Kyverno
Kyverno Policy
- 2 types: Policy and ClusterPolicy
- Multiple Rules
- Match / Exclude
-- Match resources
kind is mandatory. names, namespaces, operations, selector are optional.
Wildcards * supported in kinds, names, namespaces
All are AND condition.
Any means OR condition
We can mention based on who created
exclude:
any:
- clusterRoles:
- cluster-admin
- subjects:
- kind: User
name: John
match AND exclude
exclude must be a subset of match
- Action
1. Validate ( allow / deny )
2. Mutate
3. Generate new K8s object
4. Verify image (Cosign/Sigstore)
- Enforce / Audit
* It uses JAMESPath
- Filter JSON
# Returns a list of container objects that match the condition
{{ request.object.spec.containers[?starts_with(image, 'nginx')] }}
validate:
message: "Nginx images are not allowed!"
deny:
conditions:
all:
# Filter the list. Use length() to count.
# If count > 0, it means a violation exists -> Block.
- key: "{{ request.object.spec.containers[?starts_with(image, 'nginx')] | length(@) }}"
operator: GreaterThan
value: 0
- pipe
Used to extract a specific field from a complex object into a flat list.
# Input: List of container objects
# Output: ["nginx:latest", "redis:alpine", "busybox"]
key: "{{ request.object.spec.containers[].image }}"
kyverno jp query -i object.json 'spec.containers[].name'
Combo (Filter + Pipe): “Get the containerPort of the container named ‘app’”
request.object.spec.containers[?name == 'app'].ports[].containerPort
You want to find the names of all volumes that are of type emptyDir.
spec.volumes[?emptyDir != null].name
kyverno jp query -i object.json "spec.volumes[?emptyDir != null]"
- null handling
Risk: {{ request.object.metadata.labels.team }} (If null -> Error).
Safe: {{ request.object.metadata.labels.team || '' }} (If null -> treat as empty string).
- The length function
Example: “A Pod must not have more than 3 containers.”
validate:
deny:
conditions:
all:
- key: "{{ request.object.spec.containers | length(@) }}"
operator: GreaterThan
value: 3
- if / else
- sum
- contain means exist : contains(request.object.metadata.labels, 'production')
advance mutate foreach
mutate:
foreach:
- list: "request.object.spec.containers"
patchStrategicMerge:
spec:
containers:
- name: "{{ element.name }}"
securityContext:
readOnlyRootFilesystem: true
* Aut-Gen: If rule for pod then automatically generate rules for Deployment, StatefulSet, DaemonSet, etc.
https://release-1-8-0.kyverno.io/docs/writing-policies/autogen/
Generate rule has synchronize flag
synchronize: true: Kyverno complete managed lifecycle
synchronize: false: Kyverno created for the first time then user can edit it manually without getting revert back like synchronize: true
* request.object is the incoming resource configuration (the new state) that is being submitted to Kubernetes API server
Documentation: https://kyverno.io/docs/policy-types/cluster-policy/variables/
# -------------------------------------------------------------
# ACTION: If Kyverno is dead, just let the request go through.
# -------------------------------------------------------------
failurePolicy: Ignore # or Fail
PolicyReport
PolicyReport stores the results of those rules.
The PolicyReport is essentially a “Health Check Report Card” for your Kubernetes resources.
Its main goal is Observability & Auditing.
It provides summary and then detail about all failures. For Example
apiVersion: wgpolicyk8s.io/v1alpha2
kind: PolicyReport
metadata:
name: polr-ns-default
namespace: default # It lives next to the Pod, not at the cluster level
labels:
app.kubernetes.io/managed-by: kyverno
summary:
pass: 0
fail: 1
warn: 0
error: 0
skip: 0
results:
- policy: require-labels # The name of the ClusterPolicy responsible
rule: check-for-team-label # The specific rule name
category: Best Practices
severity: medium
result: fail # The outcome (fail, pass, warn, error, skip)
message: "Validation error: label 'team' is required"
source: kyverno
resources: # The specific object that failed
- apiVersion: v1
kind: Pod
name: nginx
namespace: default
uid: a1b2c3d4-e5f6...
* Background scan never delete resource even with enforce mode
* For background scan following variable are not relevant
request.userInfo.*
request.operation
request.dryRun
serviceAccountName in admission context
Document: https://kyverno.io/docs/policy-reports/background/
* Cleanup policy delete pods
https://kyverno.io/docs/policy-types/cleanup-policy/
Kyverno CLI
* for given resource, policy is pass or fail
kyverno apply policy.yaml --resource pod.yaml
* test JAMESPath expression against JSON
kyverno jp query -i object.json 'metadata.labels'
* Check policy YAML is written correctly or not
kyverno validate policy.yaml
External Data Source
Purpose: It allows you to load data from outside into a variable before the rule logic (validate/mutate) runs.
In order to consume data from a ConfigMap in a rule, a context is required... The context data can then be referenced in the policy rule using JMESPath notation.
Kyverno supports 3 main data sources in context:
1. Kubernetes Resources (via API Call): Look up existing data in the cluster (e.g., ConfigMaps, Secrets, Services).
2. External APIs: Make an HTTP call to a service outside the cluster.
3. Image Registry: Fetch metadata about a container image (e.g., image size, architecture).
verifyImages:
- imageReferences:
- "ghcr.io/myorg/*"
attestors:
- entries:
- keys:
publicKeys: |-
-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----
https://main.kyverno.io/docs/policy-types/cluster-policy/external-data-sources/
Kyverno Mutate — JSON Patch
the standard patchStrategicMerge merges YAMLs together.
patchesJson6902 is a mutation method specific operations (RFC 6902 standard) to tell Kyverno exactly how to change the data.
Usage:
* Removing a field (impossible with standard merge).
* Adding an item to a specific position in a list (arrays).
* Replacing a value entirely without merging.
It follows the JSON Patch format:
* op: The action (add, remove, replace).
* path: The location of the field (e.g., /metadata/labels/mytag).
* value: The data to put there.
Example: “Add a sidecar container”
https://main.kyverno.io/docs/policy-types/cluster-policy/mutate/#rfc-6902-jsonpatch
TTL Default of Certification in Kyverno:
https://pkg.go.dev/github.com/kyverno/kyverno/pkg/tls
const (
CAValidityDuration = 365 * 24 * time.Hour // 365 days
TLSValidityDuration = 150 * 24 * time.Hour // 150 days
CertRenewalInterval = 12 * time.Hour // 12 hours
)
https://www.udemy.com/course/complete-certified-kyverno-associate-kca-exam-prep/
https://medium.com/@kienlt.qn/prepare-for-the-kyverno-certified-associate-kca-exam-c144906f9bc2
Concurrent Policies Generation Number Default!
PolicyException CRD
CEL
Epic history of LLM
RNN. Seq to seq NLP tasks.
1. Many to one: Sentimental Analysis
2. One to Many: Image caption
3. Many to Many:
- Synch many to many: # input = # output. E.g. Part of speech tagging, Named Entity Recognition
- Asynch many to many: translation, text summarization, question and answer, chatboat, speech to text,
Seq2seq model is used for Many to Many
Stage 1: 2014 Encoder decoder network
Encoder and decoder are LSTM. RNN and GRU are other options.
It is good for small sentences. Not for 30+ words
BLEU score
Stage 2: 2015 Attention Mechanism
Encoder is same
Attention Mechanism: Attention layer at decoder finds out which hidden state is useful at each stage of decoder and generate context vector for that stage. So, Multiple context vectors based on encoder's (hidden state of LSTM = ctht vector) are available to decoder.
Training time is more.
2015 to 2017: May types of Attention Mechanisms were introduced.
Stage 3: 2017 Transformer
No LSTM
No RNN Cell
Self-attention was introduced
Both encoder and decoder uses attention
Transformer can process all words in parallel
1. Attention layer = Multi Head Attention
2. Normalization Layer
3. Dense Layer
4. Input embeddings
It needs hardware, time, and data
Stage 4: 2018 Jan Transfer Learning
Challenges
1 Single model cannot perform all tasks like sentimental, translation, summarization
2 lots of labeled data
Universal Language Model Fine-tuning ULMFiT proposed to use Language modelling as Pre-training. Language modelling is NLP task to predict next word. Advantages
1. Rich feature training
2. unsupervised task
model: AWD LSTM model
data set: wikipedia
finetuning changed output as classifier with many data set
Scratch 10000 data. Now fine tune 100 data still better result
- No transformer
Now in 2018, we have two technolgoies
1. architecture: transformer
2. training. Pretrain and transfer learning
Stage 5: 2018 Oct LLM
Transfer learning on transformer
1. Google : BERT (encoder only model)
2. OpenAI: GPT (decoder only model)
LM to LLM
1. data
2 hardware GPU clusters
3 time : days to weeks
4. cost = h/w + electricity + people + infra
5. energy consumption
---------------
GPT3 - > chatGPT
1. RLHF : Reinforcement Learning from Human Feedback
2. incorporate safety and ethical guidelines
3. improvement in contextual point
4. dialogue specific
5. continuous improvement based on user feedback
Reference https://www.youtube.com/watch?v=8fX3rOjTloc&list=PPSV
साधनमन्त्र
इदानीं वयं समुहे साधनमन्त्रस्य जपं कुर्याम।
