kyverno apply
kyverno apply
Section titled “kyverno apply”Applies policies on resources.
Synopsis
Section titled “Synopsis”Applies policies on resources.
kyverno apply [flags]Examples
Section titled “Examples” # Display evaluation results as a table kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml --output-format table
# Save mutated/generated resources to a directory kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml --output-dir /path/to/results/
# Save mutated/generated resources to a file kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml --output-file /path/to/results.yaml
# Apply on a resource kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --resource=/path/to/resource1 --resource=/path/to/resource2
# Apply on a folder of resources kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --resource=/path/to/resources/
# Apply on a cluster kyverno apply /path/to/policy.yaml /path/to/folderOfPolicies --cluster
# Apply policies from a gitSourceURL on a cluster kyverno apply https://github.com/kyverno/policies/openshift/ --git-branch main --cluster
# Apply single policy with variable on single resource kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml --set <variable1>=<value1>,<variable2>=<value2>
# Apply multiple policy with variable on multiple resource kyverno apply /path/to/policy1.yaml /path/to/policy2.yaml --resource /path/to/resource1.yaml --resource /path/to/resource2.yaml -f /path/to/value.yamlOptions
Section titled “Options” --audit-warn Currently has no effect; ValidatingPolicy audit support is tracked by https://github.com/kyverno/kyverno/issues/16485 --batch-size int Number of resources to fetch per API call (default 100) -c, --cluster Checks if policies should be applied to cluster in the current context --cluster-wide-resources If set to true, will apply policies to cluster-wide resources --concurrent int Number of concurrent workers for resource loading (default 1) --context string The name of the kubeconfig context to use --context-file string File containing context data for CEL policies --continue-on-error Continue processing despite resource loading errors (default true) --continue-on-fail If set to true, will continue to apply policies on the next resource upon failure to apply to the current resource instead of exiting out --crd-paths strings List of paths to CRD files to be used for apply command --detailed-results If set to true, display detailed results --envoy-payload strings Path to Envoy check request payload files (JSON) -e, --exception strings Policy exception to be considered when evaluating policies against resources --exceptions strings Policy exception to be considered when evaluating policies against resources --exceptions-with-resources Evaluate policy exceptions from the resources path --exceptions-within-policies Evaluate policy exceptions from the policies path --exceptions-within-resources Evaluate policy exceptions from the resources path --explain Print how each ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy and DeletingPolicy reached its result: whether it applied, its match conditions, variables, the images it checked, and its validations, the mutations it ran, the generate entries it ran or its delete conditions. The trace prints the values the expressions read, including resource fields and variables, so a policy that reads a Secret's data prints that data; treat the output as sensitive --generate-exceptions Generate policy exceptions for each violation --generated-exception-ttl duration Default TTL for generated exceptions (default 720h0m0s) -b, --git-branch string test git repository branch -h, --help help for apply --http-payload strings Path to HTTP check request payload files (JSON) --json strings Path to JSON payload files --kubeconfig string path to kubeconfig file with authorization and master location information -n, --namespace string Optional Policy parameter passed with cluster flag --output-dir string Directory for mutated/generated resources --output-file string File for mutated/generated resources --output-format string Output format: json or yaml for policy reports/exceptions, or table for evaluation results (default "yaml") --parameter-resource strings Path to resource files that act as ValidatingAdmissionPolicy/MutatingAdmissionPolicy parameters --password string Password for connecting to git repository -p, --policy-report Generates policy report when passed (default policyviolation) --registry If set to true, access the image registry using local docker credentials to populate external data --remove-color Remove any color from output -r, --resource strings Path to resource files --resources strings Path to resource files -s, --set strings Variables that are required --show-performance Show resource loading performance metrics -i, --stdin Optional mutate policy parameter to pipe directly through to kubectl -t, --table Show results in table format --target-resource strings Path to individual files containing target resources files for policies that have mutate existing --target-resources strings Path to a directory containing target resources files for policies that have mutate existing -u, --userinfo string Admission Info including Roles, Cluster Roles and Subjects --username string Username for connecting to git repository -f, --values-file string File containing values for policy variables --warn-exit-code int Set the exit code for warnings; if failures or errors are found, will exit 1 --warn-no-pass Specify if warning exit code should be raised if no objects satisfied a policy; can be used together with --warn-exit-code flag --warnings-as-errors Treat deprecation warnings as errorsOptions inherited from parent commands
Section titled “Options inherited from parent commands” --add_dir_header If true, adds the file directory to the header of the log messages --alsologtostderr log to standard error as well as files (no effect when -logtostderr=true) --alsologtostderrthreshold severity logs at or above this threshold go to stderr when -alsologtostderr=true (no effect when -logtostderr=true) --legacy_stderr_threshold_behavior If true, stderrthreshold is ignored when logtostderr=true (legacy behavior). If false, stderrthreshold is honored even when logtostderr=true (default true) --log_backtrace_at traceLocation when logging hits line file:N, emit a stack trace (default :0) --log_dir string If non-empty, write log files in this directory (no effect when -logtostderr=true) --log_file string If non-empty, use this log file (no effect when -logtostderr=true) --log_file_max_size uint Defines the maximum size a log file can grow to (no effect when -logtostderr=true). Unit is megabytes. If the value is 0, the maximum file size is unlimited. (default 1800) --logtostderr log to standard error instead of files (default true) --one_output If true, only write logs to their native severity level (vs also writing to each lower severity level; no effect when -logtostderr=true) --skip_headers If true, avoid header prefixes in the log messages --skip_log_headers If true, avoid headers when opening log files (no effect when -logtostderr=true) --stderrthreshold severity logs at or above this threshold go to stderr when writing to files and stderr (no effect when -logtostderr=true or -alsologtostderr=true unless -legacy_stderr_threshold_behavior=false) (default 2) -v, --v Level number for the log level verbosity --vmodule moduleSpec comma-separated list of pattern=N settings for file-filtered loggingSEE ALSO
Section titled “SEE ALSO”- kyverno - Kubernetes Native Policy Management.