kyverno.io/v2beta1
· Namespaced Resource
Policy
Policy declares validation, mutation, and generation behaviors for matching resources.
See: https://kyverno.io/docs/writing-policies/ for more information.
Click on Property Name to show the description, and Pink Types to expand schema.
Required properties are marked with *
Change History
Kyverno v1.13.2
Kyverno v1.13.1
+1
1 property has been added on this version
- .spec.emitWarning
Kyverno v1.13.0
+77~41
77 properties have been added on this version
- .spec.rules.context.apiCall.default
- .spec.rules.context.apiCall.service.headers
- .spec.rules.generate.foreach
- .spec.rules.generate.generateExisting
- .spec.rules.mutate.foreach.context.apiCall.default
- .spec.rules.mutate.foreach.context.apiCall.service.headers
- .spec.rules.mutate.mutateExistingOnPolicyUpdate
- .spec.rules.mutate.targets.context.apiCall.default
- .spec.rules.mutate.targets.context.apiCall.service.headers
- .spec.rules.mutate.targets.selector
- .spec.rules.validate.assert
- .spec.rules.validate.failureAction
- .spec.rules.validate.failureActionOverrides
- .spec.rules.validate.foreach.context.apiCall.default
- .spec.rules.validate.foreach.context.apiCall.service.headers
- .spec.rules.validate.manifests.attestors.entries.certificates.ctlog.tsaCertChain
- .spec.rules.validate.manifests.attestors.entries.keyless.ctlog.tsaCertChain
- .spec.rules.validate.manifests.attestors.entries.keyless.issuerRegExp
- .spec.rules.validate.manifests.attestors.entries.keyless.subjectRegExp
- .spec.rules.validate.manifests.attestors.entries.keys.ctlog.tsaCertChain
- .spec.rules.validate.manifests.attestors.entries.signatureAlgorithm
- .spec.rules.verifyImages.attestations.attestors.entries.certificates.ctlog.tsaCertChain
- .spec.rules.verifyImages.attestations.attestors.entries.keyless.ctlog.tsaCertChain
- .spec.rules.verifyImages.attestations.attestors.entries.keyless.issuerRegExp
- .spec.rules.verifyImages.attestations.attestors.entries.keyless.subjectRegExp
- .spec.rules.verifyImages.attestations.attestors.entries.keys.ctlog.tsaCertChain
- .spec.rules.verifyImages.attestations.attestors.entries.signatureAlgorithm
- .spec.rules.verifyImages.attestations.name
- .spec.rules.verifyImages.attestors.entries.certificates.ctlog.tsaCertChain
- .spec.rules.verifyImages.attestors.entries.keyless.ctlog.tsaCertChain
- .spec.rules.verifyImages.attestors.entries.keyless.issuerRegExp
- .spec.rules.verifyImages.attestors.entries.keyless.subjectRegExp
- .spec.rules.verifyImages.attestors.entries.keys.ctlog.tsaCertChain
- .spec.rules.verifyImages.attestors.entries.signatureAlgorithm
- .spec.rules.verifyImages.failureAction
- .spec.rules.verifyImages.validate
- .spec.webhookConfiguration.failurePolicy
- .spec.webhookConfiguration.timeoutSeconds
- .status.autogen.rules.context.apiCall.default
- .status.autogen.rules.context.apiCall.service.headers
- .status.autogen.rules.generate.foreach
- .status.autogen.rules.generate.generateExisting
- .status.autogen.rules.mutate.foreach.context.apiCall.default
- .status.autogen.rules.mutate.foreach.context.apiCall.service.headers
- .status.autogen.rules.mutate.mutateExistingOnPolicyUpdate
- .status.autogen.rules.mutate.targets.context.apiCall.default
- .status.autogen.rules.mutate.targets.context.apiCall.service.headers
- .status.autogen.rules.mutate.targets.selector
- .status.autogen.rules.reportProperties
- .status.autogen.rules.validate.allowExistingViolations
- .status.autogen.rules.validate.assert
- .status.autogen.rules.validate.failureAction
- .status.autogen.rules.validate.failureActionOverrides
- .status.autogen.rules.validate.foreach.context.apiCall.default
- .status.autogen.rules.validate.foreach.context.apiCall.service.headers
- .status.autogen.rules.validate.manifests.attestors.entries.certificates.ctlog.tsaCertChain
- .status.autogen.rules.validate.manifests.attestors.entries.keyless.ctlog.tsaCertChain
- .status.autogen.rules.validate.manifests.attestors.entries.keyless.issuerRegExp
- .status.autogen.rules.validate.manifests.attestors.entries.keyless.subjectRegExp
- .status.autogen.rules.validate.manifests.attestors.entries.keys.ctlog.tsaCertChain
- .status.autogen.rules.validate.manifests.attestors.entries.signatureAlgorithm
- .status.autogen.rules.verifyImages.attestations.attestors.entries.certificates.ctlog.tsaCertChain
- .status.autogen.rules.verifyImages.attestations.attestors.entries.keyless.ctlog.tsaCertChain
- .status.autogen.rules.verifyImages.attestations.attestors.entries.keyless.issuerRegExp
- .status.autogen.rules.verifyImages.attestations.attestors.entries.keyless.subjectRegExp
- .status.autogen.rules.verifyImages.attestations.attestors.entries.keys.ctlog.tsaCertChain
- .status.autogen.rules.verifyImages.attestations.attestors.entries.signatureAlgorithm
- .status.autogen.rules.verifyImages.attestations.name
- .status.autogen.rules.verifyImages.attestors.entries.certificates.ctlog.tsaCertChain
- .status.autogen.rules.verifyImages.attestors.entries.keyless.ctlog.tsaCertChain
- .status.autogen.rules.verifyImages.attestors.entries.keyless.issuerRegExp
- .status.autogen.rules.verifyImages.attestors.entries.keyless.subjectRegExp
- .status.autogen.rules.verifyImages.attestors.entries.keys.ctlog.tsaCertChain
- .status.autogen.rules.verifyImages.attestors.entries.signatureAlgorithm
- .status.autogen.rules.verifyImages.cosignOCI11
- .status.autogen.rules.verifyImages.failureAction
- .status.autogen.rules.verifyImages.validate
41 properties have changed the description
- .spec.failurePolicy
- .spec.generateExisting
- .spec.mutateExistingOnPolicyUpdate
- .spec.rules.celPreconditions.expression
- .spec.rules.celPreconditions.name
- .spec.rules.context.apiCall.method
- .spec.rules.mutate.foreach.context.apiCall.method
- .spec.rules.mutate.targets.context.apiCall.method
- .spec.rules.validate.cel.auditAnnotations.key
- .spec.rules.validate.cel.auditAnnotations.valueExpression
- .spec.rules.validate.cel.expressions.expression
- .spec.rules.validate.cel.paramRef.name
- .spec.rules.validate.cel.paramRef.namespace
- .spec.rules.validate.cel.paramRef.parameterNotFoundAction
- .spec.rules.validate.cel.paramRef.selector
- .spec.rules.validate.foreach.context.apiCall.method
- .spec.rules.validate.manifests.attestors.entries.keys.signatureAlgorithm
- .spec.rules.verifyImages.attestations.attestors.entries.keys.signatureAlgorithm
- .spec.rules.verifyImages.attestors.entries.keys.signatureAlgorithm
- .spec.validationFailureAction
- .spec.validationFailureActionOverrides
- .spec.webhookConfiguration
- .spec.webhookTimeoutSeconds
- .status.autogen.rules.celPreconditions.expression
- .status.autogen.rules.celPreconditions.name
- .status.autogen.rules.context.apiCall.method
- .status.autogen.rules.mutate.foreach.context.apiCall.method
- .status.autogen.rules.mutate.targets.context.apiCall.method
- .status.autogen.rules.validate.cel.auditAnnotations.key
- .status.autogen.rules.validate.cel.auditAnnotations.valueExpression
- .status.autogen.rules.validate.cel.expressions.expression
- .status.autogen.rules.validate.cel.paramRef.name
- .status.autogen.rules.validate.cel.paramRef.namespace
- .status.autogen.rules.validate.cel.paramRef.parameterNotFoundAction
- .status.autogen.rules.validate.cel.paramRef.selector
- .status.autogen.rules.validate.foreach.context.apiCall.method
- .status.autogen.rules.validate.manifests.attestors.entries.keys.signatureAlgorithm
- .status.autogen.rules.verifyImages.attestations.attestors.entries.keys.signatureAlgorithm
- .status.autogen.rules.verifyImages.attestors.entries.keys.signatureAlgorithm
- .status.autogen.rules.verifyImages.type
- .status.conditions.type
Kyverno v1.12.6
Kyverno v1.12.5
Kyverno v1.12.4
Kyverno v1.12.3
Kyverno v1.12.2
Kyverno v1.12.1
~94
94 properties have changed the description
- .apiVersion
- .kind
- .spec.admission
- .spec.applyRules
- .spec.background
- .spec.failurePolicy
- .spec.generateExisting
- .spec.mutateExistingOnPolicyUpdate
- .spec.rules
- .spec.useServerSideApply
- .spec.validationFailureAction
- .spec.validationFailureActionOverrides
- .spec.webhookConfiguration
- .spec.webhookTimeoutSeconds
- .status.autogen.rules.celPreconditions
- .status.autogen.rules.context.apiCall
- .status.autogen.rules.context.globalReference.jmesPath
- .status.autogen.rules.context.imageRegistry
- .status.autogen.rules.context.variable.default
- .status.autogen.rules.context.variable.jmesPath
- .status.autogen.rules.exclude
- .status.autogen.rules.generate.clone
- .status.autogen.rules.generate.cloneList.selector
- .status.autogen.rules.generate.data
- .status.autogen.rules.generate.orphanDownstreamOnPolicyDelete
- .status.autogen.rules.generate.synchronize
- .status.autogen.rules.imageExtractors
- .status.autogen.rules.match
- .status.autogen.rules.mutate.foreach.context.apiCall
- .status.autogen.rules.mutate.foreach.context.globalReference.jmesPath
- .status.autogen.rules.mutate.foreach.context.imageRegistry
- .status.autogen.rules.mutate.foreach.context.variable.default
- .status.autogen.rules.mutate.foreach.context.variable.jmesPath
- .status.autogen.rules.mutate.foreach.list
- .status.autogen.rules.mutate.foreach.order
- .status.autogen.rules.mutate.foreach.patchStrategicMerge
- .status.autogen.rules.mutate.foreach.patchesJson6902
- .status.autogen.rules.mutate.foreach.preconditions
- .status.autogen.rules.mutate.patchStrategicMerge
- .status.autogen.rules.mutate.patchesJson6902
- .status.autogen.rules.mutate.targets.context.apiCall
- .status.autogen.rules.mutate.targets.context.globalReference.jmesPath
- .status.autogen.rules.mutate.targets.context.imageRegistry
- .status.autogen.rules.mutate.targets.context.variable.default
- .status.autogen.rules.mutate.targets.context.variable.jmesPath
- .status.autogen.rules.mutate.targets.preconditions
- .status.autogen.rules.preconditions
- .status.autogen.rules.skipBackgroundRequests
- .status.autogen.rules.validate.anyPattern
- .status.autogen.rules.validate.cel.auditAnnotations.key
- .status.autogen.rules.validate.cel.auditAnnotations.valueExpression
- .status.autogen.rules.validate.cel.expressions.expression
- .status.autogen.rules.validate.cel.expressions.message
- .status.autogen.rules.validate.cel.expressions.messageExpression
- .status.autogen.rules.validate.cel.expressions.reason
- .status.autogen.rules.validate.cel.paramKind.apiVersion
- .status.autogen.rules.validate.cel.paramKind.kind
- .status.autogen.rules.validate.cel.paramRef.name
- .status.autogen.rules.validate.cel.paramRef.namespace
- .status.autogen.rules.validate.cel.paramRef.parameterNotFoundAction
- .status.autogen.rules.validate.cel.paramRef.selector
- .status.autogen.rules.validate.cel.variables
- .status.autogen.rules.validate.deny.conditions
- .status.autogen.rules.validate.foreach.anyPattern
- .status.autogen.rules.validate.foreach.context.apiCall
- .status.autogen.rules.validate.foreach.context.globalReference.jmesPath
- .status.autogen.rules.validate.foreach.context.imageRegistry
- .status.autogen.rules.validate.foreach.context.variable.default
- .status.autogen.rules.validate.foreach.context.variable.jmesPath
- .status.autogen.rules.validate.foreach.deny.conditions
- .status.autogen.rules.validate.foreach.elementScope
- .status.autogen.rules.validate.foreach.list
- .status.autogen.rules.validate.foreach.preconditions
- .status.autogen.rules.validate.manifests.attestors.count
- .status.autogen.rules.validate.manifests.attestors.entries
- .status.autogen.rules.validate.manifests.repository
- .status.autogen.rules.validate.podSecurity
- .status.autogen.rules.verifyImages.attestations
- .status.autogen.rules.verifyImages.attestors.count
- .status.autogen.rules.verifyImages.attestors.entries
- .status.autogen.rules.verifyImages.imageReferences
- .status.autogen.rules.verifyImages.imageRegistryCredentials.providers
- .status.autogen.rules.verifyImages.imageRegistryCredentials.secrets
- .status.autogen.rules.verifyImages.mutateDigest
- .status.autogen.rules.verifyImages.repository
- .status.autogen.rules.verifyImages.skipImageReferences
- .status.autogen.rules.verifyImages.type
- .status.conditions.lastTransitionTime
- .status.conditions.message
- .status.conditions.observedGeneration
- .status.conditions.reason
- .status.conditions.type
- .status.rulecount
- .status.validatingadmissionpolicy.message
Kyverno v1.12.0
+17~88
17 properties have been added on this version
- .spec.rules.context.globalReference
- .spec.rules.generate.orphanDownstreamOnPolicyDelete
- .spec.rules.mutate.foreach.context.globalReference
- .spec.rules.mutate.targets.context.globalReference
- .spec.rules.validate.foreach.context.globalReference
- .spec.rules.validate.podSecurity.exclude.restrictedField
- .spec.rules.validate.podSecurity.exclude.values
- .spec.rules.verifyImages.skipImageReferences
- .spec.webhookConfiguration
- .status.autogen.rules.context.globalReference
- .status.autogen.rules.generate.orphanDownstreamOnPolicyDelete
- .status.autogen.rules.mutate.foreach.context.globalReference
- .status.autogen.rules.mutate.targets.context.globalReference
- .status.autogen.rules.validate.foreach.context.globalReference
- .status.autogen.rules.validate.podSecurity.exclude.restrictedField
- .status.autogen.rules.validate.podSecurity.exclude.values