added repo
This commit is contained in:
Your Name
@@ -0,0 +1,3 @@
|
||||
.helmignore
|
||||
ci/
|
||||
README.md.gotmpl
|
||||
@@ -0,0 +1,51 @@
|
||||
apiVersion: v2
|
||||
type: application
|
||||
name: kyverno
|
||||
version: 3.6.1
|
||||
appVersion: v1.16.1
|
||||
icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png
|
||||
description: Kubernetes Native Policy Management
|
||||
keywords:
|
||||
- kubernetes
|
||||
- nirmata
|
||||
- policy agent
|
||||
- policy
|
||||
- validating webhook
|
||||
- admission controller
|
||||
- mutation
|
||||
- mutate
|
||||
- validate
|
||||
- generate
|
||||
- supply chain
|
||||
- security
|
||||
home: https://kyverno.io/
|
||||
sources:
|
||||
- https://github.com/kyverno/kyverno
|
||||
maintainers:
|
||||
- name: Nirmata
|
||||
url: https://kyverno.io/
|
||||
kubeVersion: ">=1.25.0-0"
|
||||
annotations:
|
||||
artifacthub.io/operator: "false"
|
||||
artifacthub.io/prerelease: "false"
|
||||
artifacthub.io/links: |
|
||||
- name: Documentation
|
||||
url: https://kyverno.io/docs
|
||||
# valid kinds are: added, changed, deprecated, removed, fixed and security
|
||||
artifacthub.io/changes: |
|
||||
- kind: fixed
|
||||
description: Ensure spec.template.metadata isn't null
|
||||
- kind: removed
|
||||
description: Remove the `delete` permission for policyexceptions in the admission controller
|
||||
- kind: changed
|
||||
description: Enable the flag `--generateValidatingAdmissionPolicy` by default in the admission controller.
|
||||
- kind: changed
|
||||
description: Enable the flag `--validatingAdmissionPolicyReports` by default in the reports controller.
|
||||
dependencies:
|
||||
- name: crds
|
||||
version: 3.6.1
|
||||
condition: crds.install
|
||||
- name: openreports
|
||||
version: "0.1.0"
|
||||
repository: "https://openreports.github.io/reports-api"
|
||||
condition: openreports.installCrds
|
||||
@@ -0,0 +1,3 @@
|
||||
apiVersion: v2
|
||||
name: crds
|
||||
version: 3.6.1
|
||||
@@ -0,0 +1,18 @@
|
||||
# crds
|
||||
|
||||
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| reportsServer.enabled | bool | `false` | Kyverno reports-server is used in your cluster |
|
||||
| groups.kyverno | object | `{"cleanuppolicies":true,"clustercleanuppolicies":true,"clusterpolicies":true,"globalcontextentries":true,"policies":true,"policyexceptions":true,"updaterequests":true}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||
| groups.policies | object | `{"deletingpolicies":true,"generatingpolicies":true,"imagevalidatingpolicies":true,"mutatingpolicies":true,"namespaceddeletingpolicies":true,"namespacedimagevalidatingpolicies":true,"namespacedvalidatingpolicies":true,"policyexceptions":true,"validatingpolicies":true}` | Install CRDs in group `reports.kyverno.io` |
|
||||
| groups.reports | object | `{"clusterephemeralreports":true,"ephemeralreports":true}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||
| groups.wgpolicyk8s | object | `{"clusterpolicyreports":true,"policyreports":true}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||
| annotations | object | `{}` | This field can be overwritten by setting crds.annotations in the parent chart |
|
||||
| customLabels | object | `{}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||
|
||||
----------------------------------------------
|
||||
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
|
||||
@@ -0,0 +1,16 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.crds.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.crds.matchLabels" .)
|
||||
(toYaml .Values.customLabels)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.crds.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "crds")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
+2612
File diff suppressed because it is too large
Load Diff
+2612
File diff suppressed because it is too large
Load Diff
+20329
File diff suppressed because it is too large
Load Diff
+533
@@ -0,0 +1,533 @@
|
||||
{{- if .Values.groups.kyverno.globalcontextentries }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: globalcontextentries.kyverno.io
|
||||
spec:
|
||||
group: kyverno.io
|
||||
names:
|
||||
categories:
|
||||
- kyverno
|
||||
kind: GlobalContextEntry
|
||||
listKind: GlobalContextEntryList
|
||||
plural: globalcontextentries
|
||||
shortNames:
|
||||
- gctxentry
|
||||
singular: globalcontextentry
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .spec.apiCall.refreshInterval
|
||||
name: REFRESH INTERVAL
|
||||
type: string
|
||||
- jsonPath: .status.lastRefreshTime
|
||||
name: LAST REFRESH
|
||||
type: date
|
||||
name: v2alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GlobalContextEntry declares resources to be cached.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec declares policy exception behaviors.
|
||||
oneOf:
|
||||
- required:
|
||||
- kubernetesResource
|
||||
- required:
|
||||
- apiCall
|
||||
properties:
|
||||
apiCall:
|
||||
description: |-
|
||||
Stores results from an API call which will be cached.
|
||||
Mutually exclusive with KubernetesResource.
|
||||
This can be used to make calls to external (non-Kubernetes API server) services.
|
||||
It can also be used to make calls to the Kubernetes API server in such cases:
|
||||
1. A POST is needed to create a resource.
|
||||
2. Finer-grained control is needed. Example: To restrict the number of resources cached.
|
||||
properties:
|
||||
data:
|
||||
description: |-
|
||||
The data object specifies the POST data sent to the server.
|
||||
Only applicable when the method field is set to POST.
|
||||
items:
|
||||
description: RequestData contains the HTTP POST data
|
||||
properties:
|
||||
key:
|
||||
description: Key is a unique identifier for the data value
|
||||
type: string
|
||||
value:
|
||||
description: Value is the data value
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- key
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
method:
|
||||
default: GET
|
||||
description: Method is the HTTP request type (GET or POST). Defaults
|
||||
to GET.
|
||||
enum:
|
||||
- GET
|
||||
- POST
|
||||
type: string
|
||||
refreshInterval:
|
||||
default: 10m
|
||||
description: |-
|
||||
RefreshInterval defines the interval in duration at which to poll the APICall.
|
||||
The duration is a sequence of decimal numbers, each with optional fraction and a unit suffix,
|
||||
such as "300ms", "1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
|
||||
format: duration
|
||||
type: string
|
||||
retryLimit:
|
||||
default: 3
|
||||
description: RetryLimit defines the number of times the APICall
|
||||
should be retried in case of failure.
|
||||
minimum: 1
|
||||
type: integer
|
||||
service:
|
||||
description: |-
|
||||
Service is an API call to a JSON web service.
|
||||
This is used for non-Kubernetes API server calls.
|
||||
It's mutually exclusive with the URLPath field.
|
||||
properties:
|
||||
caBundle:
|
||||
description: |-
|
||||
CABundle is a PEM encoded CA bundle which will be used to validate
|
||||
the server certificate.
|
||||
type: string
|
||||
headers:
|
||||
description: Headers is a list of optional HTTP headers to
|
||||
be included in the request.
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
description: Key is the header key
|
||||
type: string
|
||||
value:
|
||||
description: Value is the header value
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
url:
|
||||
description: |-
|
||||
URL is the JSON web service URL. A typical form is
|
||||
`https://{service}.{namespace}:{port}/{path}`.
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
urlPath:
|
||||
description: |-
|
||||
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
||||
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
||||
The format required is the same format used by the `kubectl get --raw` command.
|
||||
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
||||
for details.
|
||||
It's mutually exclusive with the Service field.
|
||||
type: string
|
||||
type: object
|
||||
kubernetesResource:
|
||||
description: |-
|
||||
Stores a list of Kubernetes resources which will be cached.
|
||||
Mutually exclusive with APICall.
|
||||
properties:
|
||||
group:
|
||||
description: Group defines the group of the resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace defines the namespace of the resource. Leave empty for cluster scoped resources.
|
||||
If left empty for namespaced resources, all resources from all namespaces will be cached.
|
||||
type: string
|
||||
resource:
|
||||
description: |-
|
||||
Resource defines the type of the resource.
|
||||
Requires the pluralized form of the resource kind in lowercase. (Ex., "deployments")
|
||||
type: string
|
||||
version:
|
||||
description: Version defines the version of the resource.
|
||||
type: string
|
||||
required:
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
projections:
|
||||
description: Projections defines the list of JMESPath expressions
|
||||
to extract values from the cached resource.
|
||||
items:
|
||||
properties:
|
||||
jmesPath:
|
||||
description: JMESPath is the JMESPath expression to extract
|
||||
the value from the cached resource.
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name to use for the extracted value
|
||||
in the context.
|
||||
type: string
|
||||
required:
|
||||
- jmesPath
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: Status contains globalcontextentry runtime data.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
lastRefreshTime:
|
||||
description: Indicates the time when the globalcontextentry was last
|
||||
refreshed successfully for the API Call
|
||||
format: date-time
|
||||
type: string
|
||||
ready:
|
||||
description: Deprecated in favor of Conditions
|
||||
type: boolean
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .spec.apiCall.refreshInterval
|
||||
name: REFRESH INTERVAL
|
||||
type: string
|
||||
- jsonPath: .status.lastRefreshTime
|
||||
name: LAST REFRESH
|
||||
type: date
|
||||
name: v2beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GlobalContextEntry declares resources to be cached.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec declares policy exception behaviors.
|
||||
oneOf:
|
||||
- required:
|
||||
- kubernetesResource
|
||||
- required:
|
||||
- apiCall
|
||||
properties:
|
||||
apiCall:
|
||||
description: |-
|
||||
Stores results from an API call which will be cached.
|
||||
Mutually exclusive with KubernetesResource.
|
||||
This can be used to make calls to external (non-Kubernetes API server) services.
|
||||
It can also be used to make calls to the Kubernetes API server in such cases:
|
||||
1. A POST is needed to create a resource.
|
||||
2. Finer-grained control is needed. Example: To restrict the number of resources cached.
|
||||
properties:
|
||||
data:
|
||||
description: |-
|
||||
The data object specifies the POST data sent to the server.
|
||||
Only applicable when the method field is set to POST.
|
||||
items:
|
||||
description: RequestData contains the HTTP POST data
|
||||
properties:
|
||||
key:
|
||||
description: Key is a unique identifier for the data value
|
||||
type: string
|
||||
value:
|
||||
description: Value is the data value
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- key
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
method:
|
||||
default: GET
|
||||
description: Method is the HTTP request type (GET or POST). Defaults
|
||||
to GET.
|
||||
enum:
|
||||
- GET
|
||||
- POST
|
||||
type: string
|
||||
refreshInterval:
|
||||
default: 10m
|
||||
description: |-
|
||||
RefreshInterval defines the interval in duration at which to poll the APICall.
|
||||
The duration is a sequence of decimal numbers, each with optional fraction and a unit suffix,
|
||||
such as "300ms", "1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
|
||||
format: duration
|
||||
type: string
|
||||
retryLimit:
|
||||
default: 3
|
||||
description: RetryLimit defines the number of times the APICall
|
||||
should be retried in case of failure.
|
||||
minimum: 1
|
||||
type: integer
|
||||
service:
|
||||
description: |-
|
||||
Service is an API call to a JSON web service.
|
||||
This is used for non-Kubernetes API server calls.
|
||||
It's mutually exclusive with the URLPath field.
|
||||
properties:
|
||||
caBundle:
|
||||
description: |-
|
||||
CABundle is a PEM encoded CA bundle which will be used to validate
|
||||
the server certificate.
|
||||
type: string
|
||||
headers:
|
||||
description: Headers is a list of optional HTTP headers to
|
||||
be included in the request.
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
description: Key is the header key
|
||||
type: string
|
||||
value:
|
||||
description: Value is the header value
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
url:
|
||||
description: |-
|
||||
URL is the JSON web service URL. A typical form is
|
||||
`https://{service}.{namespace}:{port}/{path}`.
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
urlPath:
|
||||
description: |-
|
||||
URLPath is the URL path to be used in the HTTP GET or POST request to the
|
||||
Kubernetes API server (e.g. "/api/v1/namespaces" or "/apis/apps/v1/deployments").
|
||||
The format required is the same format used by the `kubectl get --raw` command.
|
||||
See https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-kubernetes-api-server-calls
|
||||
for details.
|
||||
It's mutually exclusive with the Service field.
|
||||
type: string
|
||||
type: object
|
||||
kubernetesResource:
|
||||
description: |-
|
||||
Stores a list of Kubernetes resources which will be cached.
|
||||
Mutually exclusive with APICall.
|
||||
properties:
|
||||
group:
|
||||
description: Group defines the group of the resource.
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace defines the namespace of the resource. Leave empty for cluster scoped resources.
|
||||
If left empty for namespaced resources, all resources from all namespaces will be cached.
|
||||
type: string
|
||||
resource:
|
||||
description: |-
|
||||
Resource defines the type of the resource.
|
||||
Requires the pluralized form of the resource kind in lowercase. (Ex., "deployments")
|
||||
type: string
|
||||
version:
|
||||
description: Version defines the version of the resource.
|
||||
type: string
|
||||
required:
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
projections:
|
||||
description: Projections defines the list of JMESPath expressions
|
||||
to extract values from the cached resource.
|
||||
items:
|
||||
properties:
|
||||
jmesPath:
|
||||
description: JMESPath is the JMESPath expression to extract
|
||||
the value from the cached resource.
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name to use for the extracted value
|
||||
in the context.
|
||||
type: string
|
||||
required:
|
||||
- jmesPath
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
status:
|
||||
description: Status contains globalcontextentry runtime data.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
lastRefreshTime:
|
||||
description: Indicates the time when the globalcontextentry was last
|
||||
refreshed successfully for the API Call
|
||||
format: date-time
|
||||
type: string
|
||||
ready:
|
||||
description: Deprecated in favor of Conditions
|
||||
type: boolean
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
+1308
File diff suppressed because it is too large
Load Diff
+844
@@ -0,0 +1,844 @@
|
||||
{{- if .Values.groups.kyverno.updaterequests }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: updaterequests.kyverno.io
|
||||
spec:
|
||||
group: kyverno.io
|
||||
names:
|
||||
categories:
|
||||
- kyverno
|
||||
kind: UpdateRequest
|
||||
listKind: UpdateRequestList
|
||||
plural: updaterequests
|
||||
shortNames:
|
||||
- ur
|
||||
singular: updaterequest
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
type: string
|
||||
- jsonPath: .spec.rule
|
||||
name: Rule
|
||||
type: string
|
||||
- jsonPath: .spec.requestType
|
||||
name: RuleType
|
||||
type: string
|
||||
- jsonPath: .spec.resource.kind
|
||||
name: ResourceKind
|
||||
type: string
|
||||
- jsonPath: .spec.resource.name
|
||||
name: ResourceName
|
||||
type: string
|
||||
- jsonPath: .spec.resource.namespace
|
||||
name: ResourceNamespace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
deprecated: true
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UpdateRequest is a request to process mutate and generate rules
|
||||
in background.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ResourceSpec is the information to identify the trigger resource.
|
||||
properties:
|
||||
context:
|
||||
description: Context ...
|
||||
properties:
|
||||
admissionRequestInfo:
|
||||
description: AdmissionRequestInfoObject stores the admission request
|
||||
and operation details
|
||||
properties:
|
||||
admissionRequest:
|
||||
description: AdmissionRequest describes the admission.Attributes
|
||||
for the admission request.
|
||||
properties:
|
||||
dryRun:
|
||||
description: |-
|
||||
DryRun indicates that modifications will definitely not be persisted for this request.
|
||||
Defaults to false.
|
||||
type: boolean
|
||||
kind:
|
||||
description: Kind is the fully-qualified type of object
|
||||
being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace is the namespace associated with
|
||||
the request (if any).
|
||||
type: string
|
||||
object:
|
||||
description: Object is the object from the incoming request.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
oldObject:
|
||||
description: OldObject is the existing object. Only populated
|
||||
for DELETE and UPDATE requests.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
operation:
|
||||
description: |-
|
||||
Operation is the operation being performed. This may be different than the operation
|
||||
requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
type: string
|
||||
options:
|
||||
description: |-
|
||||
Options is the operation option structure of the operation being performed.
|
||||
e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
different than the options the caller provided. e.g. for a patch request the performed
|
||||
Operation might be a CREATE, in which case the Options will a
|
||||
`meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
requestKind:
|
||||
description: |-
|
||||
RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
requestResource:
|
||||
description: |-
|
||||
RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
requestSubResource:
|
||||
description: |-
|
||||
RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
type: string
|
||||
resource:
|
||||
description: Resource is the fully-qualified resource
|
||||
being requested (for example, v1.pods)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
subResource:
|
||||
description: SubResource is the subresource being requested,
|
||||
if any (for example, "status" or "scale")
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
type: string
|
||||
userInfo:
|
||||
description: UserInfo is information about the requesting
|
||||
user
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by
|
||||
the authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part
|
||||
of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this
|
||||
user among all active users.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- kind
|
||||
- operation
|
||||
- resource
|
||||
- uid
|
||||
- userInfo
|
||||
type: object
|
||||
operation:
|
||||
description: Operation is the type of resource operation being
|
||||
checked for admission control
|
||||
type: string
|
||||
type: object
|
||||
userInfo:
|
||||
description: RequestInfo contains permission info carried in an
|
||||
admission request.
|
||||
properties:
|
||||
clusterRoles:
|
||||
description: ClusterRoles is a list of possible clusterRoles
|
||||
send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
roles:
|
||||
description: Roles is a list of possible role send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
userInfo:
|
||||
description: UserInfo is the userInfo carried in the admission
|
||||
request.
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by the
|
||||
authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this user
|
||||
among all active users.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
deleteDownstream:
|
||||
description: DeleteDownstream represents whether the downstream needs
|
||||
to be deleted.
|
||||
type: boolean
|
||||
policy:
|
||||
description: Specifies the name of the policy.
|
||||
type: string
|
||||
requestType:
|
||||
description: Type represents request type for background processing
|
||||
enum:
|
||||
- mutate
|
||||
- generate
|
||||
type: string
|
||||
resource:
|
||||
description: ResourceSpec is the information to identify the trigger
|
||||
resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
rule:
|
||||
description: Rule is the associate rule name of the current UR.
|
||||
type: string
|
||||
synchronize:
|
||||
description: |-
|
||||
Synchronize represents the sync behavior of the corresponding rule
|
||||
Optional. Defaults to "false" if not specified.
|
||||
type: boolean
|
||||
required:
|
||||
- context
|
||||
- deleteDownstream
|
||||
- policy
|
||||
- resource
|
||||
- rule
|
||||
type: object
|
||||
status:
|
||||
description: Status contains statistics related to update request.
|
||||
properties:
|
||||
generatedResources:
|
||||
description: |-
|
||||
This will track the resources that are updated by the generate Policy.
|
||||
Will be used during clean up resources.
|
||||
items:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
handler:
|
||||
description: Deprecated
|
||||
type: string
|
||||
message:
|
||||
description: Specifies request status message.
|
||||
type: string
|
||||
retryCount:
|
||||
type: integer
|
||||
state:
|
||||
description: State represents state of the update request.
|
||||
type: string
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: false
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.policy
|
||||
name: Policy
|
||||
type: string
|
||||
- jsonPath: .spec.requestType
|
||||
name: RuleType
|
||||
type: string
|
||||
- jsonPath: .spec.resource.kind
|
||||
name: ResourceKind
|
||||
type: string
|
||||
- jsonPath: .spec.resource.name
|
||||
name: ResourceName
|
||||
type: string
|
||||
- jsonPath: .spec.resource.namespace
|
||||
name: ResourceNamespace
|
||||
type: string
|
||||
- jsonPath: .status.state
|
||||
name: status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UpdateRequest is a request to process mutate and generate rules
|
||||
in background.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ResourceSpec is the information to identify the trigger resource.
|
||||
properties:
|
||||
context:
|
||||
description: |-
|
||||
Context represents admission request context.
|
||||
It is used upon admission review only and is shared across rules within the same UR.
|
||||
properties:
|
||||
admissionRequestInfo:
|
||||
description: AdmissionRequestInfoObject stores the admission request
|
||||
and operation details
|
||||
properties:
|
||||
admissionRequest:
|
||||
description: AdmissionRequest describes the admission.Attributes
|
||||
for the admission request.
|
||||
properties:
|
||||
dryRun:
|
||||
description: |-
|
||||
DryRun indicates that modifications will definitely not be persisted for this request.
|
||||
Defaults to false.
|
||||
type: boolean
|
||||
kind:
|
||||
description: Kind is the fully-qualified type of object
|
||||
being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and
|
||||
rely on the server to generate the name. If that is the case, this field will contain an empty string.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace is the namespace associated with
|
||||
the request (if any).
|
||||
type: string
|
||||
object:
|
||||
description: Object is the object from the incoming request.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
oldObject:
|
||||
description: OldObject is the existing object. Only populated
|
||||
for DELETE and UPDATE requests.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
operation:
|
||||
description: |-
|
||||
Operation is the operation being performed. This may be different than the operation
|
||||
requested. e.g. a patch can result in either a CREATE or UPDATE Operation.
|
||||
type: string
|
||||
options:
|
||||
description: |-
|
||||
Options is the operation option structure of the operation being performed.
|
||||
e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be
|
||||
different than the options the caller provided. e.g. for a patch request the performed
|
||||
Operation might be a CREATE, in which case the Options will a
|
||||
`meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||
type: object
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
requestKind:
|
||||
description: |-
|
||||
RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale).
|
||||
If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),
|
||||
and `requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"}` (indicating the kind of the original API request).
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type for more details.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- version
|
||||
type: object
|
||||
requestResource:
|
||||
description: |-
|
||||
RequestResource is the fully-qualified resource of the original API request (for example, v1.pods).
|
||||
If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.
|
||||
|
||||
For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of
|
||||
`apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
|
||||
an API request to apps/v1beta1 deployments would be converted and sent to the webhook
|
||||
with `resource: {group:"apps", version:"v1", resource:"deployments"}` (matching the resource the webhook registered for),
|
||||
and `requestResource: {group:"apps", version:"v1beta1", resource:"deployments"}` (indicating the resource of the original API request).
|
||||
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
requestSubResource:
|
||||
description: |-
|
||||
RequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale")
|
||||
If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed.
|
||||
See documentation for the "matchPolicy" field in the webhook configuration type.
|
||||
type: string
|
||||
resource:
|
||||
description: Resource is the fully-qualified resource
|
||||
being requested (for example, v1.pods)
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
resource:
|
||||
type: string
|
||||
version:
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- resource
|
||||
- version
|
||||
type: object
|
||||
subResource:
|
||||
description: SubResource is the subresource being requested,
|
||||
if any (for example, "status" or "scale")
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are
|
||||
otherwise identical (parallel requests, requests when earlier requests did not modify etc)
|
||||
The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request.
|
||||
It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.
|
||||
type: string
|
||||
userInfo:
|
||||
description: UserInfo is information about the requesting
|
||||
user
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by
|
||||
the authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part
|
||||
of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this
|
||||
user among all active users.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- kind
|
||||
- operation
|
||||
- resource
|
||||
- uid
|
||||
- userInfo
|
||||
type: object
|
||||
operation:
|
||||
description: Operation is the type of resource operation being
|
||||
checked for admission control
|
||||
type: string
|
||||
type: object
|
||||
userInfo:
|
||||
description: RequestInfo contains permission info carried in an
|
||||
admission request.
|
||||
properties:
|
||||
clusterRoles:
|
||||
description: ClusterRoles is a list of possible clusterRoles
|
||||
send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
roles:
|
||||
description: Roles is a list of possible role send the request.
|
||||
items:
|
||||
type: string
|
||||
nullable: true
|
||||
type: array
|
||||
synchronize:
|
||||
description: |-
|
||||
DryRun indicates that modifications will definitely not be persisted for this request.
|
||||
Defaults to false.
|
||||
type: boolean
|
||||
userInfo:
|
||||
description: UserInfo is the userInfo carried in the admission
|
||||
request.
|
||||
properties:
|
||||
extra:
|
||||
additionalProperties:
|
||||
description: ExtraValue masks the value so protobuf
|
||||
can generate
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
description: Any additional information provided by the
|
||||
authenticator.
|
||||
type: object
|
||||
groups:
|
||||
description: The names of groups this user is a part of.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
uid:
|
||||
description: |-
|
||||
A unique value that identifies this user across time. If this user is
|
||||
deleted and another user by the same name is added, they will have
|
||||
different UIDs.
|
||||
type: string
|
||||
username:
|
||||
description: The name that uniquely identifies this user
|
||||
among all active users.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
deleteDownstream:
|
||||
description: |-
|
||||
DeleteDownstream represents whether the downstream needs to be deleted.
|
||||
Deprecated
|
||||
type: boolean
|
||||
policy:
|
||||
description: Specifies the name of the policy.
|
||||
type: string
|
||||
requestType:
|
||||
description: Type represents request type for background processing
|
||||
enum:
|
||||
- mutate
|
||||
- generate
|
||||
- cel-generate
|
||||
- cel-mutate
|
||||
type: string
|
||||
resource:
|
||||
description: ResourceSpec is the information to identify the trigger
|
||||
resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
rule:
|
||||
description: Rule is the associate rule name of the current UR.
|
||||
type: string
|
||||
ruleContext:
|
||||
description: |-
|
||||
RuleContext is the associate context to apply rules.
|
||||
optional
|
||||
items:
|
||||
properties:
|
||||
cacheRestore:
|
||||
description: CacheRestore indicates whether the cache should
|
||||
be restored.
|
||||
type: boolean
|
||||
deleteDownstream:
|
||||
description: DeleteDownstream represents whether the downstream
|
||||
needs to be deleted.
|
||||
type: boolean
|
||||
rule:
|
||||
description: Rule is the associate rule name of the current
|
||||
UR.
|
||||
type: string
|
||||
synchronize:
|
||||
description: |-
|
||||
Synchronize represents the sync behavior of the corresponding rule
|
||||
Optional. Defaults to "false" if not specified.
|
||||
type: boolean
|
||||
trigger:
|
||||
description: ResourceSpec is the information to identify the
|
||||
trigger resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- deleteDownstream
|
||||
- rule
|
||||
- trigger
|
||||
type: object
|
||||
type: array
|
||||
synchronize:
|
||||
description: |-
|
||||
Synchronize represents the sync behavior of the corresponding rule
|
||||
Optional. Defaults to "false" if not specified.
|
||||
Deprecated, will be removed in 1.14.
|
||||
type: boolean
|
||||
required:
|
||||
- context
|
||||
- deleteDownstream
|
||||
- policy
|
||||
- resource
|
||||
- rule
|
||||
type: object
|
||||
status:
|
||||
description: Status contains statistics related to update request.
|
||||
properties:
|
||||
generatedResources:
|
||||
description: |-
|
||||
This will track the resources that are updated by the generate Policy.
|
||||
Will be used during clean up resources.
|
||||
items:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: APIVersion specifies resource apiVersion.
|
||||
type: string
|
||||
kind:
|
||||
description: Kind specifies resource kind.
|
||||
type: string
|
||||
name:
|
||||
description: Name specifies the resource name.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies resource namespace.
|
||||
type: string
|
||||
uid:
|
||||
description: UID specifies the resource uid.
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
message:
|
||||
description: Specifies request status message.
|
||||
type: string
|
||||
retryCount:
|
||||
type: integer
|
||||
state:
|
||||
description: State represents state of the update request.
|
||||
type: string
|
||||
required:
|
||||
- state
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
+1131
File diff suppressed because it is too large
Load Diff
+1257
File diff suppressed because it is too large
Load Diff
+4615
File diff suppressed because it is too large
Load Diff
+4146
File diff suppressed because it is too large
Load Diff
+579
@@ -0,0 +1,579 @@
|
||||
{{- if .Values.groups.policies.namespaceddeletingpolicies }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: namespaceddeletingpolicies.policies.kyverno.io
|
||||
spec:
|
||||
group: policies.kyverno.io
|
||||
names:
|
||||
categories:
|
||||
- kyverno
|
||||
kind: NamespacedDeletingPolicy
|
||||
listKind: NamespacedDeletingPolicyList
|
||||
plural: namespaceddeletingpolicies
|
||||
shortNames:
|
||||
- ndpol
|
||||
singular: namespaceddeletingpolicy
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .status.conditionStatus.ready
|
||||
name: READY
|
||||
type: string
|
||||
name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: DeletingPolicySpec is the specification of the desired behavior
|
||||
of the DeletingPolicy.
|
||||
properties:
|
||||
conditions:
|
||||
description: |-
|
||||
Conditions is a list of conditions that must be met for a resource to be deleted.
|
||||
Conditions filter resources that have already been matched by the match constraints,
|
||||
namespaceSelector, and objectSelector. An empty list of conditions matches all resources.
|
||||
There are a maximum of 64 conditions allowed.
|
||||
|
||||
The exact matching logic is (in order):
|
||||
1. If ANY condition evaluates to FALSE, the policy is skipped.
|
||||
2. If ALL conditions evaluate to TRUE, the policy is executed.
|
||||
items:
|
||||
description: MatchCondition represents a condition which must by
|
||||
fulfilled for a request to be sent to a webhook.
|
||||
properties:
|
||||
expression:
|
||||
description: |-
|
||||
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
|
||||
'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
||||
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
request resource.
|
||||
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
||||
|
||||
Required.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
the associated expression.
|
||||
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
||||
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
||||
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
||||
|
||||
Required.
|
||||
type: string
|
||||
required:
|
||||
- expression
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
deletionPropagationPolicy:
|
||||
description: DeletionPropagationPolicy defines how resources will
|
||||
be deleted (Foreground, Background, Orphan).
|
||||
enum:
|
||||
- Foreground
|
||||
- Background
|
||||
- Orphan
|
||||
type: string
|
||||
matchConstraints:
|
||||
description: |-
|
||||
MatchConstraints specifies what resources this policy is designed to validate.
|
||||
The AdmissionPolicy cares about a request if it matches _all_ Constraints.
|
||||
Required.
|
||||
properties:
|
||||
excludeResourceRules:
|
||||
description: |-
|
||||
ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.
|
||||
The exclude rules take precedence over include rules (if a resource matches both, it is excluded)
|
||||
items:
|
||||
description: NamedRuleWithOperations is a tuple of Operations
|
||||
and Resources with ResourceNames.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the API groups the resources belong to. '*' is all groups.
|
||||
If '*' is present, the length of the slice must be one.
|
||||
Required.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
apiVersions:
|
||||
description: |-
|
||||
APIVersions is the API versions the resources belong to. '*' is all versions.
|
||||
If '*' is present, the length of the slice must be one.
|
||||
Required.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
operations:
|
||||
description: |-
|
||||
Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
|
||||
for all of those operations and any future admission operations that are added.
|
||||
If '*' is present, the length of the slice must be one.
|
||||
Required.
|
||||
items:
|
||||
description: OperationType specifies an operation for
|
||||
a request.
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of
|
||||
names that the rule applies to. An empty set means that
|
||||
everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
resources:
|
||||
description: |-
|
||||
Resources is a list of resources this rule applies to.
|
||||
|
||||
For example:
|
||||
'pods' means pods.
|
||||
'pods/log' means the log subresource of pods.
|
||||
'*' means all resources, but not subresources.
|
||||
'pods/*' means all subresources of pods.
|
||||
'*/scale' means all scale subresources.
|
||||
'*/*' means all resources and their subresources.
|
||||
|
||||
If wildcard is present, the validation rule will ensure resources do not
|
||||
overlap with each other.
|
||||
|
||||
Depending on the enclosing object, subresources might not be allowed.
|
||||
Required.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
scope:
|
||||
description: |-
|
||||
scope specifies the scope of this rule.
|
||||
Valid values are "Cluster", "Namespaced", and "*"
|
||||
"Cluster" means that only cluster-scoped resources will match this rule.
|
||||
Namespace API objects are cluster-scoped.
|
||||
"Namespaced" means that only namespaced resources will match this rule.
|
||||
"*" means that there are no scope restrictions.
|
||||
Subresources match the scope of their parent resource.
|
||||
Default is "*".
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchPolicy:
|
||||
description: |-
|
||||
matchPolicy defines how the "MatchResources" list is used to match incoming requests.
|
||||
Allowed values are "Exact" or "Equivalent".
|
||||
|
||||
- Exact: match a request only if it exactly matches a specified rule.
|
||||
For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
|
||||
but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
|
||||
a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.
|
||||
|
||||
- Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
|
||||
For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
|
||||
and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
|
||||
a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.
|
||||
|
||||
Defaults to "Equivalent"
|
||||
type: string
|
||||
namespaceSelector:
|
||||
description: |-
|
||||
NamespaceSelector decides whether to run the admission control policy on an object based
|
||||
on whether the namespace for that object matches the selector. If the
|
||||
object itself is a namespace, the matching is performed on
|
||||
object.metadata.labels. If the object is another cluster scoped resource,
|
||||
it never skips the policy.
|
||||
|
||||
For example, to run the webhook on any objects whose namespace is not
|
||||
associated with "runlevel" of "0" or "1"; you will set the selector as
|
||||
follows:
|
||||
"namespaceSelector": {
|
||||
"matchExpressions": [
|
||||
{
|
||||
"key": "runlevel",
|
||||
"operator": "NotIn",
|
||||
"values": [
|
||||
"0",
|
||||
"1"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
If instead you want to only run the policy on any objects whose
|
||||
namespace is associated with the "environment" of "prod" or "staging";
|
||||
you will set the selector as follows:
|
||||
"namespaceSelector": {
|
||||
"matchExpressions": [
|
||||
{
|
||||
"key": "environment",
|
||||
"operator": "In",
|
||||
"values": [
|
||||
"prod",
|
||||
"staging"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
See
|
||||
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
for more examples of label selectors.
|
||||
|
||||
Default to the empty LabelSelector, which matches everything.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
objectSelector:
|
||||
description: |-
|
||||
ObjectSelector decides whether to run the validation based on if the
|
||||
object has matching labels. objectSelector is evaluated against both
|
||||
the oldObject and newObject that would be sent to the cel validation, and
|
||||
is considered to match if either object matches the selector. A null
|
||||
object (oldObject in the case of create, or newObject in the case of
|
||||
delete) or an object that cannot have labels (like a
|
||||
DeploymentRollback or a PodProxyOptions object) is not considered to
|
||||
match.
|
||||
Use the object selector only if the webhook is opt-in, because end
|
||||
users may skip the admission webhook by setting the labels.
|
||||
Default to the empty LabelSelector, which matches everything.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
resourceRules:
|
||||
description: |-
|
||||
ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.
|
||||
The policy cares about an operation if it matches _any_ Rule.
|
||||
items:
|
||||
description: NamedRuleWithOperations is a tuple of Operations
|
||||
and Resources with ResourceNames.
|
||||
properties:
|
||||
apiGroups:
|
||||
description: |-
|
||||
APIGroups is the API groups the resources belong to. '*' is all groups.
|
||||
If '*' is present, the length of the slice must be one.
|
||||
Required.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
apiVersions:
|
||||
description: |-
|
||||
APIVersions is the API versions the resources belong to. '*' is all versions.
|
||||
If '*' is present, the length of the slice must be one.
|
||||
Required.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
operations:
|
||||
description: |-
|
||||
Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
|
||||
for all of those operations and any future admission operations that are added.
|
||||
If '*' is present, the length of the slice must be one.
|
||||
Required.
|
||||
items:
|
||||
description: OperationType specifies an operation for
|
||||
a request.
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
resourceNames:
|
||||
description: ResourceNames is an optional white list of
|
||||
names that the rule applies to. An empty set means that
|
||||
everything is allowed.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
resources:
|
||||
description: |-
|
||||
Resources is a list of resources this rule applies to.
|
||||
|
||||
For example:
|
||||
'pods' means pods.
|
||||
'pods/log' means the log subresource of pods.
|
||||
'*' means all resources, but not subresources.
|
||||
'pods/*' means all subresources of pods.
|
||||
'*/scale' means all scale subresources.
|
||||
'*/*' means all resources and their subresources.
|
||||
|
||||
If wildcard is present, the validation rule will ensure resources do not
|
||||
overlap with each other.
|
||||
|
||||
Depending on the enclosing object, subresources might not be allowed.
|
||||
Required.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
scope:
|
||||
description: |-
|
||||
scope specifies the scope of this rule.
|
||||
Valid values are "Cluster", "Namespaced", and "*"
|
||||
"Cluster" means that only cluster-scoped resources will match this rule.
|
||||
Namespace API objects are cluster-scoped.
|
||||
"Namespaced" means that only namespaced resources will match this rule.
|
||||
"*" means that there are no scope restrictions.
|
||||
Subresources match the scope of their parent resource.
|
||||
Default is "*".
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
schedule:
|
||||
description: |-
|
||||
The schedule in Cron format
|
||||
Required.
|
||||
type: string
|
||||
variables:
|
||||
description: |-
|
||||
Variables contain definitions of variables that can be used in composition of other expressions.
|
||||
Each variable is defined as a named CEL expression.
|
||||
The variables defined here will be available under `variables` in other expressions of the policy
|
||||
except MatchConditions because MatchConditions are evaluated before the rest of the policy.
|
||||
|
||||
The expression of a variable can refer to other variables defined earlier in the list but not those after.
|
||||
Thus, Variables must be sorted by the order of first appearance and acyclic.
|
||||
items:
|
||||
description: Variable is the definition of a variable that is used
|
||||
for composition. A variable is defined as a named expression.
|
||||
properties:
|
||||
expression:
|
||||
description: |-
|
||||
Expression is the expression that will be evaluated as the value of the variable.
|
||||
The CEL expression has access to the same identifiers as the CEL expressions in Validation.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the variable. The name must be a valid CEL identifier and unique among all variables.
|
||||
The variable can be accessed in other expressions through `variables`
|
||||
For example, if name is "foo", the variable will be available as `variables.foo`
|
||||
type: string
|
||||
required:
|
||||
- expression
|
||||
- name
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
required:
|
||||
- schedule
|
||||
type: object
|
||||
status:
|
||||
description: Status contains policy runtime data.
|
||||
properties:
|
||||
conditionStatus:
|
||||
description: ConditionStatus is the shared status across all policy
|
||||
types
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: Condition contains details for one aspect of the
|
||||
current state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False,
|
||||
Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
message:
|
||||
description: |-
|
||||
Message is a human readable message indicating details about the generation of ValidatingAdmissionPolicy/MutatingAdmissionPolicy
|
||||
It is an empty string when ValidatingAdmissionPolicy/MutatingAdmissionPolicy is successfully generated.
|
||||
type: string
|
||||
ready:
|
||||
description: |-
|
||||
The ready of a policy is a high-level summary of where the policy is in its lifecycle.
|
||||
The conditions array, the reason and message fields contain more detail about the policy's status.
|
||||
type: boolean
|
||||
type: object
|
||||
lastExecutionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
+2321
File diff suppressed because it is too large
Load Diff
+1589
File diff suppressed because it is too large
Load Diff
+249
@@ -0,0 +1,249 @@
|
||||
{{- if .Values.groups.policies.policyexceptions }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: policyexceptions.policies.kyverno.io
|
||||
spec:
|
||||
group: policies.kyverno.io
|
||||
names:
|
||||
kind: PolicyException
|
||||
listKind: PolicyExceptionList
|
||||
plural: policyexceptions
|
||||
singular: policyexception
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PolicyException declares resources to be excluded from specified
|
||||
policies.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec declares policy exception behaviors.
|
||||
properties:
|
||||
allowedValues:
|
||||
description: |-
|
||||
AllowedValues specifies values that can be used in CEL expressions to bypass policy checks.
|
||||
These values can be referenced in CEL expressions via `exceptions.allowedValues`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
images:
|
||||
description: |-
|
||||
Images specifies container images to be excluded from policy evaluation.
|
||||
These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchConditions:
|
||||
description: MatchConditions is a list of CEL expressions that must
|
||||
be met for a resource to be excluded.
|
||||
items:
|
||||
description: MatchCondition represents a condition which must by
|
||||
fulfilled for a request to be sent to a webhook.
|
||||
properties:
|
||||
expression:
|
||||
description: |-
|
||||
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
|
||||
'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
||||
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
request resource.
|
||||
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
||||
|
||||
Required.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
the associated expression.
|
||||
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
||||
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
||||
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
||||
|
||||
Required.
|
||||
type: string
|
||||
required:
|
||||
- expression
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
policyRefs:
|
||||
description: PolicyRefs identifies the policies to which the exception
|
||||
is applied.
|
||||
items:
|
||||
properties:
|
||||
kind:
|
||||
description: Kind is the kind of the policy
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the policy
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
reportResult:
|
||||
default: skip
|
||||
description: |-
|
||||
ReportResult indicates whether the policy exception should be reported in the policy report
|
||||
as a skip result or pass result. Defaults to "skip".
|
||||
enum:
|
||||
- skip
|
||||
- pass
|
||||
type: string
|
||||
required:
|
||||
- policyRefs
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
- name: v1beta1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PolicyException declares resources to be excluded from specified
|
||||
policies.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec declares policy exception behaviors.
|
||||
properties:
|
||||
allowedValues:
|
||||
description: |-
|
||||
AllowedValues specifies values that can be used in CEL expressions to bypass policy checks.
|
||||
These values can be referenced in CEL expressions via `exceptions.allowedValues`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
images:
|
||||
description: |-
|
||||
Images specifies container images to be excluded from policy evaluation.
|
||||
These excluded images can be referenced in CEL expressions via `exceptions.allowedImages`.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchConditions:
|
||||
description: MatchConditions is a list of CEL expressions that must
|
||||
be met for a resource to be excluded.
|
||||
items:
|
||||
description: MatchCondition represents a condition which must by
|
||||
fulfilled for a request to be sent to a webhook.
|
||||
properties:
|
||||
expression:
|
||||
description: |-
|
||||
Expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
|
||||
CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:
|
||||
|
||||
'object' - The object from the incoming request. The value is null for DELETE requests.
|
||||
'oldObject' - The existing object. The value is null for CREATE requests.
|
||||
'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
|
||||
'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
|
||||
See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
|
||||
'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
|
||||
request resource.
|
||||
Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/
|
||||
|
||||
Required.
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is an identifier for this match condition, used for strategic merging of MatchConditions,
|
||||
as well as providing an identifier for logging purposes. A good name should be descriptive of
|
||||
the associated expression.
|
||||
Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
|
||||
must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or
|
||||
'123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
|
||||
optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')
|
||||
|
||||
Required.
|
||||
type: string
|
||||
required:
|
||||
- expression
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
policyRefs:
|
||||
description: PolicyRefs identifies the policies to which the exception
|
||||
is applied.
|
||||
items:
|
||||
properties:
|
||||
kind:
|
||||
description: Kind is the kind of the policy
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the policy
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
reportResult:
|
||||
default: skip
|
||||
description: |-
|
||||
ReportResult indicates whether the policy exception should be reported in the policy report
|
||||
as a skip result or pass result. Defaults to "skip".
|
||||
enum:
|
||||
- skip
|
||||
- pass
|
||||
type: string
|
||||
required:
|
||||
- policyRefs
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: false
|
||||
{{- end }}
|
||||
+3151
File diff suppressed because it is too large
Load Diff
+344
@@ -0,0 +1,344 @@
|
||||
{{- if and .Values.groups.reports.clusterephemeralreports (not .Values.reportsServer.enabled) }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: clusterephemeralreports.reports.kyverno.io
|
||||
spec:
|
||||
group: reports.kyverno.io
|
||||
names:
|
||||
categories:
|
||||
- kyverno
|
||||
kind: ClusterEphemeralReport
|
||||
listKind: ClusterEphemeralReportList
|
||||
plural: clusterephemeralreports
|
||||
shortNames:
|
||||
- cephr
|
||||
singular: clusterephemeralreport
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/source']
|
||||
name: Source
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.group']
|
||||
name: Group
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.kind']
|
||||
name: Kind
|
||||
type: string
|
||||
- jsonPath: .metadata.annotations['audit\.kyverno\.io/resource\.name']
|
||||
name: Owner
|
||||
type: string
|
||||
- jsonPath: .spec.summary.pass
|
||||
name: Pass
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.fail
|
||||
name: Fail
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.warn
|
||||
name: Warn
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.error
|
||||
name: Error
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.skip
|
||||
name: Skip
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.uid']
|
||||
name: Uid
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||
name: Hash
|
||||
priority: 1
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterEphemeralReport is the Schema for the ClusterEphemeralReports
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
owner:
|
||||
description: Owner is a reference to the report owner (e.g. a Deployment,
|
||||
Namespace, or Node)
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
blockOwnerDeletion:
|
||||
description: |-
|
||||
If true, AND if the owner has the "foregroundDeletion" finalizer, then
|
||||
the owner cannot be deleted from the key-value store until this
|
||||
reference is removed.
|
||||
See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||
for how the garbage collector interacts with this field and enforces the foreground deletion.
|
||||
Defaults to false.
|
||||
To set this field, a user needs "delete" permission of the owner,
|
||||
otherwise 422 (Unprocessable Entity) will be returned.
|
||||
type: boolean
|
||||
controller:
|
||||
description: If true, this reference points to the managing controller.
|
||||
type: boolean
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
|
||||
type: string
|
||||
required:
|
||||
- apiVersion
|
||||
- kind
|
||||
- name
|
||||
- uid
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
results:
|
||||
description: PolicyReportResult provides result details
|
||||
items:
|
||||
description: ReportResult provides the result for an individual
|
||||
policy
|
||||
properties:
|
||||
category:
|
||||
description: Category indicates policy category
|
||||
type: string
|
||||
message:
|
||||
description: Description is a short user friendly message for
|
||||
the policy rule
|
||||
type: string
|
||||
policy:
|
||||
description: Policy is the name or identifier of the policy
|
||||
type: string
|
||||
properties:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Properties provides additional information for
|
||||
the policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: |-
|
||||
ResourceSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a ResourceSelector can be specified. If neither are provided, the
|
||||
result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
resources:
|
||||
description: Subjects is an optional reference to the checked
|
||||
Kubernetes resources
|
||||
items:
|
||||
description: ObjectReference contains enough information to
|
||||
let you inspect or modify the referred object.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
result:
|
||||
description: Result indicates the outcome of the policy rule
|
||||
execution
|
||||
enum:
|
||||
- pass
|
||||
- fail
|
||||
- warn
|
||||
- error
|
||||
- skip
|
||||
type: string
|
||||
rule:
|
||||
description: Rule is the name or identifier of the rule within
|
||||
the policy
|
||||
type: string
|
||||
scored:
|
||||
description: Scored indicates if this result is scored
|
||||
type: boolean
|
||||
severity:
|
||||
description: Severity indicates policy check result criticality
|
||||
enum:
|
||||
- critical
|
||||
- high
|
||||
- low
|
||||
- medium
|
||||
- info
|
||||
type: string
|
||||
source:
|
||||
description: |-
|
||||
Source is an identifier for the policy engine that manages this report
|
||||
If the Source is specified at this level, it will override the Source
|
||||
field set at the Report level
|
||||
type: string
|
||||
timestamp:
|
||||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
- nanos
|
||||
- seconds
|
||||
type: object
|
||||
required:
|
||||
- policy
|
||||
type: object
|
||||
type: array
|
||||
summary:
|
||||
description: PolicyReportSummary provides a summary of results
|
||||
properties:
|
||||
error:
|
||||
description: Error provides the count of policies that could not
|
||||
be evaluated
|
||||
type: integer
|
||||
fail:
|
||||
description: Fail provides the count of policies whose requirements
|
||||
were not met
|
||||
type: integer
|
||||
pass:
|
||||
description: Pass provides the count of policies whose requirements
|
||||
were met
|
||||
type: integer
|
||||
skip:
|
||||
description: Skip indicates the count of policies that were not
|
||||
selected for evaluation
|
||||
type: integer
|
||||
warn:
|
||||
description: Warn provides the count of non-scored policies whose
|
||||
requirements were not met
|
||||
type: integer
|
||||
type: object
|
||||
required:
|
||||
- owner
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
{{- end }}
|
||||
+344
@@ -0,0 +1,344 @@
|
||||
{{- if and .Values.groups.reports.ephemeralreports (not .Values.reportsServer.enabled) }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: ephemeralreports.reports.kyverno.io
|
||||
spec:
|
||||
group: reports.kyverno.io
|
||||
names:
|
||||
categories:
|
||||
- kyverno
|
||||
kind: EphemeralReport
|
||||
listKind: EphemeralReportList
|
||||
plural: ephemeralreports
|
||||
shortNames:
|
||||
- ephr
|
||||
singular: ephemeralreport
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/source']
|
||||
name: Source
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.group']
|
||||
name: Group
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.kind']
|
||||
name: Kind
|
||||
type: string
|
||||
- jsonPath: .metadata.annotations['audit\.kyverno\.io/resource\.name']
|
||||
name: Owner
|
||||
type: string
|
||||
- jsonPath: .spec.summary.pass
|
||||
name: Pass
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.fail
|
||||
name: Fail
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.warn
|
||||
name: Warn
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.error
|
||||
name: Error
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.skip
|
||||
name: Skip
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.uid']
|
||||
name: Uid
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||
name: Hash
|
||||
priority: 1
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: EphemeralReport is the Schema for the EphemeralReports API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
owner:
|
||||
description: Owner is a reference to the report owner (e.g. a Deployment,
|
||||
Namespace, or Node)
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
blockOwnerDeletion:
|
||||
description: |-
|
||||
If true, AND if the owner has the "foregroundDeletion" finalizer, then
|
||||
the owner cannot be deleted from the key-value store until this
|
||||
reference is removed.
|
||||
See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||
for how the garbage collector interacts with this field and enforces the foreground deletion.
|
||||
Defaults to false.
|
||||
To set this field, a user needs "delete" permission of the owner,
|
||||
otherwise 422 (Unprocessable Entity) will be returned.
|
||||
type: boolean
|
||||
controller:
|
||||
description: If true, this reference points to the managing controller.
|
||||
type: boolean
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids
|
||||
type: string
|
||||
required:
|
||||
- apiVersion
|
||||
- kind
|
||||
- name
|
||||
- uid
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
results:
|
||||
description: PolicyReportResult provides result details
|
||||
items:
|
||||
description: ReportResult provides the result for an individual
|
||||
policy
|
||||
properties:
|
||||
category:
|
||||
description: Category indicates policy category
|
||||
type: string
|
||||
message:
|
||||
description: Description is a short user friendly message for
|
||||
the policy rule
|
||||
type: string
|
||||
policy:
|
||||
description: Policy is the name or identifier of the policy
|
||||
type: string
|
||||
properties:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Properties provides additional information for
|
||||
the policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: |-
|
||||
ResourceSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a ResourceSelector can be specified. If neither are provided, the
|
||||
result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector
|
||||
requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector
|
||||
applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
resources:
|
||||
description: Subjects is an optional reference to the checked
|
||||
Kubernetes resources
|
||||
items:
|
||||
description: ObjectReference contains enough information to
|
||||
let you inspect or modify the referred object.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
result:
|
||||
description: Result indicates the outcome of the policy rule
|
||||
execution
|
||||
enum:
|
||||
- pass
|
||||
- fail
|
||||
- warn
|
||||
- error
|
||||
- skip
|
||||
type: string
|
||||
rule:
|
||||
description: Rule is the name or identifier of the rule within
|
||||
the policy
|
||||
type: string
|
||||
scored:
|
||||
description: Scored indicates if this result is scored
|
||||
type: boolean
|
||||
severity:
|
||||
description: Severity indicates policy check result criticality
|
||||
enum:
|
||||
- critical
|
||||
- high
|
||||
- low
|
||||
- medium
|
||||
- info
|
||||
type: string
|
||||
source:
|
||||
description: |-
|
||||
Source is an identifier for the policy engine that manages this report
|
||||
If the Source is specified at this level, it will override the Source
|
||||
field set at the Report level
|
||||
type: string
|
||||
timestamp:
|
||||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
- nanos
|
||||
- seconds
|
||||
type: object
|
||||
required:
|
||||
- policy
|
||||
type: object
|
||||
type: array
|
||||
summary:
|
||||
description: PolicyReportSummary provides a summary of results
|
||||
properties:
|
||||
error:
|
||||
description: Error provides the count of policies that could not
|
||||
be evaluated
|
||||
type: integer
|
||||
fail:
|
||||
description: Fail provides the count of policies whose requirements
|
||||
were not met
|
||||
type: integer
|
||||
pass:
|
||||
description: Pass provides the count of policies whose requirements
|
||||
were met
|
||||
type: integer
|
||||
skip:
|
||||
description: Skip indicates the count of policies that were not
|
||||
selected for evaluation
|
||||
type: integer
|
||||
warn:
|
||||
description: Warn provides the count of non-scored policies whose
|
||||
requirements were not met
|
||||
type: integer
|
||||
type: object
|
||||
required:
|
||||
- owner
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
{{- end }}
|
||||
+368
@@ -0,0 +1,368 @@
|
||||
{{- if and .Values.groups.wgpolicyk8s.clusterpolicyreports (not .Values.reportsServer.enabled) }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: clusterpolicyreports.wgpolicyk8s.io
|
||||
spec:
|
||||
group: wgpolicyk8s.io
|
||||
names:
|
||||
kind: ClusterPolicyReport
|
||||
listKind: ClusterPolicyReportList
|
||||
plural: clusterpolicyreports
|
||||
shortNames:
|
||||
- cpolr
|
||||
singular: clusterpolicyreport
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .scope.kind
|
||||
name: Kind
|
||||
type: string
|
||||
- jsonPath: .scope.name
|
||||
name: Name
|
||||
type: string
|
||||
- jsonPath: .summary.pass
|
||||
name: Pass
|
||||
type: integer
|
||||
- jsonPath: .summary.fail
|
||||
name: Fail
|
||||
type: integer
|
||||
- jsonPath: .summary.warn
|
||||
name: Warn
|
||||
type: integer
|
||||
- jsonPath: .summary.error
|
||||
name: Error
|
||||
type: integer
|
||||
- jsonPath: .summary.skip
|
||||
name: Skip
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterPolicyReport is the Schema for the clusterpolicyreports
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
results:
|
||||
description: PolicyReportResult provides result details
|
||||
items:
|
||||
description: PolicyReportResult provides the result for an individual
|
||||
policy
|
||||
properties:
|
||||
category:
|
||||
description: Category indicates policy category
|
||||
type: string
|
||||
message:
|
||||
description: Description is a short user friendly message for the
|
||||
policy rule
|
||||
type: string
|
||||
policy:
|
||||
description: Policy is the name or identifier of the policy
|
||||
type: string
|
||||
properties:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Properties provides additional information for the
|
||||
policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
resources:
|
||||
description: Subjects is an optional reference to the checked Kubernetes
|
||||
resources
|
||||
items:
|
||||
description: ObjectReference contains enough information to let
|
||||
you inspect or modify the referred object.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
result:
|
||||
description: Result indicates the outcome of the policy rule execution
|
||||
enum:
|
||||
- pass
|
||||
- fail
|
||||
- warn
|
||||
- error
|
||||
- skip
|
||||
type: string
|
||||
rule:
|
||||
description: Rule is the name or identifier of the rule within the
|
||||
policy
|
||||
type: string
|
||||
scored:
|
||||
description: Scored indicates if this result is scored
|
||||
type: boolean
|
||||
severity:
|
||||
description: Severity indicates policy check result criticality
|
||||
enum:
|
||||
- critical
|
||||
- high
|
||||
- low
|
||||
- medium
|
||||
- info
|
||||
type: string
|
||||
source:
|
||||
description: Source is an identifier for the policy engine that
|
||||
manages this report
|
||||
type: string
|
||||
timestamp:
|
||||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
- nanos
|
||||
- seconds
|
||||
type: object
|
||||
required:
|
||||
- policy
|
||||
type: object
|
||||
type: array
|
||||
scope:
|
||||
description: Scope is an optional reference to the report scope (e.g.
|
||||
a Deployment, Namespace, or Node)
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
scopeSelector:
|
||||
description: |-
|
||||
ScopeSelector is an optional selector for multiple scopes (e.g. Pods).
|
||||
Either one of, or none of, but not both of, Scope or ScopeSelector should be specified.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
summary:
|
||||
description: PolicyReportSummary provides a summary of results
|
||||
properties:
|
||||
error:
|
||||
description: Error provides the count of policies that could not be
|
||||
evaluated
|
||||
type: integer
|
||||
fail:
|
||||
description: Fail provides the count of policies whose requirements
|
||||
were not met
|
||||
type: integer
|
||||
pass:
|
||||
description: Pass provides the count of policies whose requirements
|
||||
were met
|
||||
type: integer
|
||||
skip:
|
||||
description: Skip indicates the count of policies that were not selected
|
||||
for evaluation
|
||||
type: integer
|
||||
warn:
|
||||
description: Warn provides the count of non-scored policies whose
|
||||
requirements were not met
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
{{- end }}
|
||||
+367
@@ -0,0 +1,367 @@
|
||||
{{- if and .Values.groups.wgpolicyk8s.policyreports (not .Values.reportsServer.enabled) }}
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: policyreports.wgpolicyk8s.io
|
||||
spec:
|
||||
group: wgpolicyk8s.io
|
||||
names:
|
||||
kind: PolicyReport
|
||||
listKind: PolicyReportList
|
||||
plural: policyreports
|
||||
shortNames:
|
||||
- polr
|
||||
singular: policyreport
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .scope.kind
|
||||
name: Kind
|
||||
type: string
|
||||
- jsonPath: .scope.name
|
||||
name: Name
|
||||
type: string
|
||||
- jsonPath: .summary.pass
|
||||
name: Pass
|
||||
type: integer
|
||||
- jsonPath: .summary.fail
|
||||
name: Fail
|
||||
type: integer
|
||||
- jsonPath: .summary.warn
|
||||
name: Warn
|
||||
type: integer
|
||||
- jsonPath: .summary.error
|
||||
name: Error
|
||||
type: integer
|
||||
- jsonPath: .summary.skip
|
||||
name: Skip
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PolicyReport is the Schema for the policyreports API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
results:
|
||||
description: PolicyReportResult provides result details
|
||||
items:
|
||||
description: PolicyReportResult provides the result for an individual
|
||||
policy
|
||||
properties:
|
||||
category:
|
||||
description: Category indicates policy category
|
||||
type: string
|
||||
message:
|
||||
description: Description is a short user friendly message for the
|
||||
policy rule
|
||||
type: string
|
||||
policy:
|
||||
description: Policy is the name or identifier of the policy
|
||||
type: string
|
||||
properties:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Properties provides additional information for the
|
||||
policy rule
|
||||
type: object
|
||||
resourceSelector:
|
||||
description: |-
|
||||
SubjectSelector is an optional label selector for checked Kubernetes resources.
|
||||
For example, a policy result may apply to all pods that match a label.
|
||||
Either a Subject or a SubjectSelector can be specified.
|
||||
If neither are provided, the result is assumed to be for the policy report scope.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
resources:
|
||||
description: Subjects is an optional reference to the checked Kubernetes
|
||||
resources
|
||||
items:
|
||||
description: ObjectReference contains enough information to let
|
||||
you inspect or modify the referred object.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
result:
|
||||
description: Result indicates the outcome of the policy rule execution
|
||||
enum:
|
||||
- pass
|
||||
- fail
|
||||
- warn
|
||||
- error
|
||||
- skip
|
||||
type: string
|
||||
rule:
|
||||
description: Rule is the name or identifier of the rule within the
|
||||
policy
|
||||
type: string
|
||||
scored:
|
||||
description: Scored indicates if this result is scored
|
||||
type: boolean
|
||||
severity:
|
||||
description: Severity indicates policy check result criticality
|
||||
enum:
|
||||
- critical
|
||||
- high
|
||||
- low
|
||||
- medium
|
||||
- info
|
||||
type: string
|
||||
source:
|
||||
description: Source is an identifier for the policy engine that
|
||||
manages this report
|
||||
type: string
|
||||
timestamp:
|
||||
description: Timestamp indicates the time the result was found
|
||||
properties:
|
||||
nanos:
|
||||
description: |-
|
||||
Non-negative fractions of a second at nanosecond resolution. Negative
|
||||
second values with fractions must still have non-negative nanos values
|
||||
that count forward in time. Must be from 0 to 999,999,999
|
||||
inclusive. This field may be limited in precision depending on context.
|
||||
format: int32
|
||||
type: integer
|
||||
seconds:
|
||||
description: |-
|
||||
Represents seconds of UTC time since Unix epoch
|
||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||
9999-12-31T23:59:59Z inclusive.
|
||||
format: int64
|
||||
type: integer
|
||||
required:
|
||||
- nanos
|
||||
- seconds
|
||||
type: object
|
||||
required:
|
||||
- policy
|
||||
type: object
|
||||
type: array
|
||||
scope:
|
||||
description: Scope is an optional reference to the report scope (e.g.
|
||||
a Deployment, Namespace, or Node)
|
||||
properties:
|
||||
apiVersion:
|
||||
description: API version of the referent.
|
||||
type: string
|
||||
fieldPath:
|
||||
description: |-
|
||||
If referring to a piece of an object instead of an entire object, this string
|
||||
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||
For example, if the object reference is to a container within a pod, this would take on a value like:
|
||||
"spec.containers{name}" (where "name" refers to the name of the container that triggered
|
||||
the event) or if no container name is specified "spec.containers[2]" (container with
|
||||
index 2 in this pod). This syntax is chosen only to have some well-defined way of
|
||||
referencing a part of an object.
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind of the referent.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
|
||||
type: string
|
||||
resourceVersion:
|
||||
description: |-
|
||||
Specific resourceVersion to which this reference is made, if any.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
|
||||
type: string
|
||||
uid:
|
||||
description: |-
|
||||
UID of the referent.
|
||||
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
scopeSelector:
|
||||
description: |-
|
||||
ScopeSelector is an optional selector for multiple scopes (e.g. Pods).
|
||||
Either one of, or none of, but not both of, Scope or ScopeSelector should be specified.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
summary:
|
||||
description: PolicyReportSummary provides a summary of results
|
||||
properties:
|
||||
error:
|
||||
description: Error provides the count of policies that could not be
|
||||
evaluated
|
||||
type: integer
|
||||
fail:
|
||||
description: Fail provides the count of policies whose requirements
|
||||
were not met
|
||||
type: integer
|
||||
pass:
|
||||
description: Pass provides the count of policies whose requirements
|
||||
were met
|
||||
type: integer
|
||||
skip:
|
||||
description: Skip indicates the count of policies that were not selected
|
||||
for evaluation
|
||||
type: integer
|
||||
warn:
|
||||
description: Warn provides the count of non-scored policies whose
|
||||
requirements were not met
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,55 @@
|
||||
# -- Internal settings used with `helm template` to generate install manifest
|
||||
# @ignored
|
||||
templating:
|
||||
enabled: false
|
||||
debug: false
|
||||
version: ~
|
||||
|
||||
reportsServer:
|
||||
# -- Kyverno reports-server is used in your cluster
|
||||
enabled: false
|
||||
|
||||
groups:
|
||||
# -- Install CRDs in group `kyverno.io`
|
||||
# -- This field can be overwritten by setting crds.labels in the parent chart
|
||||
kyverno:
|
||||
cleanuppolicies: true
|
||||
clustercleanuppolicies: true
|
||||
clusterpolicies: true
|
||||
globalcontextentries: true
|
||||
policies: true
|
||||
policyexceptions: true
|
||||
updaterequests: true
|
||||
|
||||
# -- Install CRDs in group `reports.kyverno.io`
|
||||
policies:
|
||||
validatingpolicies: true
|
||||
imagevalidatingpolicies: true
|
||||
namespacedimagevalidatingpolicies: true
|
||||
namespacedvalidatingpolicies: true
|
||||
namespaceddeletingpolicies: true
|
||||
policyexceptions: true
|
||||
mutatingpolicies: true
|
||||
generatingpolicies: true
|
||||
deletingpolicies: true
|
||||
|
||||
# -- This field can be overwritten by setting crds.labels in the parent chart
|
||||
reports:
|
||||
clusterephemeralreports: true
|
||||
ephemeralreports: true
|
||||
|
||||
# -- Install CRDs in group `wgpolicyk8s.io`
|
||||
# -- This field can be overwritten by setting crds.labels in the parent chart
|
||||
wgpolicyk8s:
|
||||
clusterpolicyreports: true
|
||||
policyreports: true
|
||||
|
||||
# -- Additional CRDs annotations
|
||||
# -- This field can be overwritten by setting crds.annotations in the parent chart
|
||||
annotations: {}
|
||||
# argocd.argoproj.io/sync-options: Replace=true
|
||||
# strategy.spinnaker.io/replace: 'true'
|
||||
|
||||
# -- Additional CRDs labels
|
||||
# -- This field can be overwritten by setting crds.labels in the parent chart
|
||||
customLabels: {}
|
||||
Binary file not shown.
@@ -0,0 +1,50 @@
|
||||
Chart version: {{ .Chart.Version }}
|
||||
Kyverno version: {{ default .Chart.AppVersion (default .Values.admissionController.container.image.tag .Values.admissionController.initContainer.image.tag) }}
|
||||
|
||||
Thank you for installing {{ .Chart.Name }}! Your release is named {{ .Release.Name }}.
|
||||
|
||||
The following components have been installed in your cluster:
|
||||
{{- if .Values.crds.install }}
|
||||
- CRDs
|
||||
{{- end }}
|
||||
- Admission controller
|
||||
{{- if .Values.reportsController.enabled }}
|
||||
- Reports controller
|
||||
{{- end }}
|
||||
{{- if .Values.cleanupController.enabled }}
|
||||
- Cleanup controller
|
||||
{{- end }}
|
||||
{{- if .Values.backgroundController.enabled }}
|
||||
- Background controller
|
||||
{{- end }}
|
||||
{{- if .Values.grafana.enabled }}
|
||||
- Grafana dashboard
|
||||
{{- end }}
|
||||
|
||||
{{ if not .Values.admissionController.replicas }}
|
||||
⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode.
|
||||
{{- else if lt (int .Values.admissionController.replicas) 2 }}
|
||||
⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode.
|
||||
{{- end }}
|
||||
|
||||
{{- if semverCompare "<1.21.0" .Capabilities.KubeVersion.Version }}
|
||||
⚠️ WARNING: The minimal Kubernetes version officially supported by Kyverno is 1.21. Earlier versions are untested and Kyverno is not guaranteed to work with Kubernetes {{ .Capabilities.KubeVersion.Version }}.
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.config.matchConditions }}
|
||||
⚠️ WARNING: Match conditions require a Kubernetes 1.27+ cluster with `AdmissionWebhookMatchConditions` feature gate enabled.
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.features.generateMutatingAdmissionPolicy.enabled }}
|
||||
⚠️ WARNING: Generating MutatingAdmissionPolicy requires a Kubernetes 1.32+ cluster with `MutatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled.
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.features.mutatingAdmissionPolicyReports.enabled }}
|
||||
⚠️ WARNING: Generating reports from MutatingAdmissionPolicies requires a Kubernetes 1.32+ cluster with `MutatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled.
|
||||
{{- end }}
|
||||
|
||||
{{ if not .Values.features.policyExceptions.enabled }}
|
||||
⚠️ WARNING: PolicyExceptions are disabled by default. To enable them, set '--enablePolicyException' to true.
|
||||
{{- end }}
|
||||
|
||||
💡 Note: There is a trade-off when deciding which approach to take regarding Namespace exclusions. Please see the documentation at https://kyverno.io/docs/installation/#security-vs-operability to understand the risks.
|
||||
@@ -0,0 +1,154 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/* Validate OpenReports configuration */}}
|
||||
{{- define "kyverno.validateOpenReports" -}}
|
||||
{{- if and (not .Values.openreports.enabled) .Values.openreports.installCrds -}}
|
||||
{{- fail "OpenReports CRD installation (openreports.installCrds) cannot be enabled when the feature (openreports.enabled) is disabled" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.chartVersion" -}}
|
||||
{{- if .Values.global.templating.enabled -}}
|
||||
{{- required "templating.version is required when templating.enabled is true" .Values.global.templating.version | replace "+" "_" -}}
|
||||
{{- else -}}
|
||||
{{- .Chart.Version | replace "+" "_" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.features.flags" -}}
|
||||
{{- $flags := list -}}
|
||||
{{- with .admissionReports -}}
|
||||
{{- $flags = append $flags (print "--admissionReports=" .enabled) -}}
|
||||
{{- with .backPressureThreshold -}}
|
||||
{{- $flags = append $flags (print "--maxAdmissionReports=" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- with .aggregateReports -}}
|
||||
{{- $flags = append $flags (print "--aggregateReports=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .policyReports -}}
|
||||
{{- $flags = append $flags (print "--policyReports=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .validatingAdmissionPolicyReports -}}
|
||||
{{- $flags = append $flags (print "--validatingAdmissionPolicyReports=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .mutatingAdmissionPolicyReports -}}
|
||||
{{- $flags = append $flags (print "--mutatingAdmissionPolicyReports=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .autoUpdateWebhooks -}}
|
||||
{{- $flags = append $flags (print "--autoUpdateWebhooks=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .backgroundScan -}}
|
||||
{{- $flags = append $flags (print "--backgroundScan=" .enabled) -}}
|
||||
{{- $flags = append $flags (print "--backgroundScanWorkers=" .backgroundScanWorkers) -}}
|
||||
{{- $flags = append $flags (print "--backgroundScanInterval=" .backgroundScanInterval) -}}
|
||||
{{- $flags = append $flags (print "--skipResourceFilters=" .skipResourceFilters) -}}
|
||||
{{- end -}}
|
||||
{{- with .configMapCaching -}}
|
||||
{{- $flags = append $flags (print "--enableConfigMapCaching=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .controllerRuntimeMetrics -}}
|
||||
{{- $flags = append $flags (print "--controllerRuntimeMetricsAddress=" .bindAddress) -}}
|
||||
{{- end -}}
|
||||
{{- with .deferredLoading -}}
|
||||
{{- $flags = append $flags (print "--enableDeferredLoading=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .dumpPayload -}}
|
||||
{{- $flags = append $flags (print "--dumpPayload=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .forceFailurePolicyIgnore -}}
|
||||
{{- $flags = append $flags (print "--forceFailurePolicyIgnore=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .generateValidatingAdmissionPolicy -}}
|
||||
{{- $flags = append $flags (print "--generateValidatingAdmissionPolicy=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .generateMutatingAdmissionPolicy -}}
|
||||
{{- $flags = append $flags (print "--generateMutatingAdmissionPolicy=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .dumpPatches -}}
|
||||
{{- $flags = append $flags (print "--dumpPatches=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .globalContext -}}
|
||||
{{- $flags = append $flags (print "--maxAPICallResponseLength=" (int .maxApiCallResponseLength)) -}}
|
||||
{{- end -}}
|
||||
{{- with .logging -}}
|
||||
{{- $flags = append $flags (print "--loggingFormat=" .format) -}}
|
||||
{{- $flags = append $flags (print "--v=" .verbosity) -}}
|
||||
{{- end -}}
|
||||
{{- with .omitEvents -}}
|
||||
{{- with .eventTypes -}}
|
||||
{{- $flags = append $flags (print "--omitEvents=" (join "," .)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- with .policyExceptions -}}
|
||||
{{- $flags = append $flags (print "--enablePolicyException=" .enabled) -}}
|
||||
{{- with .namespace -}}
|
||||
{{- $flags = append $flags (print "--exceptionNamespace=" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- with .protectManagedResources -}}
|
||||
{{- $flags = append $flags (print "--protectManagedResources=" .enabled) -}}
|
||||
{{- end -}}
|
||||
{{- with .registryClient -}}
|
||||
{{- $flags = append $flags (print "--allowInsecureRegistry=" .allowInsecure) -}}
|
||||
{{- $flags = append $flags (print "--registryCredentialHelpers=" (join "," .credentialHelpers)) -}}
|
||||
{{- end -}}
|
||||
{{- with .ttlController -}}
|
||||
{{- $flags = append $flags (print "--ttlReconciliationInterval=" .reconciliationInterval) -}}
|
||||
{{- end -}}
|
||||
{{- with .tuf -}}
|
||||
{{- with .enabled -}}
|
||||
{{- $flags = append $flags (print "--enableTuf=" .) -}}
|
||||
{{- end -}}
|
||||
{{- with .mirror -}}
|
||||
{{- $flags = append $flags (print "--tufMirror=" .) -}}
|
||||
{{- end -}}
|
||||
{{- with .root -}}
|
||||
{{- $flags = append $flags (print "--tufRoot=" .) -}}
|
||||
{{- end -}}
|
||||
{{- with .rootRaw -}}
|
||||
{{- $flags = append $flags (print "--tufRootRaw=" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- with .reporting -}}
|
||||
{{- $reportingConfig := list -}}
|
||||
{{- with .validate -}}
|
||||
{{- $reportingConfig = append $reportingConfig "validate" -}}
|
||||
{{- end -}}
|
||||
{{- with .mutate -}}
|
||||
{{- $reportingConfig = append $reportingConfig "mutate" -}}
|
||||
{{- end -}}
|
||||
{{- with .mutateExisting -}}
|
||||
{{- $reportingConfig = append $reportingConfig "mutateExisting" -}}
|
||||
{{- end -}}
|
||||
{{- with .imageVerify -}}
|
||||
{{- $reportingConfig = append $reportingConfig "imageVerify" -}}
|
||||
{{- end -}}
|
||||
{{- with .generate -}}
|
||||
{{- $reportingConfig = append $reportingConfig "generate" -}}
|
||||
{{- end -}}
|
||||
{{- $flags = append $flags (print "--enableReporting=" (join "," $reportingConfig)) -}}
|
||||
{{- end -}}
|
||||
{{- with $flags -}}
|
||||
{{- toYaml . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Helper function to sort imagePullSecrets by name to ensure consistent ordering */}}
|
||||
{{- define "kyverno.sortedImagePullSecrets" -}}
|
||||
{{- if . -}}
|
||||
{{- $secrets := list -}}
|
||||
{{- range . -}}
|
||||
{{- $secrets = append $secrets .name -}}
|
||||
{{- end -}}
|
||||
{{- $sortedSecrets := list -}}
|
||||
{{- if $secrets -}}
|
||||
{{- $sortedSecrets = sortAlpha $secrets -}}
|
||||
{{- end -}}
|
||||
{{- $sortedRefs := list -}}
|
||||
{{- range $sortedSecrets -}}
|
||||
{{- $sortedRefs = append $sortedRefs (dict "name" .) -}}
|
||||
{{- end -}}
|
||||
{{- toYaml $sortedRefs -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,10 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.deployment.replicas" -}}
|
||||
{{- if and (not (kindIs "invalid" .)) (not (kindIs "string" .)) -}}
|
||||
{{- if eq (int .) 0 -}}
|
||||
{{- fail "Kyverno does not support running with 0 replicas. Please provide a non-zero integer value." -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- . -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.flowcontrol.apiVersion" -}}
|
||||
{{- if .Capabilities.APIVersions.Has "flowcontrol.apiserver.k8s.io/v1" -}}
|
||||
flowcontrol.apiserver.k8s.io/v1
|
||||
{{- else if .Capabilities.APIVersions.Has "flowcontrol.apiserver.k8s.io/v1beta3" -}}
|
||||
flowcontrol.apiserver.k8s.io/v1beta3
|
||||
{{- else if .Capabilities.APIVersions.Has "flowcontrol.apiserver.k8s.io/v1beta2" -}}
|
||||
flowcontrol.apiserver.k8s.io/v1beta2
|
||||
{{- else if .Capabilities.APIVersions.Has "flowcontrol.apiserver.k8s.io/v1beta1" -}}
|
||||
flowcontrol.apiserver.k8s.io/v1beta1
|
||||
{{- else -}}
|
||||
flowcontrol.apiserver.k8s.io/v1alpha1
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.image" -}}
|
||||
{{- $tag := default .defaultTag .image.tag -}}
|
||||
{{- if not (typeIs "string" $tag) -}}
|
||||
{{ fail "Image tags must be strings." }}
|
||||
{{- end -}}
|
||||
{{- $imageRegistry := default (default .image.defaultRegistry .globalRegistry) .image.registry -}}
|
||||
{{- if $imageRegistry -}}
|
||||
{{- print $imageRegistry "/" (required "An image repository is required" .image.repository) ":" $tag -}}
|
||||
{{- else -}}
|
||||
{{- print (required "An image repository is required" .image.repository) ":" $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.labels.merge" -}}
|
||||
{{- $labels := dict -}}
|
||||
{{- range . -}}
|
||||
{{- $labels = merge $labels (fromYaml .) -}}
|
||||
{{- end -}}
|
||||
{{- with $labels -}}
|
||||
{{- toYaml $labels -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.labels.helm" -}}
|
||||
{{- if not .Values.global.templating.enabled -}}
|
||||
helm.sh/chart: {{ template "kyverno.chart" . }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.labels.version" -}}
|
||||
app.kubernetes.io/version: {{ template "kyverno.chartVersion" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.labels.common" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.helm" .)
|
||||
(include "kyverno.labels.version" .)
|
||||
(toYaml .Values.customLabels)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.matchLabels.common" -}}
|
||||
app.kubernetes.io/part-of: {{ template "kyverno.fullname" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.labels.component" -}}
|
||||
app.kubernetes.io/component: {{ . }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.labels.name" -}}
|
||||
app.kubernetes.io/name: {{ . }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.namespace" -}}
|
||||
{{ default .Release.Namespace .Values.namespaceOverride }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.pdb.apiVersion" -}}
|
||||
{{- if .Values.apiVersionOverride.podDisruptionBudget -}}
|
||||
{{- .Values.apiVersionOverride.podDisruptionBudget -}}
|
||||
{{- else -}}
|
||||
policy/v1
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.pdb.spec" -}}
|
||||
{{- if and .minAvailable .maxUnavailable -}}
|
||||
{{- fail "Cannot set both .minAvailable and .maxUnavailable" -}}
|
||||
{{- end -}}
|
||||
{{- if not .maxUnavailable }}
|
||||
minAvailable: {{ default 1 .minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .maxUnavailable }}
|
||||
maxUnavailable: {{ .maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- if .unhealthyPodEvictionPolicy }}
|
||||
unhealthyPodEvictionPolicy: {{ .unhealthyPodEvictionPolicy }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,8 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.templating.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,8 @@
|
||||
{{- if .Values.global.templating.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ include "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.templating.labels" . | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.admission-controller.name" -}}
|
||||
{{ template "kyverno.name" . }}-admission-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.admission-controller.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.admission-controller.matchLabels" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.admission-controller.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "admission-controller")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.admission-controller.roleName" -}}
|
||||
{{ include "kyverno.fullname" . }}:admission-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.admission-controller.serviceAccountName" -}}
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
{{ default (include "kyverno.admission-controller.name" .) .Values.admissionController.rbac.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ required "A service account name is required when `rbac.create` is set to `false`" .Values.admissionController.rbac.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.admission-controller.serviceName" -}}
|
||||
{{- printf "%s-svc" (include "kyverno.fullname" .) | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.admission-controller.caCertificatesConfigMapName" -}}
|
||||
{{ printf "%s-ca-certificates" (include "kyverno.admission-controller.name" .) }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,239 @@
|
||||
{{- if .Values.admissionController.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.kyverno.io/aggregate-to-admission-controller: "true"
|
||||
- matchLabels:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 8 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}:core
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/webhooks
|
||||
- kyverno.io/exceptionwebhooks
|
||||
- kyverno.io/globalcontextwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
{{- if .Values.admissionController.crdWatcher | default .Values.global.crdWatcher }}
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
{{- if .Values.features.generateValidatingAdmissionPolicy.enabled }}
|
||||
- validatingadmissionpolicies
|
||||
- validatingadmissionpolicybindings
|
||||
{{- end }}
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- clusterroles
|
||||
- rolebindings
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- policies
|
||||
- policies/status
|
||||
- clusterpolicies
|
||||
- clusterpolicies/status
|
||||
- updaterequests
|
||||
- updaterequests/status
|
||||
- globalcontextentries
|
||||
- globalcontextentries/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- policyexceptions
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- validatingpolicies
|
||||
- validatingpolicies/status
|
||||
- namespacedvalidatingpolicies
|
||||
- namespacedvalidatingpolicies/status
|
||||
- imagevalidatingpolicies
|
||||
- imagevalidatingpolicies/status
|
||||
- namespacedimagevalidatingpolicies
|
||||
- namespacedimagevalidatingpolicies/status
|
||||
- generatingpolicies
|
||||
- generatingpolicies/status
|
||||
- mutatingpolicies
|
||||
- mutatingpolicies/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- policyexceptions
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- ''
|
||||
- events.k8s.io
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
resourceNames:
|
||||
- {{ template "kyverno.admission-controller.roleName" . }}
|
||||
- {{ template "kyverno.admission-controller.roleName" . }}:core
|
||||
- {{ template "kyverno.admission-controller.roleName" . }}:temporary
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.rbac.coreClusterRole.extraResources }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.rbac.clusterRole.extraResources }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.roleName" $ }}:additional
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,33 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.admissionController.rbac.createViewRoleBinding }}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}:view
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Values.admissionController.rbac.viewRoleName }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if or .Values.admissionController.caCertificates.data .Values.global.caCertificates.data }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "kyverno.admission-controller.caCertificatesConfigMapName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
data:
|
||||
ca-certificates: |
|
||||
{{ .Values.admissionController.caCertificates.data | default .Values.global.caCertificates.data | indent 4 | trim }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,336 @@
|
||||
{{- if not .Values.global.templating.debug -}}
|
||||
{{- $automountSAToken := .Values.admissionController.rbac.serviceAccount.automountServiceAccountToken }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/webhooks
|
||||
- kyverno.io/exceptionwebhooks
|
||||
- kyverno.io/globalcontextwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.admissionController.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.admissionController.autoscaling.enabled }}
|
||||
replicas: {{ template "kyverno.deployment.replicas" .Values.admissionController.replicas }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: {{ .Values.admissionController.revisionHistoryLimit }}
|
||||
{{- with .Values.admissionController.updateStrategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 8 }}
|
||||
{{- with .Values.admissionController.podLabels }}
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.podAnnotations }}
|
||||
annotations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.admissionController.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.hostNetwork }}
|
||||
hostNetwork: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.dnsPolicy }}
|
||||
dnsPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.admissionController.antiAffinity.enabled .Values.admissionController.podAffinity .Values.admissionController.nodeAffinity }}
|
||||
affinity:
|
||||
{{- if .Values.admissionController.antiAffinity.enabled }}
|
||||
{{- with .Values.admissionController.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
initContainers:
|
||||
{{- with .Values.admissionController.extraInitContainers }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: kyverno-pre
|
||||
image: {{ include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.admissionController.initContainer.image "defaultTag" (default .Chart.AppVersion .Values.admissionController.initContainer.image.tag)) | quote }}
|
||||
imagePullPolicy: {{ default .Values.admissionController.container.image.pullPolicy .Values.admissionController.initContainer.image.pullPolicy }}
|
||||
args:
|
||||
{{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.admissionController.featuresOverride)
|
||||
"logging"
|
||||
) | nindent 12 }}
|
||||
- --openreportsEnabled={{ .Values.openreports.enabled }}
|
||||
{{- range $key, $value := .Values.admissionController.initContainer.extraArgs }}
|
||||
{{- if $value }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.initContainer.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.initContainer.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: KYVERNO_SERVICEACCOUNT_NAME
|
||||
value: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
- name: KYVERNO_ROLE_NAME
|
||||
value: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
- name: INIT_CONFIG
|
||||
value: {{ template "kyverno.config.configMapName" . }}
|
||||
- name: METRICS_CONFIG
|
||||
value: {{ template "kyverno.config.metricsConfigMapName" . }}
|
||||
- name: KYVERNO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KYVERNO_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: KYVERNO_DEPLOYMENT
|
||||
value: {{ template "kyverno.admission-controller.name" . }}
|
||||
- name: KYVERNO_SVC
|
||||
value: {{ template "kyverno.admission-controller.serviceName" . }}
|
||||
{{- with (concat .Values.global.extraEnvVars .Values.admissionController.initContainer.extraEnvVars) }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumeMounts:
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- with .Values.admissionController.extraContainers }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
- name: kyverno
|
||||
image: {{ include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.admissionController.container.image "defaultTag" .Chart.AppVersion) | quote }}
|
||||
imagePullPolicy: {{ .Values.admissionController.container.image.pullPolicy }}
|
||||
args:
|
||||
- --caSecretName={{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca
|
||||
- --tlsSecretName={{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair
|
||||
{{- if .Values.backgroundController.enabled }}
|
||||
- --backgroundServiceAccountName=system:serviceaccount:{{ include "kyverno.namespace" . }}:{{ include "kyverno.background-controller.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.reportsController.enabled }}
|
||||
- --reportsServiceAccountName=system:serviceaccount:{{ include "kyverno.namespace" . }}:{{ include "kyverno.reports-controller.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
- --servicePort={{ .Values.admissionController.service.port }}
|
||||
- --webhookServerPort={{ .Values.admissionController.webhookServer.port }}
|
||||
- --resyncPeriod={{ .Values.admissionController.resyncPeriod | default .Values.global.resyncPeriod }}
|
||||
- --crdWatcher={{ .Values.admissionController.crdWatcher | default .Values.global.crdWatcher }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
- --autoDeleteWebhooks
|
||||
{{- end }}
|
||||
{{- if .Values.admissionController.tracing.enabled }}
|
||||
- --enableTracing
|
||||
- --tracingAddress={{ .Values.admissionController.tracing.address }}
|
||||
- --tracingPort={{ .Values.admissionController.tracing.port }}
|
||||
{{- with .Values.admissionController.tracing.creds }}
|
||||
- --tracingCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- --disableMetrics={{ .Values.admissionController.metering.disabled }}
|
||||
{{- if not .Values.admissionController.metering.disabled }}
|
||||
- --otelConfig={{ .Values.admissionController.metering.config }}
|
||||
- --metricsPort={{ .Values.admissionController.metering.port }}
|
||||
{{- with .Values.admissionController.metering.collector }}
|
||||
- --otelCollector={{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.metering.creds }}
|
||||
- --transportCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.imagePullSecrets .Values.existingImagePullSecrets }}
|
||||
- --imagePullSecrets={{- $secretNames := concat (keys .Values.imagePullSecrets | sortAlpha) (.Values.existingImagePullSecrets | sortAlpha) -}}
|
||||
{{- join "," $secretNames -}}
|
||||
{{- end }}
|
||||
{{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.admissionController.featuresOverride)
|
||||
"admissionReports"
|
||||
"autoUpdateWebhooks"
|
||||
"configMapCaching"
|
||||
"controllerRuntimeMetrics"
|
||||
"deferredLoading"
|
||||
"dumpPayload"
|
||||
"forceFailurePolicyIgnore"
|
||||
"generateValidatingAdmissionPolicy"
|
||||
"generateMutatingAdmissionPolicy"
|
||||
"dumpPatches"
|
||||
"globalContext"
|
||||
"logging"
|
||||
"omitEvents"
|
||||
"policyExceptions"
|
||||
"protectManagedResources"
|
||||
"registryClient"
|
||||
"reporting"
|
||||
"tuf"
|
||||
) | nindent 12 }}
|
||||
{{- range $key, $value := .Values.admissionController.container.extraArgs }}
|
||||
{{- if $value }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ if .Values.admissionController.profiling.enabled }}
|
||||
- --profile=true
|
||||
- --profilePort={{ .Values.admissionController.profiling.port }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.container.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.container.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.admissionController.webhookServer.port }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.admissionController.metering.port }}
|
||||
name: metrics-port
|
||||
protocol: TCP
|
||||
{{ if .Values.admissionController.profiling.enabled }}
|
||||
- containerPort: {{ .Values.admissionController.profiling.port }}
|
||||
name: profiling-port
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
env:
|
||||
- name: INIT_CONFIG
|
||||
value: {{ template "kyverno.config.configMapName" . }}
|
||||
- name: METRICS_CONFIG
|
||||
value: {{ template "kyverno.config.metricsConfigMapName" . }}
|
||||
- name: KYVERNO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KYVERNO_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: KYVERNO_SERVICEACCOUNT_NAME
|
||||
value: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
- name: KYVERNO_ROLE_NAME
|
||||
value: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
- name: KYVERNO_SVC
|
||||
value: {{ template "kyverno.admission-controller.serviceName" . }}
|
||||
- name: TUF_ROOT
|
||||
value: {{ .Values.admissionController.tufRootMountPath }}
|
||||
{{- with (concat .Values.global.extraEnvVars .Values.admissionController.container.extraEnvVars) }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
- name: KYVERNO_DEPLOYMENT
|
||||
value: {{ template "kyverno.admission-controller.name" . }}
|
||||
{{- with .Values.admissionController.startupProbe }}
|
||||
startupProbe:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: {{ .Values.admissionController.tufRootMountPath }}
|
||||
name: sigstore
|
||||
{{- if or .Values.admissionController.caCertificates.data .Values.global.caCertificates.data .Values.admissionController.caCertificates.volume .Values.global.caCertificates.volume }}
|
||||
- name: ca-certificates
|
||||
mountPath: /etc/ssl/certs/ca-certificates.crt
|
||||
{{- if or .Values.admissionController.caCertificates.data .Values.global.caCertificates.data }}
|
||||
subPath: ca-certificates.crt
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: sigstore
|
||||
{{- toYaml (required "A valid .Values.admissionController.sigstoreVolume entry is required" .Values.admissionController.sigstoreVolume) | nindent 8 }}
|
||||
{{- if or .Values.admissionController.caCertificates.data .Values.global.caCertificates.data }}
|
||||
- name: ca-certificates
|
||||
configMap:
|
||||
name: {{ include "kyverno.admission-controller.caCertificatesConfigMapName" . }}
|
||||
items:
|
||||
- key: ca-certificates
|
||||
path: ca-certificates.crt
|
||||
{{- else if or .Values.admissionController.caCertificates.volume .Values.global.caCertificates.volume }}
|
||||
{{- with (.Values.admissionController.caCertificates.volume | default .Values.global.caCertificates.volume) }}
|
||||
- name: ca-certificates
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,222 @@
|
||||
{{- if .Values.admissionController.apiPriorityAndFairness }}
|
||||
apiVersion: {{ template "kyverno.flowcontrol.apiVersion" . }}
|
||||
kind: FlowSchema
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
priorityLevelConfiguration:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
rules:
|
||||
- resourceRules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- mutatingwebhookconfigurations
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- watch
|
||||
- list
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- clusterpolicies
|
||||
- clusterpolicies/status
|
||||
- globalcontextentries
|
||||
- globalcontextentries/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- policies
|
||||
- policies/status
|
||||
- updaterequests
|
||||
- updaterequests/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- ephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- ""
|
||||
- events.k8s.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- '*'
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ''
|
||||
namespaces:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- apiGroups:
|
||||
- ''
|
||||
namespaces:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
namespaces:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- apps
|
||||
namespaces:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
resources:
|
||||
- deployments
|
||||
- deployments/scale
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- patch
|
||||
- update
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
serviceAccount:
|
||||
name: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if .Values.admissionController.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
minReplicas: {{ .Values.admissionController.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.admissionController.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
- resource:
|
||||
name: cpu
|
||||
target:
|
||||
averageUtilization: {{ .Values.admissionController.autoscaling.targetCPUUtilizationPercentage }}
|
||||
type: Utilization
|
||||
type: Resource
|
||||
{{- with .Values.admissionController.autoscaling.behavior }}
|
||||
behavior:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.admissionController.networkPolicy.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
{{- if .Values.admissionController.networkPolicy.ingressFrom }}
|
||||
ingress:
|
||||
- from:
|
||||
{{- toYaml .Values.admissionController.networkPolicy.ingressFrom | nindent 8 }}
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9443 # webhook access
|
||||
# Allow prometheus scrapes for metrics
|
||||
{{- if .Values.admissionController.metricsService.create }}
|
||||
- protocol: TCP
|
||||
port: {{ .Values.admissionController.metricsService.port }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
ingress:
|
||||
- {}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if or .Values.admissionController.podDisruptionBudget.enabled (gt (int .Values.admissionController.replicas) 1) -}}
|
||||
apiVersion: {{ template "kyverno.pdb.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- include "kyverno.pdb.spec" .Values.admissionController.podDisruptionBudget | nindent 2 }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 6 }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.admissionController.apiPriorityAndFairness }}
|
||||
apiVersion: {{ template "kyverno.flowcontrol.apiVersion" . }}
|
||||
kind: PriorityLevelConfiguration
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.admissionController.priorityLevelConfigurationSpec }}
|
||||
spec:
|
||||
{{- tpl (toYaml .) $ | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,95 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/webhooks
|
||||
- kyverno.io/exceptionwebhooks
|
||||
- kyverno.io/globalcontextwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- secrets
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- patch
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
resourceNames:
|
||||
- {{ include "kyverno.config.configMapName" . }}
|
||||
- {{ include "kyverno.config.metricsConfigMapName" . }}
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
resourceNames:
|
||||
- {{ template "kyverno.admission-controller.roleName" . }}
|
||||
- {{ template "kyverno.admission-controller.roleName" . }}:temporary
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Allow update of Kyverno deployment annotations
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
{{- if .Values.webhooksCleanup.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- deployments/scale
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.webhooksCleanup.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- patch
|
||||
- update
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/webhooks
|
||||
- kyverno.io/exceptionwebhooks
|
||||
- kyverno.io/globalcontextwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "kyverno.admission-controller.roleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if .Values.admissionController.createSelfSignedCert -}}
|
||||
{{- $ca := genCA (printf "*.%s.svc" (include "kyverno.namespace" .)) 1024 -}}
|
||||
{{- $svcName := (printf "%s.%s.svc" (include "kyverno.admission-controller.serviceName" .) (include "kyverno.namespace" .)) -}}
|
||||
{{- $cert := genSignedCert $svcName nil (list $svcName) 1024 $ca -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.key: {{ $ca.Key | b64enc }}
|
||||
tls.crt: {{ $ca.Cert | b64enc }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
self-signed-cert: "true"
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.key: {{ $cert.Key | b64enc }}
|
||||
tls.crt: {{ $cert.Cert | b64enc }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,77 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.serviceName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.admissionController.service.annotations }}
|
||||
annotations: {{ tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.admissionController.service.port }}
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
name: https
|
||||
appProtocol: https
|
||||
{{- if and (eq .Values.admissionController.service.type "NodePort") (not (empty .Values.admissionController.service.nodePort)) }}
|
||||
nodePort: {{ .Values.admissionController.service.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.admissionController.service.type }}
|
||||
{{- if .Values.admissionController.service.trafficDistribution }}
|
||||
trafficDistribution: {{ .Values.admissionController.service.trafficDistribution }}
|
||||
{{- end }}
|
||||
{{- if .Values.admissionController.metricsService.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.serviceName" . }}-metrics
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.admissionController.metricsService.annotations }}
|
||||
annotations: {{ tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.admissionController.metricsService.port }}
|
||||
targetPort: {{ .Values.admissionController.metering.port }}
|
||||
protocol: TCP
|
||||
name: metrics-port
|
||||
{{- if and (eq .Values.admissionController.metricsService.type "NodePort") (not (empty .Values.admissionController.metricsService.nodePort)) }}
|
||||
nodePort: {{ .Values.admissionController.metricsService.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.admissionController.metricsService.type }}
|
||||
{{- if .Values.admissionController.metricsService.trafficDistribution }}
|
||||
trafficDistribution: {{ .Values.admissionController.metricsService.trafficDistribution }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- if .Values.admissionController.profiling.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.serviceName" . }}-profiling
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.admissionController.profiling.port }}
|
||||
targetPort: {{ .Values.admissionController.profiling.port }}
|
||||
protocol: TCP
|
||||
name: profiling-port
|
||||
{{- if and (eq .Values.admissionController.profiling.serviceType "NodePort") (not (empty .Values.admissionController.profiling.nodePort)) }}
|
||||
nodePort: {{ .Values.admissionController.profiling.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.admissionController.profiling.serviceType }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if .Values.admissionController.rbac.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/webhooks
|
||||
- kyverno.io/exceptionwebhooks
|
||||
- kyverno.io/globalcontextwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.admissionController.rbac.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if .Values.admissionController.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "kyverno.admission-controller.name" . }}
|
||||
{{- if .Values.admissionController.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.admissionController.serviceMonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.serviceMonitor.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.admissionController.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.admission-controller.matchLabels" . | nindent 6 }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
endpoints:
|
||||
- port: metrics-port
|
||||
interval: {{ .Values.admissionController.serviceMonitor.interval }}
|
||||
scrapeTimeout: {{ .Values.admissionController.serviceMonitor.scrapeTimeout }}
|
||||
{{- if .Values.admissionController.serviceMonitor.secure }}
|
||||
scheme: https
|
||||
tlsConfig:
|
||||
{{- toYaml .Values.admissionController.serviceMonitor.tlsConfig | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.admissionController.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.background-controller.name" -}}
|
||||
{{ template "kyverno.name" . }}-background-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.background-controller.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.background-controller.matchLabels" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.background-controller.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "background-controller")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.background-controller.image" -}}
|
||||
{{- $imageRegistry := default (default .image.defaultRegistry .globalRegistry) .image.registry -}}
|
||||
{{- if $imageRegistry -}}
|
||||
{{ $imageRegistry }}/{{ required "An image repository is required" .image.repository }}:{{ default .defaultTag .image.tag }}
|
||||
{{- else -}}
|
||||
{{ required "An image repository is required" .image.repository }}:{{ default .defaultTag .image.tag }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.background-controller.roleName" -}}
|
||||
{{ include "kyverno.fullname" . }}:background-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.background-controller.serviceAccountName" -}}
|
||||
{{- if .Values.backgroundController.rbac.create -}}
|
||||
{{ default (include "kyverno.background-controller.name" .) .Values.backgroundController.rbac.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ required "A service account name is required when `rbac.create` is set to `false`" .Values.backgroundController.rbac.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.background-controller.caCertificatesConfigMapName" -}}
|
||||
{{ printf "%s-ca-certificates" (include "kyverno.background-controller.name" .) }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,126 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.kyverno.io/aggregate-to-background-controller: "true"
|
||||
- matchLabels:
|
||||
{{- include "kyverno.background-controller.matchLabels" . | nindent 8 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}:core
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- policies
|
||||
- policies/status
|
||||
- clusterpolicies
|
||||
- clusterpolicies/status
|
||||
- policyexceptions
|
||||
- updaterequests
|
||||
- updaterequests/status
|
||||
- globalcontextentries
|
||||
- globalcontextentries/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- generatingpolicies
|
||||
- mutatingpolicies
|
||||
- policyexceptions
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- policyexceptions
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- namespaces
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ''
|
||||
- events.k8s.io
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
{{- with .Values.backgroundController.rbac.coreClusterRole.extraResources }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.rbac.clusterRole.extraResources }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.roleName" $ }}:additional
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.rbac.create -}}
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.background-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.backgroundController.rbac.createViewRoleBinding }}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}:view
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Values.backgroundController.rbac.viewRoleName }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.background-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "kyverno.background-controller.caCertificatesConfigMapName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
data:
|
||||
ca-certificates: |
|
||||
{{ .Values.backgroundController.caCertificates.data | default .Values.global.caCertificates.data | indent 4 | trim }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,227 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if not .Values.global.templating.debug -}}
|
||||
{{- $automountSAToken := .Values.backgroundController.rbac.serviceAccount.automountServiceAccountToken -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.backgroundController.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ template "kyverno.deployment.replicas" .Values.backgroundController.replicas }}
|
||||
revisionHistoryLimit: {{ .Values.backgroundController.revisionHistoryLimit }}
|
||||
{{- with .Values.backgroundController.updateStrategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.background-controller.matchLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 8 }}
|
||||
{{- with .Values.backgroundController.podLabels }}
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.podAnnotations }}
|
||||
annotations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.backgroundController.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.hostNetwork }}
|
||||
hostNetwork: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.dnsPolicy }}
|
||||
dnsPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.backgroundController.antiAffinity.enabled .Values.backgroundController.podAffinity .Values.backgroundController.nodeAffinity }}
|
||||
affinity:
|
||||
{{- if .Values.backgroundController.antiAffinity.enabled }}
|
||||
{{- with .Values.backgroundController.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "kyverno.background-controller.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
containers:
|
||||
- name: controller
|
||||
image: {{ include "kyverno.background-controller.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.backgroundController.image "defaultTag" .Chart.AppVersion) | quote }}
|
||||
imagePullPolicy: {{ .Values.backgroundController.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.backgroundController.server.port }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.backgroundController.metering.port }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{ if .Values.backgroundController.profiling.enabled }}
|
||||
- containerPort: {{ .Values.backgroundController.profiling.port }}
|
||||
name: profiling-port
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
args:
|
||||
{{- if .Values.backgroundController.tracing.enabled }}
|
||||
- --enableTracing
|
||||
- --tracingAddress={{ .Values.backgroundController.tracing.address }}
|
||||
- --tracingPort={{ .Values.backgroundController.tracing.port }}
|
||||
{{- with .Values.backgroundController.tracing.creds }}
|
||||
- --tracingCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- --disableMetrics={{ .Values.backgroundController.metering.disabled }}
|
||||
{{- if not .Values.backgroundController.metering.disabled }}
|
||||
- --otelConfig={{ .Values.backgroundController.metering.config }}
|
||||
- --metricsPort={{ .Values.backgroundController.metering.port }}
|
||||
{{- with .Values.backgroundController.metering.collector }}
|
||||
- --otelCollector={{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.metering.creds }}
|
||||
- --transportCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.imagePullSecrets .Values.existingImagePullSecrets }}
|
||||
- --imagePullSecrets={{- $secretNames := concat (keys .Values.imagePullSecrets | sortAlpha) (.Values.existingImagePullSecrets | sortAlpha) -}}
|
||||
{{- join "," $secretNames -}}
|
||||
{{- end }}
|
||||
- --resyncPeriod={{ .Values.backgroundController.resyncPeriod | default .Values.global.resyncPeriod }}
|
||||
{{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.backgroundController.featuresOverride)
|
||||
"reporting"
|
||||
"configMapCaching"
|
||||
"deferredLoading"
|
||||
"globalContext"
|
||||
"logging"
|
||||
"omitEvents"
|
||||
"policyExceptions"
|
||||
) | nindent 12 }}
|
||||
{{- range $key, $value := .Values.backgroundController.extraArgs }}
|
||||
{{- if $value }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ if .Values.backgroundController.profiling.enabled }}
|
||||
- --profile=true
|
||||
- --profilePort={{ .Values.backgroundController.profiling.port }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: KYVERNO_SERVICEACCOUNT_NAME
|
||||
value: {{ template "kyverno.background-controller.serviceAccountName" . }}
|
||||
- name: KYVERNO_DEPLOYMENT
|
||||
value: {{ template "kyverno.background-controller.name" . }}
|
||||
- name: INIT_CONFIG
|
||||
value: {{ template "kyverno.config.configMapName" . }}
|
||||
- name: METRICS_CONFIG
|
||||
value: {{ template "kyverno.config.metricsConfigMapName" . }}
|
||||
- name: KYVERNO_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: KYVERNO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- with (concat .Values.global.extraEnvVars .Values.backgroundController.extraEnvVars) }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data .Values.backgroundController.caCertificates.volume .Values.global.caCertificates.volume (not $automountSAToken)}}
|
||||
volumeMounts:
|
||||
{{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data .Values.backgroundController.caCertificates.volume .Values.global.caCertificates.volume }}
|
||||
- name: ca-certificates
|
||||
mountPath: /etc/ssl/certs/ca-certificates.crt
|
||||
{{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data }}
|
||||
subPath: ca-certificates.crt
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data .Values.backgroundController.caCertificates.volume .Values.global.caCertificates.volume (not $automountSAToken)}}
|
||||
volumes:
|
||||
{{- if or .Values.backgroundController.caCertificates.data .Values.global.caCertificates.data }}
|
||||
- name: ca-certificates
|
||||
configMap:
|
||||
name: {{ include "kyverno.background-controller.caCertificatesConfigMapName" . }}
|
||||
items:
|
||||
- key: ca-certificates
|
||||
path: ca-certificates.crt
|
||||
{{- else if or .Values.backgroundController.caCertificates.volume .Values.global.caCertificates.volume }}
|
||||
{{- with (.Values.backgroundController.caCertificates.volume | default .Values.global.caCertificates.volume) }}
|
||||
- name: ca-certificates
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.networkPolicy.enabled -}}
|
||||
{{- if .Values.backgroundController.metricsService.create -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.background-controller.matchLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
{{- if .Values.backgroundController.networkPolicy.ingressFrom }}
|
||||
ingress:
|
||||
- from:
|
||||
{{- toYaml .Values.backgroundController.networkPolicy.ingressFrom | nindent 8 }}
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: {{ .Values.backgroundController.metricsService.port }}
|
||||
{{- else }}
|
||||
ingress:
|
||||
- {}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if or .Values.backgroundController.podDisruptionBudget.enabled (gt (int .Values.backgroundController.replicas) 1) -}}
|
||||
apiVersion: {{ template "kyverno.pdb.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- include "kyverno.pdb.spec" .Values.backgroundController.podDisruptionBudget | nindent 2 }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.background-controller.matchLabels" . | nindent 6 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
resourceNames:
|
||||
- {{ include "kyverno.config.configMapName" . }}
|
||||
- {{ include "kyverno.config.metricsConfigMapName" . }}
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- delete
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
resourceNames:
|
||||
- kyverno-background-controller
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,19 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.rbac.create -}}
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "kyverno.background-controller.roleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.background-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,53 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.metricsService.create -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.name" . }}-metrics
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.backgroundController.metricsService.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.backgroundController.metricsService.port }}
|
||||
targetPort: {{ .Values.backgroundController.metering.port }}
|
||||
protocol: TCP
|
||||
name: metrics-port
|
||||
{{- if and (eq .Values.backgroundController.metricsService.type "NodePort") (not (empty .Values.backgroundController.metricsService.nodePort)) }}
|
||||
nodePort: {{ .Values.backgroundController.metricsService.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.background-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.backgroundController.metricsService.type }}
|
||||
{{- if .Values.backgroundController.metricsService.trafficDistribution }}
|
||||
trafficDistribution: {{ .Values.backgroundController.metricsService.trafficDistribution }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.backgroundController.profiling.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.name" . }}-profiling
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.backgroundController.profiling.port }}
|
||||
targetPort: {{ .Values.backgroundController.profiling.port }}
|
||||
protocol: TCP
|
||||
name: profiling-port
|
||||
{{- if and (eq .Values.backgroundController.profiling.serviceType "NodePort") (not (empty .Values.backgroundController.profiling.nodePort)) }}
|
||||
nodePort: {{ .Values.backgroundController.profiling.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.background-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.backgroundController.profiling.serviceType }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.rbac.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.backgroundController.rbac.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,46 @@
|
||||
{{- if .Values.backgroundController.enabled -}}
|
||||
{{- if .Values.backgroundController.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "kyverno.background-controller.name" . }}
|
||||
{{- if .Values.backgroundController.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.backgroundController.serviceMonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.serviceMonitor.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.backgroundController.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.background-controller.matchLabels" . | nindent 6 }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
endpoints:
|
||||
- port: metrics-port
|
||||
interval: {{ .Values.backgroundController.serviceMonitor.interval }}
|
||||
scrapeTimeout: {{ .Values.backgroundController.serviceMonitor.scrapeTimeout }}
|
||||
{{- if .Values.backgroundController.serviceMonitor.secure }}
|
||||
scheme: https
|
||||
tlsConfig:
|
||||
{{- toYaml .Values.backgroundController.serviceMonitor.tlsConfig | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.backgroundController.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,40 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.cleanup-controller.name" -}}
|
||||
{{ template "kyverno.name" . }}-cleanup-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.cleanup-controller.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.cleanup-controller.matchLabels" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.cleanup-controller.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "cleanup-controller")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.cleanup-controller.image" -}}
|
||||
{{- $imageRegistry := default (default .image.defaultRegistry .globalRegistry) .image.registry -}}
|
||||
{{- if $imageRegistry -}}
|
||||
{{ $imageRegistry }}/{{ required "An image repository is required" .image.repository }}:{{ default .defaultTag .image.tag }}
|
||||
{{- else -}}
|
||||
{{ required "An image repository is required" .image.repository }}:{{ default .defaultTag .image.tag }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.cleanup-controller.roleName" -}}
|
||||
{{ include "kyverno.fullname" . }}:cleanup-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.cleanup-controller.serviceAccountName" -}}
|
||||
{{- if .Values.cleanupController.rbac.create -}}
|
||||
{{ default (include "kyverno.cleanup-controller.name" .) .Values.cleanupController.rbac.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ required "A service account name is required when `rbac.create` is set to `false`" .Values.cleanupController.rbac.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,170 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.kyverno.io/aggregate-to-cleanup-controller: "true"
|
||||
- matchLabels:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 8 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" . }}:core
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/policywebhooks
|
||||
- kyverno.io/ttlwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- clustercleanuppolicies
|
||||
- cleanuppolicies
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- deletingpolicies
|
||||
- namespaceddeletingpolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- deletingpolicies/status
|
||||
- namespaceddeletingpolicies/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- policyexceptions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- globalcontextentries
|
||||
- globalcontextentries/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- clustercleanuppolicies/status
|
||||
- cleanuppolicies/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ''
|
||||
- events.k8s.io
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- subjectaccessreviews
|
||||
verbs:
|
||||
- create
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
resourceNames:
|
||||
- {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
- {{ template "kyverno.cleanup-controller.roleName" . }}:core
|
||||
- {{ template "kyverno.cleanup-controller.roleName" . }}:temporary
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- clusterroles
|
||||
- clusterrolebindings
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.rbac.clusterRole.extraResources }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" $ }}:additional
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.rbac.create -}}
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.cleanup-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,228 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if not .Values.global.templating.debug -}}
|
||||
{{- $automountSAToken := .Values.cleanupController.rbac.serviceAccount.automountServiceAccountToken -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/policywebhooks
|
||||
- kyverno.io/ttlwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.cleanupController.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ template "kyverno.deployment.replicas" .Values.cleanupController.replicas }}
|
||||
revisionHistoryLimit: {{ .Values.cleanupController.revisionHistoryLimit }}
|
||||
{{- with .Values.cleanupController.updateStrategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 8 }}
|
||||
{{- with .Values.cleanupController.podLabels }}
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.podAnnotations }}
|
||||
annotations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.cleanupController.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.hostNetwork }}
|
||||
hostNetwork: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.dnsPolicy }}
|
||||
dnsPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.cleanupController.antiAffinity.enabled .Values.cleanupController.podAffinity .Values.cleanupController.nodeAffinity }}
|
||||
affinity:
|
||||
{{- if .Values.cleanupController.antiAffinity.enabled }}
|
||||
{{- with .Values.cleanupController.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "kyverno.cleanup-controller.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
containers:
|
||||
- name: controller
|
||||
image: {{ include "kyverno.cleanup-controller.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.cleanupController.image "defaultTag" .Chart.AppVersion) | quote }}
|
||||
imagePullPolicy: {{ .Values.cleanupController.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.cleanupController.server.port }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.cleanupController.metering.port }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{ if .Values.cleanupController.profiling.enabled }}
|
||||
- containerPort: {{ .Values.cleanupController.profiling.port }}
|
||||
name: profiling-port
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
args:
|
||||
- --caSecretName={{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca
|
||||
- --tlsSecretName={{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair
|
||||
- --servicePort={{ .Values.cleanupController.service.port }}
|
||||
- --resyncPeriod={{ .Values.cleanupController.resyncPeriod | default .Values.global.resyncPeriod }}
|
||||
- --cleanupServerPort={{ .Values.cleanupController.server.port }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
- --autoDeleteWebhooks
|
||||
{{- end }}
|
||||
{{- if .Values.cleanupController.tracing.enabled }}
|
||||
- --enableTracing
|
||||
- --tracingAddress={{ .Values.cleanupController.tracing.address }}
|
||||
- --tracingPort={{ .Values.cleanupController.tracing.port }}
|
||||
{{- with .Values.cleanupController.tracing.creds }}
|
||||
- --tracingCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- --disableMetrics={{ .Values.cleanupController.metering.disabled }}
|
||||
{{- if not .Values.cleanupController.metering.disabled }}
|
||||
- --otelConfig={{ .Values.cleanupController.metering.config }}
|
||||
- --metricsPort={{ .Values.cleanupController.metering.port }}
|
||||
{{- with .Values.cleanupController.metering.collector }}
|
||||
- --otelCollector={{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.metering.creds }}
|
||||
- --transportCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.cleanupController.featuresOverride)
|
||||
"deferredLoading"
|
||||
"dumpPayload"
|
||||
"globalContext"
|
||||
"logging"
|
||||
"ttlController"
|
||||
"protectManagedResources"
|
||||
) | nindent 12 }}
|
||||
{{- range $key, $value := .Values.cleanupController.extraArgs }}
|
||||
{{- if $value }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ if .Values.cleanupController.profiling.enabled }}
|
||||
- --profile=true
|
||||
- --profilePort={{ .Values.cleanupController.profiling.port }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: KYVERNO_DEPLOYMENT
|
||||
value: {{ template "kyverno.cleanup-controller.name" . }}
|
||||
- name: INIT_CONFIG
|
||||
value: {{ template "kyverno.config.configMapName" . }}
|
||||
- name: METRICS_CONFIG
|
||||
value: {{ template "kyverno.config.metricsConfigMapName" . }}
|
||||
- name: KYVERNO_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: KYVERNO_SERVICEACCOUNT_NAME
|
||||
value: {{ template "kyverno.cleanup-controller.serviceAccountName" . }}
|
||||
- name: KYVERNO_ROLE_NAME
|
||||
value: {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
- name: KYVERNO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KYVERNO_SVC
|
||||
value: {{ template "kyverno.cleanup-controller.name" . }}
|
||||
{{- with (concat .Values.global.extraEnvVars .Values.cleanupController.extraEnvVars) }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.startupProbe }}
|
||||
startupProbe:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumeMounts:
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumes:
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,33 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.networkPolicy.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
{{- if .Values.cleanupController.networkPolicy.ingressFrom }}
|
||||
ingress:
|
||||
- from:
|
||||
{{- toYaml .Values.cleanupController.networkPolicy.ingressFrom | nindent 8 }}
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9443 # webhook access
|
||||
# Allow prometheus scrapes for metrics
|
||||
{{- if .Values.cleanupController.metricsService.create }}
|
||||
- protocol: TCP
|
||||
port: {{ .Values.cleanupController.metricsService.port }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
ingress:
|
||||
- {}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if or .Values.cleanupController.podDisruptionBudget.enabled (gt (int .Values.cleanupController.replicas) 1) -}}
|
||||
apiVersion: {{ template "kyverno.pdb.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- include "kyverno.pdb.spec" .Values.cleanupController.podDisruptionBudget | nindent 2 }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 6 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,119 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/policywebhooks
|
||||
- kyverno.io/ttlwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- watch
|
||||
resourceNames:
|
||||
- {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca
|
||||
- {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- watch
|
||||
resourceNames:
|
||||
- {{ template "kyverno.cleanup-controller.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
resourceNames:
|
||||
- {{ include "kyverno.config.configMapName" . }}
|
||||
- {{ include "kyverno.config.metricsConfigMapName" . }}
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- delete
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
resourceNames:
|
||||
- kyverno-cleanup-controller
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
resourceNames:
|
||||
- {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
- {{ template "kyverno.cleanup-controller.roleName" . }}:temporary
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- rbac.authorization.k8s.io
|
||||
resources:
|
||||
- roles
|
||||
- rolebindings
|
||||
verbs:
|
||||
- create
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
- patch
|
||||
- update
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.rbac.create -}}
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/policywebhooks
|
||||
- kyverno.io/ttlwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "kyverno.cleanup-controller.roleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.cleanup-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.createSelfSignedCert -}}
|
||||
{{- $ca := genCA (printf "*.%s.svc" (include "kyverno.namespace" .)) 1024 -}}
|
||||
{{- $svcName := (printf "%s.%s.svc" (include "kyverno.cleanup-controller.name" .) (include "kyverno.namespace" .)) -}}
|
||||
{{- $cert := genSignedCert $svcName nil (list $svcName) 1024 $ca -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.key: {{ $ca.Key | b64enc }}
|
||||
tls.crt: {{ $ca.Cert | b64enc }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
self-signed-cert: "true"
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.key: {{ $cert.Key | b64enc }}
|
||||
tls.crt: {{ $cert.Cert | b64enc }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,81 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.cleanupController.service.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.cleanupController.service.port }}
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
name: https
|
||||
appProtocol: https
|
||||
{{- if and (eq .Values.cleanupController.service.type "NodePort") (not (empty .Values.cleanupController.service.nodePort)) }}
|
||||
nodePort: {{ .Values.cleanupController.service.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.cleanupController.service.type }}
|
||||
{{- if .Values.cleanupController.service.trafficDistribution }}
|
||||
trafficDistribution: {{ .Values.cleanupController.service.trafficDistribution }}
|
||||
{{- end }}
|
||||
{{- if .Values.cleanupController.metricsService.create }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}-metrics
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.cleanupController.metricsService.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.cleanupController.metricsService.port }}
|
||||
targetPort: {{ .Values.cleanupController.metering.port }}
|
||||
protocol: TCP
|
||||
name: metrics-port
|
||||
{{- if and (eq .Values.cleanupController.metricsService.type "NodePort") (not (empty .Values.cleanupController.metricsService.nodePort)) }}
|
||||
nodePort: {{ .Values.cleanupController.metricsService.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.cleanupController.metricsService.type }}
|
||||
{{- if .Values.cleanupController.metricsService.trafficDistribution }}
|
||||
trafficDistribution: {{ .Values.cleanupController.metricsService.trafficDistribution }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- if .Values.cleanupController.profiling.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}-profiling
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.cleanupController.profiling.port }}
|
||||
targetPort: {{ .Values.cleanupController.profiling.port }}
|
||||
protocol: TCP
|
||||
name: profiling-port
|
||||
{{- if and (eq .Values.cleanupController.profiling.serviceType "NodePort") (not (empty .Values.cleanupController.profiling.nodePort)) }}
|
||||
nodePort: {{ .Values.cleanupController.profiling.nodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 4 }}
|
||||
type: {{ .Values.cleanupController.profiling.serviceType }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.rbac.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.webhooksCleanup.autoDeleteWebhooks.enabled }}
|
||||
{{- if not .Values.global.templating.enabled }}
|
||||
finalizers:
|
||||
- kyverno.io/policywebhooks
|
||||
- kyverno.io/ttlwebhooks
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.cleanupController.rbac.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,46 @@
|
||||
{{- if .Values.cleanupController.enabled -}}
|
||||
{{- if .Values.cleanupController.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "kyverno.cleanup-controller.name" . }}
|
||||
{{- if .Values.cleanupController.serviceMonitor.namespace }}
|
||||
namespace: {{ .Values.cleanupController.serviceMonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.serviceMonitor.additionalAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.cleanupController.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.cleanup-controller.matchLabels" . | nindent 6 }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
endpoints:
|
||||
- port: metrics-port
|
||||
interval: {{ .Values.cleanupController.serviceMonitor.interval }}
|
||||
scrapeTimeout: {{ .Values.cleanupController.serviceMonitor.scrapeTimeout }}
|
||||
{{- if .Values.cleanupController.serviceMonitor.secure }}
|
||||
scheme: https
|
||||
tlsConfig:
|
||||
{{- toYaml .Values.cleanupController.serviceMonitor.tlsConfig | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cleanupController.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,84 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.config.configMapName" -}}
|
||||
{{- if .Values.config.create -}}
|
||||
{{ default (include "kyverno.fullname" .) .Values.config.name }}
|
||||
{{- else -}}
|
||||
{{ required "A configmap name is required when `config.create` is set to `false`" .Values.config.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.config.metricsConfigMapName" -}}
|
||||
{{- if .Values.metricsConfig.create -}}
|
||||
{{ default (printf "%s-metrics" (include "kyverno.fullname" .)) .Values.metricsConfig.name }}
|
||||
{{- else -}}
|
||||
{{ required "A configmap name is required when `metricsConfig.create` is set to `false`" .Values.metricsConfig.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.config.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.config.matchLabels" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.config.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "config")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.config.resourceFilters" -}}
|
||||
{{- $resourceFilters := .Values.config.resourceFilters -}}
|
||||
{{- if .Values.config.excludeKyvernoNamespace -}}
|
||||
{{- $resourceFilters = prepend .Values.config.resourceFilters (printf "[*/*,%s,*]" (include "kyverno.namespace" .)) -}}
|
||||
{{- end -}}
|
||||
{{- range $resourceExclude := .Values.config.resourceFiltersExclude -}}
|
||||
{{- $resourceFilters = without $resourceFilters $resourceExclude -}}
|
||||
{{- end -}}
|
||||
{{- range $exclude := .Values.config.resourceFiltersExcludeNamespaces -}}
|
||||
{{- range $filter := $resourceFilters -}}
|
||||
{{- if (contains (printf ",%s," $exclude) $filter) -}}
|
||||
{{- $resourceFilters = without $resourceFilters $filter -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $resourceFilters = concat $resourceFilters .Values.config.resourceFiltersInclude -}}
|
||||
{{- range $include := .Values.config.resourceFiltersIncludeNamespaces -}}
|
||||
{{- $resourceFilters = append $resourceFilters (printf "[*/*,%s,*]" $include) -}}
|
||||
{{- end -}}
|
||||
{{- range $resourceFilter := $resourceFilters }}
|
||||
{{ tpl $resourceFilter $ }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.config.webhooks" -}}
|
||||
{{- $excludeDefault := dict "key" "kubernetes.io/metadata.name" "operator" "NotIn" "values" (list (include "kyverno.namespace" .)) }}
|
||||
{{- $webhooks := .Values.config.webhooks -}}
|
||||
{{- if $webhooks | typeIs "slice" -}}
|
||||
{{- $newWebhooks := dict -}}
|
||||
{{- range $index, $webhook := $webhooks -}}
|
||||
{{- if $webhook.namespaceSelector -}}
|
||||
{{- $namespaceSelector := $webhook.namespaceSelector }}
|
||||
{{- $matchExpressions := default (list) $namespaceSelector.matchExpressions }}
|
||||
{{- $newNamespaceSelector := dict "matchLabels" $namespaceSelector.matchLabels "matchExpressions" (append $matchExpressions $excludeDefault) }}
|
||||
{{- $newWebhook := merge (omit $webhook "namespaceSelector") (dict "namespaceSelector" $newNamespaceSelector) }}
|
||||
{{- $newWebhooks = merge $newWebhooks (dict $webhook.name $newWebhook) }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $newWebhooks | toJson }}
|
||||
{{- else -}}
|
||||
{{- $webhook := $webhooks }}
|
||||
{{- $namespaceSelector := default (dict) $webhook.namespaceSelector }}
|
||||
{{- $matchExpressions := default (list) $namespaceSelector.matchExpressions }}
|
||||
{{- $newNamespaceSelector := dict "matchLabels" $namespaceSelector.matchLabels "matchExpressions" (append $matchExpressions $excludeDefault) }}
|
||||
{{- $newWebhook := merge (omit $webhook "namespaceSelector") (dict "namespaceSelector" $newNamespaceSelector) }}
|
||||
{{- $newWebhook | toJson }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.config.imagePullSecret" -}}
|
||||
{{- printf "{\"auths\":{\"%s\":{\"auth\":\"%s\"}}}" .registry (printf "%s:%s" .username .password | b64enc) | b64enc }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,57 @@
|
||||
{{- if .Values.config.create -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kyverno.config.configMapName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.config.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.config.preserve }}
|
||||
helm.sh/resource-policy: "keep"
|
||||
{{- end }}
|
||||
data:
|
||||
enableDefaultRegistryMutation: {{ .Values.config.enableDefaultRegistryMutation | quote }}
|
||||
{{- with .Values.config.defaultRegistry }}
|
||||
defaultRegistry: {{ . | quote }}
|
||||
{{- end }}
|
||||
generateSuccessEvents: {{ .Values.config.generateSuccessEvents | quote }}
|
||||
{{- with .Values.config.excludeGroups }}
|
||||
excludeGroups: {{ join "," . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.config.excludeUsernames }}
|
||||
excludeUsernames: {{ join "," . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.config.excludeRoles }}
|
||||
excludeRoles: {{ join "," . | quote }}
|
||||
{{- end -}}
|
||||
{{- with .Values.config.excludeClusterRoles }}
|
||||
excludeClusterRoles: {{ join "," . | quote }}
|
||||
{{- end -}}
|
||||
{{- if .Values.config.resourceFilters }}
|
||||
resourceFilters: >-
|
||||
{{- include "kyverno.config.resourceFilters" . | trim | nindent 4 }}
|
||||
{{- end -}}
|
||||
{{- with .Values.config.updateRequestThreshold }}
|
||||
updateRequestThreshold: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- if and .Values.config.webhooks .Values.config.excludeKyvernoNamespace }}
|
||||
webhooks: {{ include "kyverno.config.webhooks" . | quote }}
|
||||
{{- else if .Values.config.webhooks }}
|
||||
webhooks: {{ .Values.config.webhooks | toJson | quote }}
|
||||
{{- else if .Values.config.excludeKyvernoNamespace }}
|
||||
webhooks: '{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["{{ include "kyverno.namespace" . }}"]}]}}'
|
||||
{{- end -}}
|
||||
{{- with .Values.config.webhookAnnotations }}
|
||||
webhookAnnotations: {{ toJson . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.webhookLabels }}
|
||||
webhookLabels: {{ toJson . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.matchConditions }}
|
||||
matchConditions: {{ toJson . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{ range $name, $secret := .Values.imagePullSecrets }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $name }}
|
||||
namespace: {{ template "kyverno.namespace" $ }}
|
||||
labels:
|
||||
{{- include "kyverno.config.labels" $ | nindent 4 }}
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
.dockerconfigjson: {{ template "kyverno.config.imagePullSecret" $secret }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- if .Values.metricsConfig.create -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kyverno.config.metricsConfigMapName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.config.labels" . | nindent 4 }}
|
||||
{{- with .Values.metricsConfig.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- with .Values.metricsConfig.namespaces }}
|
||||
namespaces: {{ toJson . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.metricsConfig.metricsRefreshInterval }}
|
||||
metricsRefreshInterval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.metricsConfig.metricsExposure }}
|
||||
metricsExposure: {{ toJson . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.metricsConfig.bucketBoundaries }}
|
||||
bucketBoundaries: {{ join ", " . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,15 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.hooks.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.hooks.matchLabels" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.hooks.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "hooks")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,182 @@
|
||||
{{- if .Values.crds.migration.enabled -}}
|
||||
{{- if not .Values.global.templating.enabled -}}
|
||||
{{- $automountSAToken := .Values.crds.migration.serviceAccount.automountServiceAccountToken }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}:migrate-resources
|
||||
labels:
|
||||
{{- include "kyverno.hooks.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: post-upgrade
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
|
||||
helm.sh/hook-weight: "100"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions/status
|
||||
verbs:
|
||||
- update
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}:migrate-resources
|
||||
labels:
|
||||
{{- include "kyverno.hooks.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: post-upgrade
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
|
||||
helm.sh/hook-weight: "100"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "kyverno.fullname" . }}:migrate-resources
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.fullname" . }}-migrate-resources
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-migrate-resources
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.hooks.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: post-upgrade
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
helm.sh/hook-weight: "100"
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-migrate-resources
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.hooks.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: post-upgrade
|
||||
# helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
|
||||
helm.sh/hook-weight: "200"
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
{{- if or .Values.crds.migration.podAnnotations .Values.crds.migration.podLabels }}
|
||||
metadata:
|
||||
{{- with .Values.crds.migration.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.podLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "kyverno.fullname" . }}-migrate-resources
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
{{- with .Values.crds.migration.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.crds.migration.image "defaultTag" (default .Chart.AppVersion .Values.crds.migration.image.tag))) | quote }}
|
||||
imagePullPolicy: {{ .Values.crds.migration.image.pullPolicy }}
|
||||
args:
|
||||
- migrate
|
||||
{{- range .Values.crds.migration.resources }}
|
||||
- --resource
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.podResources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumeMounts:
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.crds.migration.podAntiAffinity .Values.crds.migration.podAffinity .Values.crds.migration.nodeAffinity }}
|
||||
affinity:
|
||||
{{- with .Values.crds.migration.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.crds.migration.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumes:
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
+110
@@ -0,0 +1,110 @@
|
||||
{{- if .Values.webhooksCleanup.enabled -}}
|
||||
{{- if not .Values.global.templating.enabled -}}
|
||||
{{- $automountSAToken := .Values.admissionController.rbac.serviceAccount.automountServiceAccountToken }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-rm-mutatingwhconfig
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.hooks.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: pre-delete
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
|
||||
helm.sh/hook-weight: "100"
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
{{- if or .Values.webhooksCleanup.podAnnotations .Values.webhooksCleanup.podLabels }}
|
||||
metadata:
|
||||
{{- with .Values.webhooksCleanup.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.podLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
{{- with .Values.webhooksCleanup.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.webhooksCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.webhooksCleanup.image "defaultTag" (default .Chart.AppVersion .Values.webhooksCleanup.image.tag))) | quote }}
|
||||
imagePullPolicy: {{ .Values.webhooksCleanup.image.pullPolicy }}
|
||||
command:
|
||||
- kubectl
|
||||
- delete
|
||||
- mutatingwebhookconfiguration
|
||||
- -l
|
||||
- webhook.kyverno.io/managed-by=kyverno
|
||||
{{- with .Values.webhooksCleanup.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumeMounts:
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.webhooksCleanup.podAntiAffinity .Values.webhooksCleanup.podAffinity .Values.webhooksCleanup.nodeAffinity }}
|
||||
affinity:
|
||||
{{- with .Values.webhooksCleanup.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumes:
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
+110
@@ -0,0 +1,110 @@
|
||||
{{- if .Values.webhooksCleanup.enabled -}}
|
||||
{{- if not .Values.global.templating.enabled -}}
|
||||
{{- $automountSAToken := .Values.admissionController.rbac.serviceAccount.automountServiceAccountToken }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-rm-validatingwhconfig
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.hooks.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: pre-delete
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
|
||||
helm.sh/hook-weight: "100"
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
{{- if or .Values.webhooksCleanup.podAnnotations .Values.webhooksCleanup.podLabels }}
|
||||
metadata:
|
||||
{{- with .Values.webhooksCleanup.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.podLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
{{- with .Values.webhooksCleanup.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.webhooksCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.webhooksCleanup.image "defaultTag" (default .Chart.AppVersion .Values.webhooksCleanup.image.tag))) | quote }}
|
||||
imagePullPolicy: {{ .Values.webhooksCleanup.image.pullPolicy }}
|
||||
command:
|
||||
- kubectl
|
||||
- delete
|
||||
- validatingwebhookconfiguration
|
||||
- -l
|
||||
- webhook.kyverno.io/managed-by=kyverno
|
||||
{{- with .Values.webhooksCleanup.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumeMounts:
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.webhooksCleanup.podAntiAffinity .Values.webhooksCleanup.podAffinity .Values.webhooksCleanup.nodeAffinity }}
|
||||
affinity:
|
||||
{{- with .Values.webhooksCleanup.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumes:
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,114 @@
|
||||
{{- if .Values.webhooksCleanup.enabled -}}
|
||||
{{- if not .Values.global.templating.enabled -}}
|
||||
{{- $automountSAToken := .Values.admissionController.rbac.serviceAccount.automountServiceAccountToken }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "kyverno.fullname" . }}-scale-to-zero
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.hooks.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
helm.sh/hook: pre-delete
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
|
||||
{{/* Make sure this runs before other pre-delete jobs that removes webhooksconfiguration*/}}
|
||||
helm.sh/hook-weight: "90"
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
{{- if or .Values.webhooksCleanup.podAnnotations .Values.webhooksCleanup.podLabels }}
|
||||
metadata:
|
||||
{{- with .Values.webhooksCleanup.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.podLabels }}
|
||||
labels:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "kyverno.admission-controller.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
{{- with .Values.webhooksCleanup.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- with .Values.webhooksCleanup.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: {{ (include "kyverno.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.webhooksCleanup.image "defaultTag" (default .Chart.AppVersion .Values.webhooksCleanup.image.tag))) | quote }}
|
||||
imagePullPolicy: {{ .Values.webhooksCleanup.image.pullPolicy }}
|
||||
command:
|
||||
- kubectl
|
||||
- scale
|
||||
- -n
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
- deployment
|
||||
- -l
|
||||
- app.kubernetes.io/part-of={{ template "kyverno.fullname" . }}
|
||||
- --replicas=0
|
||||
{{- with .Values.webhooksCleanup.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumeMounts:
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.webhooksCleanup.podAntiAffinity .Values.webhooksCleanup.podAffinity .Values.webhooksCleanup.nodeAffinity }}
|
||||
affinity:
|
||||
{{- with .Values.webhooksCleanup.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhooksCleanup.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
volumes:
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.rbac.labels.admin" -}}
|
||||
{{- $labels := list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.rbac.matchLabels" .)
|
||||
-}}
|
||||
{{- if .Values.rbac.roles.aggregate.admin -}}
|
||||
{{- $labels = append $labels "rbac.authorization.k8s.io/aggregate-to-admin: 'true'" -}}
|
||||
{{- end -}}
|
||||
{{- template "kyverno.labels.merge" $labels -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{- define "kyverno.rbac.labels.view" -}}
|
||||
{{- $labels := list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.rbac.matchLabels" .)
|
||||
-}}
|
||||
{{- if .Values.rbac.roles.aggregate.view -}}
|
||||
{{- $labels = append $labels "rbac.authorization.k8s.io/aggregate-to-view: 'true'" -}}
|
||||
{{- end -}}
|
||||
{{- template "kyverno.labels.merge" $labels -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.rbac.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "rbac")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.rbac.roleName" -}}
|
||||
{{ include "kyverno.fullname" . }}:rbac
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:policies
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- cleanuppolicies
|
||||
- clustercleanuppolicies
|
||||
- policies
|
||||
- clusterpolicies
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:policies
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- cleanuppolicies
|
||||
- clustercleanuppolicies
|
||||
- policies
|
||||
- clusterpolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:policyreports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
resources:
|
||||
- policyreports
|
||||
- clusterpolicyreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:policyreports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
resources:
|
||||
- policyreports
|
||||
- clusterpolicyreports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:reports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:reports
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,37 @@
|
||||
{{- if .Values.admissionController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:admin:updaterequests
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.admin" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- updaterequests
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.rbac.roleName" . }}:view:updaterequests
|
||||
labels:
|
||||
{{- include "kyverno.rbac.labels.view" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- updaterequests
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{- define "kyverno.reports-controller.name" -}}
|
||||
{{ template "kyverno.name" . }}-reports-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.reports-controller.labels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.labels.common" .)
|
||||
(include "kyverno.reports-controller.matchLabels" .)
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.reports-controller.matchLabels" -}}
|
||||
{{- template "kyverno.labels.merge" (list
|
||||
(include "kyverno.matchLabels.common" .)
|
||||
(include "kyverno.labels.component" "reports-controller")
|
||||
) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.reports-controller.image" -}}
|
||||
{{- $imageRegistry := default (default .image.defaultRegistry .globalRegistry) .image.registry -}}
|
||||
{{- if $imageRegistry -}}
|
||||
{{ $imageRegistry }}/{{ required "An image repository is required" .image.repository }}:{{ default .defaultTag .image.tag }}
|
||||
{{- else -}}
|
||||
{{ required "An image repository is required" .image.repository }}:{{ default .defaultTag .image.tag }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.reports-controller.roleName" -}}
|
||||
{{ include "kyverno.fullname" . }}:reports-controller
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.reports-controller.serviceAccountName" -}}
|
||||
{{- if .Values.reportsController.rbac.create -}}
|
||||
{{ default (include "kyverno.reports-controller.name" .) .Values.reportsController.rbac.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ required "A service account name is required when `rbac.create` is set to `false`" .Values.reportsController.rbac.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kyverno.reports-controller.caCertificatesConfigMapName" -}}
|
||||
{{ printf "%s-ca-certificates" (include "kyverno.reports-controller.name" .) }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,186 @@
|
||||
{{- if .Values.reportsController.enabled -}}
|
||||
{{- if .Values.reportsController.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
aggregationRule:
|
||||
clusterRoleSelectors:
|
||||
- matchLabels:
|
||||
rbac.kyverno.io/aggregate-to-reports-controller: "true"
|
||||
- matchLabels:
|
||||
{{- include "kyverno.reports-controller.matchLabels" . | nindent 8 }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.roleName" . }}:core
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ''
|
||||
resources:
|
||||
- configmaps
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- kyverno.io
|
||||
resources:
|
||||
- globalcontextentries
|
||||
- globalcontextentries/status
|
||||
- policyexceptions
|
||||
- policies
|
||||
- clusterpolicies
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- validatingpolicies
|
||||
- validatingpolicies/status
|
||||
- namespacedvalidatingpolicies
|
||||
- namespacedvalidatingpolicies/status
|
||||
- imagevalidatingpolicies
|
||||
- imagevalidatingpolicies/status
|
||||
- namespacedimagevalidatingpolicies
|
||||
- namespacedimagevalidatingpolicies/status
|
||||
- generatingpolicies
|
||||
- mutatingpolicies
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- policies.kyverno.io
|
||||
resources:
|
||||
- policyexceptions
|
||||
- policyexceptions/status
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.features.validatingAdmissionPolicyReports.enabled }}
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingadmissionpolicies
|
||||
- validatingadmissionpolicybindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- if .Values.features.mutatingAdmissionPolicyReports.enabled }}
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- mutatingadmissionpolicies
|
||||
- mutatingadmissionpolicybindings
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
resources:
|
||||
- ephemeralreports
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- openreports.io
|
||||
resources:
|
||||
- reports
|
||||
- reports/status
|
||||
- clusterreports
|
||||
- clusterreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- ''
|
||||
- events.k8s.io
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
{{- with .Values.reportsController.rbac.coreClusterRole.extraResources }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.rbac.clusterRole.extraResources }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.roleName" $ }}:additional
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" $ | nindent 4 }}
|
||||
rules:
|
||||
{{- range . }}
|
||||
- apiGroups:
|
||||
{{- toYaml .apiGroups | nindent 6 }}
|
||||
resources:
|
||||
{{- toYaml .resources | nindent 6 }}
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{- if .Values.reportsController.enabled -}}
|
||||
{{- if .Values.reportsController.rbac.create -}}
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.roleName" . }}
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "kyverno.reports-controller.roleName" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.reports-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- if .Values.reportsController.rbac.createViewRoleBinding }}
|
||||
---
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.roleName" . }}:view
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Values.reportsController.rbac.viewRoleName }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kyverno.reports-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if or .Values.reportsController.caCertificates.data .Values.global.caCertificates.data -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "kyverno.reports-controller.caCertificatesConfigMapName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||
data:
|
||||
ca-certificates: |
|
||||
{{ .Values.reportsController.caCertificates.data | default .Values.global.caCertificates.data | indent 4 | trim }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,242 @@
|
||||
{{- if .Values.reportsController.enabled -}}
|
||||
{{- include "kyverno.validateOpenReports" . -}}
|
||||
{{- if not .Values.global.templating.debug -}}
|
||||
{{- $automountSAToken := .Values.reportsController.rbac.serviceAccount.automountServiceAccountToken }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.reportsController.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ template "kyverno.deployment.replicas" .Values.reportsController.replicas }}
|
||||
revisionHistoryLimit: {{ .Values.reportsController.revisionHistoryLimit }}
|
||||
{{- with .Values.reportsController.updateStrategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.reports-controller.matchLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 8 }}
|
||||
{{- with .Values.reportsController.podLabels }}
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.podAnnotations }}
|
||||
annotations: {{ tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.reportsController.imagePullSecrets | default .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- tpl (include "kyverno.sortedImagePullSecrets" .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.nodeSelector | default .Values.global.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.tolerations | default .Values.global.tolerations}}
|
||||
tolerations:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.hostNetwork }}
|
||||
hostNetwork: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.dnsPolicy }}
|
||||
dnsPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.reportsController.antiAffinity.enabled .Values.reportsController.podAffinity .Values.reportsController.nodeAffinity }}
|
||||
affinity:
|
||||
{{- if .Values.reportsController.antiAffinity.enabled }}
|
||||
{{- with .Values.reportsController.podAntiAffinity }}
|
||||
podAntiAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.podAffinity }}
|
||||
podAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.nodeAffinity }}
|
||||
nodeAffinity:
|
||||
{{- tpl (toYaml .) $ | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "kyverno.reports-controller.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ $automountSAToken }}
|
||||
containers:
|
||||
- name: controller
|
||||
image: {{ include "kyverno.reports-controller.image" (dict "globalRegistry" .Values.global.image.registry "image" .Values.reportsController.image "defaultTag" .Chart.AppVersion) | quote }}
|
||||
imagePullPolicy: {{ .Values.reportsController.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.reportsController.server.port }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.reportsController.metering.port }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{ if .Values.reportsController.profiling.enabled }}
|
||||
- containerPort: {{ .Values.reportsController.profiling.port }}
|
||||
name: profiling-port
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
args:
|
||||
{{- if .Values.reportsController.tracing.enabled }}
|
||||
- --enableTracing
|
||||
- --tracingAddress={{ .Values.reportsController.tracing.address }}
|
||||
- --tracingPort={{ .Values.reportsController.tracing.port }}
|
||||
{{- with .Values.reportsController.tracing.creds }}
|
||||
- --tracingCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- --disableMetrics={{ .Values.reportsController.metering.disabled }}
|
||||
- --openreportsEnabled={{ .Values.openreports.enabled }}
|
||||
{{- if not .Values.reportsController.metering.disabled }}
|
||||
- --otelConfig={{ .Values.reportsController.metering.config }}
|
||||
- --metricsPort={{ .Values.reportsController.metering.port }}
|
||||
{{- with .Values.reportsController.metering.collector }}
|
||||
- --otelCollector={{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.metering.creds }}
|
||||
- --transportCreds={{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.imagePullSecrets .Values.existingImagePullSecrets }}
|
||||
- --imagePullSecrets={{- $secretNames := concat (keys .Values.imagePullSecrets | sortAlpha) (.Values.existingImagePullSecrets | sortAlpha) -}}
|
||||
{{- join "," $secretNames -}}
|
||||
{{- end }}
|
||||
- --resyncPeriod={{ .Values.reportsController.resyncPeriod | default .Values.global.resyncPeriod }}
|
||||
{{- include "kyverno.features.flags" (pick (mergeOverwrite (deepCopy .Values.features) .Values.reportsController.featuresOverride)
|
||||
"reporting"
|
||||
"admissionReports"
|
||||
"aggregateReports"
|
||||
"policyReports"
|
||||
"validatingAdmissionPolicyReports"
|
||||
"mutatingAdmissionPolicyReports"
|
||||
"backgroundScan"
|
||||
"configMapCaching"
|
||||
"deferredLoading"
|
||||
"globalContext"
|
||||
"logging"
|
||||
"omitEvents"
|
||||
"policyExceptions"
|
||||
"registryClient"
|
||||
"tuf"
|
||||
) | nindent 12 }}
|
||||
{{- range $key, $value := .Values.reportsController.extraArgs }}
|
||||
{{- if $value }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.reportsController.profiling.enabled }}
|
||||
- --profile=true
|
||||
- --profilePort={{ .Values.reportsController.profiling.port }}
|
||||
{{- end }}
|
||||
{{- if or (not .Values.reportsController.sanityChecks) .Values.crds.reportsServer.enabled }}
|
||||
- --reportsCRDsSanityChecks=false
|
||||
{{- end }}
|
||||
env:
|
||||
- name: KYVERNO_SERVICEACCOUNT_NAME
|
||||
value: {{ template "kyverno.reports-controller.serviceAccountName" . }}
|
||||
- name: KYVERNO_DEPLOYMENT
|
||||
value: {{ template "kyverno.reports-controller.name" . }}
|
||||
- name: INIT_CONFIG
|
||||
value: {{ template "kyverno.config.configMapName" . }}
|
||||
- name: METRICS_CONFIG
|
||||
value: {{ template "kyverno.config.metricsConfigMapName" . }}
|
||||
- name: KYVERNO_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: KYVERNO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: TUF_ROOT
|
||||
value: {{ .Values.reportsController.tufRootMountPath }}
|
||||
{{- with (concat .Values.global.extraEnvVars .Values.reportsController.extraEnvVars) }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.resources }}
|
||||
resources:
|
||||
{{- tpl (toYaml .) $ | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.reportsController.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: {{ .Values.reportsController.tufRootMountPath }}
|
||||
name: sigstore
|
||||
{{- if or .Values.reportsController.caCertificates.data .Values.global.caCertificates.data .Values.reportsController.caCertificates.volume .Values.global.caCertificates.volume }}
|
||||
- name: ca-certificates
|
||||
mountPath: /etc/ssl/certs/ca-certificates.crt
|
||||
{{- if or .Values.reportsController.caCertificates.data .Values.global.caCertificates.data }}
|
||||
subPath: ca-certificates.crt
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
- name: serviceaccount-token
|
||||
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: sigstore
|
||||
{{- toYaml (required "A valid .Values.reportsController.sigstoreVolume entry is required" .Values.reportsController.sigstoreVolume) | nindent 8 }}
|
||||
{{- if or .Values.reportsController.caCertificates.data .Values.global.caCertificates.data }}
|
||||
- name: ca-certificates
|
||||
configMap:
|
||||
name: {{ include "kyverno.reports-controller.caCertificatesConfigMapName" . }}
|
||||
items:
|
||||
- key: ca-certificates
|
||||
path: ca-certificates.crt
|
||||
{{- else if or .Values.reportsController.caCertificates.volume .Values.global.caCertificates.volume }}
|
||||
{{- with (.Values.reportsController.caCertificates.volume | default .Values.global.caCertificates.volume) }}
|
||||
- name: ca-certificates
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $automountSAToken }}
|
||||
- name: serviceaccount-token
|
||||
projected:
|
||||
defaultMode: 0444
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
name: kube-root-ca.crt
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: namespace
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,120 @@
|
||||
{{- if .Values.reportsController.apiPriorityAndFairness }}
|
||||
apiVersion: {{ template "kyverno.flowcontrol.apiVersion" . }}
|
||||
kind: FlowSchema
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.name" . }}
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
priorityLevelConfiguration:
|
||||
name: {{ template "kyverno.reports-controller.name" . }}
|
||||
rules:
|
||||
- resourceRules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- clusterephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- reports.kyverno.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- ephemeralreports
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
clusterScope: true
|
||||
resources:
|
||||
- clusterpolicyreports
|
||||
- clusterpolicyreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- wgpolicyk8s.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- policyreports
|
||||
- policyreports/status
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- ''
|
||||
- events.k8s.io
|
||||
namespaces:
|
||||
- '*'
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ''
|
||||
namespaces:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
namespaces:
|
||||
- {{ template "kyverno.namespace" . }}
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
serviceAccount:
|
||||
name: {{ template "kyverno.reports-controller.serviceAccountName" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- if .Values.reportsController.enabled -}}
|
||||
{{- if .Values.reportsController.networkPolicy.enabled -}}
|
||||
{{- if .Values.reportsController.metricsService.create -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.reports-controller.matchLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
{{- if .Values.reportsController.networkPolicy.ingressFrom }}
|
||||
ingress:
|
||||
- from:
|
||||
{{- toYaml .Values.reportsController.networkPolicy.ingressFrom | nindent 8 }}
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: {{ .Values.reportsController.metricsService.port }}
|
||||
{{- else }}
|
||||
ingress:
|
||||
- {}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if .Values.reportsController.enabled -}}
|
||||
{{- if or .Values.reportsController.podDisruptionBudget.enabled (gt (int .Values.reportsController.replicas) 1) -}}
|
||||
apiVersion: {{ template "kyverno.pdb.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.name" . }}
|
||||
namespace: {{ template "kyverno.namespace" . }}
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- include "kyverno.pdb.spec" .Values.reportsController.podDisruptionBudget | nindent 2 }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kyverno.reports-controller.matchLabels" . | nindent 6 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.reportsController.apiPriorityAndFairness }}
|
||||
apiVersion: {{ template "kyverno.flowcontrol.apiVersion" . }}
|
||||
kind: PriorityLevelConfiguration
|
||||
metadata:
|
||||
name: {{ template "kyverno.reports-controller.name" . }}
|
||||
labels:
|
||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||
{{- with .Values.reportsController.priorityLevelConfigurationSpec }}
|
||||
spec:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user