Kyverno

https://kyverno.io/docs/
Admin
Kyverno is a policy engine designed for Kubernetes, allowing users to manage, validate, mutate, and...
Tokens:367,353
Snippets:2,459
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### kyverno completion examples for bash, zsh, fish, and powershell

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_completion

Provides shell-specific instructions for generating and installing completion scripts. Includes commands for bash, zsh, fish, and PowerShell, covering both installation to completion directories and sourcing for the current session.

```bash
  # Generate and install bash completion (Linux)
  kyverno completion bash > /etc/bash_completion.d/kyverno


  # Generate and source bash completion for current session
  source <(kyverno completion bash)


  # Generate and install zsh completion
  kyverno completion zsh > "${fpath[1]}/_kyverno"


  # Generate and source zsh completion for current session
  source <(kyverno completion zsh)


  # Generate and install fish completion
  kyverno completion fish > ~/.config/fish/completions/kyverno.fish


  # Generate PowerShell completion
  kyverno completion powershell | Out-String | Invoke-Expression


  # To permanently enable PowerShell completion, add to your profile:
  kyverno completion powershell >> $PROFILE
```

--------------------------------

### kyverno apply examples

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_apply

Examples of applying policies to resources, folders, clusters, and with variables.

```bash
  # Apply on a resource
  kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --resource=/path/to/resource1 --resource=/path/to/resource2


  # Apply on a folder of resources
  kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --resource=/path/to/resources/


  # Apply on a cluster
  kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --cluster


  # Apply policies from a gitSourceURL on a cluster
  kyverno apply https://github.com/kyverno/policies/openshift/ --git-branch main --cluster


  # Apply single policy with variable on single resource
  kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml --set <variable1>=<value1>,<variable2>=<value2>


  # Apply multiple policy with variable on multiple resource
  kyverno apply /path/to/policy1.yaml /path/to/policy2.yaml --resource /path/to/resource1.yaml --resource /path/to/resource2.yaml -f /path/to/value.yaml
```

--------------------------------

### Print Kyverno CLI version example

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_version

Example command to print the Kyverno CLI version.

```bash
  # Print Kyverno CLI version
  kyverno version

```

--------------------------------

### kyverno jp function examples

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_jp_function

Shows how to list all functions and get information about a specific function (truncate).

```bash
  # List functions
  kyverno jp function


  # Get function infos
  kyverno jp function truncate
```

--------------------------------

### kyverno create examples

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create

Examples for creating metrics config, test, user info, and values files using the `kyverno create` command.

```bash
# Create metrics config file
kyverno create metrics-config -i ns-included-1 -i ns-included-2 -e ns-excluded
```

```bash
# Create test file
kyverno create test -p policy.yaml -r resource.yaml -f values.yaml --pass policy-name,rule-name,resource-name,resource-namespace,resource-kind
```

```bash
# Create user info file
kyverno create user-info -u molybdenum@somecorp.com -g basic-user -c admin
```

```bash
# Create values file
kyverno create values -g request.mode=dev -n prod,env=prod --rule policy,rule,env=demo --resource policy,resource,env=demo
```

--------------------------------

### Create test file example

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_test

Example of creating a Kyverno test file with policy, resource, values, and expected pass results.

```bash
# Create test file
  kyverno create test -p policy.yaml -r resource.yaml -f values.yaml --pass policy-name,rule-name,resource-name,resource-namespace,resource-kind
```

--------------------------------

### Example: Create values file with kyverno create values

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_values

Example command that creates a values file with global, namespace selector, rule, and resource values.

```bash
  # Create values file
  kyverno create values -g request.mode=dev -n prod,env=prod --rule policy,rule,env=demo --resource policy,resource,env=demo

```

--------------------------------

### Install Kyverno CLI via Homebrew

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Installs the Kyverno CLI using Homebrew as a formula.

```bash
brew install kyverno
```

--------------------------------

### Install Kyverno and kube-prometheus-stack

Source: https://kyverno.io/docs/guides/monitoring

Installs Kyverno and the kube-prometheus-stack Helm chart, then lists pods in the monitoring namespace.

```bash
helm install kyverno kyverno/kyverno --namespace kyverno --create-namespace
helm install monitoring prometheus-community/kube-prometheus-stack -n monitoring --create-namespace


kubectl -n monitoring get po -l "release"
```

--------------------------------

### Create user info file example

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_user-info

Example command that creates a user-info file with username molybdenum@somecorp.com, group basic-user, and cluster role admin.

```bash
  # Create user info file
  kyverno create user-info -u molybdenum@somecorp.com -g basic-user -c admin

```

--------------------------------

### Install Kyverno CLI via Krew

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Installs the Kyverno CLI using the kubectl krew plugin manager and tests the installation with the version command.

```bash
# Install Kyverno CLI using kubectl krew plugin manager
kubectl krew install kyverno


# test the Kyverno CLI
kubectl kyverno version
```

--------------------------------

### Install Prometheus with kustomize

Source: https://kyverno.io/docs/guides/monitoring

Installs Prometheus on the cluster using a ready-made configuration from the kyverno/grafana-dashboard repository.

```bash
kubectl apply -k github.com/kyverno/grafana-dashboard/examples/prometheus
```

--------------------------------

### Install Kyverno pre-release versions using Helm

Source: https://kyverno.io/docs/installation/installation

Installs pre-release versions (alpha, beta, rc) of Kyverno by adding the --devel switch to the Helm install command.

```bash
helm install kyverno kyverno/kyverno -n kyverno --create-namespace --devel
```

--------------------------------

### Migrate policy exceptions example

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_migrate

Example command to migrate policy exceptions using the --resource flag.

```bash
  # Migrate policy exceptions
  kyverno migrate --resource policyexceptions.kyverno.io

```

--------------------------------

### Install Kyverno in a non-production environment using Helm

Source: https://kyverno.io/docs/installation/installation

Adds the Kyverno Helm repository, updates it, and installs Kyverno in the 'kyverno' namespace, creating the namespace if it does not exist.

```bash
helm repo add kyverno https://kyverno.github.io/kyverno/
helm repo update
helm install kyverno kyverno/kyverno -n kyverno --create-namespace
```

--------------------------------

### Manual Binary Installation of Kyverno CLI v1.12.0 on Linux x86_64

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Downloads and installs the Kyverno CLI binary from the releases page. Requires curl, tar, and sudo.

```bash
curl -LO https://github.com/kyverno/kyverno/releases/download/v1.12.0/kyverno-cli_v1.12.0_linux_x86_64.tar.gz
tar -xvf kyverno-cli_v1.12.0_linux_x86_64.tar.gz
sudo cp kyverno /usr/local/bin/
```

--------------------------------

### Create a policy exception file example

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_exception

Example command that creates a policy exception file named my-exception in namespace my-ns, with policy rules and resource filters.

```bash
  # Create a policy exception file
  kyverno create exception my-exception --namespace my-ns --policy-rules "policy,rule-1,rule-2" --any "kind=Pod,kind=Deployment,name=test-*"
```

--------------------------------

### OpenReports Output Example

Source: https://kyverno.io/docs/guides/reports

Example YAML output from `kubectl get reports -A -o yaml`, showing a report with a failed validation result for a Pod missing the 'app' label.

```yaml
apiVersion: v1
items:
  - apiVersion: openreports.io/v1alpha1
    kind: Report
    metadata:
      labels:
        app.kubernetes.io/managed-by: kyverno
      name: 7d23ea02-1526-4a4f-ba14-49665adf55e
    results:
      - message: "validation error: Pods must have an 'app' label. rule check-app-label failed at path /metadata/labels/app/"
        policy: default/require-app-label
        properties:
          process: background scan
        result: fail
        rule: check-app-label
        scored: true
        source: kyverno
        timestamp:
          nanos: 0
          seconds: 1849050397
    scope:
      apiVersion: v1
      kind: Pod
      name: example-deployment-c94dc9f47-dfq6l
      namespace: default
      uid: dcd32da4-8539-4636-bba5-fd2cc3a6aaff
    summary:
      error: 0
      fail: 1
      pass: 0
      skip: 0
      warn: 0
kind: List
metadata: {}
```

--------------------------------

### Install Kyverno using YAML manifest from tagged release

Source: https://kyverno.io/docs/installation/installation

Use this command to install Kyverno from a tagged release. Only YAML manifests from tagged releases are supported; release branches are not. This example uses version v1.16.2.

```bash
kubectl create -f https://github.com/kyverno/kyverno/releases/download/v1.16.2/install.yaml
```

--------------------------------

### Example output of kubectl get polr -n kube-system -o wide

Source: https://kyverno.io/docs/guides/reports

Example output showing policy reports in the kube-system namespace of a kind test cluster. The report name is mostly random; -o wide adds columns to identify the associated resource.

```bash
$ kubectl get polr -n kube-system -o wide
NAME                                   KIND         NAME                                         PASS   FAIL   WARN   ERROR   SKIP   AGE
049a4ec1-32a5-4417-9184-1a59cfaa1ca6   DaemonSet    kindnet                                      9      3      0      0       0      16m
049d2cca-c30f-4f26-a70a-dfcc2cc5f433   DaemonSet    kube-proxy                                   9      3      0      0       0      16m
1d491ec4-ca84-4b3a-960a-a2aefa3219ba   Pod          kube-controller-manager-kind-control-plane   10     2      0      0       0      16m
34fa05b8-40cc-4bd3-836e-077abf4c126e   Pod          kindnet-qtq54                                9      3      0      0       0      16m
3997d5d0-363a-4820-8768-4be3788b3968   Pod          kube-proxy-tcgcz                             9      3      0      0       0      16m
4434c0ac-e27f-41eb-b4c2-b1a7aca8056a   ReplicaSet   coredns-5dd5756b68                           12     0      0      0       0      16m
487df031-11d8-4ab4-b089-dfc0db1e533e   Pod          kube-apiserver-kind-control-plane            10     2      0      0       0      16m
553c0601-b995-4ed8-a36b-11e7cb38893b   Pod          kube-proxy-jdsck                             9      3      0      0       0      16m
89044d72-8a1e-4af0-877b-9be727dc3ec4   Pod          kindnet-7rrns                                9      3      0      0       0      16m
9eb8c5c0-fe5c-4c7d-96c3-3ff65c361f4f   Pod          etcd-kind-control-plane                      10     2      0      0       0      16m
b7968d37-4337-4756-bfe8-3c111f7a7356   Pod          kube-proxy-ncvxk                             9      3      0      0       0      16m
cc894ef1-6a45-44e0-99f6-3765a59088e7   Pod          kube-scheduler-kind-control-plane            10     2      0      0       0      16m
cf538bcc-4752-45d4-9712-480c425dc8d3   Pod          kindnet-c8fv6                                9      3      0      0       0      16m
d9ea5169-17a7-458d-a971-09028a73cddd   Pod          coredns-5dd5756b68-z5whj                     12     0      0      0       0      16m
e23946aa-17c3-4b96-b72b-eb7fd72eba62   Deployment   coredns                                      12     0      0      0       0      16m
e666a741-c9cf-499c-a9c7-b8e0c600239a   Pod          kindnet-2rkgr                                9      3      0      0       0      16m
e6f5aa6a-74e0-4c30-bb2b-1a6ee046e5ad   Pod          coredns-5dd5756b68-tnv25                     12     0      0      0       0      16m
fd2aa944-3fc7-42b0-a6c0-1304e0aa473f   Pod          kube-proxy-p4x82                             9      3      0      0       0      16m
```

--------------------------------

### Deployment with hostPath volume that gets denied

Source: https://kyverno.io/docs/policy-types/cluster-policy/validate

Example deployment that uses a hostPath volume. When submitted against the generated ValidatingAdmissionPolicy, the API server denies the request.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx-server
          image: nginx
          volumeMounts:
            - name: udev
              mountPath: /data
      volumes:
        - name: udev
          hostPath:
            path: /etc/udev

```

--------------------------------

### Create a GlobalContextEntry for Kubernetes Resource Caching

Source: https://kyverno.io/docs/policy-types/global-context-caching

Defines a GlobalContextEntry named my-first-cache that caches ConfigMaps in the default namespace. This is the first step of the getting started workflow.

```yaml
apiVersion: kyverno.io/v2
kind: GlobalContextEntry
metadata:
  name: my-first-cache
spec:
  kubernetesResource:
    group: ''
    version: v1
    resource: configmaps
    namespace: default

```

--------------------------------

### Example deployment args for HTTP call configuration

Source: https://kyverno.io/docs/installation/customization

Shows how to configure Kyverno deployment args to enable HTTP in namespaced policies and set block/allow lists.

```yaml
spec:
  template:
    spec:
      containers:
        - name: kyverno
          args:
            - --allowHTTPInNamespacedPolicies=true
            - --httpBlocklist=127.0.0.0/8,::1/128,169.254.0.0/16,fe80::/10
            - --httpAllowlist=https://api.example.com,https://webhook.corp/v1/
```

--------------------------------

### RBAC rule for deleting ConfigMaps

Source: https://kyverno.io/docs/policy-types/deleting-policy

Example ClusterRole rule granting get, list, watch, and delete permissions on ConfigMaps. Required for the Kyverno cleanup controller to delete these resources.

```yaml
rules:
  - apiGroups: ['']
    resources: ['configmaps']
    verbs: ['get', 'list', 'watch', 'delete']

```

--------------------------------

### Build Kyverno CLI from Source

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Clones the Kyverno repository and builds the CLI binary. Requires Go and make.

```bash
git clone https://github.com/kyverno/kyverno
cd kyverno
make build-cli
sudo mv ./cmd/cli/kubectl-kyverno/kubectl-kyverno /usr/local/bin/
```

--------------------------------

### Check policy readiness with kubectl get cpol,pol -A

Source: https://kyverno.io/docs/guides/troubleshooting

Lists all cluster and namespaced policies to verify they report 'true' under the READY column. The output shows an example policy 'inject-entrypoint' with BACKGROUND, VALIDATE ACTION, READY, AGE, and MESSAGE columns.

```bash
$ kubectl get cpol,pol -A
NAME                BACKGROUND   VALIDATE ACTION   READY   AGE   MESSAGE
inject-entrypoint   true         Audit             True    15s   Ready
```

--------------------------------

### Generate markdown documentation with kyverno docs

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_docs

Two examples: generate simple markdown documentation and generate website documentation. Both require the KYVERNO_EXPERIMENTAL=true environment variable.

```bash
  # Generate simple markdown documentation
  KYVERNO_EXPERIMENTAL=true kyverno docs -o . --autogenTag=false


  # Generate website documentation
  KYVERNO_EXPERIMENTAL=true kyverno docs -o . --website
```

--------------------------------

### GitHub Actions workflow for Kyverno policy testing

Source: https://kyverno.io/docs/guides/testing-policies

This example shows a repository layout and a GitHub Actions workflow for testing Kyverno policies. The workflow checks out the repo, installs the Kyverno CLI (v1.11.0), verifies the version, applies policies to resources, and runs pre-defined tests. It triggers on pull requests and manual dispatch.

```text
.
├── .github
│   └── workflows
│       └── kyverno.yaml
├── README.md
├── policies
│   ├── disallow-privilege-escalation.yaml
│   └── disallow-privileged-containers.yaml
├── resources
│   ├── configmap.yaml
│   └── deployment.yaml
└── tests
    ├── require_labels
    │   ├── kyverno-test.yaml
    │   ├── require_labels.yaml
    │   └── resource.yaml
    └── restrict_image_registries
        ├── kyverno-test.yaml
        ├── resource.yaml
        └── restrict_image_registries.yaml
```

```yaml
name: kyverno-policy-test
on:
  - pull_request
  - workflow_dispatch
jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Install Kyverno CLI
        uses: kyverno/action-install-cli@v0.2.0
        with:
          release: 'v1.11.0'
      - name: Check install
        run: kyverno version
      - name: Test new resources against existing policies
        run: kyverno apply policies/ -r resources/
      - name: Test pre-defined cases
        run: kyverno test tests/
```

--------------------------------

### Example: Create metrics config file with include and exclude namespaces

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_metrics-config

Creates a metrics config file, including namespaces ns-included-1 and ns-included-2, and excluding ns-excluded.

```bash
  # Create metrics config file
  kyverno create metrics-config -i ns-included-1 -i ns-included-2 -e ns-excluded

```

--------------------------------

### kyverno create test command synopsis

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_test

Shows the command-line syntax for creating a Kyverno test file.

```bash
kyverno create test [flags]
```

--------------------------------

### kyverno create user-info synopsis

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_user-info

Shows the command syntax for creating a Kyverno user-info file.

```bash
kyverno create user-info [flags]

```

--------------------------------

### Install Jaeger backend

Source: https://kyverno.io/docs/guides/monitoring

Applies the Jaeger resource to install the Jaeger backend.

```bash
kubectl create -f jaeger.yaml
```

--------------------------------

### Install Kyverno main (latest) experimental manifest

Source: https://kyverno.io/docs/installation/installation

Use this command to install the experimental manifest from the main development branch for testing unreleased Kyverno code. This is not recommended for production.

```bash
kubectl create -f https://github.com/kyverno/kyverno/raw/main/config/install-latest-testing.yaml
```

--------------------------------

### Example: policy, resource, and test manifests with output

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Complete example of testing a policy with two validate rules. Includes the policy manifest (`disallow_latest_tag.yaml`), resource manifest (`resource.yaml`), test manifest (`kyverno-test.yaml`), and the command output showing test results.

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
spec:
  rules:
    - name: require-image-tag
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        failureAction: Audit
        message: 'An image tag is required.'
        pattern:
          spec:
            containers:
              - image: '*:*'
    - name: validate-image-tag
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        failureAction: Audit
        message: "Using a mutable image tag e.g. 'latest' is not allowed."
        pattern:
          spec:
            containers:
              - image: '!*:latest'
```

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  labels:
    app: myapp
spec:
  containers:
    - name: nginx
      image: nginx:1.12
```

```yaml
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: disallow_latest_tag
policies:
  - disallow_latest_tag.yaml
resources:
  - resource.yaml
results:
  - policy: disallow-latest-tag
    rule: require-image-tag
    resources:
      - myapp-pod
    kind: Pod
    result: pass
  - policy: disallow-latest-tag
    rule: validate-image-tag
    resources:
      - myapp-pod
    kind: Pod
    result: pass
```

```bash
$ kyverno test .


Loading test  ( kyverno-test.yaml ) ...
  Loading values/variables ...
  Loading policies ...
  Loading resources ...
  Loading exceptions ...
  Applying 1 policy to 1 resource ...
  Checking results ...


│────│─────────────────────│────────────────────│───────────────│────────│────────│
│ ID │ POLICY              │ RULE               │ RESOURCE      │ RESULT │ REASON │
│────│─────────────────────│────────────────────│───────────────│────────│────────│
│ 1  │ disallow-latest-tag │ require-image-tag  │ Pod/myapp-pod │ Pass   │ Ok     │
│ 2  │ disallow-latest-tag │ validate-image-tag │ Pod/myapp-pod │ Pass   │ Ok     │
│────│─────────────────────│────────────────────│───────────────│────────│────────│


Test Summary: 2 tests passed and 0 tests failed
```

--------------------------------

### Create a kind cluster

Source: https://kyverno.io/docs/guides/monitoring

Creates a local Kubernetes cluster using kind for the tutorial.

```bash
kind create cluster
```

--------------------------------

### Install Kyverno CLI via AUR

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Installs the Kyverno CLI using an AUR helper such as yay.

```bash
yay -S kyverno-git
```

--------------------------------

### Create a Pod with kubectl run

Source: https://kyverno.io/docs/guides/tracing

Creates an nginx Pod to exercise the Kyverno admission webhooks. After running this command, navigate to the Jaeger UI and search for traces with service 'kyverno' and operation 'ADMISSION POST /validate/fail'.

```bash
kubectl run nginx --image=nginx
```

--------------------------------

### Example resource manifest required_default_network_policy.yaml

Source: https://kyverno.io/docs/subprojects/kyverno-cli

A Namespace resource manifest used as the target resource in the apply examples.

```yaml
kind: Namespace
apiVersion: v1
metadata:
  name: devtest
```

--------------------------------

### kyverno create options

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create

Shows the `-h, --help` flag for the `kyverno create` command.

```bash
-h, --help   help for create
```

--------------------------------

### kyverno create command synopsis

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create

Shows the basic usage of the `kyverno create` command with its flags placeholder.

```bash
kyverno create [flags]
```

--------------------------------

### Install Jaeger Operator

Source: https://kyverno.io/docs/guides/monitoring

Creates the observability namespace, installs the Jaeger Operator v1.33.0, and waits for it to become available.

```bash
kubectl create namespace observability
kubectl create -n observability -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.33.0/jaeger-operator.yaml
kubectl wait --for=condition=Available deployment --timeout=2m -n observability --all
```
Tokens:
Raw