From 836424ad5e4f0615e5a0e5abde2caf65c4f37e37 Mon Sep 17 00:00:00 2001 From: ci-bot Date: Tue, 9 Jan 2024 11:50:45 +0000 Subject: [PATCH] Deployed 57de0f4 to main with MkDocs 1.5.3 and mike 2.0.0 --- main/404.html | 2 +- main/apis/kyverno-json.v1alpha1/index.html | 2 +- main/catalog/index.html | 2 +- .../dockerfile-deny-expose-22/index.html | 2 +- .../dockerfile-deny-latest-image/index.html | 2 +- .../dockerfile-disallow-apt/index.html | 2 +- .../index.html | 2 +- .../dockerfile-disallow-sudo/index.html | 2 +- .../ecs/ecs-cluster-enable-logging/index.html | 2 +- .../index.html | 2 +- .../ecs/ecs-service-public-ip/index.html | 2 +- .../index.html | 2 +- .../ecs-task-definition-fs-read-only/index.html | 2 +- main/catalog/policies/ecs/policy-1/index.html | 2 +- main/cli/commands/kyverno-json/index.html | 2 +- .../commands/kyverno-json_completion/index.html | 2 +- .../kyverno-json_completion_bash/index.html | 2 +- .../kyverno-json_completion_fish/index.html | 2 +- .../index.html | 2 +- .../kyverno-json_completion_zsh/index.html | 2 +- main/cli/commands/kyverno-json_docs/index.html | 2 +- main/cli/commands/kyverno-json_jp/index.html | 2 +- .../kyverno-json_jp_function/index.html | 2 +- .../commands/kyverno-json_jp_parse/index.html | 2 +- .../commands/kyverno-json_jp_query/index.html | 2 +- .../commands/kyverno-json_playground/index.html | 2 +- main/cli/commands/kyverno-json_scan/index.html | 2 +- main/cli/commands/kyverno-json_serve/index.html | 2 +- .../commands/kyverno-json_version/index.html | 2 +- main/cli/index.html | 2 +- main/go-library/index.html | 2 +- main/index.html | 2 +- main/install/index.html | 2 +- main/intro/index.html | 2 +- main/jp/functions/index.html | 2 +- main/jp/index.html | 2 +- main/overrides/main.html | 8 ++++++++ main/playground/index.html | 2 +- main/policies/asserts/index.html | 2 +- main/policies/policies/index.html | 2 +- main/quick-start/index.html | 2 +- main/sitemap.xml.gz | Bin 582 -> 582 bytes main/webapp/index.html | 2 +- 43 files changed, 49 insertions(+), 41 deletions(-) diff --git a/main/404.html b/main/404.html index cb01a33f..ae8b0588 100644 --- a/main/404.html +++ b/main/404.html @@ -1 +1 @@ - kyverno-json

404 - Not found

\ No newline at end of file + kyverno-json

404 - Not found

\ No newline at end of file diff --git a/main/apis/kyverno-json.v1alpha1/index.html b/main/apis/kyverno-json.v1alpha1/index.html index 7327a080..8819b97a 100644 --- a/main/apis/kyverno-json.v1alpha1/index.html +++ b/main/apis/kyverno-json.v1alpha1/index.html @@ -1 +1 @@ - KyvernoJson (v1alpha1) - kyverno-json
Skip to content

v1alpha1

Package v1alpha1 contains API Schema definitions for the policy v1alpha1 API group

Resource Types

ValidatingPolicy

Appears in:

ValidatingPolicy is the resource that contains the policy definition.

Field Type Required Inline Description
apiVersion string ✅ json.kyverno.io/v1alpha1
kind string ✅ ValidatingPolicy
metadata meta/v1.ObjectMeta

Standard object's metadata.
spec ValidatingPolicySpec ✅

Policy spec.

ValidatingPolicyList

ValidatingPolicyList is a list of ValidatingPolicy instances.

Field Type Required Inline Description
apiVersion string ✅ json.kyverno.io/v1alpha1
kind string ✅ ValidatingPolicyList
metadata meta/v1.ListMeta ✅ No description provided.
items []ValidatingPolicy ✅ No description provided.

Any

Appears in:

Any can be any type.

Field Type Required Inline Description
Value interface{} ✅

Value contains the value of the Any object.

Assert

Appears in:

Assert defines collections of assertions.

Field Type Required Inline Description
any []Assertion

Any allows specifying assertions which will be ORed.
all []Assertion

All allows specifying assertions which will be ANDed.

Assertion

Appears in:

Assertion contains an assertion tree associated with a message.

Field Type Required Inline Description
message string

Message is the message associated message.
check Any ✅

Check is the assertion check definition.

ContextEntry

Appears in:

ContextEntry adds variables and data sources to a rule context.

Field Type Required Inline Description
name string ✅

Name is the entry name.
variable Any

Variable defines an arbitrary variable.

Match

Appears in:

Match defines collections of assertion trees.

Field Type Required Inline Description
any []Any

Any allows specifying assertion trees which will be ORed.
all []Any

All allows specifying assertion trees which will be ANDed.

ValidatingPolicySpec

Appears in:

ValidatingPolicySpec contains the policy spec.

Field Type Required Inline Description
rules []ValidatingRule ✅

Rules is a list of ValidatingRule instances.

ValidatingRule

Appears in:

ValidatingRule defines a validating rule.

Field Type Required Inline Description
name string ✅

Name is a label to identify the rule, It must be unique within the policy.
context []ContextEntry

Context defines variables and data sources that can be used during rule execution.
match Match

Match defines when this policy rule should be applied.
exclude Match

Exclude defines when this policy rule should not be applied.
identifier string

Identifier declares a JMESPath expression to extract a name from the payload.
assert Assert ✅

Assert is used to validate matching resources.
\ No newline at end of file + KyvernoJson (v1alpha1) - kyverno-json
Skip to content

v1alpha1

Package v1alpha1 contains API Schema definitions for the policy v1alpha1 API group

Resource Types

ValidatingPolicy

Appears in:

ValidatingPolicy is the resource that contains the policy definition.

Field Type Required Inline Description
apiVersion string ✅ json.kyverno.io/v1alpha1
kind string ✅ ValidatingPolicy
metadata meta/v1.ObjectMeta

Standard object's metadata.
spec ValidatingPolicySpec ✅

Policy spec.

ValidatingPolicyList

ValidatingPolicyList is a list of ValidatingPolicy instances.

Field Type Required Inline Description
apiVersion string ✅ json.kyverno.io/v1alpha1
kind string ✅ ValidatingPolicyList
metadata meta/v1.ListMeta ✅ No description provided.
items []ValidatingPolicy ✅ No description provided.

Any

Appears in:

Any can be any type.

Field Type Required Inline Description
Value interface{} ✅

Value contains the value of the Any object.

Assert

Appears in:

Assert defines collections of assertions.

Field Type Required Inline Description
any []Assertion

Any allows specifying assertions which will be ORed.
all []Assertion

All allows specifying assertions which will be ANDed.

Assertion

Appears in:

Assertion contains an assertion tree associated with a message.

Field Type Required Inline Description
message string

Message is the message associated message.
check Any ✅

Check is the assertion check definition.

ContextEntry

Appears in:

ContextEntry adds variables and data sources to a rule context.

Field Type Required Inline Description
name string ✅

Name is the entry name.
variable Any

Variable defines an arbitrary variable.

Match

Appears in:

Match defines collections of assertion trees.

Field Type Required Inline Description
any []Any

Any allows specifying assertion trees which will be ORed.
all []Any

All allows specifying assertion trees which will be ANDed.

ValidatingPolicySpec

Appears in:

ValidatingPolicySpec contains the policy spec.

Field Type Required Inline Description
rules []ValidatingRule ✅

Rules is a list of ValidatingRule instances.

ValidatingRule

Appears in:

ValidatingRule defines a validating rule.

Field Type Required Inline Description
name string ✅

Name is a label to identify the rule, It must be unique within the policy.
context []ContextEntry

Context defines variables and data sources that can be used during rule execution.
match Match

Match defines when this policy rule should be applied.
exclude Match

Exclude defines when this policy rule should not be applied.
identifier string

Identifier declares a JMESPath expression to extract a name from the payload.
assert Assert ✅

Assert is used to validate matching resources.
\ No newline at end of file diff --git a/main/catalog/index.html b/main/catalog/index.html index e9ef8b96..962f79f1 100644 --- a/main/catalog/index.html +++ b/main/catalog/index.html @@ -1 +1 @@ - Policy catalog - kyverno-json
Skip to content

Policy catalog

The kyverno-json policy catalog contains curated policies to be reused.

You can share your policies with the community by opening a pull request here.

Policies indexed by tags

aws

aws/ecs

dockerfile

\ No newline at end of file + Policy catalog - kyverno-json
Skip to content

Policy catalog

The kyverno-json policy catalog contains curated policies to be reused.

You can share your policies with the community by opening a pull request here.

Policies indexed by tags

aws

aws/ecs

dockerfile

\ No newline at end of file diff --git a/main/catalog/policies/dockerfile/dockerfile-deny-expose-22/index.html b/main/catalog/policies/dockerfile/dockerfile-deny-expose-22/index.html index 9c00cab9..f096aed6 100644 --- a/main/catalog/policies/dockerfile/dockerfile-deny-expose-22/index.html +++ b/main/catalog/policies/dockerfile/dockerfile-deny-expose-22/index.html @@ -1,4 +1,4 @@ - Dockerfile expose port 22 not allowed - kyverno-json
Skip to content

Dockerfile expose port 22 not allowed

Description

This Policy ensures that port 22 is not exposed in Dockerfile.

Install

In cluster

kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-deny-expose-22.yaml
+ Dockerfile expose port 22 not allowed - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Dockerfile expose port 22 not allowed
 
Description
 
This Policy ensures that port 22 is not exposed in Dockerfile.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-deny-expose-22.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-deny-expose-22.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/dockerfile/dockerfile-deny-latest-image/index.html b/main/catalog/policies/dockerfile/dockerfile-deny-latest-image/index.html
index e8b971b9..8d66533e 100644
--- a/main/catalog/policies/dockerfile/dockerfile-deny-latest-image/index.html
+++ b/main/catalog/policies/dockerfile/dockerfile-deny-latest-image/index.html
@@ -1,4 +1,4 @@
- Dockerfile latest image tag not allowed - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Dockerfile latest image tag not allowed
 
Description
 
This Policy ensures that no image uses the latest tag in Dockerfile.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-deny-latest-image.yaml
+ Dockerfile latest image tag not allowed - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Dockerfile latest image tag not allowed
 
Description
 
This Policy ensures that no image uses the latest tag in Dockerfile.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-deny-latest-image.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-deny-latest-image.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/dockerfile/dockerfile-disallow-apt/index.html b/main/catalog/policies/dockerfile/dockerfile-disallow-apt/index.html
index f4d03e90..167e1676 100644
--- a/main/catalog/policies/dockerfile/dockerfile-disallow-apt/index.html
+++ b/main/catalog/policies/dockerfile/dockerfile-disallow-apt/index.html
@@ -1,4 +1,4 @@
- Ensure apt is not used in Dockerfile - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Ensure apt is not used in Dockerfile
 
Description
 
This Policy ensures that apt isnt used but apt-get can be used as apt interface is less stable than apt-get and so this preferred.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-apt.yaml
+ Ensure apt is not used in Dockerfile - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Ensure apt is not used in Dockerfile
 
Description
 
This Policy ensures that apt isnt used but apt-get can be used as apt interface is less stable than apt-get and so this preferred.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-apt.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-apt.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/dockerfile/dockerfile-disallow-last-user-root/index.html b/main/catalog/policies/dockerfile/dockerfile-disallow-last-user-root/index.html
index edee8c18..46680be3 100644
--- a/main/catalog/policies/dockerfile/dockerfile-disallow-last-user-root/index.html
+++ b/main/catalog/policies/dockerfile/dockerfile-disallow-last-user-root/index.html
@@ -1,4 +1,4 @@
- Dockerfile last user is not allowed to be root - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Dockerfile last user is not allowed to be root
 
Description
 
This Policy ensures that last user in Dockerfile is not root.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-last-user-root.yaml
+ Dockerfile last user is not allowed to be root - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Dockerfile last user is not allowed to be root
 
Description
 
This Policy ensures that last user in Dockerfile is not root.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-last-user-root.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-last-user-root.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/dockerfile/dockerfile-disallow-sudo/index.html b/main/catalog/policies/dockerfile/dockerfile-disallow-sudo/index.html
index 1b4aba12..1493b7a7 100644
--- a/main/catalog/policies/dockerfile/dockerfile-disallow-sudo/index.html
+++ b/main/catalog/policies/dockerfile/dockerfile-disallow-sudo/index.html
@@ -1,4 +1,4 @@
- Ensure sudo is not used in Dockerfile - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Ensure sudo is not used in Dockerfile
 
Description
 
This Policy ensures that sudo isn’t used.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-sudo.yaml
+ Ensure sudo is not used in Dockerfile - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
Ensure sudo is not used in Dockerfile
 
Description
 
This Policy ensures that sudo isn’t used.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-sudo.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/dockerfile/dockerfile-disallow-sudo.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/ecs/ecs-cluster-enable-logging/index.html b/main/catalog/policies/ecs/ecs-cluster-enable-logging/index.html
index 1110fad8..80047e15 100644
--- a/main/catalog/policies/ecs/ecs-cluster-enable-logging/index.html
+++ b/main/catalog/policies/ecs/ecs-cluster-enable-logging/index.html
@@ -1,4 +1,4 @@
- ECS cluster enable logging - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS cluster enable logging
 
Description
 
This Policy ensures that ECS clusters have logging enabled.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-enable-logging.yaml
+ ECS cluster enable logging - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS cluster enable logging
 
Description
 
This Policy ensures that ECS clusters have logging enabled.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-enable-logging.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-enable-logging.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/ecs/ecs-cluster-required-container-insights/index.html b/main/catalog/policies/ecs/ecs-cluster-required-container-insights/index.html
index 52dd6636..a0786665 100644
--- a/main/catalog/policies/ecs/ecs-cluster-required-container-insights/index.html
+++ b/main/catalog/policies/ecs/ecs-cluster-required-container-insights/index.html
@@ -1,4 +1,4 @@
- ECS requires container insights - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS requires container insights
 
Description
 
This Policy ensures that ECS clusters have container insights enabled.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-required-container-insights.yaml
+ ECS requires container insights - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS requires container insights
 
Description
 
This Policy ensures that ECS clusters have container insights enabled.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-required-container-insights.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-cluster-required-container-insights.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/ecs/ecs-service-public-ip/index.html b/main/catalog/policies/ecs/ecs-service-public-ip/index.html
index b885b377..99991841 100644
--- a/main/catalog/policies/ecs/ecs-service-public-ip/index.html
+++ b/main/catalog/policies/ecs/ecs-service-public-ip/index.html
@@ -1,4 +1,4 @@
- ECS public IP - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS public IP
 
Description
 
This Policy ensures that ECS services do not have public IP addresses assigned to them automatically.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-public-ip.yaml
+ ECS public IP - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS public IP
 
Description
 
This Policy ensures that ECS services do not have public IP addresses assigned to them automatically.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-public-ip.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-public-ip.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/ecs/ecs-service-required-latest-platform-fargate/index.html b/main/catalog/policies/ecs/ecs-service-required-latest-platform-fargate/index.html
index f105d7a9..111b6a3b 100644
--- a/main/catalog/policies/ecs/ecs-service-required-latest-platform-fargate/index.html
+++ b/main/catalog/policies/ecs/ecs-service-required-latest-platform-fargate/index.html
@@ -1,4 +1,4 @@
- ECS require latest platform fargate - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS require latest platform fargate
 
Description
 
This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-required-latest-platform-fargate.yaml
+ ECS require latest platform fargate - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS require latest platform fargate
 
Description
 
This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-required-latest-platform-fargate.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-service-required-latest-platform-fargate.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/ecs/ecs-task-definition-fs-read-only/index.html b/main/catalog/policies/ecs/ecs-task-definition-fs-read-only/index.html
index f97a3d65..093df5fd 100644
--- a/main/catalog/policies/ecs/ecs-task-definition-fs-read-only/index.html
+++ b/main/catalog/policies/ecs/ecs-task-definition-fs-read-only/index.html
@@ -1,4 +1,4 @@
- ECS require filesystem read only - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS require filesystem read only
 
Description
 
This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-task-definition-fs-read-only.yaml
+ ECS require filesystem read only - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
     
ECS require filesystem read only
 
Description
 
This Policy ensures that ECS Fargate services runs on the latest Fargate platform version.
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-task-definition-fs-read-only.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/ecs-task-definition-fs-read-only.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/catalog/policies/ecs/policy-1/index.html b/main/catalog/policies/ecs/policy-1/index.html
index d12c2454..b994bb6c 100644
--- a/main/catalog/policies/ecs/policy-1/index.html
+++ b/main/catalog/policies/ecs/policy-1/index.html
@@ -1,4 +1,4 @@
- policy-1 - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
policy-1
 
Description
 
None
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/policy-1.yaml
+ policy-1 - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
policy-1
 
Description
 
None
 
Install
 
In cluster
 
kubectl apply -f https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/policy-1.yaml
 
 
Download locally
 
curl -O https://raw.githubusercontent.com/kyverno/kyverno-json/main/catalog/ecs/policy-1.yaml
 
 
Manifest
 
Original policy Raw
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
diff --git a/main/cli/commands/kyverno-json/index.html b/main/cli/commands/kyverno-json/index.html
index a604c45a..18678c92 100644
--- a/main/cli/commands/kyverno-json/index.html
+++ b/main/cli/commands/kyverno-json/index.html
@@ -1,3 +1,3 @@
- Kyverno json - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json
 
kyverno-json
 
kyverno-json is a CLI tool to apply policies to json resources.
 
Synopsis
 
kyverno-json is a CLI tool to apply policies to json resources.
 
kyverno-json [flags]
+ Kyverno json - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json
 
kyverno-json
 
kyverno-json is a CLI tool to apply policies to json resources.
 
Synopsis
 
kyverno-json is a CLI tool to apply policies to json resources.
 
kyverno-json [flags]
 
 
Options
 
  -h, --help   help for kyverno-json
 
 
SEE ALSO
  
 
  
 
  
 
 
 
    
\ No newline at end of file
diff --git a/main/cli/commands/kyverno-json_completion/index.html b/main/cli/commands/kyverno-json_completion/index.html
index 43e9cd4f..e6d2dc08 100644
--- a/main/cli/commands/kyverno-json_completion/index.html
+++ b/main/cli/commands/kyverno-json_completion/index.html
@@ -1,2 +1,2 @@
- Kyverno json completion - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion
 
kyverno-json completion
 
Generate the autocompletion script for the specified shell
 
Synopsis
 
Generate the autocompletion script for kyverno-json for the specified shell. See each sub-command's help for details on how to use the generated script.
 
Options
 
  -h, --help   help for completion
+ Kyverno json completion - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion
 
kyverno-json completion
 
Generate the autocompletion script for the specified shell
 
Synopsis
 
Generate the autocompletion script for kyverno-json for the specified shell. See each sub-command's help for details on how to use the generated script.
 
Options
 
  -h, --help   help for completion
 
 
SEE ALSO
  
 
  
 
  
 
 
 
    
\ No newline at end of file
diff --git a/main/cli/commands/kyverno-json_completion_bash/index.html b/main/cli/commands/kyverno-json_completion_bash/index.html
index 85ee6a22..1ed7689d 100644
--- a/main/cli/commands/kyverno-json_completion_bash/index.html
+++ b/main/cli/commands/kyverno-json_completion_bash/index.html
@@ -1,4 +1,4 @@
- Kyverno json completion bash - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion bash
 
kyverno-json completion bash
 
Generate the autocompletion script for bash
 
Synopsis
 
Generate the autocompletion script for the bash shell.
 
This script depends on the 'bash-completion' package. If it is not installed already, you can install it via your OS's package manager.
 
To load completions in your current shell session:
 
source <(kyverno-json completion bash)
+ Kyverno json completion bash - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion bash
 
kyverno-json completion bash
 
Generate the autocompletion script for bash
 
Synopsis
 
Generate the autocompletion script for the bash shell.
 
This script depends on the 'bash-completion' package. If it is not installed already, you can install it via your OS's package manager.
 
To load completions in your current shell session:
 
source <(kyverno-json completion bash)
 
 
To load completions for every new session, execute once:
 
Linux:
 
kyverno-json completion bash > /etc/bash_completion.d/kyverno-json
 
 
macOS:
 
kyverno-json completion bash > $(brew --prefix)/etc/bash_completion.d/kyverno-json
 
 
You will need to start a new shell for this setup to take effect.
 
kyverno-json completion bash
diff --git a/main/cli/commands/kyverno-json_completion_fish/index.html b/main/cli/commands/kyverno-json_completion_fish/index.html
index 93c6bdc2..1f1f7f30 100644
--- a/main/cli/commands/kyverno-json_completion_fish/index.html
+++ b/main/cli/commands/kyverno-json_completion_fish/index.html
@@ -1,4 +1,4 @@
- Kyverno json completion fish - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion fish
 
kyverno-json completion fish
 
Generate the autocompletion script for fish
 
Synopsis
 
Generate the autocompletion script for the fish shell.
 
To load completions in your current shell session:
 
kyverno-json completion fish | source
+ Kyverno json completion fish - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion fish
 
kyverno-json completion fish
 
Generate the autocompletion script for fish
 
Synopsis
 
Generate the autocompletion script for the fish shell.
 
To load completions in your current shell session:
 
kyverno-json completion fish | source
 
 
To load completions for every new session, execute once:
 
kyverno-json completion fish > ~/.config/fish/completions/kyverno-json.fish
 
 
You will need to start a new shell for this setup to take effect.
 
kyverno-json completion fish [flags]
 
 
Options
 
  -h, --help              help for fish
diff --git a/main/cli/commands/kyverno-json_completion_powershell/index.html b/main/cli/commands/kyverno-json_completion_powershell/index.html
index 1103f077..4ad84902 100644
--- a/main/cli/commands/kyverno-json_completion_powershell/index.html
+++ b/main/cli/commands/kyverno-json_completion_powershell/index.html
@@ -1,4 +1,4 @@
- Kyverno json completion powershell - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion powershell
 
kyverno-json completion powershell
 
Generate the autocompletion script for powershell
 
Synopsis
 
Generate the autocompletion script for powershell.
 
To load completions in your current shell session:
 
kyverno-json completion powershell | Out-String | Invoke-Expression
+ Kyverno json completion powershell - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion powershell
 
kyverno-json completion powershell
 
Generate the autocompletion script for powershell
 
Synopsis
 
Generate the autocompletion script for powershell.
 
To load completions in your current shell session:
 
kyverno-json completion powershell | Out-String | Invoke-Expression
 
 
To load completions for every new session, add the output of the above command to your powershell profile.
 
kyverno-json completion powershell [flags]
 
 
Options
 
  -h, --help              help for powershell
       --no-descriptions   disable completion descriptions
diff --git a/main/cli/commands/kyverno-json_completion_zsh/index.html b/main/cli/commands/kyverno-json_completion_zsh/index.html
index fda24372..6dd2ce45 100644
--- a/main/cli/commands/kyverno-json_completion_zsh/index.html
+++ b/main/cli/commands/kyverno-json_completion_zsh/index.html
@@ -1,4 +1,4 @@
- Kyverno json completion zsh - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion zsh
 
kyverno-json completion zsh
 
Generate the autocompletion script for zsh
 
Synopsis
 
Generate the autocompletion script for the zsh shell.
 
If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once:
 
echo "autoload -U compinit; compinit" >> ~/.zshrc
+ Kyverno json completion zsh - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json completion zsh
 
kyverno-json completion zsh
 
Generate the autocompletion script for zsh
 
Synopsis
 
Generate the autocompletion script for the zsh shell.
 
If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once:
 
echo "autoload -U compinit; compinit" >> ~/.zshrc
 
 
To load completions in your current shell session:
 
source <(kyverno-json completion zsh)
 
 
To load completions for every new session, execute once:
 
Linux:
 
kyverno-json completion zsh > "${fpath[1]}/_kyverno-json"
 
 
macOS:
 
kyverno-json completion zsh > $(brew --prefix)/share/zsh/site-functions/_kyverno-json
diff --git a/main/cli/commands/kyverno-json_docs/index.html b/main/cli/commands/kyverno-json_docs/index.html
index af14db0a..c6f71656 100644
--- a/main/cli/commands/kyverno-json_docs/index.html
+++ b/main/cli/commands/kyverno-json_docs/index.html
@@ -1,4 +1,4 @@
- Kyverno json docs - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json docs
 
kyverno-json docs
 
Generates reference documentation.
 
Synopsis
 
Generates reference documentation.
 
The docs command generates CLI reference documentation. It can be used to generate simple markdown files or markdown to be used for the website.
 
kyverno-json docs [flags]
+ Kyverno json docs - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json docs
 
kyverno-json docs
 
Generates reference documentation.
 
Synopsis
 
Generates reference documentation.
 
The docs command generates CLI reference documentation. It can be used to generate simple markdown files or markdown to be used for the website.
 
kyverno-json docs [flags]
 
 
Examples
 
  # Generate simple markdown documentation
   kyverno-json docs -o . --autogenTag=false
 
diff --git a/main/cli/commands/kyverno-json_jp/index.html b/main/cli/commands/kyverno-json_jp/index.html
index 8acf8b6c..14adbc6c 100644
--- a/main/cli/commands/kyverno-json_jp/index.html
+++ b/main/cli/commands/kyverno-json_jp/index.html
@@ -1,4 +1,4 @@
- Kyverno json jp - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp
 
kyverno-json jp
 
Provides a command-line interface to JMESPath, enhanced with custom functions.
 
Synopsis
 
Provides a command-line interface to JMESPath, enhanced with custom functions.
 
kyverno-json jp [flags]
+ Kyverno json jp - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp
 
kyverno-json jp
 
Provides a command-line interface to JMESPath, enhanced with custom functions.
 
Synopsis
 
Provides a command-line interface to JMESPath, enhanced with custom functions.
 
kyverno-json jp [flags]
 
 
Examples
 
  # List functions
   kyverno-json jp function
 
diff --git a/main/cli/commands/kyverno-json_jp_function/index.html b/main/cli/commands/kyverno-json_jp_function/index.html
index 437f9fb6..57fba856 100644
--- a/main/cli/commands/kyverno-json_jp_function/index.html
+++ b/main/cli/commands/kyverno-json_jp_function/index.html
@@ -1,4 +1,4 @@
- Kyverno json jp function - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp function
 
kyverno-json jp function
 
Provides function informations.
 
Synopsis
 
Provides function informations.
 
kyverno-json jp function [function_name]... [flags]
+ Kyverno json jp function - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp function
 
kyverno-json jp function
 
Provides function informations.
 
Synopsis
 
Provides function informations.
 
kyverno-json jp function [function_name]... [flags]
 
 
Examples
 
  # List functions
   kyverno-json jp function
 
diff --git a/main/cli/commands/kyverno-json_jp_parse/index.html b/main/cli/commands/kyverno-json_jp_parse/index.html
index cf52e099..1cf5c9bc 100644
--- a/main/cli/commands/kyverno-json_jp_parse/index.html
+++ b/main/cli/commands/kyverno-json_jp_parse/index.html
@@ -1,4 +1,4 @@
- Kyverno json jp parse - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp parse
 
kyverno-json jp parse
 
Parses jmespath expression and prints corresponding AST.
 
Synopsis
 
Parses jmespath expression and prints corresponding AST.
 
kyverno-json jp parse [-f file|expression]... [flags]
+ Kyverno json jp parse - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp parse
 
kyverno-json jp parse
 
Parses jmespath expression and prints corresponding AST.
 
Synopsis
 
Parses jmespath expression and prints corresponding AST.
 
kyverno-json jp parse [-f file|expression]... [flags]
 
 
Examples
 
  # Parse expression
   kyverno-json jp parse 'request.object.metadata.name | truncate(@, `9`)'
 
diff --git a/main/cli/commands/kyverno-json_jp_query/index.html b/main/cli/commands/kyverno-json_jp_query/index.html
index e2f9b65a..a595a88d 100644
--- a/main/cli/commands/kyverno-json_jp_query/index.html
+++ b/main/cli/commands/kyverno-json_jp_query/index.html
@@ -1,4 +1,4 @@
- Kyverno json jp query - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp query
 
kyverno-json jp query
 
Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.
 
Synopsis
 
Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.
 
kyverno-json jp query [-i input] [-q query|query]... [flags]
+ Kyverno json jp query - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json jp query
 
kyverno-json jp query
 
Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.
 
Synopsis
 
Provides a command-line interface to JMESPath, enhanced with Kyverno specific custom functions.
 
kyverno-json jp query [-i input] [-q query|query]... [flags]
 
 
Examples
 
  # Evaluate query
   kyverno-json jp query -i object.yaml 'request.object.metadata.name | truncate(@, `9`)'
 
diff --git a/main/cli/commands/kyverno-json_playground/index.html b/main/cli/commands/kyverno-json_playground/index.html
index cfcc25e3..d73660e9 100644
--- a/main/cli/commands/kyverno-json_playground/index.html
+++ b/main/cli/commands/kyverno-json_playground/index.html
@@ -1,4 +1,4 @@
- Kyverno json playground - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json playground
 
kyverno-json playground
 
playground
 
Synopsis
 
Serve playground
 
kyverno-json playground [flags]
+ Kyverno json playground - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json playground
 
kyverno-json playground
 
playground
 
Synopsis
 
Serve playground
 
kyverno-json playground [flags]
 
 
Options
 
      --gin-cors                enable gin cors (default true)
       --gin-log                 enable gin logger (default true)
       --gin-max-body-size int   gin max body size (default 2097152)
diff --git a/main/cli/commands/kyverno-json_scan/index.html b/main/cli/commands/kyverno-json_scan/index.html
index 9a731db4..95d902aa 100644
--- a/main/cli/commands/kyverno-json_scan/index.html
+++ b/main/cli/commands/kyverno-json_scan/index.html
@@ -1,4 +1,4 @@
- Kyverno json scan - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json scan
 
kyverno-json scan
 
scan
 
Synopsis
 
Apply policies to json resources
 
kyverno-json scan [flags]
+ Kyverno json scan - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json scan
 
kyverno-json scan
 
scan
 
Synopsis
 
Apply policies to json resources
 
kyverno-json scan [flags]
 
 
Options
 
  -h, --help                  help for scan
       --labels strings        Labels selectors for policies
       --output string         Output format (text or json) (default "text")
diff --git a/main/cli/commands/kyverno-json_serve/index.html b/main/cli/commands/kyverno-json_serve/index.html
index bfd16bd8..1c3b0c6a 100644
--- a/main/cli/commands/kyverno-json_serve/index.html
+++ b/main/cli/commands/kyverno-json_serve/index.html
@@ -1,4 +1,4 @@
- Kyverno json serve - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json serve
 
kyverno-json serve
 
serve
 
Synopsis
 
Serve API
 
kyverno-json serve [flags]
+ Kyverno json serve - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json serve
 
kyverno-json serve
 
serve
 
Synopsis
 
Serve API
 
kyverno-json serve [flags]
 
 
Options
 
      --gin-cors                            enable gin cors (default true)
       --gin-log                             enable gin logger (default true)
       --gin-max-body-size int               gin max body size (default 2097152)
diff --git a/main/cli/commands/kyverno-json_version/index.html b/main/cli/commands/kyverno-json_version/index.html
index 6fc034da..009a54b9 100644
--- a/main/cli/commands/kyverno-json_version/index.html
+++ b/main/cli/commands/kyverno-json_version/index.html
@@ -1,4 +1,4 @@
- Kyverno json version - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json version
 
kyverno-json version
 
Print the version informations
 
Synopsis
 
Print the version informations
 
kyverno-json version [flags]
+ Kyverno json version - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Kyverno json version
 
kyverno-json version
 
Print the version informations
 
Synopsis
 
Print the version informations
 
kyverno-json version [flags]
 
 
Examples
 
  # Print version infos
   kyverno-json version
 
 
Options
 
  -h, --help   help for version
diff --git a/main/cli/index.html b/main/cli/index.html
index cc53d47f..7a5f7769 100644
--- a/main/cli/index.html
+++ b/main/cli/index.html
@@ -1,4 +1,4 @@
- Overview - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Overview
 
The kyverno-json Command Line Interface (CLI) can be used to:
 
     
  • scan JSON or YAML files 
    •  
  • launch a web application with a REST API
    •  
  • launch a playground 
    •  
 
Here is an example of scanning an Terraform plan that creates an S3 bucket:
 
./kyverno-json scan --policy test/commands/scan/tf-s3/policy.yaml --payload test/commands/scan/tf-s3/payload.json
+ Overview - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Overview
 
The kyverno-json Command Line Interface (CLI) can be used to:
 
     
  • scan JSON or YAML files 
    •  
  • launch a web application with a REST API
    •  
  • launch a playground 
    •  
 
Here is an example of scanning an Terraform plan that creates an S3 bucket:
 
./kyverno-json scan --policy test/commands/scan/tf-s3/policy.yaml --payload test/commands/scan/tf-s3/payload.json
 
 
The output looks like:
 
Loading policies ...
 Loading payload ...
 Pre processing ...
diff --git a/main/go-library/index.html b/main/go-library/index.html
index 7ca77dd1..762b2f63 100644
--- a/main/go-library/index.html
+++ b/main/go-library/index.html
@@ -1,4 +1,4 @@
- Usage - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Usage
 
The Go API provides a way to embed the Kyverno JSON engine in Go programs that validate JSON payloads using Kyverno policies.
 
The Go API can be added to a program's dependencies as follows:
 
go get github.com/kyverno/kyverno-json/pkg/jsonengine
+ Usage - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Usage
 
The Go API provides a way to embed the Kyverno JSON engine in Go programs that validate JSON payloads using Kyverno policies.
 
The Go API can be added to a program's dependencies as follows:
 
go get github.com/kyverno/kyverno-json/pkg/jsonengine
 go get github.com/kyverno/kyverno-json/pkg/policy
 
 
Here is a sample program that shows the overall flow for programatically using the Kyverno JSON Engine:
 
package main
 
diff --git a/main/index.html b/main/index.html
index 7f248ddb..171f9cba 100644
--- a/main/index.html
+++ b/main/index.html
@@ -1,4 +1,4 @@
- kyverno-json - kyverno-json     
 
 
 
  
  
 
       
 
 
 
  
  
 
        
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Install
 
You can install the pre-compiled binary (in several ways), or compile from source. We also provide a GitHub action to easily install Kyverno-JSON in your workflows.
 
Install the pre-compiled binary
 
Homebrew tap
 
add tap:
 
brew tap kyverno/kyverno-json https://github.com/kyverno/kyverno-json
+ Install - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Install
 
You can install the pre-compiled binary (in several ways), or compile from source. We also provide a GitHub action to easily install Kyverno-JSON in your workflows.
 
Install the pre-compiled binary
 
Homebrew tap
 
add tap:
 
brew tap kyverno/kyverno-json https://github.com/kyverno/kyverno-json
 
 
install kyverno-json:
 
brew install kyverno/kyverno-json/kyverno-json
 
 
Manually
 
Download the pre-compiled binaries for your system from the releases page and copy them to the desired location.
 
Using go install
 
You can install with go install with:
 
go install github.com/kyverno/kyverno-json@latest
 
 
Build from the source code
 
clone the repository:
 
git clone https://github.com/kyverno/kyverno-json.git
diff --git a/main/intro/index.html b/main/intro/index.html
index dc99bccf..7eaed537 100644
--- a/main/intro/index.html
+++ b/main/intro/index.html
@@ -1 +1 @@
- Introduction - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Introduction
 
kyverno-json extends Kyverno policies to perform simple and efficient validation of data in JSON or YAML format. With kyverno-json, you can now use Kyverno policies to validate:
 
     
  • Terraform files
    •  
  • Dockerfiles
    •  
  • Cloud configurations
    •  
  • Authorization requests
    •  
 
Simply convert your runtime or configuration data to JSON, and use Kyverno to audit or enforce policies for security and best practices compliance.
 
kyverno-json can be run as a:
 
     
  1. A Command Line Interface (CLI)
    2.  
  2. A web application with a REST API
    3.  
  3. A Golang library
    4.  
 
 
  
 
  
 
 
 
    
\ No newline at end of file
+ Introduction - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Introduction
 
kyverno-json extends Kyverno policies to perform simple and efficient validation of data in JSON or YAML format. With kyverno-json, you can now use Kyverno policies to validate:
 
     
  • Terraform files
    •  
  • Dockerfiles
    •  
  • Cloud configurations
    •  
  • Authorization requests
    •  
 
Simply convert your runtime or configuration data to JSON, and use Kyverno to audit or enforce policies for security and best practices compliance.
 
kyverno-json can be run as a:
 
     
  1. A Command Line Interface (CLI)
    2.  
  2. A web application with a REST API
    3.  
  3. A Golang library
    4.  
 
 
  
 
  
 
 
 
    
\ No newline at end of file
diff --git a/main/jp/functions/index.html b/main/jp/functions/index.html
index 9e3ffb3e..5172a5c6 100644
--- a/main/jp/functions/index.html
+++ b/main/jp/functions/index.html
@@ -1 +1 @@
- Functions - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Functions
 
built-in functions
 
  
 Name Signature 
   
 abs abs(number) 
 
 avg avg(array[number]) 
 
 ceil ceil(number) 
 
 contains contains(array\|string, any) 
 
 ends_with ends_with(string, string) 
 
 find_first find_first(string, string, number, number) 
 
 find_last find_last(string, string, number, number) 
 
 floor floor(number) 
 
 from_items from_items(array[array]) 
 
 group_by group_by(array, expref) 
 
 items items(object) 
 
 join join(string, array[string]) 
 
 keys keys(object) 
 
 length length(string\|array\|object) 
 
 lower lower(string) 
 
 map map(expref, array) 
 
 max max(array[number]\|array[string]) 
 
 max_by max_by(array, expref) 
 
 merge merge(object) 
 
 min min(array[number]\|array[string]) 
 
 min_by min_by(array, expref) 
 
 not_null not_null(any) 
 
 pad_left pad_left(string, number, string) 
 
 pad_right pad_right(string, number, string) 
 
 replace replace(string, string, string, number) 
 
 reverse reverse(array\|string) 
 
 sort sort(array[string]\|array[number]) 
 
 sort_by sort_by(array, expref) 
 
 split split(string, string, number) 
 
 starts_with starts_with(string, string) 
 
 sum sum(array[number]) 
 
 to_array to_array(any) 
 
 to_number to_number(any) 
 
 to_string to_string(any) 
 
 trim trim(string, string) 
 
 trim_left trim_left(string, string) 
 
 trim_right trim_right(string, string) 
 
 type type(any) 
 
 upper upper(string) 
 
 values values(object) 
 
 zip zip(array, array) 
  
 
custom functions
 
  
 Name Signature 
   
 at at(array, any) 
 
 concat concat(string, string) 
 
 json_parse json_parse(string) 
 
 wildcard wildcard(string, string) 
  
 
kyverno functions
 
  
 Name Signature 
   
 compare compare(string, string) 
 
 equal_fold equal_fold(string, string) 
 
 replace replace(string, string, string, number) 
 
 replace_all replace_all(string, string, string) 
 
 to_upper to_upper(string) 
 
 to_lower to_lower(string) 
 
 trim trim(string, string) 
 
 trim_prefix trim_prefix(string, string) 
 
 split split(string, string) 
 
 regex_replace_all regex_replace_all(string, string\|number, string\|number) 
 
 regex_replace_all_literal regex_replace_all_literal(string, string\|number, string\|number) 
 
 regex_match regex_match(string, string\|number) 
 
 pattern_match pattern_match(string, string\|number) 
 
 label_match label_match(object, object) 
 
 to_boolean to_boolean(string) 
 
 add add(any, any) 
 
 sum sum(array) 
 
 subtract subtract(any, any) 
 
 multiply multiply(any, any) 
 
 divide divide(any, any) 
 
 modulo modulo(any, any) 
 
 round round(number, number) 
 
 base64_decode base64_decode(string) 
 
 base64_encode base64_encode(string) 
 
 time_since time_since(string, string, string) 
 
 time_now time_now() 
 
 time_now_utc time_now_utc() 
 
 path_canonicalize path_canonicalize(string) 
 
 truncate truncate(string, number) 
 
 semver_compare semver_compare(string, string) 
 
 parse_json parse_json(string) 
 
 parse_yaml parse_yaml(string) 
 
 lookup lookup(object\|array, string\|number) 
 
 items items(object\|array, string, string) 
 
 object_from_lists object_from_lists(array, array) 
 
 random random(string) 
 
 x509_decode x509_decode(string) 
 
 time_to_cron time_to_cron(string) 
 
 time_add time_add(string, string) 
 
 time_parse time_parse(string, string) 
 
 time_utc time_utc(string) 
 
 time_diff time_diff(string, string) 
 
 time_before time_before(string, string) 
 
 time_after time_after(string, string) 
 
 time_between time_between(string, string, string) 
 
 time_truncate time_truncate(string, string) 
  
 
 
  
 
  
 
 
 
    
\ No newline at end of file
+ Functions - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Functions
 
built-in functions
 
  
 Name Signature 
   
 abs abs(number) 
 
 avg avg(array[number]) 
 
 ceil ceil(number) 
 
 contains contains(array\|string, any) 
 
 ends_with ends_with(string, string) 
 
 find_first find_first(string, string, number, number) 
 
 find_last find_last(string, string, number, number) 
 
 floor floor(number) 
 
 from_items from_items(array[array]) 
 
 group_by group_by(array, expref) 
 
 items items(object) 
 
 join join(string, array[string]) 
 
 keys keys(object) 
 
 length length(string\|array\|object) 
 
 lower lower(string) 
 
 map map(expref, array) 
 
 max max(array[number]\|array[string]) 
 
 max_by max_by(array, expref) 
 
 merge merge(object) 
 
 min min(array[number]\|array[string]) 
 
 min_by min_by(array, expref) 
 
 not_null not_null(any) 
 
 pad_left pad_left(string, number, string) 
 
 pad_right pad_right(string, number, string) 
 
 replace replace(string, string, string, number) 
 
 reverse reverse(array\|string) 
 
 sort sort(array[string]\|array[number]) 
 
 sort_by sort_by(array, expref) 
 
 split split(string, string, number) 
 
 starts_with starts_with(string, string) 
 
 sum sum(array[number]) 
 
 to_array to_array(any) 
 
 to_number to_number(any) 
 
 to_string to_string(any) 
 
 trim trim(string, string) 
 
 trim_left trim_left(string, string) 
 
 trim_right trim_right(string, string) 
 
 type type(any) 
 
 upper upper(string) 
 
 values values(object) 
 
 zip zip(array, array) 
  
 
custom functions
 
  
 Name Signature 
   
 at at(array, any) 
 
 concat concat(string, string) 
 
 json_parse json_parse(string) 
 
 wildcard wildcard(string, string) 
  
 
kyverno functions
 
  
 Name Signature 
   
 compare compare(string, string) 
 
 equal_fold equal_fold(string, string) 
 
 replace replace(string, string, string, number) 
 
 replace_all replace_all(string, string, string) 
 
 to_upper to_upper(string) 
 
 to_lower to_lower(string) 
 
 trim trim(string, string) 
 
 trim_prefix trim_prefix(string, string) 
 
 split split(string, string) 
 
 regex_replace_all regex_replace_all(string, string\|number, string\|number) 
 
 regex_replace_all_literal regex_replace_all_literal(string, string\|number, string\|number) 
 
 regex_match regex_match(string, string\|number) 
 
 pattern_match pattern_match(string, string\|number) 
 
 label_match label_match(object, object) 
 
 to_boolean to_boolean(string) 
 
 add add(any, any) 
 
 sum sum(array) 
 
 subtract subtract(any, any) 
 
 multiply multiply(any, any) 
 
 divide divide(any, any) 
 
 modulo modulo(any, any) 
 
 round round(number, number) 
 
 base64_decode base64_decode(string) 
 
 base64_encode base64_encode(string) 
 
 time_since time_since(string, string, string) 
 
 time_now time_now() 
 
 time_now_utc time_now_utc() 
 
 path_canonicalize path_canonicalize(string) 
 
 truncate truncate(string, number) 
 
 semver_compare semver_compare(string, string) 
 
 parse_json parse_json(string) 
 
 parse_yaml parse_yaml(string) 
 
 lookup lookup(object\|array, string\|number) 
 
 items items(object\|array, string, string) 
 
 object_from_lists object_from_lists(array, array) 
 
 random random(string) 
 
 x509_decode x509_decode(string) 
 
 time_to_cron time_to_cron(string) 
 
 time_add time_add(string, string) 
 
 time_parse time_parse(string, string) 
 
 time_utc time_utc(string) 
 
 time_diff time_diff(string, string) 
 
 time_before time_before(string, string) 
 
 time_after time_after(string, string) 
 
 time_between time_between(string, string, string) 
 
 time_truncate time_truncate(string, string) 
  
 
 
  
 
  
 
 
 
    
\ No newline at end of file
diff --git a/main/jp/index.html b/main/jp/index.html
index 51af8c75..b94b7285 100644
--- a/main/jp/index.html
+++ b/main/jp/index.html
@@ -1 +1 @@
- Overview - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Overview
 
kyverno-json uses JMESPath community edition, a modern JMESPath implementation with lexical scopes support.
 
The current payload, policy and rule are always available using the following builtin bindings:
 
  
 Binding Usage 
   
 $payload Current payload being analysed 
 
 $policy Current policy being executed 
 
 $rule Current rule being evaluated 
  
 
 
Warning
 
No protection is made to prevent you from overriding those bindings.
 
 
 
  
 
  
 
 
 
    
\ No newline at end of file
+ Overview - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Overview
 
kyverno-json uses JMESPath community edition, a modern JMESPath implementation with lexical scopes support.
 
The current payload, policy and rule are always available using the following builtin bindings:
 
  
 Binding Usage 
   
 $payload Current payload being analysed 
 
 $policy Current policy being executed 
 
 $rule Current rule being evaluated 
  
 
 
Warning
 
No protection is made to prevent you from overriding those bindings.
 
 
 
  
 
  
 
 
 
    
\ No newline at end of file
diff --git a/main/overrides/main.html b/main/overrides/main.html
index dde6ec5a..e070e95c 100644
--- a/main/overrides/main.html
+++ b/main/overrides/main.html
@@ -1,4 +1,12 @@
 {% extends "base.html" %}
+
+{% block outdated %}
+  You're not viewing the latest version.
+  
+    Click here to go to latest.
+  
+{% endblock %}
+
 {% block extrahead %}
 {% set title = config.site_name %}
 {% if page and page.title and not page.is_homepage %}
diff --git a/main/playground/index.html b/main/playground/index.html
index 8164f5f2..0e489378 100644
--- a/main/playground/index.html
+++ b/main/playground/index.html
@@ -1 +1 @@
- Playground - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Playground
 
The kyverno-json playground can be used to test kyverno-json directly in your web browser.
 
 
  
 
  
 
 
 
    
\ No newline at end of file
+ Playground - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Playground
 
The kyverno-json playground can be used to test kyverno-json directly in your web browser.
 
 
  
 
  
 
 
 
    
\ No newline at end of file
diff --git a/main/policies/asserts/index.html b/main/policies/asserts/index.html
index 3910086a..f7217bd6 100644
--- a/main/policies/asserts/index.html
+++ b/main/policies/asserts/index.html
@@ -1,4 +1,4 @@
- Assertion trees - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Assertion trees
 
Assertion trees can be used to apply complex and dynamic conditional checks using JMESPath expressions.
 
Assert
 
An assert declaration contains an any or all list in which each entry contains a:
 
     
  • check: the assertion check
    •  
  • message: an optional message
    •  
 
A check can contain one or more JMESPath expressions. Expressions represent projections of selected data in the JSON payload and the result of this projection is passed to descendants for further analysis.
 
All comparisons happen in the leaves of the assertion tree.
 
A simple example:
 
This policy checks that a pod does not use the default service account:
 
apiVersion: json.kyverno.io/v1alpha1
+ Assertion trees - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Assertion trees
 
Assertion trees can be used to apply complex and dynamic conditional checks using JMESPath expressions.
 
Assert
 
An assert declaration contains an any or all list in which each entry contains a:
 
     
  • check: the assertion check
    •  
  • message: an optional message
    •  
 
A check can contain one or more JMESPath expressions. Expressions represent projections of selected data in the JSON payload and the result of this projection is passed to descendants for further analysis.
 
All comparisons happen in the leaves of the assertion tree.
 
A simple example:
 
This policy checks that a pod does not use the default service account:
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
 metadata:
   name: assert-sample
diff --git a/main/policies/policies/index.html b/main/policies/policies/index.html
index 85dac297..c8c77d8b 100644
--- a/main/policies/policies/index.html
+++ b/main/policies/policies/index.html
@@ -1,4 +1,4 @@
- Policy Structure - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Policy Structure
 
Kyverno policies are Kubernetes resources and can be easily managed via Kubernetes APIs, GitOps workflows, and other existing tools.
 
Policies that apply to JSON payload have a few differences from Kyverno policies that are applied to Kubernetes resources at admission controls.
 
Resource Scope
 
Policies that apply to JSON payloads are always cluster-wide resources.
 
API Group and Kind
 
kyverno-json policies belong to the json.kyverno.io group and can only be of kind ValidatingPolicy.
 
apiVersion: json.kyverno.io/v1alpha1
+ Policy Structure - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Policy Structure
 
Kyverno policies are Kubernetes resources and can be easily managed via Kubernetes APIs, GitOps workflows, and other existing tools.
 
Policies that apply to JSON payload have a few differences from Kyverno policies that are applied to Kubernetes resources at admission controls.
 
Resource Scope
 
Policies that apply to JSON payloads are always cluster-wide resources.
 
API Group and Kind
 
kyverno-json policies belong to the json.kyverno.io group and can only be of kind ValidatingPolicy.
 
apiVersion: json.kyverno.io/v1alpha1
 kind: ValidatingPolicy
 metadata:
   name: test
diff --git a/main/quick-start/index.html b/main/quick-start/index.html
index 179de0f3..36e7d52d 100644
--- a/main/quick-start/index.html
+++ b/main/quick-start/index.html
@@ -1,4 +1,4 @@
- Quick Start - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Quick Start
 
See Install for the available options to install the CLI.
 
Validate a Terraform Plan
 
In this example we will use a Kyverno policy to validate a Terraform plan:
 
Create the payload
 
Here is a Terraform plan that creates an AWS S3 bucket:
 
terraform {
+ Quick Start - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Quick Start
 
See Install for the available options to install the CLI.
 
Validate a Terraform Plan
 
In this example we will use a Kyverno policy to validate a Terraform plan:
 
Create the payload
 
Here is a Terraform plan that creates an AWS S3 bucket:
 
terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
diff --git a/main/sitemap.xml.gz b/main/sitemap.xml.gz
index 027f61161604b99dbba1b5c09d99cc9f3bbefce4..fd7e2e9b4cd1e4c610fec58b9d46a06d224a62d6 100644
GIT binary patch
delta 15
WcmX@ca*TydzMF$X#CRi{0}}ut!2^{5

delta 15
WcmX@ca*TydzMF%?Mt>ul0}}uuoddZ5

diff --git a/main/webapp/index.html b/main/webapp/index.html
index fdfbea0e..a3cc459e 100644
--- a/main/webapp/index.html
+++ b/main/webapp/index.html
@@ -1,4 +1,4 @@
- Usage - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Usage
 
kyverno-json can be deployed as a web application with a REST API. This is useful for deployments when a long running service that processes policy requests is desired.
 
Managing Policies
 
With kyverno-json policies are managed as Kubernetes resources. This means that you can use Kubernetes APIs, kubectl, GitOps, or any other Kubernetes management tool to manage policies.
 
Usage
 
Here is a complete demonstration of how to use kyverno-json as an web application:
 
Install CRDs
 
Install the CRD for kyverno-json:
 
kubectl apply -f .crds/json.kyverno.io_validatingpolicies.yaml
+ Usage - kyverno-json      
 
  
  
 
  
 
 
 
 
  
 
 
 
 
 
  
 
 
 
 
    
Usage
 
kyverno-json can be deployed as a web application with a REST API. This is useful for deployments when a long running service that processes policy requests is desired.
 
Managing Policies
 
With kyverno-json policies are managed as Kubernetes resources. This means that you can use Kubernetes APIs, kubectl, GitOps, or any other Kubernetes management tool to manage policies.
 
Usage
 
Here is a complete demonstration of how to use kyverno-json as an web application:
 
Install CRDs
 
Install the CRD for kyverno-json:
 
kubectl apply -f .crds/json.kyverno.io_validatingpolicies.yaml
 
 
Install policies:
 
Install a sample policy:
 
kubectl apply -f test/commands/scan/dockerfile/policy.yaml
 
 
Prepare the payload
 
The payload is a JSON object with two fields:
 
  
 Name Type Required 
   
 payload Object Y 
 
 preprocessors Array of Strings N 
  
 
You can construct a sample payload for the Dockerfile policy using:
 
cat test/commands/scan/dockerfile/payload.json | jq '{"payload": .}' > /tmp/webapp-payload.json
 
 
Run the web application
 
./kyverno-json serve