Kyverno
Hard
Mutation
How does Kyverno change resources that already exist in the cluster, rather than only new admission requests?
Select your answer:
Show answer and explanation
Answer: A mutate rule with 'targets', run by the background controller
Explanation
Mutate-existing rules name the resources to change under 'targets'. A trigger event, or a policy event when mutateExistingOnPolicyUpdate is set on the rule, makes the background controller patch those targets. Kyverno needs RBAC permission to update those kinds, granted to the background controller's service account.
More hard Kyverno questions
- A new generate rule creates a NetworkPolicy in every Namespace. What makes Kyverno also create it in Namespaces that existed before the policy?
- Which label makes Kyverno delete a resource automatically after a set amount of time?
- A Kyverno verifyImages rule has mutateDigest: true. What does it do once the signature is verified?
- In a Kyverno mutate overlay (patchStrategicMerge), what does the +() anchor do, as in '+(imagePullPolicy): IfNotPresent'?
- In a Kyverno validate pattern, what does the X() negation anchor mean, as in 'X(hostPath): "null"'?
- Which Kyverno resource exempts specific resources from a policy rule without editing the policy?