Common Policy Settings: KCA practice questions

Policy settings are the fields under spec that change how a whole policy behaves, as distinct from what an individual rule checks. Several moved over time, so it helps to know both the current location and the deprecated one.

The webhook failure policy decides what the API server does when it cannot get an answer from Kyverno. In Kubernetes terms, Fail means an error calling the webhook rejects the request and Ignore means the request continues; Fail is the default. In a Kyverno policy this is now set as webhookConfiguration.failurePolicy, and the old spec.failurePolicy, which also defaulted to Fail, has been deprecated since 1.13. Fail is the safer setting for security rules, but it means an unavailable Kyverno can block changes, while Ignore keeps the cluster usable and lets requests pass unchecked. The timeout follows the same pattern: webhookConfiguration.timeoutSeconds replaces the deprecated webhookTimeoutSeconds, the default is 10 seconds, and values from 1 to 30 are allowed. When the timeout expires the failure policy applies.

applyRules takes One or All. All, the default, applies every matching rule; One stops after the first rule that matches. background, true by default, makes Kyverno also scan existing resources and produce report results for them. admission, also true by default, controls whether the rules run during admission at all. Some match criteria depend on admission data, so rules that match on roles, clusterRoles or subjects need background set to false, and variables such as serviceAccountName or request.roles are not available to background scans because existing resources carry no requester information.

Several settings were moved from spec to the rules they affect. validationFailureAction and validationFailureActionOverrides became failureAction and failureActionOverrides on the validate rule; the spec-level action defaulted to Audit. generateExisting moved under the generate rule; without it, installing a policy does not apply a generate rule to trigger resources that already exist. mutateExistingOnPolicyUpdate moved under the mutate rule and, together with mutate targets, mutates existing resources when the policy is created or updated. All of these spec-level forms are deprecated as of 1.13.

schemaValidation is deprecated since 1.11 and has no effect any more. useServerSideApply, false by default, makes generate rules use server-side apply so that other controllers can see which fields Kyverno owns. skipBackgroundRequests, true by default, skips admission requests that come from Kyverno's own background controller; it has to be false for generate and mutate-existing rules to act on those requests.

Settings outside the policy matter too. The Kyverno ConfigMap holds resourceFilters in the form [Kind,Namespace,Name], which skip some kinds such as Events and Nodes by default, excludeGroups, whose defaults include system:nodes, and a webhook namespaceSelector that excludes the kube-system and kyverno namespaces by default.