Skip to content

Commit

Permalink
feat: add documentation for emit warning in mutate and validate
Browse files Browse the repository at this point in the history
Signed-off-by: Vishal Choudhary <[email protected]>
  • Loading branch information
vishal-chdhry committed Oct 28, 2024
1 parent 66ad854 commit 1623552
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 0 deletions.
4 changes: 4 additions & 0 deletions content/en/docs/writing-policies/mutate.md
Original file line number Diff line number Diff line change
Expand Up @@ -415,6 +415,10 @@ spec:
- <(emptyDir): {}
```

{{% alert title="Note" color="info" %}}
Set `spec.emitWarning` to `true` to show rules that mutated the resource in Admission Response warning and kubectl output.
{{% /alert %}}

## Mutate Existing resources

In addition to standard mutations, Kyverno also supports mutation on existing resources with `patchStrategicMerge` and `patchesJson6902`. Unlike regular mutate policies that are applied through the AdmissionReview process, mutate existing policies are applied in the background (via the background controller) which update existing resources in the cluster. These "mutate existing" policies, like traditional mutate policies, are still triggered via the AdmissionReview process but apply to existing resources. This decoupling also allows triggering on one resource and mutating a totally different one. They may also optionally be configured to apply upon updates to the policy itself. This has two important implications:
Expand Down
4 changes: 4 additions & 0 deletions content/en/docs/writing-policies/validate.md
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,10 @@ The `FailureAction` attribute controls admission control behaviors for resources
The field `spec.validationFailureAction` is deprecated and will be removed in a future release. Instead, use `spec.rules[*].validate[*].failureAction`.
{{% /alert %}}

{{% alert title="Note" color="info" %}}
When `spec.rules[*].validate[*].failureAction` is set to `Audit`, set `spec.emitWarning` to `true` to show audit policy violation in Admission Response warning and kubectl output.
{{% /alert %}}

## Failure Action Overrides

Using `failureActionOverrides`, you can specify which actions to apply per Namespace. This attribute is only available for ClusterPolicies.
Expand Down

0 comments on commit 1623552

Please sign in to comment.