<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Kubernetes Admission Controllers — API Reference

## OPA/Gatekeeper

### ConstraintTemplate CRD

| Field | Type | Description |
|-------|------|-------------|
| `spec.crd.spec.names.kind` | string | Custom constraint kind name |
| `spec.targets[].target` | string | `admission.k8s.gatekeeper.sh` |
| `spec.targets[].rego` | string | Rego policy code |

### Constraint CRD

| Field | Type | Description |
|-------|------|-------------|
| `spec.match.kinds[].apiGroups` | list | API groups to match |
| `spec.match.kinds[].kinds` | list | Resource kinds to match |
| `spec.match.namespaces` | list | Namespaces to scope |
| `spec.match.excludedNamespaces` | list | Namespaces to exclude |
| `spec.parameters` | object | Parameters passed to Rego |
| `status.totalViolations` | int | Current violation count |

### Gatekeeper CLI

```bash
# Install Gatekeeper
kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper/master/deploy/gatekeeper.yaml

# List constraint templates
kubectl get constrainttemplates

# List constraints and violations
kubectl get constraints -A -o json | jq '.items[] | {name: .metadata.name, violations: .status.totalViolations}'

# Audit mode
kubectl get constraint CONSTRAINT_NAME -o json | jq '.status.violations'
```

## Kyverno

### ClusterPolicy CRD

| Field | Type | Description |
|-------|------|-------------|
| `spec.validationFailureAction` | string | Enforce or Audit |
| `spec.rules[].match.any[].resources.kinds` | list | Resource kinds |
| `spec.rules[].validate.pattern` | object | Expected resource pattern |
| `spec.rules[].validate.message` | string | Denial message |
| `spec.rules[].mutate` | object | Mutation rules |
| `spec.rules[].generate` | object | Resource generation rules |

### Kyverno CLI

```bash
# Install Kyverno
helm install kyverno kyverno/kyverno -n kyverno --create-namespace

# List policies
kubectl get clusterpolicies

# Policy reports
kubectl get policyreport -A

# Test policy locally
kyverno apply policy.yaml --resource pod.yaml

# Generate report
kubectl get policyreport -A -o json | jq '.items[].results[] | select(.result == "fail")'
```

## kubectl Admission Testing

```bash
# Server-side dry-run (tests against live webhooks)
kubectl apply --dry-run=server -f manifest.yaml

# Check webhook configurations
kubectl get validatingwebhookconfigurations
kubectl get mutatingwebhookconfigurations

# Describe webhook
kubectl get validatingwebhookconfigurations -o json | jq '.items[].webhooks[].rules'
```
