kyverno

Kyverno Generator

Published on kadet-hub (catalog): pin a released version by digest from its catalog page.

Kapitan kadet generator for Kyverno policy resources:

Built for Kyverno 1.19.1.

At 1.19.1 Kyverno marks every version of ClusterPolicy, Policy, PolicyException, ClusterCleanupPolicy and CleanupPolicy deprecated in favour of the CEL-based policies.kyverno.io kinds and plans to remove them in 1.20 (ClusterPolicy, Policy, PolicyException, ClusterCleanupPolicy, CleanupPolicy, migration guide). For these legacy kinds the generator emits the storage versions kyverno.io/v1 and kyverno.io/v2, and the API server prints a deprecation warning when they are applied. The policies.kyverno.io kinds are emitted at v1beta1, their storage version at 1.19.1; v1 is served with the same schema and becomes the storage version in 1.20 (storage version).

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kyverno@sha256:<digest>
        output_path: lib/kyverno
    compile:
      - output_path: manifests/kyverno/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/kyverno

Inventory Contract

All keys live under parameters.generators.kyverno. namespace at that level sets the default namespace of the namespaced kinds, falling back to parameters.namespace, then default.

Every resource entry accepts name (overrides the map key), labels, annotations and spec; namespaced kinds also accept namespace. For the same field, spec loses to the flat keys and shorthands below, and a flat key that overrides a spec value logs a warning.

Flat keys are the snake_case spelling of the CRD spec fields; values pass through unchanged unless a shorthand or the mapping of deprecated keys below applies:

A rule accepts name, context, match, match_kinds, exclude, preconditions, cel_preconditions, validate, mutate, generate, verify_images and image_extractors; any other rule key, such as skipBackgroundRequests, passes through verbatim. An exception entry takes policy_name and rule_names.

Shorthands:

Kyverno’s admission rejects a policies.kyverno.io policy without a resource rule in matchConstraints (validate.go). match_kinds there knows the GA built-in kinds of Kubernetes 1.37.1; any other kind, such as one from a CRD, stops the compile with a ValueError and belongs under match_constraints.resourceRules, where its API group and resource are explicit. A key that a policies.kyverno.io kind does not take also stops the compile, since an ignored key such as match_kinds on a PolicyException would leave the exception wider than written.

No defaults are added. A field left unset gets Kyverno’s default:

PolicyExceptions apply only when Kyverno runs with enablePolicyException and lists their namespace in exceptionNamespace (exceptions). A policies.kyverno.io PolicyException exempts every resource its match_conditions select, in any namespace; its own namespace does not limit it, so state the namespace in a condition (ListExceptions).

On ClusterPolicy and Policy the deprecated spec-level keys are rendered as their replacements. failure_policy and webhook_timeout_seconds become webhookConfiguration.failurePolicy and webhookConfiguration.timeoutSeconds, which Kyverno reads before the deprecated fields (spec_types.go). Setting one of them together with the same field in webhook_configuration stops the compile, because Kyverno rejects a policy with both (validateDeprecatedFields).

generate_existing_on_policy_update becomes generateExisting in the generate block of each rule, because Kyverno rejects the spec-level field even when it is false (validateDeprecatedFields); a rule that sets its own generateExisting keeps it and logs a warning.

validation_failure_action becomes failureAction, capitalised, in the validate block of every rule; Kyverno resolves a rule’s own action before the spec-level one (ruleAction). It stays at spec level where the move would change a resolved action:

• a validate rule sets its own failureAction: the policy-wide action is the first rule-level one (GetValidationFailureAction)
• the policy has validation_failure_action_overrides, which a rule-level action would outrank (failureActionForRule)
• the policy has a verifyImages rule, which reads the spec-level action (validate.go)

Invalid values of validation_failure_action, failure_policy and webhook_timeout_seconds (1 to 30) raise ValueError and stop the compile.

With the reclass-rs inventory backend, keys that start with = lose that character, because reclass treats = as its constant-key prefix. A Kyverno equality anchor =(field) in a pattern then becomes the conditional anchor (field) without any error, which changes what the policy checks. Use the omegaconf backend for policies with equality anchors, or write those checks as validate.cel or deny conditions.

Example

parameters:
  generators:
    kyverno:
      namespace: shop
      cluster_policies:
        disallow-privileged-containers:
          annotations:
            policies.kyverno.io/title: Disallow Privileged Containers
            policies.kyverno.io/category: Pod Security Standards (Baseline)
          validation_failure_action: Enforce
          webhook_configuration:
            failurePolicy: Fail
            timeoutSeconds: 10
          rules:
            - name: privileged-containers
              match_kinds: [Pod]
              validate:
                cel:
                  expressions:
                    - expression: >-
                        object.spec.containers.all(c, !has(c.securityContext) ||
                        !has(c.securityContext.privileged) || c.securityContext.privileged == false)
                      message: Privileged mode is disallowed.
      policies:
        require-memory-limits:
          rules:
            - name: check-memory-limits
              match_kinds: [Pod]
              validate:
                failureAction: Audit
                message: Memory limits are required
                pattern:
                  spec:
                    containers:
                      - resources:
                          limits:
                            memory: "?*"
      policy_exceptions:
        node-exporter-host-access:
          namespace: monitoring
          match:
            any:
              - resources:
                  kinds: [Pod]
                  namespaces: [monitoring]
                  names: ["node-exporter-*"]
          exceptions:
            - policy_name: disallow-privileged-containers
              rule_names: [privileged-containers]
      cluster_cleanup_policies:
        failed-jobs:
          schedule: "0 0 * * *"
          match_kinds: [Job]
          conditions:
            all:
              - key: "{{ target.status.failed || `0` }}"
                operator: GreaterThan
                value: 0
      cleanup_policies:
        preview-pods:
          schedule: "*/30 * * * *"
          spec:
            deletionPropagationPolicy: Foreground
          match:
            any:
              - resources:
                  kinds: [Pod]
                  selector:
                    matchLabels:
                      env: preview
      validating_policies:
        require-team-label:
          match_kinds: [Deployment, StatefulSet]
          validation_actions: [Deny]
          validations:
            - expression: "has(object.metadata.labels) && has(object.metadata.labels.team)"
              message: "label team is required"
      cel_policy_exceptions:
        legacy-billing:
          namespace: billing
          policy_refs:
            - name: require-team-label
              kind: ValidatingPolicy
          match_conditions:
            - name: billing-namespace
              expression: "object.metadata.namespace == 'billing'"
            - name: legacy-deployment
              expression: "object.metadata.name == 'billing-legacy'"
      deleting_policies:
        succeeded-jobs:
          schedule: "0 1 * * *"
          match_kinds: [Job]
          conditions:
            - name: succeeded
              expression: "has(object.status.succeeded) && object.status.succeeded > 0"