations }} annotations: {{- tpl (toYaml .) $ | nindent 4 }} @@ -34,7 +38,7 @@ spec: spec: {{- with .Values.backgroundController.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }} {{- end }} {{- with .Values.backgroundController.podSecurityContext }} securityContext: @@ -52,7 +56,7 @@ spec: topologySpreadConstraints: {{- tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- with .Values.backgroundController.priorityClassName }} + {{- with .Values.backgroundController.priorityClassName | default .Values.global.priorityClassName }} priorityClassName: {{ . | quote }} {{- end }} {{- with .Values.backgroundController.hostNetwork }} @@ -83,6 +87,11 @@ spec: {{- end }} {{- end }} serviceAccountName: {{ template "kyverno.background-controller.serviceAccountName" . }} + automountServiceAccountToken: {{ $automountSAToken }} + {{- if and .Values.reportsServer.enabled .Values.reportsServer.waitForReady }} + initContainers: + {{- include "kyverno.reportsServer.initContainer" . | nindent 8 }} + {{- end }} containers: - name: controller image: {{ include "kyverno.background-controller.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.backgroundController.image "defaultTag" .Chart.AppVersion) | quote }} @@ -112,6 +121,11 @@ spec: {{- if not .Values.backgroundController.metering.disabled }} - --otelConfig={{ .Values.backgroundController.metering.config }} - --metricsPort={{ .Values.backgroundController.metering.port }} + {{- if .Values.backgroundController.metering.secure }} + - --metricsCASecretName={{ template "kyverno.background-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-ca + - --metricsTLSSecretName={{ template "kyverno.background-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-pair + - --metricsKeyAlgorithm={{ .Values.backgroundController.metering.tlsKeyAlgorithm | default "RSA" }} + {{- end }} {{- with .Values.backgroundController.metering.collector }} - --otelCollector={{ . }} {{- end }} @@ -120,7 +134,8 @@ spec: {{- end }} {{- end }} {{- if or .Values.imagePullSecrets .Values.existingImagePullSecrets }} - - --imagePullSecrets={{- join "," (concat (keys .Values.imagePullSecrets) .Values.existingImagePullSecrets) }} + - --imagePullSecrets={{- $secretNames := concat (keys .Values.imagePullSecrets | sortAlpha) (.Values.existingImagePullSecrets | sortAlpha) -}} + {{- join "," $secretNames -}} {{- end }} - --resyncPeriod={{ .Values.backgroundController.resyncPeriod | default .Values.global.resyncPeriod }} {{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.backgroundController.featuresOverride) @@ -131,6 +146,7 @@ spec: "logging" "omitEvents" "policyExceptions" + "controllerRuntimeMetrics" ) | nindent 12 }} {{- range $key, $value := .Values.backgroundController.extraArgs }} {{- if $value }} @@ -169,16 +185,40 @@ spec: securityContext: {{- toYaml . | nindent 12 }} {{- end }} - {{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data .Values.backgroundController.caCertificates.volume .Values.global.caCertificates.volume }} + {{- with .Values.backgroundController.lifecycle }} + lifecycle: + {{- toYaml . | nindent 12 }} + {{- end }} volumeMounts: + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + {{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data .Values.backgroundController.caCertificates.volume .Values.global.caCertificates.volume }} - name: ca-certificates mountPath: /etc/ssl/certs/ca-certificates.crt {{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data }} subPath: ca-certificates.crt {{- end }} - {{- end }} - {{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data .Values.backgroundController.caCertificates.volume .Values.global.caCertificates.volume }} + {{- end }} + {{- if not $automountSAToken }} + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} + {{- with .Values.backgroundController.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} volumes: + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: {{ .Values.apiCallToken.expirationSeconds | default 3600 }} + {{- with .Values.apiCallToken.audience }} + audience: {{ . }} + {{- end }} {{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data }} - name: ca-certificates configMap: @@ -192,6 +232,31 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} {{- end }} + {{- if not $automountSAToken }} + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.backgroundController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.backgroundController.rbac.serviceAccount.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} + {{- with .Values.backgroundController.extraVolumes }} + {{- toYaml . | nindent 6 }} {{- end }} {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/networkpolicy.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/networkpolicy.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/networkpolicy.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/networkpolicy.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/poddisruptionbudget.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/poddisruptionbudget.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/poddisruptionbudget.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/poddisruptionbudget.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/role.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/role.yaml similarity index 66% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/role.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/role.yaml index c18d118..5cbe34f 100644 --- a/manifests/helm/kyverno/3.4.1/templates/background-controller/role.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/background-controller/role.yaml @@ -36,6 +36,24 @@ rules: - update resourceNames: - kyverno-background-controller +{{- if .Values.backgroundController.metering.secure }} + - apiGroups: + - '' + resources: + - secrets + verbs: + - create + - apiGroups: + - '' + resources: + - secrets + verbs: + - delete + - update + resourceNames: + - {{ template "kyverno.background-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-ca + - {{ template "kyverno.background-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-pair +{{- end }} - apiGroups: - '' resources: diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/rolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/rolebinding.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/rolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/rolebinding.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/service.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/service.yaml similarity index 91% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/service.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/service.yaml index 876f228..1431575 100644 --- a/manifests/helm/kyverno/3.4.1/templates/background-controller/service.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/background-controller/service.yaml @@ -24,6 +24,9 @@ spec: selector: {{- include "kyverno.background-controller.matchLabels" . | nindent 4 }} type: {{ .Values.backgroundController.metricsService.type }} + {{- if .Values.backgroundController.metricsService.trafficDistribution }} + trafficDistribution: {{ .Values.backgroundController.metricsService.trafficDistribution }} + {{- end }} {{- end -}} {{- end -}} {{- if .Values.backgroundController.profiling.enabled }} diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/serviceaccount.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/serviceaccount.yaml similarity index 93% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/serviceaccount.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/serviceaccount.yaml index b291b7e..5884883 100644 --- a/manifests/helm/kyverno/3.4.1/templates/background-controller/serviceaccount.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/background-controller/serviceaccount.yaml @@ -11,5 +11,6 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: false {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/background-controller/servicemonitor.yaml b/manifests/helm/kyverno/3.9.0/templates/background-controller/servicemonitor.yaml similarity index 91% rename from manifests/helm/kyverno/3.4.1/templates/background-controller/servicemonitor.yaml rename to manifests/helm/kyverno/3.9.0/templates/background-controller/servicemonitor.yaml index 67c38a2..c548a6a 100644 --- a/manifests/helm/kyverno/3.4.1/templates/background-controller/servicemonitor.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/background-controller/servicemonitor.yaml @@ -9,6 +9,10 @@ metadata: {{- else }} namespace: {{ template "kyverno.namespace" . }} {{- end }} + {{- with .Values.backgroundController.serviceMonitor.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} labels: {{- include "kyverno.background-controller.labels" . | nindent 4 }} {{- with .Values.backgroundController.serviceMonitor.additionalLabels }} diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/_helpers.tpl similarity index 95% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/_helpers.tpl index 1804291..984f056 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/_helpers.tpl @@ -6,6 +6,7 @@ {{- define "kyverno.cleanup-controller.labels" -}} {{- template "kyverno.labels.merge" (list + (include "kyverno.labels.name" (include "kyverno.cleanup-controller.name" .)) (include "kyverno.labels.common" .) (include "kyverno.cleanup-controller.matchLabels" .) ) -}} diff --git a/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/cert-manager-certificates.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/cert-manager-certificates.yaml new file mode 100644 index 0000000..fbb9d56 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/cert-manager-certificates.yaml @@ -0,0 +1,99 @@ +{{- if and .Values.cleanupController.enabled .Values.cleanupController.certManager.enabled (not .Values.cleanupController.createSelfSignedCert) -}} +{{- $ns := include "kyverno.namespace" . -}} +{{- $name := include "kyverno.cleanup-controller.name" . -}} +{{- $fullSvcName := printf "%s.%s.svc" $name $ns -}} +{{- $algorithm := .Values.cleanupController.certManager.algorithm | default "RSA" -}} +{{- $size := .Values.cleanupController.certManager.size | default 2048 -}} +{{- $caIssuerName := printf "%s-cleanup-ca-issuer" (include "kyverno.fullname" .) -}} +{{- $selfSignedIssuerName := printf "%s-cleanup-selfsigned-issuer" (include "kyverno.fullname" .) -}} +--- +# Self-signed ClusterIssuer for generating the CA certificate +{{- if .Values.cleanupController.certManager.createSelfSignedIssuer }} +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: {{ $selfSignedIssuerName }} + labels: + {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} +spec: + selfSigned: {} +--- +{{- end }} +# CA Certificate for signing Kyverno cleanup controller TLS certificates +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "kyverno.fullname" . }}-cleanup-controller-ca + namespace: {{ $ns }} + labels: + {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} +spec: + isCA: true + commonName: {{ include "kyverno.fullname" . }}-cleanup-controller-ca + # Use the exact secret name Kyverno expects for cleanup controller CA + secretName: {{ $fullSvcName }}.kyverno-tls-ca + duration: {{ .Values.cleanupController.certManager.ca.duration | default "87600h" }} + renewBefore: {{ .Values.cleanupController.certManager.ca.renewBefore | default "720h" }} + privateKey: + algorithm: {{ $algorithm }} + {{- if ne $algorithm "Ed25519" }} + size: {{ $size }} + {{- end }} + issuerRef: + {{- if .Values.cleanupController.certManager.issuerRef.name }} + name: {{ .Values.cleanupController.certManager.issuerRef.name }} + kind: {{ .Values.cleanupController.certManager.issuerRef.kind | default "ClusterIssuer" }} + group: {{ .Values.cleanupController.certManager.issuerRef.group | default "cert-manager.io" }} + {{- else if .Values.cleanupController.certManager.createSelfSignedIssuer }} + name: {{ $selfSignedIssuerName }} + kind: ClusterIssuer + group: cert-manager.io + {{- else }} + {{- fail "Either cleanupController.certManager.issuerRef.name must be specified or cleanupController.certManager.createSelfSignedIssuer must be true" }} + {{- end }} +--- +# CA Issuer using the CA certificate for signing TLS certificates +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ $caIssuerName }} + namespace: {{ $ns }} + labels: + {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} +spec: + ca: + # Reference the CA secret created by the CA certificate + secretName: {{ $fullSvcName }}.kyverno-tls-ca +--- +# TLS Certificate for Kyverno Cleanup Controller +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "kyverno.fullname" . }}-cleanup-controller-tls + namespace: {{ $ns }} + labels: + {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} +spec: + # Use the exact secret name Kyverno expects for cleanup controller TLS + secretName: {{ $fullSvcName }}.kyverno-tls-pair + duration: {{ .Values.cleanupController.certManager.tls.duration | default "8760h" }} + renewBefore: {{ .Values.cleanupController.certManager.tls.renewBefore | default "720h" }} + privateKey: + algorithm: {{ $algorithm }} + {{- if ne $algorithm "Ed25519" }} + size: {{ $size }} + {{- end }} + usages: + - server auth + - digital signature + - key encipherment + dnsNames: + - {{ $name }} + - {{ $name }}.{{ $ns }} + - {{ $name }}.{{ $ns }}.svc + - {{ $name }}.{{ $ns }}.svc.cluster.local + issuerRef: + name: {{ $caIssuerName }} + kind: Issuer + group: cert-manager.io +{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/clusterrole.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/clusterrole.yaml similarity index 77% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/clusterrole.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/clusterrole.yaml index 8f1dd0c..c009f43 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/clusterrole.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/clusterrole.yaml @@ -17,13 +17,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ template "kyverno.cleanup-controller.roleName" . }}:core - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/policywebhooks - - kyverno.io/ttlwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} rules: @@ -60,6 +53,32 @@ rules: verbs: - list - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies + - namespaceddeletingpolicies + verbs: + - get + - list + - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies/status + - namespaceddeletingpolicies/status + verbs: + - update + - apiGroups: + - policies.kyverno.io + resources: + - policyexceptions + verbs: + - get + - list + - patch + - update + - watch - apiGroups: - kyverno.io resources: @@ -104,31 +123,9 @@ rules: - subjectaccessreviews verbs: - create - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - resourceNames: - - {{ template "kyverno.cleanup-controller.roleName" . }} - - {{ template "kyverno.cleanup-controller.roleName" . }}:core - - {{ template "kyverno.cleanup-controller.roleName" . }}:temporary - verbs: - - get - - patch - - update - - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - clusterrolebindings - verbs: - - create - - list - {{- end }} - {{- end }} +{{- with .Values.cleanupController.rbac.coreClusterRole.extraResources }} + {{- toYaml . | nindent 2 }} +{{- end }} {{- with .Values.cleanupController.rbac.clusterRole.extraResources }} --- apiVersion: rbac.authorization.k8s.io/v1 diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/clusterrolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/clusterrolebinding.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/clusterrolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/clusterrolebinding.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/deployment.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/deployment.yaml similarity index 69% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/deployment.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/deployment.yaml index 3b81a62..4e77c02 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/deployment.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/deployment.yaml @@ -1,19 +1,16 @@ {{- if .Values.cleanupController.enabled -}} -{{- if not .Values.templating.debug -}} +{{- if not .Values.global.templating.debug -}} +{{- $automountSAToken := .Values.cleanupController.rbac.serviceAccount.automountServiceAccountToken -}} apiVersion: apps/v1 kind: Deployment metadata: name: {{ template "kyverno.cleanup-controller.name" . }} namespace: {{ template "kyverno.namespace" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/policywebhooks - - kyverno.io/ttlwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} + {{- with .Values.cleanupController.labels }} + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- with .Values.cleanupController.annotations }} annotations: {{- tpl (toYaml .) $ | nindent 4 }} @@ -41,7 +38,7 @@ spec: spec: {{- with .Values.cleanupController.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }} {{- end }} {{- with .Values.cleanupController.podSecurityContext }} securityContext: @@ -59,7 +56,7 @@ spec: topologySpreadConstraints: {{- tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- with .Values.cleanupController.priorityClassName }} + {{- with .Values.cleanupController.priorityClassName | default .Values.global.priorityClassName }} priorityClassName: {{ . | quote }} {{- end }} {{- with .Values.cleanupController.hostNetwork }} @@ -90,6 +87,11 @@ spec: {{- end }} {{- end }} serviceAccountName: {{ template "kyverno.cleanup-controller.serviceAccountName" . }} + automountServiceAccountToken: {{ $automountSAToken }} + {{- if and .Values.reportsServer.enabled .Values.reportsServer.waitForReady }} + initContainers: + {{- include "kyverno.reportsServer.initContainer" . | nindent 8 }} + {{- end }} containers: - name: controller image: {{ include "kyverno.cleanup-controller.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.cleanupController.image "defaultTag" .Chart.AppVersion) | quote }} @@ -109,13 +111,13 @@ spec: args: - --caSecretName={{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca - --tlsSecretName={{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair - - --servicePort={{ .Values.cleanupController.service.port }} - - --cleanupServerPort={{ .Values.cleanupController.server.port }} - - --webhookServerPort={{ .Values.cleanupController.webhookServer.port }} - - --resyncPeriod={{ .Values.cleanupController.resyncPeriod | default .Values.global.resyncPeriod }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - - --autoDeleteWebhooks + - --tlsKeyAlgorithm={{ .Values.cleanupController.tlsKeyAlgorithm | default "RSA" }} + {{- if .Values.cleanupController.certManager.enabled }} + - --disableCertManagerController=true {{- end }} + - --servicePort={{ .Values.cleanupController.service.port }} + - --resyncPeriod={{ .Values.cleanupController.resyncPeriod | default .Values.global.resyncPeriod }} + - --cleanupServerPort={{ .Values.cleanupController.server.port }} {{- if .Values.cleanupController.tracing.enabled }} - --enableTracing - --tracingAddress={{ .Values.cleanupController.tracing.address }} @@ -128,6 +130,11 @@ spec: {{- if not .Values.cleanupController.metering.disabled }} - --otelConfig={{ .Values.cleanupController.metering.config }} - --metricsPort={{ .Values.cleanupController.metering.port }} + {{- if .Values.cleanupController.metering.secure }} + - --metricsCASecretName={{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-ca + - --metricsTLSSecretName={{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-pair + - --metricsKeyAlgorithm={{ .Values.cleanupController.metering.tlsKeyAlgorithm | default "RSA" }} + {{- end }} {{- with .Values.cleanupController.metering.collector }} - --otelCollector={{ . }} {{- end }} @@ -196,5 +203,58 @@ spec: readinessProbe: {{- tpl (toYaml .) $ | nindent 12 }} {{- end }} + {{- with .Values.cleanupController.lifecycle }} + lifecycle: + {{- toYaml . | nindent 12 }} + {{- end }} + volumeMounts: + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + {{- if not $automountSAToken }} + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} + {{- with .Values.cleanupController.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + volumes: + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: {{ .Values.apiCallToken.expirationSeconds | default 3600 }} + {{- with .Values.apiCallToken.audience }} + audience: {{ . }} + {{- end }} + {{- if not $automountSAToken }} + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.cleanupController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.cleanupController.rbac.serviceAccount.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} + {{- with .Values.cleanupController.extraVolumes }} + {{- toYaml . | nindent 8 }} + {{- end }} {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/networkpolicy.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/networkpolicy.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/networkpolicy.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/networkpolicy.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/poddisruptionbudget.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/poddisruptionbudget.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/poddisruptionbudget.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/poddisruptionbudget.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/role.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/role.yaml similarity index 55% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/role.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/role.yaml index 7aebf84..d7ce2c3 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/role.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/role.yaml @@ -4,13 +4,6 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ template "kyverno.cleanup-controller.roleName" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/policywebhooks - - kyverno.io/ttlwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} namespace: {{ template "kyverno.namespace" . }} @@ -34,22 +27,8 @@ rules: resourceNames: - {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca - {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - - apiGroups: - - '' - resources: - - serviceaccounts - verbs: - - delete - - get - - list - - update - - watch - resourceNames: - - {{ template "kyverno.cleanup-controller.serviceAccountName" . }} - {{- end }} - {{- end }} + - {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-ca + - {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-pair - apiGroups: - '' resources: @@ -78,29 +57,12 @@ rules: - update resourceNames: - kyverno-cleanup-controller - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - apiGroups: - - rbac.authorization.k8s.io + - discovery.k8s.io resources: - - roles - - rolebindings - resourceNames: - - {{ template "kyverno.cleanup-controller.roleName" . }} - - {{ template "kyverno.cleanup-controller.roleName" . }}:temporary + - endpointslices verbs: - - get - - patch - - update - - apiGroups: - - rbac.authorization.k8s.io - resources: - - roles - - rolebindings - verbs: - - create - {{- end }} - {{- end }} + - list - apiGroups: - apps resources: @@ -109,11 +71,5 @@ rules: - get - list - watch - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - - patch - - update - {{- end }} - {{- end }} {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/rolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/rolebinding.yaml similarity index 76% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/rolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/rolebinding.yaml index 8ccec90..2096f16 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/rolebinding.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/rolebinding.yaml @@ -4,13 +4,6 @@ kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ template "kyverno.cleanup-controller.roleName" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/policywebhooks - - kyverno.io/ttlwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} namespace: {{ template "kyverno.namespace" . }} diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/secret.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/secret.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/secret.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/secret.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/service.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/service.yaml similarity index 89% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/service.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/service.yaml index 5ae061e..88210f8 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/service.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/service.yaml @@ -24,6 +24,9 @@ spec: selector: {{- include "kyverno.cleanup-controller.matchLabels" . | nindent 4 }} type: {{ .Values.cleanupController.service.type }} + {{- if .Values.cleanupController.service.trafficDistribution }} + trafficDistribution: {{ .Values.cleanupController.service.trafficDistribution }} + {{- end }} {{- if .Values.cleanupController.metricsService.create }} --- apiVersion: v1 @@ -49,6 +52,9 @@ spec: selector: {{- include "kyverno.cleanup-controller.matchLabels" . | nindent 4 }} type: {{ .Values.cleanupController.metricsService.type }} + {{- if .Values.cleanupController.metricsService.trafficDistribution }} + trafficDistribution: {{ .Values.cleanupController.metricsService.trafficDistribution }} + {{- end }} {{- end -}} {{- if .Values.cleanupController.profiling.enabled }} --- diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/serviceaccount.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/serviceaccount.yaml similarity index 71% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/serviceaccount.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/serviceaccount.yaml index d069870..090d647 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/serviceaccount.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/serviceaccount.yaml @@ -5,18 +5,12 @@ kind: ServiceAccount metadata: name: {{ template "kyverno.cleanup-controller.serviceAccountName" . }} namespace: {{ template "kyverno.namespace" . }} - {{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }} - {{- if not .Values.templating.enabled }} - finalizers: - - kyverno.io/policywebhooks - - kyverno.io/ttlwebhooks - {{- end }} - {{- end }} labels: {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} {{- with .Values.cleanupController.rbac.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: false {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/servicemonitor.yaml b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/servicemonitor.yaml similarity index 91% rename from manifests/helm/kyverno/3.4.1/templates/cleanup-controller/servicemonitor.yaml rename to manifests/helm/kyverno/3.9.0/templates/cleanup-controller/servicemonitor.yaml index e9f50e6..5c27f9d 100644 --- a/manifests/helm/kyverno/3.4.1/templates/cleanup-controller/servicemonitor.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/cleanup-controller/servicemonitor.yaml @@ -9,6 +9,10 @@ metadata: {{- else }} namespace: {{ template "kyverno.namespace" . }} {{- end }} + {{- with .Values.cleanupController.serviceMonitor.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} labels: {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }} {{- with .Values.cleanupController.serviceMonitor.additionalLabels }} diff --git a/manifests/helm/kyverno/3.4.1/templates/config/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/config/_helpers.tpl similarity index 98% rename from manifests/helm/kyverno/3.4.1/templates/config/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/config/_helpers.tpl index 68dd801..a3f8772 100644 --- a/manifests/helm/kyverno/3.4.1/templates/config/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/config/_helpers.tpl @@ -57,7 +57,7 @@ {{- define "kyverno.config.webhooks" -}} {{- $excludeDefault := dict "key" "kubernetes.io/metadata.name" "operator" "NotIn" "values" (list (include "kyverno.namespace" .)) }} {{- $webhooks := .Values.config.webhooks -}} -{{- if $webhooks | typeIs "slice" -}} +{{- if $webhooks | kindIs "slice" -}} {{- $newWebhooks := dict -}} {{- range $index, $webhook := $webhooks -}} {{- if $webhook.namespaceSelector -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/config/configmap.yaml b/manifests/helm/kyverno/3.9.0/templates/config/configmap.yaml similarity index 84% rename from manifests/helm/kyverno/3.4.1/templates/config/configmap.yaml rename to manifests/helm/kyverno/3.9.0/templates/config/configmap.yaml index d10a74d..74f5728 100644 --- a/manifests/helm/kyverno/3.4.1/templates/config/configmap.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/config/configmap.yaml @@ -19,6 +19,9 @@ data: defaultRegistry: {{ . | quote }} {{- end }} generateSuccessEvents: {{ .Values.config.generateSuccessEvents | quote }} + {{- with .Values.config.successEventActions }} + successEventActions: {{ . | quote }} + {{- end }} {{- with .Values.config.excludeGroups }} excludeGroups: {{ join "," . | quote }} {{- end -}} @@ -43,7 +46,7 @@ data: {{- else if .Values.config.webhooks }} webhooks: {{ .Values.config.webhooks | toJson | quote }} {{- else if .Values.config.excludeKyvernoNamespace }} - webhooks: '[{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["{{ include "kyverno.namespace" . }}"]}]}}]' + webhooks: '{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["{{ include "kyverno.namespace" . }}"]}]}}' {{- end -}} {{- with .Values.config.webhookAnnotations }} webhookAnnotations: {{ toJson . | quote }} @@ -54,4 +57,7 @@ data: {{- with .Values.config.matchConditions }} matchConditions: {{ toJson . | quote }} {{- end }} + {{- with .Values.config.maxContextSize }} + maxContextSize: {{ . | quote }} + {{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/config/imagepullsecret.yaml b/manifests/helm/kyverno/3.9.0/templates/config/imagepullsecret.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/config/imagepullsecret.yaml rename to manifests/helm/kyverno/3.9.0/templates/config/imagepullsecret.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/config/metricsconfigmap.yaml b/manifests/helm/kyverno/3.9.0/templates/config/metricsconfigmap.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/config/metricsconfigmap.yaml rename to manifests/helm/kyverno/3.9.0/templates/config/metricsconfigmap.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/hooks/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/hooks/_helpers.tpl similarity index 72% rename from manifests/helm/kyverno/3.4.1/templates/hooks/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/hooks/_helpers.tpl index edc290b..5808e2d 100644 --- a/manifests/helm/kyverno/3.4.1/templates/hooks/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/hooks/_helpers.tpl @@ -1,7 +1,12 @@ {{/* vim: set filetype=mustache: */}} +{{- define "kyverno.hooks.name" -}} +{{ template "kyverno.name" . }}-hooks +{{- end -}} + {{- define "kyverno.hooks.labels" -}} {{- template "kyverno.labels.merge" (list + (include "kyverno.labels.name" (include "kyverno.hooks.name" .)) (include "kyverno.labels.common" .) (include "kyverno.hooks.matchLabels" .) ) -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/hooks/post-upgrade-migrate-resources.yaml b/manifests/helm/kyverno/3.9.0/templates/hooks/post-upgrade-migrate-resources.yaml similarity index 69% rename from manifests/helm/kyverno/3.4.1/templates/hooks/post-upgrade-migrate-resources.yaml rename to manifests/helm/kyverno/3.9.0/templates/hooks/post-upgrade-migrate-resources.yaml index fd3f79d..97134d2 100644 --- a/manifests/helm/kyverno/3.4.1/templates/hooks/post-upgrade-migrate-resources.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/hooks/post-upgrade-migrate-resources.yaml @@ -1,5 +1,6 @@ {{- if .Values.crds.migration.enabled -}} -{{- if not .Values.templating.enabled -}} +{{- if not .Values.global.templating.enabled -}} +{{- $automountSAToken := .Values.crds.migration.serviceAccount.automountServiceAccountToken }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -19,6 +20,14 @@ rules: - get - list - update + - apiGroups: + - policies.kyverno.io + resources: + - '*' + verbs: + - get + - list + - update - apiGroups: - apiextensions.k8s.io resources: @@ -62,6 +71,7 @@ metadata: helm.sh/hook: post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded helm.sh/hook-weight: "100" +automountServiceAccountToken: false --- apiVersion: batch/v1 kind: Job @@ -72,11 +82,12 @@ metadata: {{- include "kyverno.hooks.labels" . | nindent 4 }} annotations: helm.sh/hook: post-upgrade - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed + # helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed helm.sh/hook-weight: "200" spec: backoffLimit: 2 template: + {{- if or .Values.crds.migration.podAnnotations .Values.crds.migration.podLabels }} metadata: {{- with .Values.crds.migration.podAnnotations }} annotations: @@ -86,15 +97,17 @@ spec: labels: {{- toYaml . | nindent 8 }} {{- end }} + {{- end }} spec: serviceAccountName: {{ template "kyverno.fullname" . }}-migrate-resources + automountServiceAccountToken: {{ $automountSAToken }} {{- with .Values.crds.migration.podSecurityContext }} securityContext: {{- tpl (toYaml .) $ | nindent 8 }} {{- end }} restartPolicy: Never containers: - - name: kubectl + - name: kyverno-cli image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.crds.migration.image "defaultTag" (default .Chart.AppVersion .Values.crds.migration.image.tag))) | quote }} imagePullPolicy: {{ .Values.crds.migration.image.pullPolicy }} args: @@ -103,6 +116,11 @@ spec: - --resource - {{ . }} {{- end }} + {{- range $key, $value := .Values.crds.migration.extraArgs }} + {{- if ne $value nil }} + - --{{ $key }}={{ $value }} + {{- end }} + {{- end }} {{- with .Values.crds.migration.podResources }} resources: {{- tpl (toYaml .) $ | nindent 12 }} @@ -111,9 +129,15 @@ spec: securityContext: {{- toYaml . | nindent 12 }} {{- end }} + {{- if not $automountSAToken }} + volumeMounts: + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} {{- with .Values.crds.migration.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }} {{- end }} {{- with .Values.crds.migration.tolerations | default .Values.global.tolerations}} tolerations: @@ -138,5 +162,29 @@ spec: {{- tpl (toYaml .) $ | nindent 10 }} {{- end }} {{- end }} + {{- if not $automountSAToken }} + volumes: + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.crds.migration.serviceAccount.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.crds.migration.serviceAccount.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/hooks/pre-delete-scale-to-zero.yaml b/manifests/helm/kyverno/3.9.0/templates/hooks/pre-delete-remove-webhooks.yaml similarity index 61% rename from manifests/helm/kyverno/3.4.1/templates/hooks/pre-delete-scale-to-zero.yaml rename to manifests/helm/kyverno/3.9.0/templates/hooks/pre-delete-remove-webhooks.yaml index 3f3aade..a310a6b 100644 --- a/manifests/helm/kyverno/3.4.1/templates/hooks/pre-delete-scale-to-zero.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/hooks/pre-delete-remove-webhooks.yaml @@ -1,9 +1,10 @@ {{- if .Values.webhooksCleanup.enabled -}} -{{- if not .Values.templating.enabled -}} +{{- if not .Values.global.templating.enabled -}} +{{- $automountSAToken := .Values.webhooksCleanup.serviceAccount.automountServiceAccountToken }} apiVersion: batch/v1 kind: Job metadata: - name: {{ template "kyverno.fullname" . }}-scale-to-zero + name: {{ template "kyverno.fullname" . }}-rm-webhooks namespace: {{ template "kyverno.namespace" . }} labels: {{- include "kyverno.hooks.labels" . | nindent 4 }} @@ -14,6 +15,7 @@ metadata: spec: backoffLimit: 2 template: + {{- if or .Values.webhooksCleanup.podAnnotations .Values.webhooksCleanup.podLabels }} metadata: {{- with .Values.webhooksCleanup.podAnnotations }} annotations: @@ -23,8 +25,10 @@ spec: labels: {{- toYaml . | nindent 8 }} {{- end }} + {{- end }} spec: serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }} + automountServiceAccountToken: {{ $automountSAToken }} {{- with .Values.webhooksCleanup.podSecurityContext }} securityContext: {{- tpl (toYaml .) $ | nindent 8 }} @@ -32,21 +36,14 @@ spec: restartPolicy: Never {{- with .Values.webhooksCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }} {{- end }} containers: - name: kubectl image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.webhooksCleanup.image "defaultTag" (default .Chart.AppVersion .Values.webhooksCleanup.image.tag))) | quote }} imagePullPolicy: {{ .Values.webhooksCleanup.image.pullPolicy }} - command: - - /bin/bash - - '-c' - - |- - set -euo pipefail - kubectl scale -n {{ template "kyverno.namespace" . }} deployment -l app.kubernetes.io/part-of={{ template "kyverno.fullname" . }} --replicas=0 - sleep 30 - kubectl delete validatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno - kubectl delete mutatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno + args: + - delete-webhooks {{- with .Values.webhooksCleanup.resources }} resources: {{- tpl (toYaml .) $ | nindent 12 }} @@ -55,6 +52,12 @@ spec: securityContext: {{- toYaml . | nindent 12 }} {{- end }} + {{- if not $automountSAToken }} + volumeMounts: + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} {{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations}} tolerations: {{- tpl (toYaml .) $ | nindent 8 }} @@ -78,5 +81,29 @@ spec: {{- tpl (toYaml .) $ | nindent 10 }} {{- end }} {{- end }} + {{- if not $automountSAToken }} + volumes: + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.webhooksCleanup.serviceAccount.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.webhooksCleanup.serviceAccount.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/hooks/post-delete-configmap.yaml b/manifests/helm/kyverno/3.9.0/templates/hooks/pre-delete-scale-to-zero.yaml similarity index 52% rename from manifests/helm/kyverno/3.4.1/templates/hooks/post-delete-configmap.yaml rename to manifests/helm/kyverno/3.9.0/templates/hooks/pre-delete-scale-to-zero.yaml index 93f0c33..c988934 100644 --- a/manifests/helm/kyverno/3.4.1/templates/hooks/post-delete-configmap.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/hooks/pre-delete-scale-to-zero.yaml @@ -1,72 +1,22 @@ -{{- if .Values.config.preserve -}} -{{- if not .Values.templating.enabled -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ template "kyverno.fullname" . }}:remove-configmap - namespace: {{ template "kyverno.namespace" . }} - labels: - {{- include "kyverno.hooks.labels" . | nindent 4 }} - annotations: - helm.sh/hook: post-delete - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed - helm.sh/hook-weight: "0" -rules: - - apiGroups: - - "" - resources: - - configmaps - verbs: - - list - - get - - delete ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ template "kyverno.fullname" . }}:remove-configmap - namespace: {{ template "kyverno.namespace" . }} - labels: - {{- include "kyverno.hooks.labels" . | nindent 4 }} - annotations: - helm.sh/hook: post-delete - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed - helm.sh/hook-weight: "0" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "kyverno.fullname" . }}:remove-configmap -subjects: - - kind: ServiceAccount - name: {{ template "kyverno.fullname" . }}-remove-configmap - namespace: {{ template "kyverno.namespace" . }} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "kyverno.fullname" . }}-remove-configmap - namespace: {{ template "kyverno.namespace" . }} - labels: - {{- include "kyverno.hooks.labels" . | nindent 4 }} - annotations: - helm.sh/hook: post-delete - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - helm.sh/hook-weight: "0" ---- +{{- if .Values.webhooksCleanup.enabled -}} +{{- if not .Values.global.templating.enabled -}} +{{- $automountSAToken := .Values.webhooksCleanup.serviceAccount.automountServiceAccountToken }} apiVersion: batch/v1 kind: Job metadata: - name: {{ template "kyverno.fullname" . }}-remove-configmap + name: {{ template "kyverno.fullname" . }}-scale-to-zero namespace: {{ template "kyverno.namespace" . }} labels: {{- include "kyverno.hooks.labels" . | nindent 4 }} annotations: - helm.sh/hook: post-delete + helm.sh/hook: pre-delete helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed - helm.sh/hook-weight: "10" + {{/* Make sure this runs before other pre-delete jobs that removes webhooksconfiguration*/}} + helm.sh/hook-weight: "90" spec: backoffLimit: 2 template: + {{- if or .Values.webhooksCleanup.podAnnotations .Values.webhooksCleanup.podLabels }} metadata: {{- with .Values.webhooksCleanup.podAnnotations }} annotations: @@ -76,8 +26,10 @@ spec: labels: {{- toYaml . | nindent 8 }} {{- end }} + {{- end }} spec: - serviceAccountName: {{ template "kyverno.fullname" . }}-remove-configmap + serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }} + automountServiceAccountToken: {{ $automountSAToken }} {{- with .Values.webhooksCleanup.podSecurityContext }} securityContext: {{- tpl (toYaml .) $ | nindent 8 }} @@ -85,27 +37,29 @@ spec: restartPolicy: Never {{- with .Values.webhooksCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }} {{- end }} containers: - name: kubectl image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.webhooksCleanup.image "defaultTag" (default .Chart.AppVersion .Values.webhooksCleanup.image.tag))) | quote }} imagePullPolicy: {{ .Values.webhooksCleanup.image.pullPolicy }} - command: - - /bin/bash - - '-c' - - |- - set -euo pipefail - kubectl delete cm --ignore-not-found -n {{ template "kyverno.namespace" . }} {{ template "kyverno.config.configMapName" . }} + args: + - scale-deploy + {{- with .Values.webhooksCleanup.resources }} + resources: + {{- tpl (toYaml .) $ | nindent 12 }} + {{- end }} {{- with .Values.webhooksCleanup.securityContext }} securityContext: {{- toYaml . | nindent 12 }} {{- end }} - {{- with .Values.webhooksCleanup.resources }} - resources: - {{- tpl (toYaml .) $ | nindent 12 }} - {{- end }} - {{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations }} + {{- if not $automountSAToken }} + volumeMounts: + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} + {{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations}} tolerations: {{- tpl (toYaml .) $ | nindent 8 }} {{- end }} @@ -128,5 +82,29 @@ spec: {{- tpl (toYaml .) $ | nindent 10 }} {{- end }} {{- end }} + {{- if not $automountSAToken }} + volumes: + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.webhooksCleanup.serviceAccount.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.webhooksCleanup.serviceAccount.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/templates/prometheusrule.yaml b/manifests/helm/kyverno/3.9.0/templates/prometheusrule.yaml new file mode 100644 index 0000000..c306471 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/prometheusrule.yaml @@ -0,0 +1,23 @@ +{{- if and .Values.prometheusRule.enabled .Values.prometheusRule.spec }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ template "kyverno.fullname" . }} + {{- if .Values.prometheusRule.namespace }} + namespace: {{ .Values.prometheusRule.namespace }} + {{- else }} + namespace: {{ template "kyverno.namespace" . }} + {{- end }} + {{- with .Values.prometheusRule.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "kyverno.labels.common" . | nindent 4 }} + {{- with .Values.prometheusRule.additionalLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + groups: + {{- toYaml .Values.prometheusRule.spec | nindent 4 }} +{{- end }} diff --git a/manifests/helm/kyverno/3.4.1/templates/rbac/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/rbac/_helpers.tpl similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/rbac/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/rbac/_helpers.tpl diff --git a/manifests/helm/kyverno/3.9.0/templates/rbac/policies.yaml b/manifests/helm/kyverno/3.9.0/templates/rbac/policies.yaml new file mode 100644 index 0000000..0a539ca --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/rbac/policies.yaml @@ -0,0 +1,83 @@ +{{- if .Values.admissionController.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "kyverno.rbac.roleName" . }}:admin:policies + labels: + {{- include "kyverno.rbac.labels.admin" . | nindent 4 }} +rules: + - apiGroups: + - kyverno.io + resources: + - cleanuppolicies + - clustercleanuppolicies + - policies + - clusterpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies + - generatingpolicies + - imagevalidatingpolicies + - mutatingpolicies + - namespaceddeletingpolicies + - namespacedgeneratingpolicies + - namespacedimagevalidatingpolicies + - namespacedmutatingpolicies + - namespacedvalidatingpolicies + - policyexceptions + - validatingpolicies + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "kyverno.rbac.roleName" . }}:view:policies + labels: + {{- include "kyverno.rbac.labels.view" . | nindent 4 }} +rules: + - apiGroups: + - kyverno.io + resources: + - cleanuppolicies + - clustercleanuppolicies + - policies + - clusterpolicies + verbs: + - get + - list + - watch + - apiGroups: + - policies.kyverno.io + resources: + - deletingpolicies + - generatingpolicies + - imagevalidatingpolicies + - mutatingpolicies + - namespaceddeletingpolicies + - namespacedgeneratingpolicies + - namespacedimagevalidatingpolicies + - namespacedmutatingpolicies + - namespacedvalidatingpolicies + - policyexceptions + - validatingpolicies + verbs: + - get + - list + - watch +{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/rbac/policyreports.yaml b/manifests/helm/kyverno/3.9.0/templates/rbac/policyreports.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/rbac/policyreports.yaml rename to manifests/helm/kyverno/3.9.0/templates/rbac/policyreports.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/rbac/reports.yaml b/manifests/helm/kyverno/3.9.0/templates/rbac/reports.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/rbac/reports.yaml rename to manifests/helm/kyverno/3.9.0/templates/rbac/reports.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/rbac/updaterequests.yaml b/manifests/helm/kyverno/3.9.0/templates/rbac/updaterequests.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/rbac/updaterequests.yaml rename to manifests/helm/kyverno/3.9.0/templates/rbac/updaterequests.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/reports-controller/_helpers.tpl similarity index 95% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/_helpers.tpl index fe8e41e..663c05d 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/_helpers.tpl @@ -6,6 +6,7 @@ {{- define "kyverno.reports-controller.labels" -}} {{- template "kyverno.labels.merge" (list + (include "kyverno.labels.name" (include "kyverno.reports-controller.name" .)) (include "kyverno.labels.common" .) (include "kyverno.reports-controller.matchLabels" .) ) -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/clusterrole.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/clusterrole.yaml similarity index 73% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/clusterrole.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/clusterrole.yaml index 2f74f29..b054e1d 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/clusterrole.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/clusterrole.yaml @@ -57,8 +57,16 @@ rules: resources: - validatingpolicies - validatingpolicies/status + - namespacedvalidatingpolicies + - namespacedvalidatingpolicies/status - imagevalidatingpolicies - imagevalidatingpolicies/status + - namespacedimagevalidatingpolicies + - namespacedimagevalidatingpolicies/status + - generatingpolicies + - namespacedgeneratingpolicies + - mutatingpolicies + - namespacedmutatingpolicies verbs: - create - delete @@ -77,6 +85,28 @@ rules: - get - list - watch +{{- if .Values.features.validatingAdmissionPolicyReports.enabled }} + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingadmissionpolicies + - validatingadmissionpolicybindings + verbs: + - get + - list + - watch +{{- end }} +{{- if .Values.features.mutatingAdmissionPolicyReports.enabled }} + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingadmissionpolicies + - mutatingadmissionpolicybindings + verbs: + - get + - list + - watch +{{- end }} - apiGroups: - reports.kyverno.io resources: @@ -107,6 +137,22 @@ rules: - update - watch - deletecollection + - apiGroups: + - openreports.io + resources: + - reports + - reports/status + - clusterreports + - clusterreports/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - deletecollection - apiGroups: - '' - events.k8s.io diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/clusterrolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/clusterrolebinding.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/clusterrolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/clusterrolebinding.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/configmap.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/configmap.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/configmap.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/configmap.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/deployment.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/deployment.yaml similarity index 71% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/deployment.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/deployment.yaml index f674c45..63ac516 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/deployment.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/deployment.yaml @@ -1,5 +1,7 @@ {{- if .Values.reportsController.enabled -}} -{{- if not .Values.templating.debug -}} +{{- include "kyverno.validateOpenReports" . -}} +{{- if not .Values.global.templating.debug -}} +{{- $automountSAToken := .Values.reportsController.rbac.serviceAccount.automountServiceAccountToken }} apiVersion: apps/v1 kind: Deployment metadata: @@ -7,6 +9,9 @@ metadata: namespace: {{ template "kyverno.namespace" . }} labels: {{- include "kyverno.reports-controller.labels" . | nindent 4 }} + {{- with .Values.reportsController.labels }} + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- with .Values.reportsController.annotations }} annotations: {{- tpl (toYaml .) $ | nindent 4 }} @@ -34,7 +39,7 @@ spec: spec: {{- with .Values.reportsController.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 8 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }} {{- end }} {{- with .Values.reportsController.podSecurityContext }} securityContext: @@ -52,7 +57,7 @@ spec: topologySpreadConstraints: {{- tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- with .Values.reportsController.priorityClassName }} + {{- with .Values.reportsController.priorityClassName | default .Values.global.priorityClassName }} priorityClassName: {{ . | quote }} {{- end }} {{- with .Values.reportsController.hostNetwork }} @@ -83,6 +88,11 @@ spec: {{- end }} {{- end }} serviceAccountName: {{ template "kyverno.reports-controller.serviceAccountName" . }} + automountServiceAccountToken: {{ $automountSAToken }} + {{- if and .Values.reportsServer.enabled .Values.reportsServer.waitForReady }} + initContainers: + {{- include "kyverno.reportsServer.initContainer" . | nindent 8 }} + {{- end }} containers: - name: controller image: {{ include "kyverno.reports-controller.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.reportsController.image "defaultTag" .Chart.AppVersion) | quote }} @@ -109,9 +119,15 @@ spec: {{- end }} {{- end }} - --disableMetrics={{ .Values.reportsController.metering.disabled }} + - --openreportsEnabled={{ .Values.openreports.enabled }} {{- if not .Values.reportsController.metering.disabled }} - --otelConfig={{ .Values.reportsController.metering.config }} - --metricsPort={{ .Values.reportsController.metering.port }} + {{- if .Values.reportsController.metering.secure }} + - --metricsCASecretName={{ template "kyverno.reports-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-ca + - --metricsTLSSecretName={{ template "kyverno.reports-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-pair + - --metricsKeyAlgorithm={{ .Values.reportsController.metering.tlsKeyAlgorithm | default "RSA" }} + {{- end }} {{- with .Values.reportsController.metering.collector }} - --otelCollector={{ . }} {{- end }} @@ -120,7 +136,8 @@ spec: {{- end }} {{- end }} {{- if or .Values.imagePullSecrets .Values.existingImagePullSecrets }} - - --imagePullSecrets={{- join "," (concat (keys .Values.imagePullSecrets) .Values.existingImagePullSecrets) }} + - --imagePullSecrets={{- $secretNames := concat (keys .Values.imagePullSecrets | sortAlpha) (.Values.existingImagePullSecrets | sortAlpha) -}} + {{- join "," $secretNames -}} {{- end }} - --resyncPeriod={{ .Values.reportsController.resyncPeriod | default .Values.global.resyncPeriod }} {{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.reportsController.featuresOverride) @@ -129,6 +146,7 @@ spec: "aggregateReports" "policyReports" "validatingAdmissionPolicyReports" + "mutatingAdmissionPolicyReports" "backgroundScan" "configMapCaching" "deferredLoading" @@ -148,7 +166,7 @@ spec: - --profile=true - --profilePort={{ .Values.reportsController.profiling.port }} {{- end }} - {{- if not .Values.reportsController.sanityChecks }} + {{- if or (not .Values.reportsController.sanityChecks) .Values.crds.reportsServer.enabled }} - --reportsCRDsSanityChecks=false {{- end }} env: @@ -181,6 +199,10 @@ spec: securityContext: {{- toYaml . | nindent 12 }} {{- end }} + {{- with .Values.reportsController.lifecycle }} + lifecycle: + {{- toYaml . | nindent 12 }} + {{- end }} volumeMounts: - mountPath: {{ .Values.reportsController.tufRootMountPath }} name: sigstore @@ -191,6 +213,17 @@ spec: subPath: ca-certificates.crt {{- end }} {{- end }} + - name: apicall-token + mountPath: /var/run/secrets/kyverno/apicall + readOnly: true + {{- if not $automountSAToken }} + - name: serviceaccount-token + mountPath: /var/run/secrets/kubernetes.io/serviceaccount + readOnly: true + {{- end }} + {{- with .Values.reportsController.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} volumes: - name: sigstore {{- toYaml (required "A valid .Values.reportsController.sigstoreVolume entry is required" .Values.reportsController.sigstoreVolume) | nindent 8 }} @@ -207,5 +240,41 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} {{- end }} + - name: apicall-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + path: token + expirationSeconds: {{ .Values.apiCallToken.expirationSeconds | default 3600 }} + {{- with .Values.apiCallToken.audience }} + audience: {{ . }} + {{- end }} + {{- if not $automountSAToken }} + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.reportsController.rbac.serviceAccount.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.reportsController.rbac.serviceAccount.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} + {{- with .Values.reportsController.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/flowschema.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/flowschema.yaml similarity index 98% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/flowschema.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/flowschema.yaml index 7dbd98a..bbef963 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/flowschema.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/flowschema.yaml @@ -23,6 +23,7 @@ spec: - apiGroups: - reports.kyverno.io clusterScope: true + namespaces: [] resources: - clusterephemeralreports verbs: @@ -52,6 +53,7 @@ spec: - apiGroups: - wgpolicyk8s.io clusterScope: true + namespaces: [] resources: - clusterpolicyreports - clusterpolicyreports/status diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/networkpolicy.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/networkpolicy.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/networkpolicy.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/networkpolicy.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/poddisruptionbudget.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/poddisruptionbudget.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/poddisruptionbudget.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/poddisruptionbudget.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/prioritylevelconfiguration.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/prioritylevelconfiguration.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/prioritylevelconfiguration.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/prioritylevelconfiguration.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/role.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/role.yaml similarity index 66% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/role.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/role.yaml index 6b163b7..b488d03 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/role.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/role.yaml @@ -19,6 +19,24 @@ rules: resourceNames: - {{ include "kyverno.config.configMapName" . }} - {{ include "kyverno.config.metricsConfigMapName" . }} +{{- if .Values.reportsController.metering.secure }} + - apiGroups: + - '' + resources: + - secrets + verbs: + - create + - apiGroups: + - '' + resources: + - secrets + verbs: + - delete + - update + resourceNames: + - {{ template "kyverno.reports-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-ca + - {{ template "kyverno.reports-controller.name" . }}.{{ template "kyverno.namespace" . }}.metering.kyverno-tls-pair +{{- end }} - apiGroups: - '' resources: diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/rolebinding.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/rolebinding.yaml similarity index 100% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/rolebinding.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/rolebinding.yaml diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/service.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/service.yaml similarity index 91% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/service.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/service.yaml index 34fdfee..559ffb3 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/service.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/service.yaml @@ -24,6 +24,9 @@ spec: selector: {{- include "kyverno.reports-controller.matchLabels" . | nindent 4 }} type: {{ .Values.reportsController.metricsService.type }} + {{- if .Values.reportsController.metricsService.trafficDistribution }} + trafficDistribution: {{ .Values.reportsController.metricsService.trafficDistribution }} + {{- end }} {{- end -}} {{- end -}} {{- if .Values.reportsController.profiling.enabled }} diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/serviceaccount.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/serviceaccount.yaml similarity index 93% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/serviceaccount.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/serviceaccount.yaml index 44ddeda..472c923 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/serviceaccount.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/serviceaccount.yaml @@ -11,5 +11,6 @@ metadata: annotations: {{- toYaml . | nindent 4 }} {{- end }} +automountServiceAccountToken: false {{- end -}} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/reports-controller/servicemonitor.yaml b/manifests/helm/kyverno/3.9.0/templates/reports-controller/servicemonitor.yaml similarity index 91% rename from manifests/helm/kyverno/3.4.1/templates/reports-controller/servicemonitor.yaml rename to manifests/helm/kyverno/3.9.0/templates/reports-controller/servicemonitor.yaml index 681e3d9..47a63b9 100644 --- a/manifests/helm/kyverno/3.4.1/templates/reports-controller/servicemonitor.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/reports-controller/servicemonitor.yaml @@ -9,6 +9,10 @@ metadata: {{- else }} namespace: {{ template "kyverno.namespace" . }} {{- end }} + {{- with .Values.reportsController.serviceMonitor.additionalAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} labels: {{- include "kyverno.reports-controller.labels" . | nindent 4 }} {{- with .Values.reportsController.serviceMonitor.additionalLabels }} diff --git a/manifests/helm/kyverno/3.9.0/templates/reports-server/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/reports-server/_helpers.tpl new file mode 100644 index 0000000..2bd7bc2 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/reports-server/_helpers.tpl @@ -0,0 +1,58 @@ +{{/* +Reports Server helpers +*/}} + +{{/* +Check if reports-server is enabled +*/}} +{{- define "kyverno.reportsServer.enabled" -}} +{{- if .Values.reportsServer.enabled -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{/* +Reports Server readiness init container +*/}} +{{- define "kyverno.reportsServer.initContainer" -}} +{{- if and .Values.reportsServer.enabled .Values.reportsServer.waitForReady }} +- name: wait-for-reports-server + image: {{ include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.test.image "defaultTag" .Chart.AppVersion) | quote }} + imagePullPolicy: {{ .Values.test.image.pullPolicy | default "IfNotPresent" }} + args: + - check-endpoints + - --service-name={{ .Release.Name }}-reports-server + - --namespace={{ .Release.Namespace }} + - --timeout={{ .Values.reportsServer.readinessTimeout }} + securityContext: + runAsUser: 65534 + runAsGroup: 65534 + runAsNonRoot: true + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 10m + memory: 32Mi +{{- end }} +{{- end }} + +{{/* +Reports Server service dependency annotation +*/}} +{{- define "kyverno.reportsServer.dependsOnAnnotation" -}} +{{- if .Values.reportsServer.enabled }} +"helm.sh/hook-depends-on": "Service/reports-server" +{{- end -}} +{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/_helpers.tpl b/manifests/helm/kyverno/3.9.0/templates/tests/_helpers.tpl similarity index 81% rename from manifests/helm/kyverno/3.4.1/templates/tests/_helpers.tpl rename to manifests/helm/kyverno/3.9.0/templates/tests/_helpers.tpl index f1e1a3e..ae1dda4 100644 --- a/manifests/helm/kyverno/3.4.1/templates/tests/_helpers.tpl +++ b/manifests/helm/kyverno/3.9.0/templates/tests/_helpers.tpl @@ -15,7 +15,11 @@ {{- end -}} {{- define "kyverno.test.annotations" -}} -helm.sh/hook: test +{{- $annotations := dict "helm.sh/hook" "test" -}} +{{- with .Values.test.podAnnotations -}} +{{- $annotations = merge $annotations . -}} +{{- end -}} +{{- toYaml $annotations -}} {{- end -}} {{- define "kyverno.test.image" -}} diff --git a/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-liveness.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-liveness.yaml new file mode 100644 index 0000000..2d8b6bf --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-liveness.yaml @@ -0,0 +1,69 @@ +{{- if .Values.admissionController.enabled -}} +apiVersion: v1 +kind: Pod +metadata: + name: {{ template "kyverno.fullname" . }}-admission-controller-liveness + namespace: {{ template "kyverno.namespace" . }} + labels: + {{- include "kyverno.test.labels" . | nindent 4 }} + annotations: + {{- include "kyverno.test.annotations" . | nindent 4 }} +spec: + automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }} + restartPolicy: Never + {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }} + {{- end }} + containers: + - name: test + image: {{ template "kyverno.test.image" . }} + imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }} + {{- with .Values.test.resources }} + resources: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.test.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + args: + - check-http + - --service-name={{ template "kyverno.admission-controller.serviceName" . }} + - --namespace={{ template "kyverno.namespace" . }} + - --port={{ .Values.admissionController.service.port }} + - --path=health/liveness + - --https + {{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- with .Values.test.tolerations | default .Values.global.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- if not .Values.test.automountServiceAccountToken }} + volumes: + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.test.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.test.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} +{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-metrics.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-metrics.yaml similarity index 58% rename from manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-metrics.yaml rename to manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-metrics.yaml index 44d6c6a..ce60cb5 100644 --- a/manifests/helm/kyverno/3.4.1/templates/tests/admission-controller-metrics.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-metrics.yaml @@ -9,10 +9,11 @@ metadata: annotations: {{- include "kyverno.test.annotations" . | nindent 4 }} spec: + automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }} restartPolicy: Never {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 4 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }} {{- end }} containers: - name: test @@ -26,8 +27,18 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} - command: - - /bin/sh - - -c - - sleep {{ .Values.test.sleep }} ; wget -O- -S --no-check-certificate http://{{ template "kyverno.admission-controller.serviceName" . }}-metrics.{{ template "kyverno.namespace" . }}:{{ .Values.admissionController.metricsService.port }}/metrics + args: + - check-http + - --service-name={{ template "kyverno.admission-controller.serviceName" . }}-metrics + - --namespace={{ template "kyverno.namespace" . }} + - --port={{ .Values.admissionController.metricsService.port }} + - --path=metrics + {{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- with .Values.test.tolerations | default .Values.global.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-readiness.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-readiness.yaml new file mode 100644 index 0000000..3d81384 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/tests/admission-controller-readiness.yaml @@ -0,0 +1,69 @@ +{{- if .Values.admissionController.enabled -}} +apiVersion: v1 +kind: Pod +metadata: + name: {{ template "kyverno.fullname" . }}-admission-controller-readiness + namespace: {{ template "kyverno.namespace" . }} + labels: + {{- include "kyverno.test.labels" . | nindent 4 }} + annotations: + {{- include "kyverno.test.annotations" . | nindent 4 }} +spec: + automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }} + restartPolicy: Never + {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }} + {{- end }} + containers: + - name: test + image: {{ template "kyverno.test.image" . }} + imagePullPolicy: {{ template "kyverno.test.imagePullPolicy" . }} + {{- with .Values.test.resources }} + resources: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + {{- with .Values.test.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + args: + - check-http + - --service-name={{ template "kyverno.admission-controller.serviceName" . }} + - --namespace={{ template "kyverno.namespace" . }} + - --port={{ .Values.admissionController.service.port }} + - --path=health/readiness + - --https + {{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- with .Values.test.tolerations | default .Values.global.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- if not .Values.test.automountServiceAccountToken }} + volumes: + - name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: {{ .Values.test.projectedServiceAccountToken.expirationSeconds | default 3600 }} + path: token + {{- with .Values.test.projectedServiceAccountToken.audience }} + audience: {{ . }} + {{- end }} + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- end }} +{{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-liveness.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-liveness.yaml similarity index 57% rename from manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-liveness.yaml rename to manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-liveness.yaml index a667f6b..ae0ea27 100644 --- a/manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-liveness.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-liveness.yaml @@ -9,10 +9,11 @@ metadata: annotations: {{- include "kyverno.test.annotations" . | nindent 4 }} spec: + automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }} restartPolicy: Never {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 4 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }} {{- end }} containers: - name: test @@ -26,8 +27,19 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} - command: - - /bin/sh - - -c - - sleep {{ .Values.test.sleep }} ; wget -O- -S --no-check-certificate https://{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}:{{ .Values.cleanupController.service.port }}/health/liveness + args: + - check-http + - --service-name={{ template "kyverno.cleanup-controller.name" . }} + - --namespace={{ template "kyverno.namespace" . }} + - --port={{ .Values.cleanupController.service.port }} + - --path=health/liveness + - --https + {{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- with .Values.test.tolerations | default .Values.global.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-metrics.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-metrics.yaml similarity index 59% rename from manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-metrics.yaml rename to manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-metrics.yaml index 080d7e8..f6ee188 100644 --- a/manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-metrics.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-metrics.yaml @@ -9,10 +9,11 @@ metadata: annotations: {{- include "kyverno.test.annotations" . | nindent 4 }} spec: + automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }} restartPolicy: Never {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 4 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }} {{- end }} containers: - name: test @@ -26,8 +27,18 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} - command: - - /bin/sh - - -c - - sleep {{ .Values.test.sleep }} ; wget -O- -S --no-check-certificate http://{{ template "kyverno.cleanup-controller.name" . }}-metrics.{{ template "kyverno.namespace" . }}:{{ .Values.cleanupController.metricsService.port }}/metrics + args: + - check-http + - --service-name={{ template "kyverno.cleanup-controller.name" . }}-metrics + - --namespace={{ template "kyverno.namespace" . }} + - --port={{ .Values.cleanupController.metricsService.port }} + - --path=metrics + {{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- with .Values.test.tolerations | default .Values.global.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-readiness.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-readiness.yaml similarity index 57% rename from manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-readiness.yaml rename to manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-readiness.yaml index e5ef16e..6dd3511 100644 --- a/manifests/helm/kyverno/3.4.1/templates/tests/cleanup-controller-readiness.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/tests/cleanup-controller-readiness.yaml @@ -9,10 +9,11 @@ metadata: annotations: {{- include "kyverno.test.annotations" . | nindent 4 }} spec: + automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }} restartPolicy: Never {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 4 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }} {{- end }} containers: - name: test @@ -26,8 +27,19 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} - command: - - /bin/sh - - -c - - sleep {{ .Values.test.sleep }} ; wget -O- -S --no-check-certificate https://{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}:{{ .Values.cleanupController.service.port }}/health/readiness + args: + - check-http + - --service-name={{ template "kyverno.cleanup-controller.name" . }} + - --namespace={{ template "kyverno.namespace" . }} + - --port={{ .Values.cleanupController.service.port }} + - --path=health/readiness + - --https + {{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- with .Values.test.tolerations | default .Values.global.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.9.0/templates/tests/helper-functions-test.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/helper-functions-test.yaml new file mode 100644 index 0000000..756e374 --- /dev/null +++ b/manifests/helm/kyverno/3.9.0/templates/tests/helper-functions-test.yaml @@ -0,0 +1,25 @@ +{{/* vim: set filetype=mustache: */}} +{{- /* Test file for the sortedImagePullSecrets helper function */ -}} + +{{- if .Values.unittest -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "kyverno.fullname" . }}-helper-functions-test + labels: + {{- include "kyverno.labels.common" . | nindent 4 }} + app.kubernetes.io/component: test + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +data: + empty: {{ include "kyverno.sortedImagePullSecrets" (list) }} + single: | +{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-a")) | indent 4 }} + sorted: | +{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-a") (dict "name" "registry-secret-b") (dict "name" "registry-secret-c")) | indent 4 }} + reversed: | +{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-c") (dict "name" "registry-secret-b") (dict "name" "registry-secret-a")) | indent 4 }} + random: | +{{ include "kyverno.sortedImagePullSecrets" (list (dict "name" "registry-secret-c") (dict "name" "registry-secret-a") (dict "name" "registry-secret-d") (dict "name" "registry-secret-b")) | indent 4 }} +{{- end -}} \ No newline at end of file diff --git a/manifests/helm/kyverno/3.4.1/templates/tests/reports-controller-metrics.yaml b/manifests/helm/kyverno/3.9.0/templates/tests/reports-controller-metrics.yaml similarity index 59% rename from manifests/helm/kyverno/3.4.1/templates/tests/reports-controller-metrics.yaml rename to manifests/helm/kyverno/3.9.0/templates/tests/reports-controller-metrics.yaml index 386e11f..97aff6a 100644 --- a/manifests/helm/kyverno/3.4.1/templates/tests/reports-controller-metrics.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/tests/reports-controller-metrics.yaml @@ -9,10 +9,11 @@ metadata: annotations: {{- include "kyverno.test.annotations" . | nindent 4 }} spec: + automountServiceAccountToken: {{ .Values.test.automountServiceAccountToken }} restartPolicy: Never {{- with .Values.test.imagePullSecrets | default .Values.global.imagePullSecrets }} imagePullSecrets: - {{- tpl (toYaml .) $ | nindent 4 }} + {{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 4 }} {{- end }} containers: - name: test @@ -26,8 +27,18 @@ spec: securityContext: {{- toYaml . | nindent 8 }} {{- end }} - command: - - /bin/sh - - -c - - sleep {{ .Values.test.sleep }} ; wget -O- -S --no-check-certificate http://{{ template "kyverno.reports-controller.name" . }}-metrics.{{ template "kyverno.namespace" . }}:{{ .Values.reportsController.metricsService.port }}/metrics + args: + - check-http + - --service-name={{ template "kyverno.reports-controller.name" . }}-metrics + - --namespace={{ template "kyverno.namespace" . }} + - --port={{ .Values.reportsController.metricsService.port }} + - --path=metrics + {{- with .Values.test.nodeSelector | default .Values.global.nodeSelector }} + nodeSelector: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} + {{- with .Values.test.tolerations | default .Values.global.tolerations}} + tolerations: + {{- tpl (toYaml .) $ | nindent 4 }} + {{- end }} {{- end -}} diff --git a/manifests/helm/kyverno/3.4.1/templates/validate.yaml b/manifests/helm/kyverno/3.9.0/templates/validate.yaml similarity index 73% rename from manifests/helm/kyverno/3.4.1/templates/validate.yaml rename to manifests/helm/kyverno/3.9.0/templates/validate.yaml index aabd335..80cc638 100644 --- a/manifests/helm/kyverno/3.4.1/templates/validate.yaml +++ b/manifests/helm/kyverno/3.9.0/templates/validate.yaml @@ -4,16 +4,23 @@ {{- if and (eq .Values.cleanupController.enabled true) (eq .Values.crds.groups.kyverno.clustercleanuppolicies false) }} {{- fail "CRD clustercleanuppolicies disabled while cleanupController enabled" }} {{- end }} -{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.wgpolicyk8s.clusterpolicyreports false) }} +{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.wgpolicyk8s.clusterpolicyreports false) (eq .Values.crds.reportsServer.enabled false) }} {{- fail "CRD clusterpolicyreports disabled while reportsController enabled" }} {{- end }} -{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.wgpolicyk8s.policyreports false) }} +{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.wgpolicyk8s.policyreports false) (eq .Values.crds.reportsServer.enabled false) }} {{- fail "CRD policyreports disabled while reportsController enabled" }} {{- end }} -{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.reports.ephemeralreports false) }} +{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.reports.ephemeralreports false) (eq .Values.crds.reportsServer.enabled false) }} {{- fail "CRD ephemeralreports disabled while reportsController enabled" }} {{- end }} -{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.reports.clusterephemeralreports false) }} +{{- if and (eq .Values.reportsController.enabled true) (eq .Values.reportsController.sanityChecks true) (eq .Values.crds.groups.reports.clusterephemeralreports false) (eq .Values.crds.reportsServer.enabled false) }} +{{- fail "CRD clusterephemeralreports disabled while reportsController enabled" }} +{{- end }} + +{{- if and (eq .Values.backgroundController.enabled true) (eq .Values.backgroundController.sanityChecks true) (eq .Values.crds.groups.reports.ephemeralreports false) (eq .Values.crds.reportsServer.enabled false) }} +{{- fail "CRD ephemeralreports disabled while reportsController enabled" }} +{{- end }} +{{- if and (eq .Values.backgroundController.enabled true) (eq .Values.backgroundController.sanityChecks true) (eq .Values.crds.groups.reports.clusterephemeralreports false) (eq .Values.crds.reportsServer.enabled false) }} {{- fail "CRD clusterephemeralreports disabled while reportsController enabled" }} {{- end }} diff --git a/manifests/helm/kyverno/3.4.1/values.yaml b/manifests/helm/kyverno/3.9.0/values.yaml similarity index 68% rename from manifests/helm/kyverno/3.4.1/values.yaml rename to manifests/helm/kyverno/3.9.0/values.yaml index d793c55..b9a5bfe 100644 --- a/manifests/helm/kyverno/3.4.1/values.yaml +++ b/manifests/helm/kyverno/3.9.0/values.yaml @@ -1,12 +1,12 @@ -# -- Internal settings used with `helm template` to generate install manifest -# @ignored -templating: - enabled: false - debug: false - version: ~ - global: + # -- Internal settings used with `helm template` to generate install manifest + # @ignored + templating: + enabled: false + debug: false + version: ~ + image: # -- (string) Global value that allows to set a single image registry across all deployments. # When set, it will override any values set under `.image.registry` across the chart. @@ -18,6 +18,9 @@ global: # -- Resync period for informers resyncPeriod: 15m + # -- Enable/Disable custom resource watcher to invalidate cache + crdWatcher: false + caCertificates: # -- Global CA certificates to use with Kyverno deployments # This value is expected to be one large string of CA certificates @@ -33,6 +36,9 @@ global: # path: /etc/pki/tls/ca-certificates.crt # type: File + # -- Global priority class name for pod priority. Non-global values will override the global value. + priorityClassName: '' + # -- Additional container environment variables to apply to all containers and init containers extraEnvVars: [] # Example setting proxy @@ -40,8 +46,9 @@ global: # - name: HTTPS_PROXY # value: 'https://proxy.example.com:3128' - # -- Global node labels for pod assignment. Non-global values will override the global value. - nodeSelector: {} + # -- Global node labels for pod assignment, applied to all chart workloads including controller Deployments, hook Jobs, and Helm test Pods. Non-global (controller) values will override the global value when non-empty. The default `kubernetes.io/os: linux` key is always merged into any user-supplied value and cannot be unset by design, because Kyverno images only run on Linux nodes. + nodeSelector: + kubernetes.io/os: linux # -- Global List of node taints to tolerate. Non-global values will override the global value. tolerations: [] @@ -72,15 +79,40 @@ rbac: admin: true view: true +# Use openreports.io as the API group for reporting +openreports: + # -- Enable OpenReports feature in controllers + enabled: false + # -- Whether to install CRDs from the upstream OpenReports chart. Setting this to true requires enabled to also be true. + installCrds: false + +# Reports Server configuration +reportsServer: + # -- Enable reports-server deployment alongside Kyverno + enabled: false + + # -- Wait for reports-server to be ready before starting Kyverno components + waitForReady: true + + # -- Timeout for waiting for reports-server readiness (as duration string, e.g. 300s, 5m) + readinessTimeout: 300s + # CRDs configuration crds: # -- Whether to have Helm install the Kyverno CRDs, if the CRDs are not installed by Helm, they must be added before policies can be created install: true + reportsServer: + # -- Kyverno reports-server is used in your cluster + enabled: false + groups: - # -- Install CRDs in group `kyverno.io` + # -- Install CRDs in group `kyverno.io`. + # Note: the legacy policy types in this group (`ClusterPolicy`, `Policy`, `ClusterCleanupPolicy`, `CleanupPolicy`, `PolicyException`) + # are deprecated and will be removed in a future release, migrate to the `policies.kyverno.io` policy types + # (see https://kyverno.io/docs/guides/migration-to-cel/). kyverno: cleanuppolicies: true clustercleanuppolicies: true @@ -89,13 +121,19 @@ crds: policies: true policyexceptions: true updaterequests: true - validatingpolicies: true # -- Install CRDs in group `policies.kyverno.io` policies: validatingpolicies: true policyexceptions: true imagevalidatingpolicies: true + namespacedimagevalidatingpolicies: true + mutatingpolicies: true + namespacedmutatingpolicies: true + generatingpolicies: true + deletingpolicies: true + namespaceddeletingpolicies: true + namespacedvalidatingpolicies: true # -- Install CRDs in group `reports.kyverno.io` reports: @@ -120,6 +158,9 @@ crds: # -- Enable CRDs migration using helm post upgrade hook enabled: true + # -- Additional CLI flags passed to the migration job + extraArgs: {} + # -- Resources to migrate resources: - cleanuppolicies.kyverno.io @@ -129,6 +170,18 @@ crds: - policies.kyverno.io - policyexceptions.kyverno.io - updaterequests.kyverno.io + # policies.kyverno.io + - deletingpolicies.policies.kyverno.io + - generatingpolicies.policies.kyverno.io + - imagevalidatingpolicies.policies.kyverno.io + - mutatingpolicies.policies.kyverno.io + - namespaceddeletingpolicies.policies.kyverno.io + - namespacedgeneratingpolicies.policies.kyverno.io + - namespacedimagevalidatingpolicies.policies.kyverno.io + - namespacedmutatingpolicies.policies.kyverno.io + - namespacedvalidatingpolicies.policies.kyverno.io + - policyexceptions.policies.kyverno.io + - validatingpolicies.policies.kyverno.io image: # -- (string) Image registry @@ -149,7 +202,7 @@ crds: # -- Security context for the pod podSecurityContext: {} - # -- Node labels for pod assignment + # -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. nodeSelector: {} # -- List of node taints to tolerate @@ -194,6 +247,36 @@ crds: cpu: 10m memory: 64Mi + serviceAccount: + # -- Toggle automounting of the ServiceAccount. + # When set to false, a projected service account token is used instead + # which provides time-limited and audience-bound tokens for improved security. + automountServiceAccountToken: true + + # -- Projected service account token configuration (only used when automountServiceAccountToken is false) + projectedServiceAccountToken: + # -- Token expiration time in seconds. + # The kubelet will request a new token before the token expires. + expirationSeconds: 3600 + # -- Audience for the projected service account token. + # If not set, the token will have no audience restriction. + audience: "" + +# -- Scoped token injected into outbound APICall and CEL http requests. +# This token carries a custom audience so that if leaked to an external service +# it cannot be replayed against the Kubernetes API server. +apiCallToken: + # -- Audience for the projected token used in outbound requests. + # Set this to the audience your receiving service validates in the OIDC token's + # `aud` claim. The default is `kyverno-svc.kyverno.io`, which is a Kyverno-specific + # audience and prevents the token from being accepted by the Kubernetes API server. + audience: "kyverno-svc.kyverno.io" + # -- Token lifetime in seconds for the projected outbound API call token. + # The default is `3600` (1 hour). The kubelet requests a replacement before the + # token expires, so lowering this reduces token lifetime while increasing rotation + # frequency. + expirationSeconds: 3600 + # Configuration config: @@ -232,6 +315,22 @@ config: # -- Generate success events. generateSuccessEvents: false + # -- Comma-separated list of event actions for which success events should be generated. + # When set, only success events matching the specified actions are emitted. + # Requires `generateSuccessEvents` to be `true`. + # Valid values: "Resource Mutated", "Resource Passed", "Resource Generated", "Resource Cleaned Up". + # Example: "Resource Mutated" or "Resource Mutated,Resource Generated". + # @default -- "" (empty, all success events are emitted when generateSuccessEvents is true) + successEventActions: "" + + # -- Maximum cumulative size of context data during policy evaluation. + # Supports Kubernetes quantity format (e.g., 100Mi, 2Gi) or plain bytes (e.g., 2097152). + # Limits memory used by context variables to prevent unbounded growth. + # Increase if policies legitimately need large context data (e.g., processing large ConfigMaps). + # Set to 0 to disable the limit (not recommended for production). + # @default -- 2Mi + maxContextSize: ~ + # -- Resource types to be skipped by the Kyverno policy engine. # Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list. # These are joined together without spaces, run through `tpl`, and the result is set in the config map. @@ -242,16 +341,16 @@ config: - '[*/*,kube-public,*]' - '[*/*,kube-node-lease,*]' - '[Node,*,*]' - - '[Node/*,*,*]' + - '[Node/?*,*,*]' - '[APIService,*,*]' - - '[APIService/*,*,*]' + - '[APIService/?*,*,*]' - '[TokenReview,*,*]' - '[SubjectAccessReview,*,*]' - '[SelfSubjectAccessReview,*,*]' - '[Binding,*,*]' - '[Pod/binding,*,*]' - '[ReplicaSet,*,*]' - - '[ReplicaSet/*,*,*]' + - '[ReplicaSet/?*,*,*]' - '[EphemeralReport,*,*]' - '[ClusterEphemeralReport,*,*]' # exclude resources from the chart @@ -272,13 +371,13 @@ config: - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' + - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' + - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' + - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' + - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' @@ -290,51 +389,51 @@ config: - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]' - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' + - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' + - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' + - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' + - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - - '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' + - '[Job/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' + - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' + - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' + - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' + - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' + - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' + - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' + - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' + - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' + - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]' @@ -356,10 +455,10 @@ config: values: - kube-system # Exclude objects - # - objectSelector: - # matchExpressions: - # - key: webhooks.kyverno.io/exclude - # operator: DoesNotExist + # objectSelector: + # matchExpressions: + # - key: webhooks.kyverno.io/exclude + # operator: DoesNotExist # -- Defines annotations to set on webhook configurations. webhookAnnotations: @@ -426,6 +525,18 @@ metricsConfig: kyverno_policy_execution_duration_seconds: # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] + kyverno_validating_policy_execution_duration_seconds: + # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] + disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] + kyverno_image_validating_policy_execution_duration_seconds: + # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] + disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] + kyverno_mutating_policy_execution_duration_seconds: + # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] + disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] + kyverno_generating_policy_execution_duration_seconds: + # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] + disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] kyverno_admission_review_duration_seconds: # enabled: false disabledLabelDimensions: ["resource_namespace"] @@ -437,6 +548,14 @@ metricsConfig: disabledLabelDimensions: ["resource_namespace"] kyverno_cleanup_controller_deletedobjects_total: disabledLabelDimensions: ["resource_namespace", "policy_namespace"] + kyverno_validating_policy_results_total: + disabledLabelDimensions: ["resource_namespace", "policy_namespace"] + kyverno_mutating_policy_results_total: + disabledLabelDimensions: ["resource_namespace", "policy_namespace"] + kyverno_generating_policy_results_total: + disabledLabelDimensions: ["resource_namespace", "policy_namespace"] + kyverno_image_validating_policy_results_total: + disabledLabelDimensions: ["resource_namespace", "policy_namespace"] # -- Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument imagePullSecrets: {} @@ -461,12 +580,12 @@ test: image: # -- (string) Image registry - registry: ~ + registry: ghcr.io # -- Image repository - repository: busybox + repository: kyverno/readiness-checker # -- Image tag # Defaults to `latest` if omitted - tag: '1.35' + tag: ~ # -- (string) Image pull policy # Defaults to image.pullPolicy if omitted pullPolicy: ~ @@ -499,25 +618,45 @@ test: seccompProfile: type: RuntimeDefault + # -- Toggle automounting of the ServiceAccount. + # When set to false, a projected service account token is used instead + # which provides time-limited and audience-bound tokens for improved security. + automountServiceAccountToken: true + + # -- Projected service account token configuration (only used when automountServiceAccountToken is false) + projectedServiceAccountToken: + # -- Token expiration time in seconds. + # The kubelet will request a new token before the token expires. + expirationSeconds: 3600 + # -- Audience for the projected service account token. + # If not set, the token will have no audience restriction. + audience: "" + + # -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. + nodeSelector: {} + + # -- Additional Pod annotations + podAnnotations: {} + + # -- List of node taints to tolerate + tolerations: [] + # -- Additional labels customLabels: {} + webhooksCleanup: # -- Create a helm pre-delete hook to cleanup webhooks. enabled: true - autoDeleteWebhooks: - # -- Allow webhooks controller to delete webhooks using finalizers - enabled: false - image: # -- (string) Image registry - registry: ~ + registry: ghcr.io # -- Image repository - repository: bitnami/kubectl + repository: kyverno/readiness-checker # -- Image tag # Defaults to `latest` if omitted - tag: '1.32.3' + tag: ~ # -- (string) Image pull policy # Defaults to image.pullPolicy if omitted pullPolicy: ~ @@ -528,7 +667,7 @@ webhooksCleanup: # -- Security context for the pod podSecurityContext: {} - # -- Node labels for pod assignment + # -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. nodeSelector: {} # -- List of node taints to tolerate @@ -573,73 +712,20 @@ webhooksCleanup: cpu: 10m memory: 64Mi -policyReportsCleanup: - # -- Create a helm post-upgrade hook to cleanup the old policy reports. - enabled: true + serviceAccount: + # -- Toggle automounting of the ServiceAccount. + # When set to false, a projected service account token is used instead + # which provides time-limited and audience-bound tokens for improved security. + automountServiceAccountToken: true - image: - # -- (string) Image registry - registry: ~ - # -- Image repository - repository: bitnami/kubectl - # -- Image tag - # Defaults to `latest` if omitted - tag: '1.32.3' - # -- (string) Image pull policy - # Defaults to image.pullPolicy if omitted - pullPolicy: ~ - - # -- Image pull secrets - imagePullSecrets: [] - # - name: secretName - - # -- Security context for the pod - podSecurityContext: {} - - # -- Node labels for pod assignment - nodeSelector: {} - - # -- List of node taints to tolerate - tolerations: [] - - # -- Pod anti affinity constraints. - podAntiAffinity: {} - - # -- Pod affinity constraints. - podAffinity: {} - - # -- Pod labels. - podLabels: {} - - # -- Pod annotations. - podAnnotations: {} - - # -- Node affinity constraints. - nodeAffinity: {} - - # -- Security context for the hook containers - securityContext: - runAsUser: 65534 - runAsGroup: 65534 - runAsNonRoot: true - privileged: false - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - - resources: - # -- Pod resource limits - limits: - cpu: 100m - memory: 256Mi - # -- Pod resource requests - requests: - cpu: 10m - memory: 64Mi + # -- Projected service account token configuration (only used when automountServiceAccountToken is false) + projectedServiceAccountToken: + # -- Token expiration time in seconds. + # The kubelet will request a new token before the token expires. + expirationSeconds: 3600 + # -- Audience for the projected service account token. + # If not set, the token will have no audience restriction. + audience: "" grafana: # -- Enable grafana dashboard creation. @@ -668,6 +754,78 @@ grafana: matchLabels: dashboards: "grafana" +prometheusRule: + # -- Enable PrometheusRule resource creation. + # Requires prometheus-operator (monitoring.coreos.com/v1 CRD) to be installed — + # the same prerequisite as serviceMonitor.enabled. + # The resource is only created when `enabled: true` and `spec` is non-empty. + enabled: false + + # -- (string) Namespace to create the PrometheusRule in. + # If not set, it will be created in the same namespace as the chart. + namespace: ~ + + # -- Additional annotations to add to the PrometheusRule. + additionalAnnotations: {} + + # -- Additional labels to add to the PrometheusRule. + # Must match the `ruleSelector` configured on your Prometheus instance + # (e.g. `release: prometheus` for kube-prometheus-stack). + additionalLabels: {} + + # -- Alert rule groups. Provide your own rules here; the examples below use + # Kyverno's histogram metrics and can serve as starting points. + # Thresholds MUST be tuned to your environment's measured baseline — + # see https://kyverno.io/docs/guides/monitoring/#alerting for guidance. + spec: [] + # spec: + # - name: kyverno.admission + # rules: + # - alert: KyvernoAdmissionHighLatency + # expr: | + # histogram_quantile(0.99, + # sum(rate(kyverno_admission_review_duration_seconds_bucket[5m])) by (le) + # ) > 1 + # for: 5m + # labels: + # severity: warning + # annotations: + # summary: Kyverno admission review p99 latency is elevated + # description: >- + # Admission review p99 latency is {{ $value | humanizeDuration }}, + # above the 1s threshold. Kubernetes webhooks hard-timeout at 10s. + # runbook_url: https://kyverno.io/docs/guides/monitoring/#admission-latency-high + # - alert: KyvernoAdmissionCriticalLatency + # expr: | + # histogram_quantile(0.99, + # sum(rate(kyverno_admission_review_duration_seconds_bucket[5m])) by (le) + # ) > 5 + # for: 5m + # labels: + # severity: critical + # annotations: + # summary: Kyverno admission review p99 latency is critically high + # description: >- + # Admission review p99 latency is {{ $value | humanizeDuration }}, + # above 5s. Kubernetes webhooks hard-timeout at 10s. + # runbook_url: https://kyverno.io/docs/guides/monitoring/#admission-latency-high + # - name: kyverno.policy + # rules: + # - alert: KyvernoPolicyExecutionHighLatency + # expr: | + # histogram_quantile(0.99, + # sum(rate(kyverno_policy_execution_duration_seconds_bucket[5m])) by (le, rule_type) + # ) > 0.5 + # for: 5m + # labels: + # severity: warning + # annotations: + # summary: Kyverno policy execution p99 latency is elevated + # description: >- + # {{ $labels.rule_type }} rule p99 execution latency is + # {{ $value | humanizeDuration }}. + # runbook_url: https://kyverno.io/docs/guides/monitoring/#policy-execution-latency-high + # Features configuration features: admissionReports: @@ -680,6 +838,9 @@ features: # -- Enables the feature enabled: true validatingAdmissionPolicyReports: + # -- Enables the feature + enabled: true + mutatingAdmissionPolicyReports: # -- Enables the feature enabled: false reporting: @@ -696,6 +857,9 @@ features: autoUpdateWebhooks: # -- Enables the feature enabled: true + excludeBootstrapResources: + # -- Excludes cluster bootstrap resources (Node, CertificateSigningRequest) from Fail resource webhooks to avoid a webhook deadlock when the cluster restarts with no Kyverno pods running. Policies targeting these resources are not enforced while enabled. + enabled: false backgroundScan: # -- Enables the feature enabled: true @@ -708,6 +872,9 @@ features: configMapCaching: # -- Enables the feature enabled: true + controllerRuntimeMetrics: + # -- Bind address for controller-runtime metrics (use "0" to disable it) + bindAddress: ":8080" deferredLoading: # -- Enables the feature enabled: true @@ -718,6 +885,9 @@ features: # -- Enables the feature enabled: false generateValidatingAdmissionPolicy: + # -- Enables the feature + enabled: true + generateMutatingAdmissionPolicy: # -- Enables the feature enabled: false dumpPatches: @@ -726,6 +896,10 @@ features: globalContext: # -- Maximum allowed response size from API Calls. A value of 0 bypasses checks (not recommended) maxApiCallResponseLength: 2000000 + # -- Timeout for HTTP API calls made by policies. A value of 0s means no timeout. + apiCallTimeout: 30s + # -- Maximum number of entries in the global context store. A value of 0 means unbounded. + maxGlobalContextEntries: 0 logging: # -- Logging format format: text @@ -785,6 +959,9 @@ admissionController: # -- Target CPU utilization percentage targetCPUUtilizationPercentage: 80 + # -- (int) Target memory utilization percentage + targetMemoryUtilizationPercentage: ~ + # -- Configurable scaling behavior behavior: {} @@ -812,6 +989,20 @@ admissionController: annotations: {} # example.com/annotation: value + # -- Toggle automounting of the ServiceAccount. + # When set to false, a projected service account token is used instead + # which provides time-limited and audience-bound tokens for improved security. + automountServiceAccountToken: true + + # -- Projected service account token configuration (only used when automountServiceAccountToken is false) + projectedServiceAccountToken: + # -- Token expiration time in seconds. + # The kubelet will request a new token before the token expires. + expirationSeconds: 3600 + # -- Audience for the projected service account token. + # If not set, the token will have no audience restriction. + audience: "" + coreClusterRole: # -- Extra resource permissions to add in the core cluster role. # This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. @@ -834,6 +1025,49 @@ admissionController: # The certificates won't be automatically renewed if this is set to `true`. createSelfSignedCert: false + # -- Key algorithm for self-signed TLS certificates. + # Supported values: RSA, ECDSA, Ed25519 + # Only used when createSelfSignedCert is false (Kyverno-managed certificates). + tlsKeyAlgorithm: RSA + + # -- Configure cert-manager to manage TLS certificates. + # When enabled, cert-manager Certificate resources will be created to provision + # the TLS certificates for the admission controller. + # Requires cert-manager to be installed in the cluster. + # Takes precedence over createSelfSignedCert when enabled. + certManager: + # -- Enable cert-manager integration for certificate management + enabled: false + # -- Create a self-signed ClusterIssuer for CA generation. + # Set to false if you want to use an existing issuer specified in issuerRef. + createSelfSignedIssuer: true + # -- Reference to an existing issuer for signing CA certificates. + # Only used when createSelfSignedIssuer is false. + issuerRef: + # -- Name of the issuer + name: "" + # -- Kind of the issuer (ClusterIssuer or Issuer) + kind: ClusterIssuer + # -- Group of the issuer + group: cert-manager.io + # -- Key algorithm for certificates (RSA, ECDSA, Ed25519) + algorithm: RSA + # -- Key size for RSA (2048, 4096) or ECDSA (256, 384). + # Ignored for Ed25519. + size: 2048 + # -- CA certificate configuration + ca: + # -- Duration of the CA certificate (default 10 years) + duration: 87600h + # -- Time before expiry to renew the CA certificate (default 30 days) + renewBefore: 720h + # -- TLS certificate configuration + tls: + # -- Duration of the TLS certificate (default 1 year) + duration: 8760h + # -- Time before expiry to renew the TLS certificate (default 30 days) + renewBefore: 720h + # -- (int) Desired number of pods replicas: ~ @@ -843,6 +1077,9 @@ admissionController: # -- Resync period for informers resyncPeriod: 15m + # -- Enable/Disable custom resource watcher to invalidate cache + crdWatcher: false + # -- Additional labels to add to each pod podLabels: {} # example.com/label: foo @@ -851,6 +1088,9 @@ admissionController: podAnnotations: {} # example.com/annotation: foo + # -- Deployment labels. + labels: {} + # -- Deployment annotations. annotations: {} @@ -949,7 +1189,7 @@ admissionController: failureThreshold: 6 successThreshold: 1 - # -- Node labels for pod assignment + # -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. nodeSelector: {} # -- List of node taints to tolerate @@ -996,6 +1236,9 @@ admissionController: # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: + # -- Unhealthy pod eviction policy to be used. + # Possible values are `IfHealthyBudget` or `AlwaysAllow`. + unhealthyPodEvictionPolicy: # -- A writable volume to use for the TUF root initialization. tufRootMountPath: /.sigstore @@ -1047,6 +1290,8 @@ admissionController: # -- Container security context securityContext: + runAsUser: 65534 + runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false @@ -1092,6 +1337,8 @@ admissionController: # -- Container security context securityContext: + runAsUser: 65534 + runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false @@ -1102,6 +1349,14 @@ admissionController: seccompProfile: type: RuntimeDefault + # -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. + lifecycle: {} + # Example: + # lifecycle: + # preStop: + # sleep: + # seconds: 10 + # -- Additional container args. extraArgs: {} @@ -1124,6 +1379,16 @@ admissionController: # image: busybox # command: ['sh', '-c', 'echo Hello && sleep 3600'] + # -- Additional volumes to be mounted in the pod + extraVolumes: [] + # - name: my-volume + # emptyDir: {} + + # -- Additional volumeMounts to be mounted to the main container + extraVolumeMounts: [] + # - name: my-volume + # mountPath: /path/to/mount + service: # -- Service port. port: 443 @@ -1134,6 +1399,9 @@ admissionController: nodePort: # -- Service annotations. annotations: {} + # -- (string) Service traffic distribution policy. + # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. + trafficDistribution: ~ metricsService: # -- Create service. @@ -1148,6 +1416,9 @@ admissionController: nodePort: # -- Service annotations. annotations: {} + # -- (string) Service traffic distribution policy. + # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. + trafficDistribution: ~ networkPolicy: # -- When true, use a NetworkPolicy to allow ingress to the webhook @@ -1159,6 +1430,8 @@ admissionController: serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false + # -- Additional annotations + additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace @@ -1193,6 +1466,11 @@ admissionController: config: prometheus # -- Prometheus endpoint port port: 8000 + # -- Is TLS required for endpoint + secure: false + # -- Key algorithm for self-signed TLS certificates. + # Supported values: RSA, ECDSA, Ed25519 + tlsKeyAlgorithm: RSA # -- Otel collector endpoint collector: '' # -- Otel collector credentials @@ -1236,6 +1514,20 @@ backgroundController: annotations: {} # example.com/annotation: value + # -- Toggle automounting of the ServiceAccount. + # When set to false, a projected service account token is used instead + # which provides time-limited and audience-bound tokens for improved security. + automountServiceAccountToken: true + + # -- Projected service account token configuration (only used when automountServiceAccountToken is false) + projectedServiceAccountToken: + # -- Token expiration time in seconds. + # The kubelet will request a new token before the token expires. + expirationSeconds: 3600 + # -- Audience for the projected service account token. + # If not set, the token will have no audience restriction. + audience: "" + coreClusterRole: # -- Extra resource permissions to add in the core cluster role. # This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. @@ -1273,7 +1565,17 @@ backgroundController: - update - patch - delete - + - apiGroups: + - resource.k8s.io + resources: + - resourceclaims + - resourceclaimtemplates + verbs: + - create + - delete + - update + - patch + - deletecollection clusterRole: # -- Extra resource permissions to add in the cluster role extraResources: [] @@ -1320,6 +1622,9 @@ backgroundController: podAnnotations: {} # example.com/annotation: foo + # -- Deployment labels. + labels: {} + # -- Deployment annotations. annotations: {} @@ -1371,7 +1676,7 @@ backgroundController: cpu: 100m memory: 64Mi - # -- Node labels for pod assignment + # -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. nodeSelector: {} # -- List of node taints to tolerate @@ -1410,6 +1715,8 @@ backgroundController: # -- Security context for the containers securityContext: + runAsUser: 65534 + runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false @@ -1420,6 +1727,14 @@ backgroundController: seccompProfile: type: RuntimeDefault + # -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. + lifecycle: {} + # Example: + # lifecycle: + # preStop: + # sleep: + # seconds: 10 + podDisruptionBudget: # -- Enable PodDisruptionBudget. # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. @@ -1430,6 +1745,9 @@ backgroundController: # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: + # -- Unhealthy pod eviction policy to be used. + # Possible values are `IfHealthyBudget` or `AlwaysAllow`. + unhealthyPodEvictionPolicy: caCertificates: # -- CA certificates to use with Kyverno deployments @@ -1443,6 +1761,16 @@ backgroundController: # path: /etc/pki/tls/ca-certificates.crt # type: File + # -- Additional volumes to be mounted in the pod + extraVolumes: [] + # - name: my-volume + # emptyDir: {} + + # -- Additional volumeMounts to be mounted to the main container + extraVolumeMounts: [] + # - name: my-volume + # mountPath: /path/to/mount + metricsService: # -- Create service. create: true @@ -1456,6 +1784,9 @@ backgroundController: nodePort: # -- Service annotations. annotations: {} + # -- (string) Service traffic distribution policy. + # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. + trafficDistribution: ~ networkPolicy: @@ -1469,6 +1800,8 @@ backgroundController: serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false + # -- Additional annotations + additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace @@ -1503,6 +1836,11 @@ backgroundController: config: prometheus # -- Prometheus endpoint port port: 8000 + # -- Is TLS required for endpoint + secure: false + # -- Key algorithm for self-signed TLS certificates. + # Supported values: RSA, ECDSA, Ed25519 + tlsKeyAlgorithm: RSA # -- Otel collector endpoint collector: '' # -- Otel collector credentials @@ -1545,6 +1883,26 @@ cleanupController: annotations: {} # example.com/annotation: value + # -- Toggle automounting of the ServiceAccount. + # When set to false, a projected service account token is used instead + # which provides time-limited and audience-bound tokens for improved security. + automountServiceAccountToken: true + + # -- Projected service account token configuration (only used when automountServiceAccountToken is false) + projectedServiceAccountToken: + # -- Token expiration time in seconds. + # The kubelet will request a new token before the token expires. + expirationSeconds: 3600 + # -- Audience for the projected service account token. + # If not set, the token will have no audience restriction. + audience: "" + + coreClusterRole: + # -- Extra resource permissions to add in the core cluster role. + # This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. + # @default -- See [values.yaml](values.yaml) + extraResources: [] + clusterRole: # -- Extra resource permissions to add in the cluster role extraResources: [] @@ -1561,6 +1919,49 @@ cleanupController: # The certificates won't be automatically renewed if this is set to `true`. createSelfSignedCert: false + # -- Key algorithm for self-signed TLS certificates. + # Supported values: RSA, ECDSA, Ed25519 + # Only used when createSelfSignedCert is false (Kyverno-managed certificates). + tlsKeyAlgorithm: RSA + + # -- Configure cert-manager to manage TLS certificates. + # When enabled, cert-manager Certificate resources will be created to provision + # the TLS certificates for the cleanup controller. + # Requires cert-manager to be installed in the cluster. + # Takes precedence over createSelfSignedCert when enabled. + certManager: + # -- Enable cert-manager integration for certificate management + enabled: false + # -- Create a self-signed ClusterIssuer for CA generation. + # Set to false if you want to use an existing issuer specified in issuerRef. + createSelfSignedIssuer: true + # -- Reference to an existing issuer for signing CA certificates. + # Only used when createSelfSignedIssuer is false. + issuerRef: + # -- Name of the issuer + name: "" + # -- Kind of the issuer (ClusterIssuer or Issuer) + kind: ClusterIssuer + # -- Group of the issuer + group: cert-manager.io + # -- Key algorithm for certificates (RSA, ECDSA, Ed25519) + algorithm: RSA + # -- Key size for RSA (2048, 4096) or ECDSA (256, 384). + # Ignored for Ed25519. + size: 2048 + # -- CA certificate configuration + ca: + # -- Duration of the CA certificate (default 10 years) + duration: 87600h + # -- Time before expiry to renew the CA certificate (default 30 days) + renewBefore: 720h + # -- TLS certificate configuration + tls: + # -- Duration of the TLS certificate (default 1 year) + duration: 8760h + # -- Time before expiry to renew the TLS certificate (default 30 days) + renewBefore: 720h + image: # -- Image registry registry: ~ @@ -1594,6 +1995,9 @@ cleanupController: podAnnotations: {} # example.com/annotation: foo + # -- Deployment labels. + labels: {} + # -- Deployment annotations. annotations: {} @@ -1618,10 +2022,6 @@ cleanupController: # in case you are using hostNetwork: true, you might want to change the port the cleanupController is listening to server: port: 9443 - # -- cleanupController webhook server port - # in case you are using hostNetwork: true, you might want to change the port the webhookServer is listening to - webhookServer: - port: 9443 # -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster. # In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`. @@ -1697,7 +2097,7 @@ cleanupController: failureThreshold: 6 successThreshold: 1 - # -- Node labels for pod assignment + # -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. nodeSelector: {} # -- List of node taints to tolerate @@ -1736,6 +2136,8 @@ cleanupController: # -- Security context for the containers securityContext: + runAsUser: 65534 + runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false @@ -1746,6 +2148,14 @@ cleanupController: seccompProfile: type: RuntimeDefault + # -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. + lifecycle: {} + # Example: + # lifecycle: + # preStop: + # sleep: + # seconds: 10 + podDisruptionBudget: # -- Enable PodDisruptionBudget. # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. @@ -1756,6 +2166,19 @@ cleanupController: # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: + # -- Unhealthy pod eviction policy to be used. + # Possible values are `IfHealthyBudget` or `AlwaysAllow`. + unhealthyPodEvictionPolicy: + + # -- Additional volumes to be mounted in the pod + extraVolumes: [] + # - name: my-volume + # emptyDir: {} + + # -- Additional volumeMounts to be mounted to the main container + extraVolumeMounts: [] + # - name: my-volume + # mountPath: /path/to/mount service: # -- Service port. @@ -1767,6 +2190,9 @@ cleanupController: nodePort: # -- Service annotations. annotations: {} + # -- (string) Service traffic distribution policy. + # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. + trafficDistribution: ~ metricsService: # -- Create service. @@ -1781,6 +2207,9 @@ cleanupController: nodePort: # -- Service annotations. annotations: {} + # -- (string) Service traffic distribution policy. + # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. + trafficDistribution: ~ networkPolicy: @@ -1794,6 +2223,8 @@ cleanupController: serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false + # -- Additional annotations + additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace @@ -1828,6 +2259,11 @@ cleanupController: config: prometheus # -- Prometheus endpoint port port: 8000 + # -- Is TLS required for endpoint + secure: false + # -- Key algorithm for self-signed TLS certificates. + # Supported values: RSA, ECDSA, Ed25519 + tlsKeyAlgorithm: RSA # -- Otel collector endpoint collector: '' # -- Otel collector credentials @@ -1871,6 +2307,20 @@ reportsController: annotations: {} # example.com/annotation: value + # -- Toggle automounting of the ServiceAccount. + # When set to false, a projected service account token is used instead + # which provides time-limited and audience-bound tokens for improved security. + automountServiceAccountToken: true + + # -- Projected service account token configuration (only used when automountServiceAccountToken is false) + projectedServiceAccountToken: + # -- Token expiration time in seconds. + # The kubelet will request a new token before the token expires. + expirationSeconds: 3600 + # -- Audience for the projected service account token. + # If not set, the token will have no audience restriction. + audience: "" + coreClusterRole: # -- Extra resource permissions to add in the core cluster role. # This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. @@ -1918,6 +2368,9 @@ reportsController: podAnnotations: {} # example.com/annotation: foo + # -- Deployment labels. + labels: {} + # -- Deployment annotations. annotations: {} @@ -1987,7 +2440,7 @@ reportsController: cpu: 100m memory: 64Mi - # -- Node labels for pod assignment + # -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`. nodeSelector: {} # -- List of node taints to tolerate @@ -2026,6 +2479,8 @@ reportsController: # -- Security context for the containers securityContext: + runAsUser: 65534 + runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false @@ -2036,6 +2491,14 @@ reportsController: seccompProfile: type: RuntimeDefault + # -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+. + lifecycle: {} + # Example: + # lifecycle: + # preStop: + # sleep: + # seconds: 10 + podDisruptionBudget: # -- Enable PodDisruptionBudget. # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. @@ -2046,6 +2509,9 @@ reportsController: # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: + # -- Unhealthy pod eviction policy to be used. + # Possible values are `IfHealthyBudget` or `AlwaysAllow`. + unhealthyPodEvictionPolicy: # -- A writable volume to use for the TUF root initialization. tufRootMountPath: /.sigstore @@ -2066,6 +2532,15 @@ reportsController: # path: /etc/pki/tls/ca-certificates.crt # type: File + # -- Additional volumes to be mounted in the pod + extraVolumes: [] + # - name: my-volume + # emptyDir: {} + + # -- Additional volumeMounts to be mounted to the main container + extraVolumeMounts: [] + # - name: my-volume + # mountPath: /path/to/mount metricsService: # -- Create service. @@ -2080,6 +2555,9 @@ reportsController: nodePort: ~ # -- Service annotations. annotations: {} + # -- (string) Service traffic distribution policy. + # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. + trafficDistribution: ~ networkPolicy: @@ -2093,6 +2571,8 @@ reportsController: serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false + # -- Additional annotations + additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace @@ -2127,6 +2607,11 @@ reportsController: config: prometheus # -- Prometheus endpoint port port: 8000 + # -- Is TLS required for endpoint + secure: false + # -- Key algorithm for self-signed TLS certificates. + # Supported values: RSA, ECDSA, Ed25519 + tlsKeyAlgorithm: RSA # -- (string) Otel collector endpoint collector: ~ # -- (string) Otel collector credentials diff --git a/scripts/deploy-test/fixtures/kyverno-self-build-overrides.yaml b/scripts/deploy-test/fixtures/kyverno-self-build-overrides.yaml new file mode 100644 index 0000000..0086f9d --- /dev/null +++ b/scripts/deploy-test/fixtures/kyverno-self-build-overrides.yaml @@ -0,0 +1,56 @@ +# kyverno 자체 빌드 이미지 배포 테스트 전용 오버라이드 — custom-values.yaml 위에 얹어서 쓴다. +# +# hardened-containers에서 만든 7개 자체 빌드 이미지(docs/decisions/0009-kyverno-self-build.md)를 +# 아직 병합·게시하지 않은 상태에서 실제 클러스터 동작을 먼저 확인하기 위한 임시 오버라이드다. +# docker.io/wbsong111/*은 개인 테스트 푸시이지 카탈로그가 실제로 참조할 좌표가 아니다 — +# 정식 반영은 published.json → catalog/image-map/*.env → catalog-tag-update.yml 경로를 따른다. +# 카탈로그의 실제 권장 설정(custom-values.yaml)은 변경하지 않는다. + +admissionController: + container: + image: + registry: docker.io + repository: wbsong111/kyverno + tag: v1.19.0-security-hardened-20260827 + initContainer: + image: + registry: docker.io + repository: wbsong111/kyvernopre + tag: v1.19.0-security-hardened-20260827 + +backgroundController: + image: + registry: docker.io + repository: wbsong111/background-controller + tag: v1.19.0-security-hardened-20260827 + +cleanupController: + image: + registry: docker.io + repository: wbsong111/cleanup-controller + tag: v1.19.0-security-hardened-20260827 + +reportsController: + image: + registry: docker.io + repository: wbsong111/reports-controller + tag: v1.19.0-security-hardened-20260827 + +crds: + migration: + image: + registry: docker.io + repository: wbsong111/kyverno-cli + tag: v1.19.0-security-hardened-20260827 + +test: + image: + registry: docker.io + repository: wbsong111/readiness-checker + tag: v1.19.0-security-hardened-20260827 + +webhooksCleanup: + image: + registry: docker.io + repository: wbsong111/readiness-checker + tag: v1.19.0-security-hardened-20260827