added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,84 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{- define "kyverno.config.configMapName" -}}
+{{- if .Values.config.create -}}
+    {{ default (include "kyverno.fullname" .) .Values.config.name }}
+{{- else -}}
+    {{ required "A configmap name is required when `config.create` is set to `false`" .Values.config.name }}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.config.metricsConfigMapName" -}}
+{{- if .Values.metricsConfig.create -}}
+    {{ default (printf "%s-metrics" (include "kyverno.fullname" .)) .Values.metricsConfig.name }}
+{{- else -}}
+    {{ required "A configmap name is required when `metricsConfig.create` is set to `false`" .Values.metricsConfig.name }}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.config.labels" -}}
+{{- template "kyverno.labels.merge" (list
+  (include "kyverno.labels.common" .)
+  (include "kyverno.config.matchLabels" .)
+) -}}
+{{- end -}}
+
+{{- define "kyverno.config.matchLabels" -}}
+{{- template "kyverno.labels.merge" (list
+  (include "kyverno.matchLabels.common" .)
+  (include "kyverno.labels.component" "config")
+) -}}
+{{- end -}}
+
+{{- define "kyverno.config.resourceFilters" -}}
+{{- $resourceFilters := .Values.config.resourceFilters -}}
+{{- if .Values.config.excludeKyvernoNamespace -}}
+  {{- $resourceFilters = prepend .Values.config.resourceFilters (printf "[*/*,%s,*]" (include "kyverno.namespace" .)) -}}
+{{- end -}}
+{{- range $resourceExclude := .Values.config.resourceFiltersExclude -}}
+  {{- $resourceFilters = without $resourceFilters $resourceExclude -}}
+{{- end -}}
+{{- range $exclude := .Values.config.resourceFiltersExcludeNamespaces -}}
+  {{- range $filter := $resourceFilters -}}
+    {{- if (contains (printf ",%s," $exclude) $filter) -}}
+      {{- $resourceFilters = without $resourceFilters $filter -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+{{- $resourceFilters = concat $resourceFilters .Values.config.resourceFiltersInclude -}}
+{{- range $include := .Values.config.resourceFiltersIncludeNamespaces -}}
+  {{- $resourceFilters = append $resourceFilters (printf "[*/*,%s,*]" $include) -}}
+{{- end -}}
+{{- range $resourceFilter := $resourceFilters }}
+{{ tpl $resourceFilter $ }}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.config.webhooks" -}}
+{{- $excludeDefault := dict "key" "kubernetes.io/metadata.name" "operator" "NotIn" "values" (list (include "kyverno.namespace" .)) }}
+{{- $webhooks := .Values.config.webhooks -}}
+{{- if $webhooks | kindIs "slice" -}}
+  {{- $newWebhooks := dict -}}
+  {{- range $index, $webhook := $webhooks -}}
+    {{- if $webhook.namespaceSelector -}}
+      {{- $namespaceSelector := $webhook.namespaceSelector }}
+      {{- $matchExpressions := default (list) $namespaceSelector.matchExpressions }}
+      {{- $newNamespaceSelector := dict "matchLabels" $namespaceSelector.matchLabels "matchExpressions" (append $matchExpressions $excludeDefault) }}
+      {{- $newWebhook := merge (omit $webhook "namespaceSelector") (dict "namespaceSelector" $newNamespaceSelector) }}
+      {{- $newWebhooks = merge $newWebhooks (dict $webhook.name $newWebhook) }}
+    {{- end -}}
+  {{- end -}}
+  {{- $newWebhooks | toJson }}
+{{- else -}}
+  {{- $webhook := $webhooks }}
+  {{- $namespaceSelector := default (dict) $webhook.namespaceSelector }}
+  {{- $matchExpressions := default (list) $namespaceSelector.matchExpressions }}
+  {{- $newNamespaceSelector := dict "matchLabels" $namespaceSelector.matchLabels "matchExpressions" (append $matchExpressions $excludeDefault) }}
+  {{- $newWebhook := merge (omit $webhook "namespaceSelector") (dict "namespaceSelector" $newNamespaceSelector) }}
+  {{- $newWebhook | toJson }}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.config.imagePullSecret" -}}
+{{- printf "{\"auths\":{\"%s\":{\"auth\":\"%s\"}}}" .registry (printf "%s:%s" .username .password | b64enc) | b64enc }}
+{{- end -}}
@@ -0,0 +1,63 @@
+{{- if .Values.config.create -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "kyverno.config.configMapName" . }}
+  namespace: {{ template "kyverno.namespace" . }}
+  labels:
+    {{- include "kyverno.config.labels" . | nindent 4 }}
+  annotations:
+    {{- with .Values.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if .Values.config.preserve }}
+    helm.sh/resource-policy: "keep"
+    {{- end }}
+data:
+  enableDefaultRegistryMutation: {{ .Values.config.enableDefaultRegistryMutation | quote }}
+  {{- with .Values.config.defaultRegistry }}
+  defaultRegistry: {{ . | quote }}
+  {{- end }}
+  generateSuccessEvents: {{ .Values.config.generateSuccessEvents | quote }}
+  {{- with .Values.config.successEventActions }}
+  successEventActions: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.config.excludeGroups }}
+  excludeGroups: {{ join "," . | quote }}
+  {{- end -}}
+  {{- with .Values.config.excludeUsernames }}
+  excludeUsernames: {{ join "," . | quote }}
+  {{- end -}}
+  {{- with .Values.config.excludeRoles }}
+  excludeRoles: {{ join "," . | quote }}
+  {{- end -}}
+  {{- with .Values.config.excludeClusterRoles }}
+  excludeClusterRoles: {{ join "," . | quote }}
+  {{- end -}}
+  {{- if .Values.config.resourceFilters }}
+  resourceFilters: >-
+    {{- include "kyverno.config.resourceFilters" . | trim | nindent 4 }}
+  {{- end -}}
+  {{- with .Values.config.updateRequestThreshold }}
+  updateRequestThreshold: {{ . | quote }}
+  {{- end -}}
+  {{- if and .Values.config.webhooks .Values.config.excludeKyvernoNamespace }}
+  webhooks: {{ include "kyverno.config.webhooks" . | quote }}
+  {{- else if .Values.config.webhooks }}
+  webhooks: {{ .Values.config.webhooks | toJson | quote }}
+  {{- else if .Values.config.excludeKyvernoNamespace }}
+  webhooks: '{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["{{ include "kyverno.namespace" . }}"]}]}}'
+  {{- end -}}
+  {{- with .Values.config.webhookAnnotations }}
+  webhookAnnotations: {{ toJson . | quote }}
+  {{- end }}
+  {{- with .Values.config.webhookLabels }}
+  webhookLabels: {{ toJson . | quote }}
+  {{- end }}
+  {{- with .Values.config.matchConditions }}
+  matchConditions: {{ toJson . | quote }}
+  {{- end }}
+  {{- with .Values.config.maxContextSize }}
+  maxContextSize: {{ . | quote }}
+  {{- end }}
+{{- end -}}
@@ -0,0 +1,13 @@
+{{ range $name, $secret := .Values.imagePullSecrets }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  namespace: {{ template "kyverno.namespace" $ }}
+  labels:
+    {{- include "kyverno.config.labels" $ | nindent 4 }}
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: {{ template "kyverno.config.imagePullSecret" $secret }}
+{{ end }}
@@ -0,0 +1,26 @@
+{{- if .Values.metricsConfig.create -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "kyverno.config.metricsConfigMapName" . }}
+  namespace: {{ template "kyverno.namespace" . }}
+  labels:
+    {{- include "kyverno.config.labels" . | nindent 4 }}
+  {{- with .Values.metricsConfig.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+data:
+  {{- with .Values.metricsConfig.namespaces }}
+  namespaces: {{ toJson . | quote }}
+  {{- end }}
+  {{- with .Values.metricsConfig.metricsRefreshInterval }}
+  metricsRefreshInterval: {{ . }}
+  {{- end }}
+  {{- with .Values.metricsConfig.metricsExposure }}
+  metricsExposure: {{ toJson . | quote }}
+  {{- end }}
+  {{- with .Values.metricsConfig.bucketBoundaries }}
+  bucketBoundaries: {{ join ", " . | quote }}
+  {{- end }}
+{{- end -}}