Run policy test suite

Execute kyverno-test.yaml suites asserting resource pass/fail/skip; -d for detailed diff

kyverno test ./tests --remove-color -d
tool
kyverno5 commands
tags
kyvernocitroubleshooting

More kyverno commands

  • Inspect policy reports for violations
    kubectl get polr,cpolr -A -o json | jq -r '.items[].results[] | select(.result=="fail") | "\(.policy)/\(.rule)"' | sort | uniq -c

    Aggregate failing PolicyReport results cluster-wide ranked by count

  • Mutate policy adding default labels
    kubectl apply -f - <<'EOF' apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: add-team-label spec: rules: - name: add-label match: any: - resources: kinds: [Pod] mutate: patchStrategicMerge: metadata: labels: team: "{{request.userInfo.username}}" EOF

    Auto-inject labels on admission via strategic merge patch; mutate runs before validate

  • List all cluster and namespaced policies
    kubectl get cpol,pol -A -o custom-columns='NAME:.metadata.name,ACTION:.spec.validationFailureAction,READY:.status.ready'

    Show every Kyverno policy with enforce/audit mode and ready state at a glance

  • Apply policy against a resource offline
    kyverno apply policy.yaml --resource resource.yaml --policy-report

    Dry-run a policy on a manifest without a cluster; emits a PolicyReport for CI gating

all 5 kyverno commands