Skip to content

Commit fefddd8

Browse files
committed
docs: clarify that preconditions are not allowed in imageReferences field
Signed-off-by: kushal9897 <kushalag2580@gmail.com>
1 parent ad2320c commit fefddd8

File tree

1 file changed

+5
-12
lines changed
  • content/en/docs/writing-policies/verify-images

1 file changed

+5
-12
lines changed

content/en/docs/writing-policies/verify-images/_index.md

+5-12
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,14 @@ For additional details please reference a section below for the solution used to
5353
### Variables in `imageReferences`
5454
The `imageReferences` field does **not** support variable interpolation (e.g., `{{ }}` syntax). Only **static strings** or predefined lists should be used.
5555

56-
#### ** Incorrect Usage (Using Variables – Not Allowed)**
56+
#### Incorrect Usage (Using Variables – Not Allowed)
5757
```yaml
5858
verifyImages:
5959
- imageReferences: ["{{ parse_yaml(allowedregistryprefixes.data.allowedregistryprefixes) }}"]
6060
```
6161
This will result in a validation error because variables are **not allowed** in `imageReferences`.
6262

63-
#### ** Correct Usage (Using Static Values – Allowed)**
63+
#### Correct Usage (Using Static Values – Allowed)
6464
```yaml
6565
verifyImages:
6666
- imageReferences:
@@ -78,7 +78,7 @@ The `imageReferences` field does **not** support variable interpolation (e.g., `
7878
- `preconditions.all`
7979
- `preconditions.any`
8080

81-
#### ** Incorrect Usage (Using Variables – Not Allowed)**
81+
#### Incorrect Usage (Using Variables – Not Allowed)
8282
```yaml
8383
rules:
8484
- name: restrict-deployment-kinds
@@ -91,7 +91,7 @@ The `imageReferences` field does **not** support variable interpolation (e.g., `
9191
- `match.resources.kinds` must contain **static** resource kinds (e.g., `Pod`, `Deployment`).
9292
- Dynamic interpolation using `{{ request.object.kind }}` is **not supported**.
9393

94-
#### ** Correct Usage (Using Static Values – Allowed)**
94+
#### Correct Usage (Using Static Values – Allowed)
9595
```yaml
9696
rules:
9797
- name: restrict-deployment-kinds
@@ -104,18 +104,11 @@ The `imageReferences` field does **not** support variable interpolation (e.g., `
104104
**Why is this correct?**
105105
- Only predefined, static resource kinds (`Deployment`, `StatefulSet`) are used.
106106

107-
---
107+
108108

109109
### **Why Are Variables Not Allowed in These Fields?**
110110
Kyverno requires these fields to be **static** to ensure policy validation and enforcement remain deterministic and efficient. Allowing variables in these fields could introduce unexpected behavior, making policy evaluation unreliable.
111111

112-
---
113-
114-
#### **Incorrect Usage**
115-
```yaml
116-
verifyImages:
117-
- imageReferences: ["{{ parse_yaml(allowedregistryprefixes.data.allowedregistryprefixes) }}"]
118-
119112

120113

121114
### Cache

0 commit comments

Comments
 (0)