Manifests
Before you manage manifests in the platform, authorize in the platform.
Add a manifest
Example command to dry-run a namespace object manifest
curl -k -s -L --request POST "$BACKENDPOINT/api/v1/clusters/$CLUSTERNAME/manifests?create_option=dry-run" --header "Authorization: Bearer $token" --data-binary @- <<'EOF'
apiVersion: v1
kind: Secret
metadata:
name: secret-name
namespace: namespace-name
EOF
Example response for a successful dry run
[{"kind":"Secret","body":"{\"apiVersion\":\"v1\",\"kind\":\"Secret\",\"metadata\":{\"name\":\"secret-name\",\"namespace\":\"namespace-name\"}}","result":"success"}]
Example command to apply a namespace object manifest
curl -k -s -L --request POST "$BACKENDPOINT/api/v1/clusters/$CLUSTERNAME/manifests" --header "Authorization: Bearer $token" --data-binary @- <<'EOF'
apiVersion: v1
kind: Secret
metadata:
name: secret-name
namespace: namespace-name
EOF
Example response after successfully applying the manifest
[{"kind":"Secret","body":"{\"apiVersion\":\"v1\",\"kind\":\"Secret\",\"metadata\":{\"name\":\"secret-name\",\"namespace\":\"namespace-name\"}}","result":"success"}]
Example command to dry-run a cluster object manifest
curl -k -s -L --request POST "$BACKENDPOINT/api/v1/clusters/$CLUSTERNAME/manifests?create_option=dry-run" --header "Authorization: Bearer $token" --data-binary @- <<'EOF'
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
annotations:
meta.helm.sh/release-name: shturval-policies
meta.helm.sh/release-namespace: kyverno
policies.kyverno.io/category: infosec
policies.kyverno.io/description: Kubernetes supports setting limits on CPU consumption
for running containers. If limits are not set, a Denial of Service (DoS) may
occur because a pod (container) can use all resources available on the node.
Setting CPU request values is considered a best practice.
policies.kyverno.io/severity: High
policies.kyverno.io/title: CPU Requests checker
labels:
app.kubernetes.io/managed-by: Helm
name: absence-of-cpu-requests
spec:
admission: true
background: true
failurePolicy: Ignore
rules:
- match:
any:
- resources:
kinds:
- Pod
name: check-for-cpu-requests
skipBackgroundRequests: true
validate:
foreach:
- list: request.object.spec.[initContainers, containers][]
pattern:
resources:
requests:
cpu: ?*
message: CPU requests are not set for Container/InitContainer
schemaValidation: true
validationFailureAction: Audit
webhookTimeoutSeconds: 10
EOF
Example response after successfully applying the manifest
[{"kind":"ClusterPolicy","body":"{\"apiVersion\":\"kyverno.io/v1\",\"kind\":\"ClusterPolicy\",\"metadata\":{\"annotations\":{\"meta.helm.sh/release-name\":\"shturval-policies\",\"meta.helm.sh/release-namespace\":\"kyverno\",\"policies.kyverno.io/category\":\"infosec\",\"policies.kyverno.io/description\":\"Kubernetes supports setting limits on CPU consumption for running containers. If limits are not set, a Denial of Service (DoS) may occur because a pod (container) can use all resources available on the node. Setting CPU request values is considered a best practice.\",\"policies.kyverno.io/severity\":\"High\",\"policies.kyverno.io/title\":\"CPU Requests checker\"},\"labels\":{\"app.kubernetes.io/managed-by\":\"Helm\"},\"name\":\"absence-of-cpu-requests\"},\"spec\":{\"admission\":true,\"background\":true,\"failurePolicy\":\"Ignore\",\"rules\":[{\"match\":{\"any\":[{\"resources\":{\"kinds\":[\"Pod\"]}}]},\"name\":\"check-for-cpu-requests\",\"skipBackgroundRequests\":true,\"validate\":{\"foreach\":[{\"list\":\"request.object.spec.[initContainers, containers][]\",\"pattern\":{\"resources\":{\"requests\":{\"cpu\":\"?*\"}}}}],\"message\":\"CPU requests are not set for Container/InitContainer\"}}],\"schemaValidation\":true,\"validationFailureAction\":\"Audit\",\"webhookTimeoutSeconds\":10}}","result":"success"}]
Example command to apply a cluster object manifest
curl -k -s -L --request POST "$BACKENDPOINT/api/v1/clusters/$CLUSTERNAME/manifests" --header "Authorization: Bearer $token" --data-binary @- <<'EOF'
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
annotations:
meta.helm.sh/release-name: shturval-policies
meta.helm.sh/release-namespace: kyverno
policies.kyverno.io/category: infosec
policies.kyverno.io/description: Kubernetes supports setting limits on CPU consumption
for running containers. If limits are not set, a Denial of Service (DoS) may
occur because a pod (container) can use all resources available on the node.
Setting CPU request values is considered a best practice.
policies.kyverno.io/severity: High
policies.kyverno.io/title: CPU Requests checker
labels:
app.kubernetes.io/managed-by: Helm
name: absence-of-cpu-requests
spec:
admission: true
background: true
failurePolicy: Ignore
rules:
- match:
any:
- resources:
kinds:
- Pod
name: check-for-cpu-requests
skipBackgroundRequests: true
validate:
foreach:
- list: request.object.spec.[initContainers, containers][]
pattern:
resources:
requests:
cpu: ?*
message: CPU requests are not set for Container/InitContainer
schemaValidation: true
validationFailureAction: Audit
webhookTimeoutSeconds: 10
EOF
Example response after successfully applying the manifest
[{"kind":"ClusterPolicy","body":"{\"apiVersion\":\"kyverno.io/v1\",\"kind\":\"ClusterPolicy\",\"metadata\":{\"annotations\":{\"meta.helm.sh/release-name\":\"shturval-policies\",\"meta.helm.sh/release-namespace\":\"kyverno\",\"policies.kyverno.io/category\":\"infosec\",\"policies.kyverno.io/description\":\"Kubernetes supports setting limits on CPU consumption for running containers. If limits are not set, a Denial of Service (DoS) may occur because a pod (container) can use all resources available on the node. Setting CPU request values is considered a best practice.\",\"policies.kyverno.io/severity\":\"High\",\"policies.kyverno.io/title\":\"CPU Requests checker\"},\"labels\":{\"app.kubernetes.io/managed-by\":\"Helm\"},\"name\":\"absence-of-cpu-requests\"},\"spec\":{\"admission\":true,\"background\":true,\"failurePolicy\":\"Ignore\",\"rules\":[{\"match\":{\"any\":[{\"resources\":{\"kinds\":[\"Pod\"]}}]},\"name\":\"check-for-cpu-requests\",\"skipBackgroundRequests\":true,\"validate\":{\"foreach\":[{\"list\":\"request.object.spec.[initContainers, containers][]\",\"pattern\":{\"resources\":{\"requests\":{\"cpu\":\"?*\"}}}}],\"message\":\"CPU requests are not set for Container/InitContainer\"}}],\"schemaValidation\":true,\"validationFailureAction\":\"Audit\",\"webhookTimeoutSeconds\":10}}","result":"success"}]
Delete an object
Example command to delete a namespace object
export NAMESPACE=namespace-name
export APIGROUP=core
export KIND=Secret
export CUSTOMRESOURCENAME=secret-name
curl -k -L --request DELETE "$BACKENDPOINT/api/v1/clusters/$CLUSTERNAME/namespaces/$NAMESPACE/customresources/groups/$APIGROUP/kinds/$KIND/names/$CUSTOMRESOURCENAME" --header "Authorization: Bearer $token"
Example command to delete a cluster object
export APIGROUP=kyverno.io
export KIND=ClusterPolicy
export CUSTOMRESOURCENAME=absence-of-cpu-requests
curl -k -L --request DELETE "$BACKENDPOINT/api/v1/clusters/$CLUSTERNAME/customresources/groups/$APIGROUP/kinds/$KIND/names/$CUSTOMRESOURCENAME" --header "Authorization: Bearer $token"