kwctl CLI

annotate — Add Admission Controller metadata to a WebAssembly module

bench — Benchmarks a Admission Controller policy

completions — Generate shell completions

digest — Fetch digest from the OCI manifest of a policy

docs — Generates the markdown documentation for kwctl commands

info — Display system information

inspect — Inspect Admission Controller policy

load — load policies from a tar.gz file

policies — Lists all downloaded policies

pull — Pulls a Admission Controller policy from a given URI

push — Pushes a Admission Controller policy to an OCI registry

rm — Removes a Admission Controller policy from the store

run — Runs a Admission Controller policy from a given URI

save — save policies to a tar.gz file

scaffold — Scaffold a Kubernetes resource or configuration file

verify — Verify a Admission Controller policy from a given URI using Sigstore

-v, --verbose <VERBOSE> — Increase verbosity

--no-color <NO-COLOR> — Disable colorful output

<WASM-PATH> — Path to WebAssembly module to be annotated

-m, --metadata-path <PATH> — File containing the metadata

-o, --output-path <PATH> — Output file

-u, --usage-path <PATH> — File containing the usage information of the policy

<URI_OR_SHA_PREFIX_OR_YAML_FILE> — Policy URI, SHA prefix or YAML file containing Admission Controller policy resources. Supported schemes: registry://, https://, file://. If schema is omitted, file:// is assumed, rooted on the current directory.

--allow-context-aware <ALLOW-CONTEXT-AWARE> — Grant access to the Kubernetes resources defined inside of the policy’s contextAwareResources section. Warning: review the list of resources carefully to avoid abuses. Disabled by default

--cert-email <VALUE> — Expected email in Fulcio certificate

--cert-oidc-issuer <VALUE> — Expected OIDC issuer in Fulcio certificates

--disable-wasmtime-cache <DISABLE-WASMTIME-CACHE> — Turn off usage of wasmtime cache

--docker-config-json-path <PATH> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

--dump-results-to-disk <DUMP_RESULTS_TO_DISK> — Puts results in target/tiny-bench/label/.. if target can be found. used for comparing previous runs

-e, --execution-mode <MODE> — The runtime to use to execute this policy
Possible values: opa, gatekeeper, kubewarden, wasi

--github-owner <VALUE> — GitHub owner expected in the certificates generated in CD pipelines

--github-repo <VALUE> — GitHub repository expected in the certificates generated in CD pipelines

--measurement-time <SECONDS> — How long the bench 'should' run, num_samples is prioritized so benching will take longer to be able to collect num_samples if the code to be benched is slower than this time limit allowed

--num-resamples <NUM> — How many resamples should be done

--num-samples <NUM> — How many resamples should be done. Recommended at least 50, above 100 doesn’t seem to yield a significantly different result

--raw <RAW> — Validate a raw request
Default value: false

--record-host-capabilities-interactions <FILE> — Record all the policy and host capabilities communications to the given file. Useful to be combined later with '--replay-host-capabilities-interactions' flag

--replay-host-capabilities-interactions <FILE> — During policy and host capabilities exchanges the host replays back the answers found inside of the provided file. This is useful to test policies in a reproducible way, given no external interactions with OCI registries, DNS, Kubernetes are performed.

-r, --request-path <PATH> — File containing the Kubernetes admission request object in JSON format

--settings-json <VALUE> — JSON string containing the settings for this policy

-s, --settings-path <PATH> — File containing the settings for this policy

--sigstore-trust-config <PATH> — JSON-formatted file conforming to the ClientTrustConfig message in the Sigstore protobuf specs. This file configures the entire Sigstore instance state, including the URIs used to access the CA and artifact transparency services as well as the cryptographic root of trust itself

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

-a, --verification-annotation <KEY=VALUE> — Annotation in key=value format. Can be repeated multiple times

--verification-config-path <PATH> — YAML file holding verification config information (signatures, public keys…​)

-k, --verification-key <PATH> — Path to key used to verify the policy. Can be repeated multiple times

--warm-up-time <SECONDS> — How long the bench should warm up

-s, --shell <VALUE> — Shell type
Possible values: bash, elvish, fish, powershell, zsh

<URI> — Policy URI

--docker-config-json-path <PATH> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

-o, --output <FILE> — path where the documentation file will be stored

<URI_OR_SHA_PREFIX> — Policy URI or SHA prefix. Supported schemes: registry://, https://, file://. If schema is omitted, file:// is assumed, rooted on the current directory.

--docker-config-json-path <PATH> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

-o, --output <FORMAT> — Output format
Possible values: yaml

--show-signatures <SHOW-SIGNATURES> — Show sigstore signatures

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

--input <INPUT> — load policies from tarball

<URI> — Policy URI. Supported schemes: registry://, https://, file://

--cert-email <VALUE> — Expected email in Fulcio certificate

--cert-oidc-issuer <VALUE> — Expected OIDC issuer in Fulcio certificates

--docker-config-json-path <DOCKER_CONFIG> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

--github-owner <VALUE> — GitHub owner expected in the certificates generated in CD pipelines

--github-repo <VALUE> — GitHub repository expected in the certificates generated in CD pipelines

-o, --output-path <PATH> — Output file. If not provided will be downloaded to the Admission Controller store

--sigstore-trust-config <PATH> — JSON-formatted file conforming to the ClientTrustConfig message in the Sigstore protobuf specs. This file configures the entire Sigstore instance state, including the URIs used to access the CA and artifact transparency services as well as the cryptographic root of trust itself

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

-a, --verification-annotation <KEY=VALUE> — Annotation in key=value format. Can be repeated multiple times

--verification-config-path <PATH> — YAML file holding verification config information (signatures, public keys…​)

-k, --verification-key <PATH> — Path to key used to verify the policy. Can be repeated multiple times

<POLICY> — Policy to push. Can be the path to a local file, a policy URI or the SHA prefix of a policy in the store.

<URI> — Policy URI. Supported schemes: registry://

--docker-config-json-path <PATH> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

-f, --force <FORCE> — Push also a policy that is not annotated

-o, --output <PATH> — Output format
Default value: text
Possible values: text, json

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

<URI_OR_SHA_PREFIX> — Policy URI or SHA prefix

<URI_OR_SHA_PREFIX_OR_YAML_FILE> — Policy URI, SHA prefix or YAML file containing Admission Controller policy resources. Supported schemes: registry://, https://, file://. If schema is omitted, file:// is assumed, rooted on the current directory.

--allow-context-aware <ALLOW-CONTEXT-AWARE> — Grant access to the Kubernetes resources defined inside of the policy’s contextAwareResources section. Warning: review the list of resources carefully to avoid abuses. Disabled by default

--cert-email <VALUE> — Expected email in Fulcio certificate

--cert-oidc-issuer <VALUE> — Expected OIDC issuer in Fulcio certificates

--disable-wasmtime-cache <DISABLE-WASMTIME-CACHE> — Turn off usage of wasmtime cache

--docker-config-json-path <PATH> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

-e, --execution-mode <MODE> — The runtime to use to execute this policy
Possible values: opa, gatekeeper, kubewarden, wasi

--github-owner <VALUE> — GitHub owner expected in the certificates generated in CD pipelines

--github-repo <VALUE> — GitHub repository expected in the certificates generated in CD pipelines

--raw <RAW> — Validate a raw request
Default value: false

--record-host-capabilities-interactions <FILE> — Record all the policy and host capabilities communications to the given file. Useful to be combined later with '--replay-host-capabilities-interactions' flag

--replay-host-capabilities-interactions <FILE> — During policy and host capabilities exchanges the host replays back the answers found inside of the provided file. This is useful to test policies in a reproducible way, given no external interactions with OCI registries, DNS, Kubernetes are performed.

-r, --request-path <PATH> — File containing the Kubernetes admission request object in JSON format

--settings-json <VALUE> — JSON string containing the settings for this policy

-s, --settings-path <PATH> — File containing the settings for this policy

--sigstore-trust-config <PATH> — JSON-formatted file conforming to the ClientTrustConfig message in the Sigstore protobuf specs. This file configures the entire Sigstore instance state, including the URIs used to access the CA and artifact transparency services as well as the cryptographic root of trust itself

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

-a, --verification-annotation <KEY=VALUE> — Annotation in key=value format. Can be repeated multiple times

--verification-config-path <PATH> — YAML file holding verification config information (signatures, public keys…​)

-k, --verification-key <PATH> — Path to key used to verify the policy. Can be repeated multiple times

<POLICIES> — list of policies to save

-o, --output <FILE> — path where the file will be stored

admission-request — Scaffold an AdmissionRequest object

artifacthub — Output an artifacthub-pkg.yml file from a metadata.yml file

manifest — Output a Kubernetes resource manifest

vap — Convert a Kubernetes ValidatingAdmissionPolicy into a Admission Controller ClusterAdmissionPolicy

verification-config — Output a default Sigstore verification configuration file

--object <PATH> — The file containing the new object being admitted

--old-object <PATH> — The file containing the existing object

-o, --operation <TYPE> — Admission Controller Custom Resource type
Possible values: CREATE

-m, --metadata-path <PATH> — File containing the metadata of the policy

-o, --output <FILE> — Path where the artifact-pkg.yml file will be stored

-q, --questions-path <PATH> — File containing the questions-ui content of the policy

-v, --version <VALUE> — Semver version of the policy

<URI_OR_SHA_PREFIX> — Policy URI or SHA prefix. Supported schemes: registry://, https://, file://. If schema is omitted, file:// is assumed, rooted on the current directory.

--allow-context-aware <ALLOW-CONTEXT-AWARE> — Uses the policy metadata to define which Kubernetes resources can be accessed by the policy. Warning: review the list of resources carefully to avoid abuses. Disabled by default

--cert-email <VALUE> — Expected email in Fulcio certificate

--cert-oidc-issuer <VALUE> — Expected OIDC issuer in Fulcio certificates

--docker-config-json-path <DOCKER_CONFIG> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

--fulcio-cert-path <PATH> — Path to the Fulcio certificate. Can be repeated multiple times

--github-owner <VALUE> — GitHub owner expected in the certificates generated in CD pipelines

--github-repo <VALUE> — GitHub repository expected in the certificates generated in CD pipelines

--rekor-public-key-path <PATH> — Path to the Rekor public key. Can be repeated multiple times

--settings-json <VALUE> — JSON string containing the settings for this policy

-s, --settings-path <PATH> — File containing the settings for this policy

--sigstore-trust-config <PATH> — JSON-formatted file conforming to the ClientTrustConfig message in the Sigstore protobuf specs. This file configures the entire Sigstore instance state, including the URIs used to access the CA and artifact transparency services as well as the cryptographic root of trust itself

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

--title <VALUE> — Policy title

-t, --type <VALUE> — Admission Controller Custom Resource type
Possible values: ClusterAdmissionPolicy, AdmissionPolicy

-a, --verification-annotation <KEY=VALUE> — Annotation in key=value format. Can be repeated multiple times

--verification-config-path <PATH> — YAML file holding verification config information (signatures, public keys…​)

-k, --verification-key <PATH> — Path to key used to verify the policy. Can be repeated multiple times

-b, --binding <VALIDATING-ADMISSION-POLICY-BINDING.yaml> — The file containing the ValidatingAdmissionPolicyBinding definition

--cel-policy <URI> — The CEL policy module to use
Default value: ghcr.io/kubewarden/policies/cel-policy:latest

-p, --policy <VALIDATING-ADMISSION-POLICY.yaml> — The file containing the ValidatingAdmissionPolicy definition

<URI> — Policy URI. Supported schemes: registry://

--cert-email <VALUE> — Expected email in Fulcio certificate

--cert-oidc-issuer <VALUE> — Expected OIDC issuer in Fulcio certificates

--docker-config-json-path <PATH> — Path to a directory containing the Docker 'config.json' file. Can be used to indicate registry authentication details

--github-owner <VALUE> — GitHub owner expected in the certificates generated in CD pipelines

--github-repo <VALUE> — GitHub repository expected in the certificates generated in CD pipelines

--sigstore-trust-config <PATH> — JSON-formatted file conforming to the ClientTrustConfig message in the Sigstore protobuf specs. This file configures the entire Sigstore instance state, including the URIs used to access the CA and artifact transparency services as well as the cryptographic root of trust itself

--sources-path <PATH> — YAML file holding source information (https, registry insecure hosts, custom CA’s…​)

-a, --verification-annotation <KEY=VALUE> — Annotation in key=value format. Can be repeated multiple times

--verification-config-path <PATH> — YAML file holding verification config information (signatures, public keys…​)

-k, --verification-key <PATH> — Path to key used to verify the policy. Can be repeated multiple times