CRD API Reference

violation ViolationRecord

Violation is the violation record that was acknowledged.

reason string

Reason is an optional field to indicate why this violation was
acknowledged.

acknowledgedAt Time

AcknowledgedAt is the time when the violation was acknowledged.

from IstioFrom array

From defines source identities for the rule.

to IstioTo array

To defines destination operations for the rule.

selector LabelSelector

Selector selects the destination workloads where the policy is enforced.

rules IstioAuthorizationPolicyRule array

Rules is the ruleset.

source IstioSource

Source defines the source identities for the rule.

ports string array

Ports is the list of destination ports.

principals string array

Principals are the source SPIFFE identities.

operation IstioOperation

Operation defines the destination operations for the rule.

backend PolicyBackend

Backend selects which backend policy model this object carries.

Enum: [kubernetes istio]
Required: \{}

kubernetes NetworkPolicySpec

Kubernetes contains the policy expressed as a standard Kubernetes
NetworkPolicySpec.

istio IstioAuthorizationPolicySpec

Istio contains a constrained L4 policy model rendered as an Istio
AuthorizationPolicy by the reconciler.

timestamp Time

Timestamp is when the violation last occurred.

source WorkloadRef

Source is the workload that initiated the traffic.

dest WorkloadRef

Dest is the workload that received the traffic.

protocol Protocol

Protocol is the L4 protocol (TCP, UDP).

dstPort integer

DstPort is the destination port. 0 when unavailable.

Maximum: 65535
Minimum: 0

action WorkloadNetworkPolicyMode

Action is the enforcement action taken (monitor or protect).

Enum: [monitor protect]

denyingPolicyNamespace string

DenyingPolicyNamespace is the namespace of the WorkloadNetworkPolicy this
violation belongs to. For a DENY it is the policy that denied the flow; for
an ALLOW-miss (which carries no denying policy on the wire) the scraper
resolves the owning WorkloadNetworkPolicy by matching the destination pod’s
labels against WNP selectors and records it here (see istio.Enricher).

denyingPolicyName string

DenyingPolicyName is the name of the WorkloadNetworkPolicy this violation
belongs to. For a DENY it is the policy that denied the flow; for an
ALLOW-miss it is the owning WorkloadNetworkPolicy resolved by selector match
(see DenyingPolicyNamespace). The controller keys the violation to its WNP
by this name for both cases; Action (monitor vs protect) distinguishes them.

timestamp Time

Timestamp is when the violation last occurred.

source WorkloadRef

Source is the workload that initiated the traffic.

dest WorkloadRef

Dest is the workload that received the traffic.

protocol Protocol

Protocol is the L4 protocol (TCP, UDP).

dstPort integer

DstPort is the destination port. 0 when unavailable.

Maximum: 65535
Minimum: 0

action WorkloadNetworkPolicyMode

Action is the enforcement action taken (monitor or protect).

Enum: [monitor protect]

denyingPolicyNamespace string

DenyingPolicyNamespace is the namespace of the WorkloadNetworkPolicy this
violation belongs to. For a DENY it is the policy that denied the flow; for
an ALLOW-miss (which carries no denying policy on the wire) the scraper
resolves the owning WorkloadNetworkPolicy by matching the destination pod’s
labels against WNP selectors and records it here (see istio.Enricher).

denyingPolicyName string

DenyingPolicyName is the name of the WorkloadNetworkPolicy this violation
belongs to. For a DENY it is the policy that denied the flow; for an
ALLOW-miss it is the owning WorkloadNetworkPolicy resolved by selector match
(see DenyingPolicyNamespace). The controller keys the violation to its WNP
by this name for both cases; Action (monitor vs protect) distinguishes them.

id integer

ID is a per-policy unique identifier allocated by the controller
when the record is first observed. It is stable across re-scrapes
of the same logical violation, so consumers can refer to a single
record by ID (for example when correlating with external events).

Stored as int64 (not uint64) for compatibility with the Kubernetes
field-management machinery used by controller-runtime’s test
fixtures; the counter is monotonically increasing and never goes
negative, so the sign bit is never set in practice.

apiVersion string

networkenforcer.kubewarden.io/v1alpha1

kind string

WorkloadNetworkPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec WorkloadNetworkPolicySpec

status WorkloadNetworkPolicyStatus

apiVersion string

networkenforcer.kubewarden.io/v1alpha1

kind string

WorkloadNetworkPolicyList

metadata ListMeta

Refer to Kubernetes API documentation for fields of metadata.

items WorkloadNetworkPolicy array

apiVersion string

networkenforcer.kubewarden.io/v1alpha1

kind string

WorkloadNetworkPolicyProposal

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec WorkloadNetworkPolicyProposalSpec

status WorkloadNetworkPolicyProposalStatus

apiVersion string

networkenforcer.kubewarden.io/v1alpha1

kind string

WorkloadNetworkPolicyProposalList

metadata ListMeta

Refer to Kubernetes API documentation for fields of metadata.

items WorkloadNetworkPolicyProposal array

backend PolicyBackend

Backend selects which backend policy model this object carries.

Enum: [kubernetes istio]
Required: \{}

kubernetes NetworkPolicySpec

Kubernetes contains the policy expressed as a standard Kubernetes
NetworkPolicySpec.

istio IstioAuthorizationPolicySpec

Istio contains a constrained L4 policy model rendered as an Istio
AuthorizationPolicy by the reconciler.

conditions Condition array

conditions represent the current state of the proposal.

backend PolicyBackend

Backend selects which backend policy model this object carries.

Enum: [kubernetes istio]
Required: \{}

kubernetes NetworkPolicySpec

Kubernetes contains the policy expressed as a standard Kubernetes
NetworkPolicySpec.

istio IstioAuthorizationPolicySpec

Istio contains a constrained L4 policy model rendered as an Istio
AuthorizationPolicy by the reconciler.

mode WorkloadNetworkPolicyMode

Mode controls whether the policy is observed (monitor) or actively
enforced (protect). Defaults to monitor.

monitor

Enum: [monitor protect]

observedGeneration integer

ObservedGeneration is the most recent generation observed for this
WorkloadNetworkPolicy. It corresponds to the resource’s
metadata.generation, which is updated by the API server when the
spec changes.

violationCount integer

ViolationCount is the total number of violation records ever
observed for this policy, including those that have already been
trimmed out of Violations or cleared because the flow is now
permitted by the policy template. It is not guaranteed to be strongly
consistent and may be temporarily outdated.

0

activeViolationCount integer

ActiveViolationCount is the number of currently active (non-cleared)
violation records. It is always equal to len(Violations) and is
updated in the same status write.

0

violations ViolationRecord array

Violations is the list of the most recent violation records
(max maxViolationRecords). Oldest entries are dropped when the
limit is reached.

acknowledgedViolations AcknowledgedViolationRecord array

AcknowledgedViolations is the list of the most recent violation
records that have been acknowledged by users (max maxViolationRecords).
Oldest entries are dropped when the limit is reached.

namespace string

Namespace is the Kubernetes namespace of the workload.

ownerKind WorkloadKind

OwnerKind is the kind of the owner resource.

ownerName string

OwnerName is the name of the owner resource.

identity string

Identity is the istio-specific workload identity.
This field is not populated for other providers.

selector LabelSelector

Selector is the label selector for the workload.