CRD API Reference

violation ViolationRecord

violation is the violation record acknowledged by users

reason string

reason is an optional field to indicate the reason this violation is acknowledged.

acknowledgedAt Time

acknowledgedAt is the time when the violation was acknowledged

code PolicyCode

code is the policy code.

message string

message is a human-readable description.

since Time

since is the time at which the node entered its current status.
It is stamped by the controller when the node’s code changes and
preserved across status recomputations while the code is unchanged;
the agent does not report it.

nodeName string

code PolicyCode

code is the policy code.

message string

message is a human-readable description.

since Time

since is the time at which the node entered its current status.
It is stamped by the controller when the node’s code changes and
preserved across status recomputations while the code is unchanged;
the agent does not report it.

id integer

id is a per-policy unique identifier allocated by the controller
when the record is first observed. It is stable across re-scrapes
of the same logical violation, so consumers can refer to a single
record by id (for example when correlating with external events).

Stored as int64 (not uint64) for compatibility with the Kubernetes
field-management machinery used by controller-runtime’s test
fixtures; the counter is monotonically increasing and never goes
negative, so the sign bit is never set in practice.

lastObservedTimestamp Time

lastObservedTimestamp is when the violation was last observed.

occurrences integer

occurrences is the number of times this violation (identified by
pod, container, executable and action) has been observed since the
record was first created. It is a per-record counter, distinct from
the policy-level violationCount aggregate: it is only incremented
when a scraped event matches this exact record, so consumers can
tell how many times this specific executable/container/pod combo
fired.

1

firstObservedTimestamp Time

firstObservedTimestamp is when the violation was first observed. It
is stamped from the scraped event’s own timestamp when the record
is created and is never updated on re-scrapes, so consumers can
compute the age of the violation (unlike timestamp, which tracks
the last occurrence).

podName string

podName is the name of the pod where the violation occurred.

containerName string

containerName is the container where the unauthorized executable ran.

executablePath string

executablePath is the path of the unauthorized executable.

nodeName string

nodeName is the node where the violation occurred.

action string

action is the enforcement action taken (monitor or protect).

workloadName string

workloadName is the name of the workload that owns the pod, taken
from the pod’s first owner reference at the time the record was
first observed. Empty if the pod has no owner reference or could
not be looked up.

workloadKind string

workloadKind is the kind of the workload that owns the pod, taken
from the pod’s first owner reference at the time the record was
first observed. Empty if the pod has no owner reference or could
not be looked up.

apiVersion string

runtimeenforcer.kubewarden.io/v1alpha1

kind string

WorkloadPolicy

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec WorkloadPolicySpec

status WorkloadPolicyStatus

allowed string array

allowed defines a list of executables that are allowed to run

items:Pattern: ^/.*$

apiVersion string

runtimeenforcer.kubewarden.io/v1alpha1

kind string

WorkloadPolicyList

metadata ListMeta

Refer to Kubernetes API documentation for fields of metadata.

items WorkloadPolicy array

apiVersion string

runtimeenforcer.kubewarden.io/v1alpha1

kind string

WorkloadPolicyProposal

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec WorkloadPolicyProposalSpec

apiVersion string

runtimeenforcer.kubewarden.io/v1alpha1

kind string

WorkloadPolicyProposalList

metadata ListMeta

Refer to Kubernetes API documentation for fields of metadata.

items WorkloadPolicyProposal array

rulesByContainer object (keys:string, values:WorkloadPolicyRules)

rulesByContainer specifies for each container the list of rules to apply.

executables WorkloadPolicyExecutables

executables defines a security policy for executables.

mode string

mode defines the execution mode of this policy. Can be set to
either "protect" or "monitor". In "protect" mode, the policy
blocks and reports violations, while in "monitor" mode,
it only reports violations.

Enum: [monitor protect]
Required: \{}

rulesByContainer object (keys:string, values:WorkloadPolicyRules)

rulesByContainer specifies for each container the list of rules to apply.

observedGeneration integer

nodesWithIssues object (keys:string, values:PolicyStatus)

nodesWithIssues contains the status of each node with issues.

totalNodes integer

totalNodes is the total number of nodes the policy is applied to.

successfulNodes integer

successfulNodes is the number of nodes where the policy is successfully enforced.

failedNodes integer

failedNodes is the number of nodes where the policy enforcement failed.

transitioningNodes integer

transitioningNodes is the number of nodes where the policy is transitioning mode.

nodesTransitioning PolicyNodeStatus array

nodesTransitioning contains the nodes that are transitioning, including
the time at which each node entered the transitioning state.

phase Phase

phase indicates the current phase of the workload policy.

violationCount integer

violationCount is the total number of unique violation records
ever observed for this policy, including those that have already
been trimmed out of Violations or cleared because the executable
was later added to an allowlist. It is not guaranteed to be strongly
consistent and may be temporarily outdated.

0

activeViolationCount integer

activeViolationCount is the number of currently active (non-cleared)
violation records. It is always equal to len(Violations) and is
updated in the same status write.

0

violations ViolationRecord array

violations is the list of the most recent violation records (max maxViolationRecords).
Oldest entries are dropped when the limit is reached.

acknowledgedViolations AcknowledgedViolationRecord array

acknowledgedViolations is the list of the most recent violation records that are acknowledged
by users (max maxViolationRecords).
Oldest entries are dropped when the limit is reached.