### Match Services by Name Pattern or User

Source: https://kyverno.io/docs/policy-types/cluster-policy/match-exclude

This example demonstrates matching Services starting with 'prod-' or named 'staging', OR any Service created by the user 'dave'. Wildcards are supported in resource names for flexible matching.

```yaml
match:
  any:
    - resources:
        names:
          - 'prod-*'
          - 'staging'
        kinds:
          - Service
        operations:
          - CREATE
    - resources:
        kinds:
          - Service
        operations:
          - CREATE
      subjects:
        - kind: User
          name: dave
```

--------------------------------

### Kyverno Resource Manifests for Global Value Example

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Example Pod manifests to demonstrate global value precedence.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: test-global-prod
spec:
  containers:
    - name: nginx
      image: nginx:latest
---
apiVersion: v1
kind: Pod
metadata:
  name: test-global-dev
spec:
  containers:
    - name: nginx
      image: nginx:1.12

```

--------------------------------

### Kyverno Resource Manifest Example

Source: https://kyverno.io/docs/subprojects/kyverno-cli

An example of a Namespace resource manifest.

```yaml
kind: Namespace
apiVersion: v1
metadata:
  name: devtest

```

--------------------------------

### Install and Verify Kyverno CLI via Krew

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Installs the Kyverno CLI using the kubectl krew plugin manager and verifies the installation by checking the version.

```bash
# Install Kyverno CLI using kubectl krew plugin manager
kubectl krew install kyverno

# test the Kyverno CLI
kubectl kyverno version
```

--------------------------------

### Install Kyverno using YAML Manifest

Source: https://kyverno.io/docs/installation/installation

Install Kyverno using a single YAML installation manifest from a tagged release. This method is an alternative to Helm, though Helm is preferred for production.

```bash
kubectl create -f https://github.com/kyverno/kyverno/releases/download/v1.16.2/install.yaml
```

--------------------------------

### Install Pre-Release Kyverno Versions with Helm

Source: https://kyverno.io/docs/installation/installation

Install pre-release versions (alpha, beta, rc) of Kyverno using Helm by adding the `--devel` flag to the installation command.

```bash
helm install kyverno kyverno/kyverno -n kyverno --create-namespace --devel
```

--------------------------------

### Install Kyverno and Prometheus Stack

Source: https://kyverno.io/docs/guides/monitoring

Install the Kyverno Helm chart and the kube-prometheus-stack chart. Ensure the namespaces 'kyverno' and 'monitoring' are created.

```bash
helm install kyverno kyverno/kyverno --namespace kyverno --create-namespace
helm install monitoring prometheus-community/kube-prometheus-stack -n monitoring --create-namespace
```

--------------------------------

### Kubectl Describe Deployment Example

Source: https://kyverno.io/docs/policy-types/cluster-policy/mutate

This output shows an example of Kubernetes events for a deployment, indicating that a Kyverno policy was applied successfully. It is useful for verifying policy application.

```bash
$ kubectl describe deploy foobar
...
Events:
  Type     Reason             Age                From                   Message
  ----     ------             ----               ----                   -------
  Normal   PolicyApplied      29s (x2 over 31s)  kyverno-mutate         policy add-sec/add-sec-rule applied

```

--------------------------------

### Install Kyverno CLI via Homebrew

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Installs the Kyverno CLI using the Homebrew package manager.

```bash
brew install kyverno
```

--------------------------------

### Install Kyverno CLI Binary Manually

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Manually installs a specific version of the Kyverno CLI by downloading the binary, extracting it, and copying it to the system's PATH.

```bash
curl -LO https://github.com/kyverno/kyverno/releases/download/v1.12.0/kyverno-cli_v1.12.0_linux_x86_64.tar.gz
tar -xvf kyverno-cli_v1.12.0_linux_x86_64.tar.gz
sudo cp kyverno /usr/local/bin/
```

--------------------------------

### Install Kyverno via Helm (Non-Production)

Source: https://kyverno.io/docs/installation/installation

Use these Helm commands to install Kyverno in a non-production environment. Ensure you add and update the Kyverno Helm repository before installation.

```bash
helm repo add kyverno https://kyverno.github.io/kyverno/
helm repo update
helm install kyverno kyverno/kyverno -n kyverno --create-namespace
```

--------------------------------

### Example: Test Subresource Matching

Source: https://kyverno.io/docs/subprojects/kyverno-cli

An example demonstrating how to specify subresource details within the `values` file for testing purposes.

```yaml
apiVersion: cli.kyverno.io/v1alpha1
kind: Values
metadata:
  name: values
subresources:
  - subresource:
      name: 'deployments/scale'
      kind: 'Scale'
      group: 'autoscaling'
      version: 'v1'
    parentResource:
      name: 'deployments'
      kind: 'Deployment'
      group: 'apps'
      version: 'v1'

```

--------------------------------

### Install Prometheus

Source: https://kyverno.io/docs/guides/monitoring

Apply the Prometheus configuration using kubectl to install it in the cluster. This is a prerequisite for viewing metrics.

```bash
kubectl apply -k github.com/kyverno/grafana-dashboard/examples/prometheus

```

--------------------------------

### ValidatingWebhookConfiguration Example

Source: https://kyverno.io/docs/guides/admission-controllers

This example shows an abbreviated ValidatingWebhookConfiguration. It defines rules for sending creation requests for Deployments to a specific service within the cluster. Ensure the clientConfig correctly points to your service.

```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: kyverno-resource-validating-webhook-cfg
webhooks:
  - name: validate.kyverno.svc-fail ## The name of this webhook
    rules: ## What resources should be sent
      - apiGroups:
          - apps
        apiVersions:
          - v1
        operations:
          - CREATE
        resources:
          - deployments
    clientConfig: ## Where the resources should be sent
      caBundle: LS0t<snip>0tLS0K
      service:
        name: kyverno-svc
        namespace: kyverno
        path: /validate/fail
        port: 443
    timeoutSeconds: 10 ## How long should the API server wait
    failurePolicy: Fail ## What should happen after the wait is over

```

--------------------------------

### Example Deployment for PolicyException

Source: https://kyverno.io/docs/guides/exceptions

This Deployment is used as an example to demonstrate how a PolicyException can allow a resource that would otherwise violate a policy rule.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: important-tool
  namespace: delta
  labels:
    app: busybox
spec:
  replicas: 1
  selector:
    matchLabels:
      app: busybox
  template:
    metadata:
      labels:
        app: busybox
    spec:
      hostIPC: true
      containers:
        - image: busybox:1.35
          name: busybox
          command: ['sleep', '1d']

```

--------------------------------

### Complete ArgoCD Application Example for Kyverno

Source: https://kyverno.io/docs/installation/platform-notes

This example demonstrates a complete ArgoCD Application manifest for deploying Kyverno. It includes annotations for ServerSideDiff, destination and source configurations, and sync policy settings.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kyverno
  namespace: argocd
  annotations:
    argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
spec:
  destination:
    namespace: kyverno
    server: https://kubernetes.default.svc
  project: default
  source:
    chart: kyverno
    repoURL: https://kyverno.github.io/kyverno
    targetRevision: <my.target.version>
    helm:
      values: |
        webhookLabels:
          app.kubernetes.io/managed-by: argocd
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true


```

--------------------------------

### Install Kyverno CLI via AUR (Arch Linux)

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Installs the Kyverno CLI on Arch Linux using an AUR helper like yay.

```bash
yay -S kyverno-git
```

--------------------------------

### Example of Denied Deployment with Bad Annotation

Source: https://kyverno.io/docs/policy-types/cel-libraries

This example demonstrates the output when a deployment is created with an annotation that violates the 'check-goodboi' Kyverno policy.

```bash
/ # cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  name: some-deploy
  labels:
    app: nginx
  annotations:
    pets: |-
      species:
        dog: lab
        name: dory
        color: black
        height: 15
        isGoodBoi: false
        snacks:
        - chimken
        - fries
        - pizza
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        resources:
          requests:
            cpu: 1
EOF
Error from server: error when creating "STDIN": admission webhook "vpol.validate.kyverno.svc-fail" denied the request: Policy check-goodboi failed: "Only good bois allowed."

```

--------------------------------

### Install Jaeger Backend

Source: https://kyverno.io/docs/guides/monitoring

Apply the Jaeger resource configuration to install the Jaeger backend in the cluster.

```bash
kubectl create -f jaeger.yaml

```

--------------------------------

### Example Deployment Manifest

Source: https://kyverno.io/docs/policy-types/cluster-policy/preconditions

This is an example of a Kubernetes Deployment manifest with various labels. It serves as a basis for demonstrating how Kyverno policies can match specific label combinations.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: busybox
  labels:
    app: busybox
    color: red
    animal: cow
    food: pizza
    car: jeep
    env: qa
spec:
  replicas: 1
  selector:
    matchLabels:
      app: busybox
  template:
    metadata:
      labels:
        app: busybox
    spec:
      containers:
        - image: busybox:1.28
          name: busybox
          command: ['sleep', '9999']

```

--------------------------------

### Install Ingress NGINX Controller

Source: https://kyverno.io/docs/guides/tracing

Installs the ingress-nginx controller from a GitHub repository and waits for the controller pod to be ready. Ensure the specified URL is accessible.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
sleep 15
kubectl wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=90s

```

--------------------------------

### Install Kyverno in High Availability Mode with Helm

Source: https://kyverno.io/docs/installation/installation

Use Helm to install Kyverno with multiple replicas for controllers to ensure high availability. This command creates a namespace and sets replica counts for admission, background, cleanup, and reports controllers.

```bash
helm install kyverno kyverno/kyverno -n kyverno --create-namespace \
--set admissionController.replicas=3 \
--set backgroundController.replicas=2 \
--set cleanupController.replicas=2 \
--set reportsController.replicas=2
```

--------------------------------

### Create a Pod

Source: https://kyverno.io/docs/guides/tracing

Create a sample Nginx pod to trigger Kyverno admission webhooks and generate traces. This command is used to exercise the setup.

```bash
kubectl run nginx --image=nginx

```

--------------------------------

### Install Jaeger All-in-One with Helm

Source: https://kyverno.io/docs/guides/tracing

Installs the Jaeger all-in-one version using Helm, configured for in-memory storage and disabling agent, collector, and query components to simplify setup. This is suitable for testing and development environments.

```bash
helm install jaeger --namespace monitoring --create-namespace --wait \
  --repo https://jaegertracing.github.io/helm-charts jaeger \
  --values - <<EOF
storage:
  type: none
provisionDataStore:
  cassandra: false
agent:
  enabled: false
collector:
  enabled: false
query:
  enabled: false
allInOne:
  enabled: true
  ingress:
    enabled: true
    hosts:
      - localhost
EOF
```

--------------------------------

### Kubectl Get UpdateRequest Example

Source: https://kyverno.io/docs/policy-types/cluster-policy/mutate

This command retrieves UpdateRequest resources in the `kyverno` namespace, showing their status. It helps in identifying policy application failures.

```bash
$ kubectl get ur -n kyverno
NAME       POLICY    RULETYPE   RESOURCEKIND   RESOURCENAME   RESOURCENAMESPACE   STATUS   AGE
ur-swsdg   add-sec   mutate     Deployment     foobar         default             Failed   84s

```

--------------------------------

### Install Kyverno with Tracing Enabled

Source: https://kyverno.io/docs/guides/tracing

Deploy Kyverno using Helm, enabling tracing and configuring it to point to the Tempo backend. Ensure the correct namespace and repository are used.

```bash
helm install kyverno --namespace kyverno --create-namespace --wait \
  --repo https://kyverno.github.io/kyverno kyverno \
  --values - <<EOF
admissionController:
  tracing:
    # enable tracing
    enabled: true
    # tempo backend url
    address: tempo.monitoring
    # tempo backend port for opentelemetry traces
    port: 4317


backgroundController:
  tracing:
    # enable tracing
    enabled: true
    # tempo backend url
    address: tempo.monitoring
    # tempo backend port for opentelemetry traces
    port: 4317


cleanupController:
  tracing:
    # enable tracing
    enabled: true
    # tempo backend url
    address: tempo.monitoring
    # tempo backend port for opentelemetry traces
    port: 4317


reportsController:
  tracing:
    # enable tracing
    enabled: true
    # tempo backend url
    address: tempo.monitoring
    # tempo backend port for opentelemetry traces
    port: 4317
EOF

```

--------------------------------

### Conditional Iteration with CEL Map and Filter

Source: https://kyverno.io/docs/policy-types/mutating-policy

Conditionally mutate elements using CEL's map() and filter() functions. This example adds environment variables to containers only if their image starts with 'nginx:'.

```yaml
apiVersion: policies.kyverno.io/v1
kind: MutatingPolicy
metadata:
  name: foreach-conditional
spec:
  matchConstraints:
    resourceRules:
      - apiGroups: ['']
        apiVersions: ['v1']
        resources: ['pods']
        operations: ['CREATE', 'UPDATE']
  mutations:
    - patchType: JSONPatch
      jsonPatch:
        expression: |
          object.spec.containers.map(c,
            c.image.startsWith("nginx:") ?
            JSONPatch{
              op: "add",
              path: "/spec/containers/" + string(object.spec.containers.indexOf(c)) + "/env",
              value: [{"name": "NGINX_ENV", "value": "production"}]
            } : null
          ).filter(p, p != null)


```

--------------------------------

### RBAC Permissions for Deleting Resources

Source: https://kyverno.io/docs/policy-types/deleting-policy

This example shows the necessary RBAC rules for the Kyverno cleanup controller to delete ConfigMaps. Ensure verbs like 'get', 'list', 'watch', and 'delete' are allowed on targeted resources.

```yaml
rules:
  - apiGroups: ['']
    resources: ['configmaps']
    verbs: ['get', 'list', 'watch', 'delete']
```

--------------------------------

### Kyverno CLI Context File Example

Source: https://kyverno.io/docs/subprojects/kyverno-cli

A sample context file for Kyverno CLI, defining mock ConfigMap resources for local policy evaluation.

```yaml
apiVersion: cli.kyverno.io/v1alpha1
kind: Context
metadata:
  name: context
spec:
  # The resources defined here will be available to functions like resource.Get()
  resources:
    - apiVersion: v1
      kind: ConfigMap
      metadata:
        namespace: default
        name: policy-cm
      data:
        # According to this, the valid pod name is 'good-pod'.
        name: good-pod

```

--------------------------------

### Kyverno GitHub Actions Workflow Example

Source: https://kyverno.io/docs/guides/testing-policies

This workflow automates Kyverno policy testing for pull requests and manual triggers. It checks out the repository, installs the Kyverno CLI, and tests policies against resources and predefined test cases.

```yaml
name: kyverno-policy-test
on:
  - pull_request
  - workflow_dispatch
jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4
      - name: Install Kyverno CLI
        uses: kyverno/action-install-cli@v0.2.0
        with:
          release: 'v1.11.0'
      - name: Check install
        run: kyverno version
      - name: Test new resources against existing policies
        run: kyverno apply policies/ -r resources/
      - name: Test pre-defined cases
        run: kyverno test tests/
```

--------------------------------

### Translated Pattern for Pod Controllers

Source: https://kyverno.io/docs/policy-types/cluster-policy/autogen

This is an example of how a simple namespace exclusion pattern gets translated for Pod controllers like Deployments. It shows the `namespace` field within the Pod template's metadata, which differs from the controller's metadata.

```yaml
pattern:
  spec:
    template:
      metadata:
        namespace: '!default'
```

--------------------------------

### Build Kyverno CLI from Source

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Builds the Kyverno CLI binary from the Git repository, requiring Go to be installed. It clones the repository, builds the CLI, and moves the binary to the system's PATH.

```bash
git clone https://github.com/kyverno/kyverno
cd kyverno
make build-cli
sudo mv ./cmd/cli/kubectl-kyverno/kubectl-kyverno /usr/local/bin/
```

--------------------------------

### Calculate Time Difference with time_diff

Source: https://kyverno.io/docs/policy-types/cluster-policy/jmespath

The time_diff filter calculates the duration between a start and end time in RFC 3339 format. The output can be a negative duration. This example ensures a container image's vulnerability scan is no older than 24 hours.

```yaml
apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
  name: require-vulnerability-scan
spec:
  webhookConfiguration:
    failurePolicy: Fail
    timeoutSeconds: 20
  rules:
    - name: scan-not-older-than-one-day
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - 'ghcr.io/myorg/myrepo:*'
          failureAction: Enforce
          attestations:
            - predicateType: cosign.sigstore.dev/attestation/vuln/v1
              attestors:
                - entries:
                    - keyless:
                        subject: 'https://github.com/myorg/myrepo/.github/workflows/*'
                        issuer: 'https://token.actions.githubusercontent.com'
                        rekor:
                          url: https://rekor.sigstore.dev
              conditions:
                - all:
                    - key: "{{ time_diff('{{metadata.scanFinishedOn}}','{{ time_now_utc() }}') }}"
                      operator: LessThanOrEquals
                      value: '24h'

```

--------------------------------

### Create Deployments for Testing

Source: https://kyverno.io/docs/guides/reports

Creates four sample Deployments with varying replica counts and in different namespaces to test policy enforcement.

```bash
kubectl create deployment deployment-1 --image=nginx --replicas=7

```

```bash
kubectl create deployment deployment-2 --image=nginx --replicas=3

```

```bash
kubectl create deployment deployment-3 --image=nginx --replicas=7 -n staging

```

```bash
kubectl create deployment deployment-4 --image=nginx --replicas=3 -n staging

```

--------------------------------

### Check if Time is Between Two Other Times with time_between

Source: https://kyverno.io/docs/policy-types/cluster-policy/jmespath

Use the time_between filter to evaluate if a specific timestamp falls within a given start and end time range. All times must be in RFC 3339 format. This example enforces a label on ConfigMaps created within January 2023.

```yaml
apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
  name: expiration
spec:
  background: false
  rules:
    - name: expire-jan-31
      match:
        any:
          - resources:
              kinds:
                - ConfigMap
      preconditions:
        all:
          - key: "{{ time_between('{{ time_now_utc() }}','2023-01-01T00:00:00Z','2023-01-31T23:59:59Z') }}"
            operator: Equals
            value: true
      validate:
        failureAction: Enforce
        message: 'The foo label must be set.'
        pattern:
          metadata:
            labels:
              foo: '?*'

```

--------------------------------

### kyverno create user-info Command Synopsis

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_user-info

The basic syntax for creating a Kyverno user-info file.

```bash
kyverno create user-info [flags]
```

--------------------------------

### Kyverno Create Metrics Config Options

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_metrics-config

Lists the available options for the `kyverno create metrics-config` command, including flags for specifying included and excluded namespaces, and output path.

```bash
  -e, --exclude strings    Excluded namespaces
  -h, --help               help for metrics-config
  -i, --include strings    Included namespaces
  -n, --name string        Name (default "kyverno-metrics")
      --namespace string   Namespace (default "kyverno")
  -o, --output string      Output path (uses standard console output if not set)
```

--------------------------------

### Testing a Local Folder

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_test

Example of how to run tests from a local directory. The command will look for a kyverno-test.yaml file in the specified directory.

```bash
kyverno test .
```

--------------------------------

### Kyverno Policy Manifest Example

Source: https://kyverno.io/docs/subprojects/kyverno-cli

An example of a ClusterPolicy manifest that generates a NetworkPolicy.

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-networkpolicy
spec:
  background: false
  rules:
    - name: default-deny-ingress
      match:
        any:
          - resources:
              kinds:
                - Namespace
            clusterRoles:
              - cluster-admin
      generate:
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        name: default-deny-ingress
        namespace: '{{request.object.metadata.name}}'
        synchronize: true
        data:
          spec:
            # select all pods in the namespace
            podSelector: {}
            policyTypes:
              - Ingress

```

--------------------------------

### kyverno create user-info Command Options

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_user-info

Lists the available flags for customizing the user-info file creation, including cluster role, group, output path, and username.

```bash
  -c, --cluster-role strings   Cluster role
  -g, --group strings          Group
  -h, --help                   help for user-info
  -o, --output string          Output path (uses standard console output if not set)
  -r, --role strings           Role
  -u, --username string        User name
```

--------------------------------

### Generated ValidatingAdmissionPolicy Example

Source: https://kyverno.io/docs/policy-types/cluster-policy/validate

This is an example of a ValidatingAdmissionPolicy generated by Kyverno based on a Kyverno policy.

```yaml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  labels:
    app.kubernetes.io/managed-by: kyverno
  name: disallow-host-path
  ownerReferences:
    - apiVersion: kyverno.io/v1
      kind: ClusterPolicy
      name: disallow-host-path
spec:
  failurePolicy: Fail
  matchConstraints:
    matchPolicy: Equivalent
    namespaceSelector: {}
    objectSelector: {}
    resourceRules:
      - apiGroups:
          - apps
        apiVersions:

```

--------------------------------

### Secret YAML Manifest Example

Source: https://kyverno.io/docs/policy-types/cluster-policy/validate

An example of a Kubernetes Secret manifest that can be signed and validated.

```yaml
apiVersion: v1
data:
  api_token: MDEyMzQ1Njc4OWFiY2RlZg==
kind: Secret
metadata:
  annotations:
    cosign.sigstore.dev/message: H4sIAAAAAAAA/zTMPQrCQBBA4X5OMVeIWA2kU7sYVFC0kXEzyJr9c3cirKcXlXSv+R4ne5RcbAyErwYGViZA5GSvGkcJhN1qXbv3rtk+zLI/bex5sXeXe9vCaMNAeBCTRcGL8owd38SVbyG6aFh/d5lyTAKIgb0Q+lr+UmsSwj7xcxL4BAAA//+dVuynjwAAAA==
    cosign.sigstore.dev/signature: MEQCIDfRq08y5MSOFo3iiEQUKdRJw9YhQHTjMAXwgO0eWO+hAiBYbR5qpa3wBjfN+d4rdQy5iNFf2pEp24aHZJgwyHEaSA==
  labels:
    location: europe
  name: mysecret
type: Opaque
```

--------------------------------

### NamespacedDeletingPolicy Example

Source: https://kyverno.io/docs/policy-types/deleting-policy

An example of a cluster-scoped DeletingPolicy that cleans up completed jobs in the 'production' namespace daily.

```yaml
apiVersion: policies.kyverno.io/v1
kind: NamespacedDeletingPolicy
metadata:
  name: cleanup-jobs
  namespace: production
spec:
  schedule: '0 2 * * *' # Daily at 2 AM
  matchConstraints:
    resourceRules:
      - apiGroups: ['batch']
        apiVersions: ['v1']
        resources: ['jobs']
  conditions:
    - name: 'completed-jobs'
      expression: "object.status.conditions.exists(c, c.type == 'Complete' && c.status == 'True')"
```

--------------------------------

### Kyverno CLI Test Execution

Source: https://kyverno.io/docs/subprojects/kyverno-cli

This example demonstrates how to run Kyverno policy tests using the `kyverno test` command. It includes the test manifest and the expected CLI output.

```yaml
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata:
  name: deny-all-traffic
policies:
  - add_network_policy.yaml
resources:
  - resource.yaml
results:
  - policy: add-networkpolicy
    rule: default-deny
    resources:
      - hello-world-namespace
    generatedResource: generatedResource.yaml
    kind: Namespace
    result: pass

```

```bash
$ kyverno test .
Executing deny-all-traffic...
applying 1 policy to 1 resource...


│───│───────────────────│──────────────│──────────────────────────────────│────────│
│ # │ POLICY            │ RULE         │ RESOURCE                         │ RESULT │
│───│───────────────────│──────────────│──────────────────────────────────│────────│
│ 1 │ add-networkpolicy │ default-deny │ /Namespace/hello-world-namespace │ Pass   │
│───│───────────────────│──────────────│──────────────────────────────────│────────│
Test Summary: 1 tests passed and 0 tests failed


```

--------------------------------

### NamespacedImageValidatingPolicy Example

Source: https://kyverno.io/docs/policy-types/image-validating-policy

An example of a namespace-scoped ImageValidatingPolicy that verifies image signatures using Cosign keyless authentication.

```yaml
apiVersion: policies.kyverno.io/v1
kind: NamespacedImageValidatingPolicy
metadata:
  name: verify-team-images
  namespace: development
spec:
  matchConstraints:
    resourceRules:
      - apiGroups: ['']
        apiVersions: ['v1']
        operations: [CREATE, UPDATE]
        resources: [pods]
  matchImageReferences:
    - glob: 'ghcr.io/myorg/dev-*'
  attestors:
    - name: dev-attestor
      cosign:
        keyless:
          identities:
            - issuer: 'https://token.actions.githubusercontent.com'
              subject: '*@myorg.github.io'
  validations:
    - message: 'image must be signed by the development team'
      expression: 'imageverify.verify(images.containers, attestors.devAttestor).all(result, result.verified)'

```

--------------------------------

### Custom Predicate JSON Example

Source: https://kyverno.io/docs/policy-types/cluster-policy/verify-images/sigstore

Example of a JSON document that can be used as a custom predicate for Cosign attestations.

```json
{
  "author": "alice@example.com",
  "repo": {
    "branch": "main",
    "type": "git",
    "uri": "https://git-repo.com/org/app"
  },
  "reviewers": ["bob@example.com"]
}
```

--------------------------------

### Kyverno Docs Command

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno

Generates reference documentation for Kyverno.

```bash
kyverno docs -h
```

--------------------------------

### ClusterPolicy Structure Example

Source: https://kyverno.io/docs/guides/migration-to-cel

Example of a ClusterPolicy definition, which contains an ordered list of rules and common settings.

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-labels
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: 'Required labels missing'
        pattern:
          metadata:
            labels:
              app: '?*'
              version: '?*'

```

--------------------------------

### Example Pod Manifests for Validation

Source: https://kyverno.io/docs/subprojects/kyverno-cli

These are example Kubernetes Pod manifests, one designed to pass validation and the other to fail.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: good-pod
spec:
  containers:
    - name: nginx
      image: nginx
```

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: bad-pod
spec:
  containers:
    - name: nginx
      image: nginx
```

--------------------------------

### Generate Simple Markdown Documentation

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_docs

Use this command to generate simple markdown reference documentation. Ensure the `KYVERNO_EXPERIMENTAL` environment variable is set to `true` and specify the output directory with `-o`.

```bash
KYVERNO_EXPERIMENTAL=true kyverno docs -o . --autogenTag=false
```

--------------------------------

### Generate Website Documentation

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_docs

This command generates markdown documentation specifically formatted for the Kyverno website. Set `KYVERNO_EXPERIMENTAL` to `true` and use the `--website` flag.

```bash
KYVERNO_EXPERIMENTAL=true kyverno docs -o . --website
```

--------------------------------

### NamespacedMutatingPolicy Example

Source: https://kyverno.io/docs/policy-types/mutating-policy

This example demonstrates a `NamespacedMutatingPolicy` that adds environment and managed labels to pods within the 'production' namespace.

```yaml
apiVersion: policies.kyverno.io/v1
kind: NamespacedMutatingPolicy
metadata:
  name: add-labels
  namespace: production
spec:
  matchConstraints:
    resourceRules:
      - apiGroups: ['']
        apiVersions: ['v1']
        operations: ['CREATE', 'UPDATE']
        resources: ['pods']
  mutations:
    - patchType: ApplyConfiguration
      applyConfiguration:
        expression: >
          Object{
            metadata: Object.metadata{
              labels: Object.metadata.labels{
                environment: "production",
                managed: "true"
              }
            }
          }

```

--------------------------------

### CEL-based ValidatingPolicy Structure Example

Source: https://kyverno.io/docs/guides/migration-to-cel

Example of a CEL-based ValidatingPolicy, focused on a single action (validation) with a CEL expression.

```yaml
apiVersion: policies.kyverno.io/v1
kind: ValidatingPolicy
metadata:
  name: require-app-version-labels
spec:
  matchConstraints:
    resourceRules:
      - apiGroups:
          - ''
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - pods
  validationActions:
    - Deny
  validations:
    - expression: >
        ['app', 'version'].all(label,
          object.metadata.?labels[label].orValue('') != ''
        )
      message: 'Required labels missing'

```

--------------------------------

### Kyverno Create Exception Command Options

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_exception

Lists the available options for the 'kyverno create exception' command, including filters for resources, namespace, output path, and policy rule specifications.

```bash
      --all stringArray                                        List of resource filters
      --any stringArray                                        List of resource filters
  -b, --background                                             Set to false when policy shouldn't be considered in background scans (default true)
  -h, --help                                                   help for exception
      --namespace string                                       Policy exception namespace
  -o, --output string                                          Output path (uses standard console output if not set)
      --policy-rules --policy-rules=policy,rule-1,rule-2   Policy name, followed by rule names (--policy-rules=policy,rule-1,rule-2,...)
```

--------------------------------

### Install Pod Security Standards Policies via Helm

Source: https://kyverno.io/docs/guides/pod-security

Installs the Kyverno Pod Security Standards (PSS) policies using the kyverno/kyverno-policies Helm chart. The policies are installed into the 'kyverno-policies' namespace, which will be created if it doesn't exist. Adjust the namespace as needed.

```bash
helm install kyverno-pss kyverno/kyverno-policies \
  --namespace kyverno-policies --create-namespace \
  --set policyGroups=pod-security
```

--------------------------------

### Example Pod Resource

Source: https://kyverno.io/docs/policy-types/cluster-policy/jmespath

This is a sample Kubernetes Pod resource definition used to demonstrate array flattening.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  initContainers:
    - name: redis
      image: redis
  containers:
    - name: busybox
      image: busybox
    - name: nginx
      image: nginx

```

--------------------------------

### Find Deployment Resource API

Source: https://kyverno.io/docs/policy-types/cluster-policy/external-data-sources

This example demonstrates how to find the API group and version for 'Deployment' resources by combining `kubectl api-resources` and `kubectl api-versions`. First, it filters for 'deploy' using `grep` to identify the resource, then it filters for 'apps' to find the corresponding API version.

```bash
kubectl api-resources | grep deploy

```

```bash
kubectl api-versions | grep apps

```

--------------------------------

### Generate bash completion script for installation

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_completion

Generates the bash completion script and directs it to the appropriate directory for installation on Linux systems.

```bash
kyverno completion bash > /etc/bash_completion.d/kyverno
```

--------------------------------

### Kyverno Test Output Summary

Source: https://kyverno.io/docs/subprojects/kyverno-cli

Example output from the 'kyverno test' command, showing test results and a summary.

```bash
Loading test  ( kyverno-test.yaml ) ...
  Loading values/variables ...
  Loading policies ...
  Loading resources ...
  Loading exceptions ...
  Applying 1 policy to 2 resources with 0 exceptions ...
  Checking results ...


│────│────────────────────│──────│─────────────────────────│────────│────────│
│ ID │ POLICY             │ RULE │ RESOURCE                │ RESULT │ REASON │
│────│────────────────────│──────│─────────────────────────│────────│────────│
│ 1  │ disallow-host-path │      │ v1/Pod/default/bad-pod  │ Pass   │ Ok     │
│ 2  │ disallow-host-path │      │ v1/Pod/default/good-pod │ Pass   │ Ok     │
│────│────────────────────│──────│─────────────────────────│────────│────────│


Test Summary: 2 tests passed and 0 tests failed
```

--------------------------------

### Example Kubernetes Event for Resource Deletion

Source: https://kyverno.io/docs/policy-types/deleting-policy

This is an example of a Kubernetes Event object emitted by Kyverno when a DeletingPolicy successfully cleans up a resource.

```yaml
apiVersion: v1
kind: Event
metadata:
  name: cleanup-old-test-pods.184c935c5c7c52c0
  namespace: default
  creationTimestamp: '2025-06-26T11:13:00Z'
  resourceVersion: '3894'
  uid: 064e08ef-4547-43a3-b199-d2bbadd93b65
action: Resource Cleaned Up
reason: PolicyApplied
message: successfully deleted the target resource Pod/default/example
involvedObject:
  apiVersion: policies.kyverno.io/v1
  kind: DeletingPolicy
  name: deleting-pod
  uid: cc44fb71-9413-4bbf-bc37-036a10f02c7c
related:
  apiVersion: v1
  kind: Pod
  name: example
  namespace: default
reportingComponent: kyverno-cleanup
reportingInstance: kyverno-cleanup-kyverno-cleanup-controller-76c8b69df6-89mjj
type: Normal
```

--------------------------------

### Create a Compliant Pod and Inspect PolicyReport

Source: https://kyverno.io/docs/guides/reports

This section shows how to create a Pod that adheres to the policy and then inspect the generated PolicyReport to confirm a 'PASS' status. It includes commands to create the Pod, list Pods, and get PolicyReports.

```bash
$ kubectl run busybox --image busybox:1.28 -- sleep 9999
pod/busybox created


$ kubectl get po
NAME      READY   STATUS    RESTARTS   AGE
busybox   1/1     Running   0          66s


$ kubectl get polr -o wide
NAME                                   KIND         NAME                                         PASS   FAIL   WARN   ERROR   SKIP   AGE
89044d72-8a1e-4af0-877b-9be727dc3ec4   Pod          busybox                                      1      0      0      0       0      15s

```

```yaml
---
results:
- message: validation rule 'secrets-not-from-env-vars' passed.
  policy: secrets-not-from-env-vars
  result: pass
  rule: secrets-not-from-env-vars
  scored: true
  source: kyverno
  timestamp:
    nanos: 0
    seconds: 1666097147
summary:
  error: 0
  fail: 0
  pass: 1
  skip: 0
  warn: 0

```

--------------------------------

### ClusterAdmissionReport Example

Source: https://kyverno.io/docs/guides/reports

An example of a ClusterAdmissionReport resource, which is an intermediary resource used by Kyverno to build final policy reports for admission events.

```yaml
apiVersion: kyverno.io/v1alpha2
kind: ClusterAdmissionReport
metadata:
  creationTimestamp: '2022-10-18T13:15:09Z'
  generation: 1
  labels:
    app.kubernetes.io/managed-by: kyverno
    audit.kyverno.io/resource.hash: a7ec5160f220c5b83c26b5c8f7dc35b6
    audit.kyverno.io/resource.uid: 61946422-14ba-4aa2-94b4-229d38446381
    cpol.kyverno.io/require-ns-labels: '4773'
  name: c0cc7337-9bcd-4d53-abb2-93f7f5555216
  resourceVersion: '4986'
  uid: 10babc6c-9e6e-4386-abed-c13f50091523
spec:
  owner:
    apiVersion: v1
    kind: Namespace
    name: testing
    uid: 61946422-14ba-4aa2-94b4-229d38446381
  results:
    - message:
        'validation error: The label `thisshouldntexist` is required. rule check-for-labels-on-namespace
        failed at path /metadata/labels/thisshouldntexist/'
      policy: require-ns-labels
      result: fail
      rule: check-for-labels-on-namespace
      scored: true
      source: kyverno
      timestamp:
        nanos: 0
        seconds: 1666098909
  summary:
    error: 0
    fail: 1
    pass: 0
    skip: 0
    warn: 0

```

--------------------------------

### Incoming Pod Manifest

Source: https://kyverno.io/docs/policy-types/cluster-policy/jmespath

A sample Pod manifest before mutation by a Kyverno policy. This shows the initial state of the resource.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
    - name: busybox
      image: busybox

```

--------------------------------

### Generate zsh completion script for installation

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_completion

Generates the zsh completion script and directs it to the correct location within the zsh fpath for installation.

```zsh
kyverno completion zsh > "${fpath[1]}/_kyverno"
```

--------------------------------

### Verify Kyverno Kubernetes Install Manifest Signature

Source: https://kyverno.io/docs/guides/security

Verify the signature of the Kubernetes install manifest for Kyverno. This ensures the integrity of the deployment artifacts.

```bash
cosign verify ghcr.io/kyverno/manifests/kyverno:<release_tag> \
  --certificate-identity-regexp="https://github.com/kyverno/kyverno/.github/workflows/release.yaml@refs/tags/*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" | jq
```

--------------------------------

### Kyverno Create Command

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno

Assists in the creation of various Kyverno resources.

```bash
kyverno create -h
```

--------------------------------

### Create a Policy Exception File

Source: https://kyverno.io/docs/kyverno-cli/reference/kyverno_create_exception

Example of creating a Kyverno policy exception file. It specifies the exception name, namespace, and the policy rules and resource filters to apply.

```bash
kyverno create exception my-exception --namespace my-ns --policy-rules "policy,rule-1,rule-2" --any "kind=Pod,kind=Deployment,name=test-*"
```