Reporting on Kyverno

Background Scans

Mon, 01 Jan 0001 00:00:00 +0000

Kyverno can validate existing resources in the cluster that may have been created before a policy was created. This can be useful when evaluating the potential effects some new policies will have on a cluster prior to changing them to Enforce mode. The application of policies to existing resources is referred to as background scanning and is enabled by default unless spec.background is set to false in a policy like shown below in the snippet.

OpenReports Integration

Mon, 01 Jan 0001 00:00:00 +0000

Note: OpenReports integration is available as of Kyverno 1.15. The feature is in ALPHA status

Kyverno supports reporting policy results using the openreports.io/v1alpha1 API as an alternative to the default wgpolicyk8s reporting. This can be enabled using the --openreportsEnabled flag in the Kyverno controller.

This is an initial step to eventually deprecate wgpolicyk8s and fully depend on openreports.io as the API group for permanent reports

Enabling OpenReports

To enable OpenReports integration, add the --openreportsEnabled flag to the Kyverno reports controller.

ValidatingAdmissionPolicy Reports

Mon, 01 Jan 0001 00:00:00 +0000

Kyverno can generate reports for ValidatingAdmissionPolicies and their bindings. These reports provide information about the resources that are validated by the policies and the results of the validation. They can be used to monitor the health of the cluster and to ensure that the policies are being enforced as expected.

To configure Kyverno to generate reports for ValidatingAdmissionPolicies, set the --validatingAdmissionPolicyReports flag to true in the reports controller. This flag is set to false by default.

Example Scenarios

Mon, 01 Jan 0001 00:00:00 +0000

Example: Trigger a PolicyReport

A PolicyReport object (Namespaced) is created in the same Namespace where resources apply to one or more Kyverno policies. Cluster wide resources will generate ClusterPolicyReport resources at the cluster level.

A single Kyverno ClusterPolicy exists with a single rule which ensures Pods cannot mount Secrets as environment variables.