Reference documentation on Kyverno

kyverno

Mon, 01 Jan 0001 00:00:00 +0000

kyverno

Kubernetes Native Policy Management.

Synopsis

Kubernetes Native Policy Management.

The Kyverno CLI provides a command-line interface to work with Kyverno resources. It can be used to validate and test policy behavior to resources prior to adding them to a cluster.

kyverno apply

Mon, 01 Jan 0001 00:00:00 +0000

kyverno apply

Applies policies on resources.

Synopsis

Applies policies on resources.

For more information visit https://kyverno.io/docs/kyverno-cli/usage/apply/

kyverno apply [flags]

Examples

 # Apply on a resource
 kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --resource=/path/to/resource1 --resource=/path/to/resource2

 # Apply on a folder of resources
 kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --resource=/path/to/resources/

 # Apply on a cluster
 kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --cluster

 # Apply policies from a gitSourceURL on a cluster
 kyverno apply https://github.com/kyverno/policies/openshift/ --git-branch main --cluster

 # Apply single policy with variable on single resource
 kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml --set <variable1>=<value1>,<variable2>=<value2>

 # Apply multiple policy with variable on multiple resource
 kyverno apply /path/to/policy1.yaml /path/to/policy2.yaml --resource /path/to/resource1.yaml --resource /path/to/resource2.yaml -f /path/to/value.yaml

Options

 --audit-warn If set to true, will flag audit policies as warnings instead of failures
 -c, --cluster Checks if policies should be applied to cluster in the current context
 --cluster-wide-resources If set to true, will apply policies to cluster-wide resources
 --context string The name of the kubeconfig context to use
 --context-file string File containing context data for CEL policies
 --continue-on-fail If set to true, will continue to apply policies on the next resource upon failure to apply to the current resource instead of exiting out
 --detailed-results If set to true, display detailed results
 -e, --exception strings Policy exception to be considered when evaluating policies against resources
 --exceptions strings Policy exception to be considered when evaluating policies against resources
 --exceptions-with-resources Evaluate policy exceptions from the resources path
 --generate-exceptions Generate policy exceptions for each violation
 --generated-exception-ttl duration Default TTL for generated exceptions (default 720h0m0s)
 -b, --git-branch string test git repository branch
 -h, --help help for apply
 --json strings Path to JSON payload files
 --kubeconfig string path to kubeconfig file with authorization and master location information
 -n, --namespace string Optional Policy parameter passed with cluster flag
 -o, --output string Prints the mutated/generated resources in provided file/directory
 --output-format string Specifies the policy report format (json or yaml). Default: yaml. (default "yaml")
 --parameter-resource strings Path to resource files that act as ValidatingAdmissionPolicy/MutatingAdmissionPolicy parameters
 --password string Password for connecting to git repository
 -p, --policy-report Generates policy report when passed (default policyviolation)
 --registry If set to true, access the image registry using local docker credentials to populate external data
 --remove-color Remove any color from output
 -r, --resource strings Path to resource files
 --resources strings Path to resource files
 -s, --set strings Variables that are required
 -i, --stdin Optional mutate policy parameter to pipe directly through to kubectl
 -t, --table Show results in table format
 --target-resource strings Path to individual files containing target resources files for policies that have mutate existing
 --target-resources strings Path to a directory containing target resources files for policies that have mutate existing
 -u, --userinfo string Admission Info including Roles, Cluster Roles and Subjects
 --username string Username for connecting to git repository
 -f, --values-file string File containing values for policy variables
 --warn-exit-code int Set the exit code for warnings; if failures or errors are found, will exit 1
 --warn-no-pass Specify if warning exit code should be raised if no objects satisfied a policy; can be used together with --warn-exit-code flag

Options inherited from parent commands

 --add_dir_header If true, adds the file directory to the header of the log messages
 --alsologtostderr log to standard error as well as files (no effect when -logtostderr=true)
 --log_backtrace_at traceLocation when logging hits line file:N, emit a stack trace (default :0)
 --log_dir string If non-empty, write log files in this directory (no effect when -logtostderr=true)
 --log_file string If non-empty, use this log file (no effect when -logtostderr=true)
 --log_file_max_size uint Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
 --logtostderr log to standard error instead of files (default true)
 --one_output If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
 --skip_headers If true, avoid header prefixes in the log messages
 --skip_log_headers If true, avoid headers when opening log files (no effect when -logtostderr=true)
 --stderrthreshold severity logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2)
 -v, --v Level number for the log level verbosity
 --vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging

kyverno completion

Mon, 01 Jan 0001 00:00:00 +0000

kyverno completion

Generate the autocompletion script for kyverno for the specified shell.

Synopsis

Generate the autocompletion script for kyverno for the specified shell.

kyverno create

Mon, 01 Jan 0001 00:00:00 +0000

kyverno create

Helps with the creation of various Kyverno resources.

Synopsis

Helps with the creation of various Kyverno resources.

kyverno create cluster-role

Mon, 01 Jan 0001 00:00:00 +0000

kyverno create cluster-role

Create an aggregated role for given resource types

Synopsis

This command generates a Kubernetes ClusterRole for specified resource types. The output is printed to stdout by default or saved to a specified file. Required flags include ‘api-groups’, ‘verbs’, and ‘resources’.

kyverno create exception

Mon, 01 Jan 0001 00:00:00 +0000

kyverno create exception

Create a Kyverno policy exception file.

Synopsis

Create a Kyverno policy exception file.

kyverno create metrics-config

Mon, 01 Jan 0001 00:00:00 +0000

kyverno create metrics-config

Create a Kyverno metrics-config file.

Synopsis

Create a Kyverno metrics-config file.

For more information visit https://kyverno.io/docs/kyverno-cli/#create

kyverno create test

Mon, 01 Jan 0001 00:00:00 +0000

kyverno create test

Create a Kyverno test file.

Synopsis

Create a Kyverno test file.

For more information visit https://kyverno.io/docs/kyverno-cli/#create

kyverno create user-info

Mon, 01 Jan 0001 00:00:00 +0000

kyverno create user-info

Create a Kyverno user-info file.

Synopsis

Create a Kyverno user-info file.

For more information visit https://kyverno.io/docs/kyverno-cli/#create

kyverno create values

Mon, 01 Jan 0001 00:00:00 +0000

kyverno create values

Create a Kyverno values file.

Synopsis

Create a Kyverno values file.

For more information visit https://kyverno.io/docs/kyverno-cli/#create

kyverno docs

Mon, 01 Jan 0001 00:00:00 +0000

kyverno docs

Generates reference documentation.

Synopsis

Generates reference documentation.

The docs command generates Kyverno CLI reference documentation.

kyverno jp

Mon, 01 Jan 0001 00:00:00 +0000

kyverno jp

Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.

Synopsis

Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.

kyverno jp function

Mon, 01 Jan 0001 00:00:00 +0000

kyverno jp function

Provides function informations.

Synopsis

Provides function informations.

For more information visit https://kyverno.io/docs/kyverno-cli/usage/jp/

kyverno jp function [function_name]... [flags]

Examples

 # List functions
 kyverno jp function

 # Get function infos
 kyverno jp function truncate

Options

 -h, --help help for function

Options inherited from parent commands

 --add_dir_header If true, adds the file directory to the header of the log messages
 --alsologtostderr log to standard error as well as files (no effect when -logtostderr=true)
 --kubeconfig string Paths to a kubeconfig. Only required if out-of-cluster.
 --log_backtrace_at traceLocation when logging hits line file:N, emit a stack trace (default :0)
 --log_dir string If non-empty, write log files in this directory (no effect when -logtostderr=true)
 --log_file string If non-empty, use this log file (no effect when -logtostderr=true)
 --log_file_max_size uint Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800)
 --logtostderr log to standard error instead of files (default true)
 --one_output If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true)
 --skip_headers If true, avoid header prefixes in the log messages
 --skip_log_headers If true, avoid headers when opening log files (no effect when -logtostderr=true)
 --stderrthreshold severity logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true) (default 2)
 -v, --v Level number for the log level verbosity
 --vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered logging

kyverno jp parse

Mon, 01 Jan 0001 00:00:00 +0000

kyverno jp parse

Parses jmespath expression and shows corresponding AST.

Synopsis

Parses jmespath expression and shows corresponding AST.

kyverno jp query

Mon, 01 Jan 0001 00:00:00 +0000

kyverno jp query

Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.

Synopsis

Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.

kyverno json

Mon, 01 Jan 0001 00:00:00 +0000

kyverno json

Runs tests against any json compatible payloads/policies.

Synopsis

Runs tests against any json compatible payloads/policies.

kyverno json scan

Mon, 01 Jan 0001 00:00:00 +0000

kyverno json scan

Runs tests against any json compatible payloads/policies.

Synopsis

Runs tests against any json compatible payloads/policies.

kyverno migrate

Mon, 01 Jan 0001 00:00:00 +0000

kyverno migrate

Migrate one or more resources to the stored version.

Synopsis

Migrate one or more resources to the stored version.

kyverno test

Mon, 01 Jan 0001 00:00:00 +0000

kyverno test

Run tests from a local filesystem or a remote git repository.

Synopsis

Run tests from a local filesystem or a remote git repository.

kyverno version

Mon, 01 Jan 0001 00:00:00 +0000

kyverno version

Prints the version of Kyverno CLI.

Synopsis

Prints the version of Kyverno CLI.

For more information visit https://kyverno.io/docs/kyverno-cli/#version

Reference documentation on Kyverno

kyverno

kyverno

Synopsis

kyverno apply

kyverno apply

Synopsis

Examples

Options

Options inherited from parent commands

SEE ALSO

kyverno completion

kyverno completion

Synopsis

kyverno create

kyverno create

Synopsis

kyverno create cluster-role

kyverno create cluster-role

Synopsis

kyverno create exception

kyverno create exception

Synopsis

kyverno create metrics-config

kyverno create metrics-config

Synopsis

kyverno create test

kyverno create test

Synopsis

kyverno create user-info

kyverno create user-info

Synopsis

kyverno create values

kyverno create values

Synopsis

kyverno docs

kyverno docs

Synopsis

kyverno jp

kyverno jp

Synopsis

kyverno jp function

kyverno jp function

Synopsis

Examples

Options

Options inherited from parent commands

SEE ALSO

kyverno jp parse

kyverno jp parse

Synopsis

kyverno jp query

kyverno jp query

Synopsis

kyverno json

kyverno json

Synopsis

kyverno json scan

kyverno json scan

Synopsis

kyverno migrate

kyverno migrate

Synopsis

kyverno test

kyverno test

Synopsis

kyverno version

kyverno version

Synopsis