API Reference

{}

{ "error": "No Kyverno CRDs found" }

{}

[   {      "kind":"ClusterPolicy",      "name":"deny-privilege-escalation",      "autogenControllers":[         "DaemonSet",         "Deployment",         "Job",         "StatefulSet",         "CronJob"      ],      "validationFailureAction":"audit",      "background":true,      "rules":[         {            "message":"Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation, and spec.initContainers[*].securityContext.allowPrivilegeEscalation must be undefined or set to `false`.",            "name":"deny-privilege-escalation",            "type":"validation"         },         {            "message":"Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation, and spec.initContainers[*].securityContext.allowPrivilegeEscalation must be undefined or set to `false`.",            "name":"autogen-deny-privilege-escalation",            "type":"validation"         },         {            "message":"Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation, and spec.initContainers[*].securityContext.allowPrivilegeEscalation must be undefined or set to `false`.",            "name":"autogen-cronjob-deny-privilege-escalation",            "type":"validation"         }      ],      "category":"Pod Security Standards (Restricted)",      "description":"Privilege escalation, such as via set-user-ID or set-group-ID file mode, should not be allowed.",      "severity":"medium",      "creationTimestamp":"2021-11-07T18:32:40Z",      "uid":"7cabc2f3-0e9b-4d1e-a434-a19275a54d29",      "content":"apiVersion: kyverno.io/v1\nkind: ClusterPolicy\nmetadata:\n  annotations:\n    pod-policies.kyverno.io/autogen-controllers: DaemonSet,Deployment,Job,StatefulSet,CronJob\n    policies.kyverno.io/category: Pod Security Standards (Restricted)\n    policies.kyverno.io/description: Privilege escalation, such as via set-user-ID\n      or set-group-ID file mode, should not be allowed.\n    policies.kyverno.io/severity: medium\n  creationTimestamp: \"2021-11-07T18:32:40Z\"\n  generation: 16\n  labels:\n    app: kyverno\n    app.kubernetes.io/component: kyverno\n    app.kubernetes.io/instance: kyverno-policies\n    app.kubernetes.io/managed-by: Helm\n    app.kubernetes.io/name: kyverno-policies\n    app.kubernetes.io/part-of: kyverno-policies\n    app.kubernetes.io/version: v2.1.3\n    argocd.argoproj.io/instance: kyverno-policies\n    helm.sh/chart: kyverno-policies-v2.1.3\n  name: deny-privilege-escalation\n  resourceVersion: \"1742766\"\n  uid: 7cabc2f3-0e9b-4d1e-a434-a19275a54d29\nspec:\n  background: true\n  failurePolicy: Fail\n  rules:\n  - exclude:\n      resources: {}\n    generate:\n      clone: {}\n    match:\n      resources:\n        kinds:\n        - Pod\n    mutate: {}\n    name: deny-privilege-escalation\n    validate:\n      message: Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation,\n        and spec.initContainers[*].securityContext.allowPrivilegeEscalation must be\n        undefined or set to `false`.\n      pattern:\n        spec:\n          =(initContainers):\n          - =(securityContext):\n              =(allowPrivilegeEscalation): \"false\"\n          containers:\n          - =(securityContext):\n              =(allowPrivilegeEscalation): \"false\"\n  - exclude:\n      resources: {}\n    generate:\n      clone: {}\n    match:\n      resources:\n        kinds:\n        - DaemonSet\n        - Deployment\n        - Job\n        - StatefulSet\n    mutate: {}\n    name: autogen-deny-privilege-escalation\n    validate:\n      message: Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation,\n        and spec.initContainers[*].securityContext.allowPrivilegeEscalation must be\n        undefined or set to `false`.\n      pattern:\n        spec:\n          template:\n            spec:\n              =(initContainers):\n              - =(securityContext):\n                  =(allowPrivilegeEscalation): \"false\"\n              containers:\n              - =(securityContext):\n                  =(allowPrivilegeEscalation): \"false\"\n  - exclude:\n      resources: {}\n    generate:\n      clone: {}\n    match:\n      resources:\n        kinds:\n        - CronJob\n    mutate: {}\n    name: autogen-cronjob-deny-privilege-escalation\n    validate:\n      message: Privilege escalation is disallowed. The fields spec.containers[*].securityContext.allowPrivilegeEscalation,\n        and spec.initContainers[*].securityContext.allowPrivilegeEscalation must be\n        undefined or set to `false`.\n      pattern:\n        spec:\n          jobTemplate:\n            spec:\n              template:\n                spec:\n                  =(initContainers):\n                  - =(securityContext):\n                      =(allowPrivilegeEscalation): \"false\"\n                  containers:\n                  - =(securityContext):\n                      =(allowPrivilegeEscalation): \"false\"\n  validationFailureAction: audit\n"   }]

{ "message": "Error Message" }

[    {        "policy": {            "name": "check-image",            "uid": "b623d896-cfdb-4926-86c8-1bddaf93371f"        },        "rule": "check-image",        "repository": "registry.io/signatures",        "image": "ghcr.io/kyverno/test-verify-image:*",        "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM\n5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==\n-----END PUBLIC KEY-----",        "attestations": "attestations:\n- conditions:\n  - all:\n    - key: '{{ repo.uri }}'\n      operator: Equals\n      value: https://git-repo.com/org/app\n    - key: '{{ repo.branch }}'\n      operator: Equals\n      value: main\n    - key: '{{ reviewers }}'\n      operator: In\n      value:\n      - ana@example.com\n      - bob@example.com\n  predicateType: https://example.com/CodeReview/v1\n"    }]

{ "message": "Error Message" }