global: # -- Internal settings used with `helm template` to generate install manifest # @ignored templating: enabled: false debug: false version: ~ image: # -- (string) Global value that allows to set a single image registry across all deployments. # When set, it will override any values set under `.image.registry` across the chart. registry: ~ # -- (list) Global list of Image pull secrets # When set, it will override any values set under `imagePullSecrets` under different components across the chart. imagePullSecrets: [] # -- Resync period for informers resyncPeriod: 15m # -- Enable/Disable custom resource watcher to invalidate cache crdWatcher: false caCertificates: # -- Global CA certificates to use with Kyverno deployments # This value is expected to be one large string of CA certificates # Individual controller values will override this global value data: ~ # -- Global value to set single volume to be mounted for CA certificates for all deployments. # Not used when `.Values.global.caCertificates.data` is defined # Individual controller values will override this global value volume: {} # Example to use hostPath: # hostPath: # path: /etc/pki/tls/ca-certificates.crt # type: File # -- Global priority class name for pod priority. Non-global values will override the global value. priorityClassName: '' # -- Additional container environment variables to apply to all containers and init containers extraEnvVars: [] # Example setting proxy # extraEnvVars: # - name: HTTPS_PROXY # value: 'https://proxy.example.com:3128' # -- Global node labels for pod assignment. Non-global values will override the global value. nodeSelector: {} # -- Global List of node taints to tolerate. Non-global values will override the global value. tolerations: [] # -- (string) Override the name of the chart nameOverride: ~ # -- (string) Override the expanded name of the chart fullnameOverride: ~ # -- (string) Override the namespace the chart deploys to namespaceOverride: ~ upgrade: # -- Upgrading from v2 to v3 is not allowed by default, set this to true once changes have been reviewed. fromV2: false apiVersionOverride: # -- (string) Override api version used to create `PodDisruptionBudget`` resources. # When not specified the chart will check if `policy/v1/PodDisruptionBudget` is available to # determine the api version automatically. podDisruptionBudget: ~ rbac: roles: # -- Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) aggregate: admin: true view: true # Use openreports.io as the API group for reporting openreports: # -- Enable OpenReports feature in controllers enabled: false # -- Whether to install CRDs from the upstream OpenReports chart. Setting this to true requires enabled to also be true. installCrds: false # Reports Server configuration reportsServer: # -- Enable reports-server deployment alongside Kyverno enabled: false # -- Wait for reports-server to be ready before starting Kyverno components waitForReady: true # -- Timeout for waiting for reports-server readiness (as duration string, e.g. 300s, 5m) readinessTimeout: 300s # CRDs configuration crds: # -- Whether to have Helm install the Kyverno CRDs, if the CRDs are not installed by Helm, they must be added before policies can be created install: true reportsServer: # -- Kyverno reports-server is used in your cluster enabled: false groups: # -- Install CRDs in group `kyverno.io` kyverno: cleanuppolicies: true clustercleanuppolicies: true clusterpolicies: true globalcontextentries: true policies: true policyexceptions: true updaterequests: true # -- Install CRDs in group `policies.kyverno.io` policies: validatingpolicies: true policyexceptions: true imagevalidatingpolicies: true namespacedimagevalidatingpolicies: true mutatingpolicies: true namespacedmutatingpolicies: true generatingpolicies: true deletingpolicies: true namespaceddeletingpolicies: true namespacedvalidatingpolicies: true # -- Install CRDs in group `reports.kyverno.io` reports: clusterephemeralreports: true ephemeralreports: true # -- Install CRDs in group `wgpolicyk8s.io` wgpolicyk8s: clusterpolicyreports: true policyreports: true # -- Additional CRDs annotations annotations: {} # argocd.argoproj.io/sync-options: Replace=true # strategy.spinnaker.io/replace: 'true' # -- Additional CRDs labels customLabels: {} migration: # -- Enable CRDs migration using helm post upgrade hook enabled: true # -- Resources to migrate resources: - cleanuppolicies.kyverno.io - clustercleanuppolicies.kyverno.io - clusterpolicies.kyverno.io - globalcontextentries.kyverno.io - policies.kyverno.io - policyexceptions.kyverno.io - updaterequests.kyverno.io # policies.kyverno.io - deletingpolicies.policies.kyverno.io - generatingpolicies.policies.kyverno.io - imagevalidatingpolicies.policies.kyverno.io - mutatingpolicies.policies.kyverno.io - namespaceddeletingpolicies.policies.kyverno.io - namespacedgeneratingpolicies.policies.kyverno.io - namespacedimagevalidatingpolicies.policies.kyverno.io - namespacedmutatingpolicies.policies.kyverno.io - namespacedvalidatingpolicies.policies.kyverno.io - policyexceptions.policies.kyverno.io - validatingpolicies.policies.kyverno.io image: # -- (string) Image registry registry: ~ defaultRegistry: reg.kyverno.io # -- (string) Image repository repository: kyverno/kyverno-cli # -- (string) Image tag # Defaults to appVersion in Chart.yaml if omitted tag: ~ # -- (string) Image pull policy pullPolicy: IfNotPresent # -- Image pull secrets imagePullSecrets: [] # - name: secretName # -- Security context for the pod podSecurityContext: {} # -- Node labels for pod assignment nodeSelector: {} # -- List of node taints to tolerate tolerations: [] # -- Pod anti affinity constraints. podAntiAffinity: {} # -- Pod affinity constraints. podAffinity: {} # -- Pod labels. podLabels: {} # -- Pod annotations. podAnnotations: {} # -- Node affinity constraints. nodeAffinity: {} # -- Security context for the hook containers securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault podResources: # -- Pod resource limits limits: cpu: 100m memory: 256Mi # -- Pod resource requests requests: cpu: 10m memory: 64Mi serviceAccount: # -- Toggle automounting of the ServiceAccount. # When set to false, a projected service account token is used instead # which provides time-limited and audience-bound tokens for improved security. automountServiceAccountToken: true # -- Projected service account token configuration (only used when automountServiceAccountToken is false) projectedServiceAccountToken: # -- Token expiration time in seconds. # The kubelet will request a new token before the token expires. expirationSeconds: 3600 # -- Audience for the projected service account token. # If not set, the token will have no audience restriction. audience: "" # -- Scoped token injected into outbound APICall and CEL http requests. # This token carries a custom audience so that if leaked to an external service # it cannot be replayed against the Kubernetes API server. apiCallToken: # -- Audience for the projected token used in outbound requests. # Set this to the audience your receiving service validates in the OIDC token's # `aud` claim. The default is `kyverno-svc.kyverno.io`, which is a Kyverno-specific # audience and prevents the token from being accepted by the Kubernetes API server. audience: "kyverno-svc.kyverno.io" # -- Token lifetime in seconds for the projected outbound API call token. # The default is `3600` (1 hour). The kubelet requests a replacement before the # token expires, so lowering this reduces token lifetime while increasing rotation # frequency. expirationSeconds: 3600 # Configuration config: # -- Create the configmap. create: true # -- Preserve the configmap settings during upgrade. preserve: true # -- (string) The configmap name (required if `create` is `false`). name: ~ # -- Additional annotations to add to the configmap. annotations: {} # -- Enable registry mutation for container images. Enabled by default. enableDefaultRegistryMutation: true # -- The registry hostname used for the image mutation. defaultRegistry: docker.io # -- Exclude groups excludeGroups: - system:nodes # -- Exclude usernames excludeUsernames: [] # - '!system:kube-scheduler' # -- Exclude roles excludeRoles: [] # -- Exclude roles excludeClusterRoles: [] # -- Generate success events. generateSuccessEvents: false # -- Comma-separated list of event actions for which success events should be generated. # When set, only success events matching the specified actions are emitted. # Requires `generateSuccessEvents` to be `true`. # Valid values: "Resource Mutated", "Resource Passed", "Resource Generated", "Resource Cleaned Up". # Example: "Resource Mutated" or "Resource Mutated,Resource Generated". # @default -- "" (empty, all success events are emitted when generateSuccessEvents is true) successEventActions: "" # -- Maximum cumulative size of context data during policy evaluation. # Supports Kubernetes quantity format (e.g., 100Mi, 2Gi) or plain bytes (e.g., 2097152). # Limits memory used by context variables to prevent unbounded growth. # Increase if policies legitimately need large context data (e.g., processing large ConfigMaps). # Set to 0 to disable the limit (not recommended for production). # @default -- 2Mi maxContextSize: ~ # -- Resource types to be skipped by the Kyverno policy engine. # Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list. # These are joined together without spaces, run through `tpl`, and the result is set in the config map. # @default -- See [values.yaml](values.yaml) resourceFilters: - '[Event,*,*]' - '[*/*,kube-system,*]' - '[*/*,kube-public,*]' - '[*/*,kube-node-lease,*]' - '[Node,*,*]' - '[Node/?*,*,*]' - '[APIService,*,*]' - '[APIService/?*,*,*]' - '[TokenReview,*,*]' - '[SubjectAccessReview,*,*]' - '[SelfSubjectAccessReview,*,*]' - '[Binding,*,*]' - '[Pod/binding,*,*]' - '[ReplicaSet,*,*]' - '[ReplicaSet/?*,*,*]' - '[EphemeralReport,*,*]' - '[ClusterEphemeralReport,*,*]' # exclude resources from the chart - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]' - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]' - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]' - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]' - '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]' - '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]' - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]' - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - '[Job/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]' - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]' - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]' # -- Sets the threshold for the total number of UpdateRequests generated for mutateExisitng and generate policies. updateRequestThreshold: 1000 # -- Defines the `namespaceSelector`/`objectSelector` in the webhook configurations. # The Kyverno namespace is excluded if `excludeKyvernoNamespace` is `true` (default) webhooks: # Exclude namespaces namespaceSelector: matchExpressions: - key: kubernetes.io/metadata.name operator: NotIn values: - kube-system # Exclude objects # objectSelector: # matchExpressions: # - key: webhooks.kyverno.io/exclude # operator: DoesNotExist # -- Defines annotations to set on webhook configurations. webhookAnnotations: # Example to disable admission enforcer on AKS: 'admissions.enforcer/disabled': 'true' # -- Defines labels to set on webhook configurations. webhookLabels: {} # Example to adopt webhook resources in ArgoCD: # 'argocd.argoproj.io/instance': 'kyverno' # -- Defines match conditions to set on webhook configurations (requires Kubernetes 1.27+). matchConditions: [] # -- Exclude Kyverno namespace # Determines if default Kyverno namespace exclusion is enabled for webhooks and resourceFilters excludeKyvernoNamespace: true # -- resourceFilter namespace exclude # Namespaces to exclude from the default resourceFilters resourceFiltersExcludeNamespaces: [] # -- resourceFilters exclude list # Items to exclude from config.resourceFilters resourceFiltersExclude: [] # -- resourceFilter namespace include # Namespaces to include to the default resourceFilters resourceFiltersIncludeNamespaces: [] # -- resourceFilters include list # Items to include to config.resourceFilters resourceFiltersInclude: [] # Metrics configuration metricsConfig: # -- Create the configmap. create: true # -- (string) The configmap name (required if `create` is `false`). name: ~ # -- Additional annotations to add to the configmap. annotations: {} namespaces: # -- List of namespaces to capture metrics for. include: [] # -- list of namespaces to NOT capture metrics for. exclude: [] # -- (string) Rate at which metrics should reset so as to clean up the memory footprint of kyverno metrics, if you might be expecting high memory footprint of Kyverno's metrics. Default: 0, no refresh of metrics. WARNING: This flag is not working since Kyverno 1.8.0 metricsRefreshInterval: ~ # metricsRefreshInterval: 24h # -- (list) Configures the bucket boundaries for all Histogram metrics, changing this configuration requires restart of the kyverno admission controller bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 15, 20, 25, 30] # -- (map) Configures the exposure of individual metrics, by default all metrics and all labels are exported, changing this configuration requires restart of the kyverno admission controller metricsExposure: kyverno_policy_execution_duration_seconds: # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] kyverno_validating_policy_execution_duration_seconds: # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] kyverno_image_validating_policy_execution_duration_seconds: # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] kyverno_mutating_policy_execution_duration_seconds: # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] kyverno_generating_policy_execution_duration_seconds: # bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5] disabledLabelDimensions: ["resource_namespace", "resource_request_operation"] kyverno_admission_review_duration_seconds: # enabled: false disabledLabelDimensions: ["resource_namespace"] kyverno_policy_rule_info_total: disabledLabelDimensions: ["resource_namespace", "policy_namespace"] kyverno_policy_results_total: disabledLabelDimensions: ["resource_namespace", "policy_namespace"] kyverno_admission_requests_total: disabledLabelDimensions: ["resource_namespace"] kyverno_cleanup_controller_deletedobjects_total: disabledLabelDimensions: ["resource_namespace", "policy_namespace"] # -- Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument imagePullSecrets: {} # regcred: # registry: foo.example.com # username: foobar # password: secret # regcred2: # registry: bar.example.com # username: barbaz # password: secret2 # -- Existing Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument existingImagePullSecrets: [] # - test-registry # - other-test-registry # Tests configuration test: # -- Sleep time before running test sleep: 20 image: # -- (string) Image registry registry: ghcr.io # -- Image repository repository: kyverno/readiness-checker # -- Image tag # Defaults to `latest` if omitted tag: ~ # -- (string) Image pull policy # Defaults to image.pullPolicy if omitted pullPolicy: ~ # -- Image pull secrets imagePullSecrets: [] # - name: secretName resources: # -- Pod resource limits limits: cpu: 100m memory: 256Mi # -- Pod resource requests requests: cpu: 10m memory: 64Mi # -- Security context for the test containers securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault # -- Toggle automounting of the ServiceAccount. # When set to false, a projected service account token is used instead # which provides time-limited and audience-bound tokens for improved security. automountServiceAccountToken: true # -- Projected service account token configuration (only used when automountServiceAccountToken is false) projectedServiceAccountToken: # -- Token expiration time in seconds. # The kubelet will request a new token before the token expires. expirationSeconds: 3600 # -- Audience for the projected service account token. # If not set, the token will have no audience restriction. audience: "" # -- Node labels for pod assignment nodeSelector: {} # -- Additional Pod annotations podAnnotations: {} # -- List of node taints to tolerate tolerations: [] # -- Additional labels customLabels: {} webhooksCleanup: # -- Create a helm pre-delete hook to cleanup webhooks. enabled: true image: # -- (string) Image registry registry: ghcr.io # -- Image repository repository: kyverno/readiness-checker # -- Image tag # Defaults to `latest` if omitted tag: ~ # -- (string) Image pull policy # Defaults to image.pullPolicy if omitted pullPolicy: ~ # -- Image pull secrets imagePullSecrets: [] # -- Security context for the pod podSecurityContext: {} # -- Node labels for pod assignment nodeSelector: {} # -- List of node taints to tolerate tolerations: [] # -- Pod anti affinity constraints. podAntiAffinity: {} # -- Pod affinity constraints. podAffinity: {} # -- Pod labels. podLabels: {} # -- Pod annotations. podAnnotations: {} # -- Node affinity constraints. nodeAffinity: {} # -- Security context for the hook containers securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault resources: # -- Pod resource limits limits: cpu: 100m memory: 256Mi # -- Pod resource requests requests: cpu: 10m memory: 64Mi serviceAccount: # -- Toggle automounting of the ServiceAccount. # When set to false, a projected service account token is used instead # which provides time-limited and audience-bound tokens for improved security. automountServiceAccountToken: true # -- Projected service account token configuration (only used when automountServiceAccountToken is false) projectedServiceAccountToken: # -- Token expiration time in seconds. # The kubelet will request a new token before the token expires. expirationSeconds: 3600 # -- Audience for the projected service account token. # If not set, the token will have no audience restriction. audience: "" grafana: # -- Enable grafana dashboard creation. enabled: false # -- Configmap name template. configMapName: '{{ include "kyverno.fullname" . }}-grafana' # -- (string) Namespace to create the grafana dashboard configmap. # If not set, it will be created in the same namespace where the chart is deployed. namespace: ~ # -- Grafana dashboard configmap annotations. annotations: {} # -- Grafana dashboard configmap labels labels: grafana_dashboard: "1" # -- create GrafanaDashboard custom resource referencing to the configMap. # according to https://grafana-operator.github.io/grafana-operator/docs/examples/dashboard_from_configmap/readme/ grafanaDashboard: create: false folder: kyverno allowCrossNamespaceImport: true matchLabels: dashboards: "grafana" # Features configuration features: admissionReports: # -- Enables the feature enabled: true aggregateReports: # -- Enables the feature enabled: true policyReports: # -- Enables the feature enabled: true validatingAdmissionPolicyReports: # -- Enables the feature enabled: true mutatingAdmissionPolicyReports: # -- Enables the feature enabled: false reporting: # -- Enables the feature validate: true # -- Enables the feature mutate: true # -- Enables the feature mutateExisting: true # -- Enables the feature imageVerify: true # -- Enables the feature generate: true autoUpdateWebhooks: # -- Enables the feature enabled: true backgroundScan: # -- Enables the feature enabled: true # -- Number of background scan workers backgroundScanWorkers: 2 # -- Background scan interval backgroundScanInterval: 1h # -- Skips resource filters in background scan skipResourceFilters: true configMapCaching: # -- Enables the feature enabled: true controllerRuntimeMetrics: # -- Bind address for controller-runtime metrics (use "0" to disable it) bindAddress: ":8080" deferredLoading: # -- Enables the feature enabled: true dumpPayload: # -- Enables the feature enabled: false forceFailurePolicyIgnore: # -- Enables the feature enabled: false generateValidatingAdmissionPolicy: # -- Enables the feature enabled: true generateMutatingAdmissionPolicy: # -- Enables the feature enabled: false dumpPatches: # -- Enables the feature enabled: false globalContext: # -- Maximum allowed response size from API Calls. A value of 0 bypasses checks (not recommended) maxApiCallResponseLength: 2000000 # -- Timeout for HTTP API calls made by policies. A value of 0s means no timeout. apiCallTimeout: 30s logging: # -- Logging format format: text # -- Logging verbosity verbosity: 2 omitEvents: # -- Events which should not be emitted (possible values `PolicyViolation`, `PolicyApplied`, `PolicyError`, and `PolicySkipped`) eventTypes: - PolicyApplied - PolicySkipped # - PolicyViolation # - PolicyError policyExceptions: # -- Enables the feature enabled: false # -- Restrict policy exceptions to a single namespace # Set to "*" to allow exceptions in all namespaces namespace: '' protectManagedResources: # -- Enables the feature enabled: false registryClient: # -- Allow insecure registry allowInsecure: false # -- Enable registry client helpers credentialHelpers: - default - google - amazon - azure - github ttlController: # -- Reconciliation interval for the label based cleanup manager reconciliationInterval: 1m tuf: # -- Enables the feature enabled: false # -- (string) Path to Tuf root root: ~ # -- (string) Raw Tuf root rootRaw: ~ # -- (string) Tuf mirror mirror: ~ # Admission controller configuration admissionController: autoscaling: # -- Enable horizontal pod autoscaling enabled: false # -- Minimum number of pods minReplicas: 1 # -- Maximum number of pods maxReplicas: 10 # -- Target CPU utilization percentage targetCPUUtilizationPercentage: 80 # -- (int) Target memory utilization percentage targetMemoryUtilizationPercentage: ~ # -- Configurable scaling behavior behavior: {} # -- Overrides features defined at the root level featuresOverride: admissionReports: # -- Max number of admission reports allowed in flight until the admission controller stops creating new ones backPressureThreshold: 1000 rbac: # -- Create RBAC resources create: true # -- Create rolebinding to view role createViewRoleBinding: true # -- The view role to use in the rolebinding viewRoleName: view serviceAccount: # -- The ServiceAccount name name: # -- Annotations for the ServiceAccount annotations: {} # example.com/annotation: value # -- Toggle automounting of the ServiceAccount. # When set to false, a projected service account token is used instead # which provides time-limited and audience-bound tokens for improved security. automountServiceAccountToken: true # -- Projected service account token configuration (only used when automountServiceAccountToken is false) projectedServiceAccountToken: # -- Token expiration time in seconds. # The kubelet will request a new token before the token expires. expirationSeconds: 3600 # -- Audience for the projected service account token. # If not set, the token will have no audience restriction. audience: "" coreClusterRole: # -- Extra resource permissions to add in the core cluster role. # This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. # @default -- See [values.yaml](values.yaml) extraResources: [] clusterRole: # -- Extra resource permissions to add in the cluster role extraResources: [] # - apiGroups: # - '' # resources: # - pods # verbs: # - create # - update # - delete # -- Create self-signed certificates at deployment time. # The certificates won't be automatically renewed if this is set to `true`. createSelfSignedCert: false # -- Key algorithm for self-signed TLS certificates. # Supported values: RSA, ECDSA, Ed25519 # Only used when createSelfSignedCert is false (Kyverno-managed certificates). tlsKeyAlgorithm: RSA # -- Configure cert-manager to manage TLS certificates. # When enabled, cert-manager Certificate resources will be created to provision # the TLS certificates for the admission controller. # Requires cert-manager to be installed in the cluster. # Takes precedence over createSelfSignedCert when enabled. certManager: # -- Enable cert-manager integration for certificate management enabled: false # -- Create a self-signed ClusterIssuer for CA generation. # Set to false if you want to use an existing issuer specified in issuerRef. createSelfSignedIssuer: true # -- Reference to an existing issuer for signing CA certificates. # Only used when createSelfSignedIssuer is false. issuerRef: # -- Name of the issuer name: "" # -- Kind of the issuer (ClusterIssuer or Issuer) kind: ClusterIssuer # -- Group of the issuer group: cert-manager.io # -- Key algorithm for certificates (RSA, ECDSA, Ed25519) algorithm: RSA # -- Key size for RSA (2048, 4096) or ECDSA (256, 384). # Ignored for Ed25519. size: 2048 # -- CA certificate configuration ca: # -- Duration of the CA certificate (default 10 years) duration: 87600h # -- Time before expiry to renew the CA certificate (default 30 days) renewBefore: 720h # -- TLS certificate configuration tls: # -- Duration of the TLS certificate (default 1 year) duration: 8760h # -- Time before expiry to renew the TLS certificate (default 30 days) renewBefore: 720h # -- (int) Desired number of pods replicas: ~ # -- The number of revisions to keep revisionHistoryLimit: 10 # -- Resync period for informers resyncPeriod: 15m # -- Enable/Disable custom resource watcher to invalidate cache crdWatcher: false # -- Additional labels to add to each pod podLabels: {} # example.com/label: foo # -- Additional annotations to add to each pod podAnnotations: {} # example.com/annotation: foo # -- Deployment labels. labels: {} # -- Deployment annotations. annotations: {} # -- Deployment update strategy. # Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy # @default -- See [values.yaml](values.yaml) updateStrategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate # -- Optional priority class priorityClassName: '' # -- Change `apiPriorityAndFairness` to `true` if you want to insulate the API calls made by Kyverno admission controller activities. # This will help ensure Kyverno stability in busy clusters. # Ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/ apiPriorityAndFairness: false # -- Priority level configuration. # The block is directly forwarded into the priorityLevelConfiguration, so you can use whatever specification you want. # ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/#prioritylevelconfiguration # @default -- See [values.yaml](values.yaml) priorityLevelConfigurationSpec: type: Limited limited: nominalConcurrencyShares: 10 limitResponse: queuing: queueLengthLimit: 50 type: Queue # -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace. # Useful for situations like when you end up dealing with a custom CNI over Amazon EKS. # Update the `dnsPolicy` accordingly as well to suit the host network mode. hostNetwork: false # -- admissionController webhook server port # in case you are using hostNetwork: true, you might want to change the port the webhookServer is listening to webhookServer: port: 9443 # -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster. # In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. dnsPolicy: ClusterFirst # -- `dnsConfig` allows to specify DNS configuration for the pod. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config. dnsConfig: {} # options: # - name: ndots # value: "2" # -- Startup probe. # The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want. # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ # @default -- See [values.yaml](values.yaml) startupProbe: httpGet: path: /health/liveness port: 9443 scheme: HTTPS failureThreshold: 20 initialDelaySeconds: 2 periodSeconds: 6 # -- Liveness probe. # The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want. # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ # @default -- See [values.yaml](values.yaml) livenessProbe: httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 timeoutSeconds: 5 failureThreshold: 2 successThreshold: 1 # -- Readiness Probe. # The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want. # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ # @default -- See [values.yaml](values.yaml) readinessProbe: httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 # -- Node labels for pod assignment nodeSelector: kubernetes.io/os: linux # -- List of node taints to tolerate tolerations: [] antiAffinity: # -- Pod antiAffinities toggle. # Enabled by default but can be disabled if you want to schedule pods to the same node. enabled: true # -- Pod anti affinity constraints. # @default -- See [values.yaml](values.yaml) podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - admission-controller topologyKey: kubernetes.io/hostname # -- Pod affinity constraints. podAffinity: {} # -- Node affinity constraints. nodeAffinity: {} # -- Topology spread constraints. topologySpreadConstraints: [] # -- Security context for the pod podSecurityContext: {} podDisruptionBudget: # -- Enable PodDisruptionBudget. # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1 # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: # -- Unhealthy pod eviction policy to be used. # Possible values are `IfHealthyBudget` or `AlwaysAllow`. unhealthyPodEvictionPolicy: # -- A writable volume to use for the TUF root initialization. tufRootMountPath: /.sigstore # -- Volume to be mounted in pods for TUF/cosign work. sigstoreVolume: emptyDir: {} caCertificates: # -- CA certificates to use with Kyverno deployments # This value is expected to be one large string of CA certificates data: ~ # -- Volume to be mounted for CA certificates # Not used when `.Values.admissionController.caCertificates.data` is defined volume: {} # Example to use hostPath: # hostPath: # path: /etc/pki/tls/ca-certificates.crt # type: File # -- Image pull secrets imagePullSecrets: [] # - secretName initContainer: image: # -- Image registry registry: ~ defaultRegistry: reg.kyverno.io # -- Image repository repository: kyverno/kyvernopre # -- (string) Image tag # If missing, defaults to image.tag tag: ~ # -- (string) Image pull policy # If missing, defaults to image.pullPolicy pullPolicy: ~ resources: # -- Pod resource limits limits: cpu: 100m memory: 256Mi # -- Pod resource requests requests: cpu: 10m memory: 64Mi # -- Container security context securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault # -- Additional container args. extraArgs: {} # -- Additional container environment variables. extraEnvVars: [] # Example setting proxy # extraEnvVars: # - name: HTTPS_PROXY # value: 'https://proxy.example.com:3128' container: image: # -- Image registry registry: ~ defaultRegistry: reg.kyverno.io # -- Image repository repository: kyverno/kyverno # -- (string) Image tag # Defaults to appVersion in Chart.yaml if omitted tag: ~ # -- Image pull policy pullPolicy: IfNotPresent resources: # -- Pod resource limits limits: memory: 384Mi # -- Pod resource requests requests: cpu: 100m memory: 128Mi # -- Container security context securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault # -- Additional container args. extraArgs: {} # -- Additional container environment variables. extraEnvVars: [] # Example setting proxy # extraEnvVars: # - name: HTTPS_PROXY # value: 'https://proxy.example.com:3128' # -- Array of extra init containers extraInitContainers: [] # - name: init-container # image: busybox # command: ['sh', '-c', 'echo Hello'] # -- Array of extra containers to run alongside kyverno extraContainers: [] # - name: myapp-container # image: busybox # command: ['sh', '-c', 'echo Hello && sleep 3600'] # -- Additional volumes to be mounted in the pod extraVolumes: [] # - name: my-volume # emptyDir: {} # -- Additional volumeMounts to be mounted to the main container extraVolumeMounts: [] # - name: my-volume # mountPath: /path/to/mount service: # -- Service port. port: 443 # -- Service type. type: ClusterIP # -- Service node port. # Only used if `type` is `NodePort`. nodePort: # -- Service annotations. annotations: {} # -- (string) Service traffic distribution policy. # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. trafficDistribution: ~ metricsService: # -- Create service. create: true # -- Service port. # Kyverno's metrics server will be exposed at this port. port: 8000 # -- Service type. type: ClusterIP # -- Service node port. # Only used if `type` is `NodePort`. nodePort: # -- Service annotations. annotations: {} # -- (string) Service traffic distribution policy. # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. trafficDistribution: ~ networkPolicy: # -- When true, use a NetworkPolicy to allow ingress to the webhook # This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. enabled: false # -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. ingressFrom: [] serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false # -- Additional annotations additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace namespace: ~ # -- Interval to scrape metrics interval: 30s # -- Timeout if metrics can't be retrieved in given time interval scrapeTimeout: 25s # -- Is TLS required for endpoint secure: false # -- TLS Configuration for endpoint tlsConfig: {} # -- RelabelConfigs to apply to samples before scraping relabelings: [] # -- MetricRelabelConfigs to apply to samples before ingestion. metricRelabelings: [] tracing: # -- Enable tracing enabled: false # -- Traces receiver address address: # -- Traces receiver port port: # -- Traces receiver credentials creds: '' metering: # -- Disable metrics export disabled: false # -- Otel configuration, can be `prometheus` or `grpc` config: prometheus # -- Prometheus endpoint port port: 8000 # -- Is TLS required for endpoint secure: false # -- Key algorithm for self-signed TLS certificates. # Supported values: RSA, ECDSA, Ed25519 tlsKeyAlgorithm: RSA # -- Otel collector endpoint collector: '' # -- Otel collector credentials creds: '' profiling: # -- Enable profiling enabled: false # -- Profiling endpoint port port: 6060 # -- Service type. serviceType: ClusterIP # -- Service node port. # Only used if `type` is `NodePort`. nodePort: # Background controller configuration backgroundController: # -- Overrides features defined at the root level featuresOverride: {} # -- Enable background controller. enabled: true rbac: # -- Create RBAC resources create: true # -- Create rolebinding to view role createViewRoleBinding: true # -- The view role to use in the rolebinding viewRoleName: view serviceAccount: # -- Service account name name: # -- Annotations for the ServiceAccount annotations: {} # example.com/annotation: value # -- Toggle automounting of the ServiceAccount. # When set to false, a projected service account token is used instead # which provides time-limited and audience-bound tokens for improved security. automountServiceAccountToken: true # -- Projected service account token configuration (only used when automountServiceAccountToken is false) projectedServiceAccountToken: # -- Token expiration time in seconds. # The kubelet will request a new token before the token expires. expirationSeconds: 3600 # -- Audience for the projected service account token. # If not set, the token will have no audience restriction. audience: "" coreClusterRole: # -- Extra resource permissions to add in the core cluster role. # This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. # @default -- See [values.yaml](values.yaml) extraResources: - apiGroups: - networking.k8s.io resources: - ingresses - ingressclasses - networkpolicies verbs: - create - update - patch - delete - apiGroups: - rbac.authorization.k8s.io resources: - rolebindings - roles verbs: - create - update - patch - delete - apiGroups: - '' resources: - configmaps - resourcequotas - limitranges verbs: - create - update - patch - delete - apiGroups: - resource.k8s.io resources: - resourceclaims - resourceclaimtemplates verbs: - create - delete - update - patch - deletecollection clusterRole: # -- Extra resource permissions to add in the cluster role extraResources: [] # - apiGroups: # - '' # resources: # - pods # verbs: # - create # - update # - delete # - patch image: # -- Image registry registry: ~ defaultRegistry: reg.kyverno.io # -- Image repository repository: kyverno/background-controller # -- Image tag # Defaults to appVersion in Chart.yaml if omitted tag: ~ # -- Image pull policy pullPolicy: IfNotPresent # -- Image pull secrets imagePullSecrets: [] # - secretName # -- (int) Desired number of pods replicas: ~ # -- The number of revisions to keep revisionHistoryLimit: 10 # -- Resync period for informers resyncPeriod: 15m # -- Additional labels to add to each pod podLabels: {} # example.com/label: foo # -- Additional annotations to add to each pod podAnnotations: {} # example.com/annotation: foo # -- Deployment labels. labels: {} # -- Deployment annotations. annotations: {} # -- Deployment update strategy. # Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy # @default -- See [values.yaml](values.yaml) updateStrategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate # -- Optional priority class priorityClassName: '' # -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace. # Useful for situations like when you end up dealing with a custom CNI over Amazon EKS. # Update the `dnsPolicy` accordingly as well to suit the host network mode. hostNetwork: false # -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster. # In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. dnsPolicy: ClusterFirst # -- `dnsConfig` allows to specify DNS configuration for the pod. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config. dnsConfig: {} # options: # - name: ndots # value: "2" # -- Extra arguments passed to the container on the command line extraArgs: {} # -- Additional container environment variables. extraEnvVars: [] # Example setting proxy # extraEnvVars: # - name: HTTPS_PROXY # value: 'https://proxy.example.com:3128' resources: # -- Pod resource limits limits: memory: 128Mi # -- Pod resource requests requests: cpu: 100m memory: 64Mi # -- Node labels for pod assignment nodeSelector: kubernetes.io/os: linux # -- List of node taints to tolerate tolerations: [] antiAffinity: # -- Pod antiAffinities toggle. # Enabled by default but can be disabled if you want to schedule pods to the same node. enabled: true # -- Pod anti affinity constraints. # @default -- See [values.yaml](values.yaml) podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - background-controller topologyKey: kubernetes.io/hostname # -- Pod affinity constraints. podAffinity: {} # -- Node affinity constraints. nodeAffinity: {} # -- Topology spread constraints. topologySpreadConstraints: [] # -- Security context for the pod podSecurityContext: {} # -- Security context for the containers securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault podDisruptionBudget: # -- Enable PodDisruptionBudget. # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1 # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: # -- Unhealthy pod eviction policy to be used. # Possible values are `IfHealthyBudget` or `AlwaysAllow`. unhealthyPodEvictionPolicy: caCertificates: # -- CA certificates to use with Kyverno deployments # This value is expected to be one large string of CA certificates data: ~ # -- Volume to be mounted for CA certificates # Not used when `.Values.backgroundController.caCertificates.data` is defined volume: {} # Example to use hostPath: # hostPath: # path: /etc/pki/tls/ca-certificates.crt # type: File # -- Additional volumes to be mounted in the pod extraVolumes: [] # - name: my-volume # emptyDir: {} # -- Additional volumeMounts to be mounted to the main container extraVolumeMounts: [] # - name: my-volume # mountPath: /path/to/mount metricsService: # -- Create service. create: true # -- Service port. # Metrics server will be exposed at this port. port: 8000 # -- Service type. type: ClusterIP # -- Service node port. # Only used if `metricsService.type` is `NodePort`. nodePort: # -- Service annotations. annotations: {} # -- (string) Service traffic distribution policy. # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. trafficDistribution: ~ networkPolicy: # -- When true, use a NetworkPolicy to allow ingress to the webhook # This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. enabled: false # -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. ingressFrom: [] serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false # -- Additional annotations additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace namespace: ~ # -- Interval to scrape metrics interval: 30s # -- Timeout if metrics can't be retrieved in given time interval scrapeTimeout: 25s # -- Is TLS required for endpoint secure: false # -- TLS Configuration for endpoint tlsConfig: {} # -- RelabelConfigs to apply to samples before scraping relabelings: [] # -- MetricRelabelConfigs to apply to samples before ingestion. metricRelabelings: [] tracing: # -- Enable tracing enabled: false # -- Traces receiver address address: # -- Traces receiver port port: # -- Traces receiver credentials creds: '' metering: # -- Disable metrics export disabled: false # -- Otel configuration, can be `prometheus` or `grpc` config: prometheus # -- Prometheus endpoint port port: 8000 # -- Is TLS required for endpoint secure: false # -- Key algorithm for self-signed TLS certificates. # Supported values: RSA, ECDSA, Ed25519 tlsKeyAlgorithm: RSA # -- Otel collector endpoint collector: '' # -- Otel collector credentials creds: '' # -- backgroundController server port # in case you are using hostNetwork: true, you might want to change the port the backgroundController is listening to server: port: 9443 profiling: # -- Enable profiling enabled: false # -- Profiling endpoint port port: 6060 # -- Service type. serviceType: ClusterIP # -- Service node port. # Only used if `type` is `NodePort`. nodePort: # Cleanup controller configuration cleanupController: # -- Overrides features defined at the root level featuresOverride: {} # -- Enable cleanup controller. enabled: true rbac: # -- Create RBAC resources create: true serviceAccount: # -- Service account name name: # -- Annotations for the ServiceAccount annotations: {} # example.com/annotation: value # -- Toggle automounting of the ServiceAccount. # When set to false, a projected service account token is used instead # which provides time-limited and audience-bound tokens for improved security. automountServiceAccountToken: true # -- Projected service account token configuration (only used when automountServiceAccountToken is false) projectedServiceAccountToken: # -- Token expiration time in seconds. # The kubelet will request a new token before the token expires. expirationSeconds: 3600 # -- Audience for the projected service account token. # If not set, the token will have no audience restriction. audience: "" clusterRole: # -- Extra resource permissions to add in the cluster role extraResources: [] # - apiGroups: # - '' # resources: # - pods # verbs: # - delete # - list # - watch # -- Create self-signed certificates at deployment time. # The certificates won't be automatically renewed if this is set to `true`. createSelfSignedCert: false # -- Key algorithm for self-signed TLS certificates. # Supported values: RSA, ECDSA, Ed25519 # Only used when createSelfSignedCert is false (Kyverno-managed certificates). tlsKeyAlgorithm: RSA # -- Configure cert-manager to manage TLS certificates. # When enabled, cert-manager Certificate resources will be created to provision # the TLS certificates for the cleanup controller. # Requires cert-manager to be installed in the cluster. # Takes precedence over createSelfSignedCert when enabled. certManager: # -- Enable cert-manager integration for certificate management enabled: false # -- Create a self-signed ClusterIssuer for CA generation. # Set to false if you want to use an existing issuer specified in issuerRef. createSelfSignedIssuer: true # -- Reference to an existing issuer for signing CA certificates. # Only used when createSelfSignedIssuer is false. issuerRef: # -- Name of the issuer name: "" # -- Kind of the issuer (ClusterIssuer or Issuer) kind: ClusterIssuer # -- Group of the issuer group: cert-manager.io # -- Key algorithm for certificates (RSA, ECDSA, Ed25519) algorithm: RSA # -- Key size for RSA (2048, 4096) or ECDSA (256, 384). # Ignored for Ed25519. size: 2048 # -- CA certificate configuration ca: # -- Duration of the CA certificate (default 10 years) duration: 87600h # -- Time before expiry to renew the CA certificate (default 30 days) renewBefore: 720h # -- TLS certificate configuration tls: # -- Duration of the TLS certificate (default 1 year) duration: 8760h # -- Time before expiry to renew the TLS certificate (default 30 days) renewBefore: 720h image: # -- Image registry registry: ~ defaultRegistry: reg.kyverno.io # -- Image repository repository: kyverno/cleanup-controller # -- (string) Image tag # Defaults to appVersion in Chart.yaml if omitted tag: ~ # -- Image pull policy pullPolicy: IfNotPresent # -- Image pull secrets imagePullSecrets: [] # - secretName # -- (int) Desired number of pods replicas: ~ # -- The number of revisions to keep revisionHistoryLimit: 10 # -- Resync period for informers resyncPeriod: 15m # -- Additional labels to add to each pod podLabels: {} # example.com/label: foo # -- Additional annotations to add to each pod podAnnotations: {} # example.com/annotation: foo # -- Deployment labels. labels: {} # -- Deployment annotations. annotations: {} # -- Deployment update strategy. # Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy # @default -- See [values.yaml](values.yaml) updateStrategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate # -- Optional priority class priorityClassName: '' # -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace. # Useful for situations like when you end up dealing with a custom CNI over Amazon EKS. # Update the `dnsPolicy` accordingly as well to suit the host network mode. hostNetwork: false # -- cleanupController server port # in case you are using hostNetwork: true, you might want to change the port the cleanupController is listening to server: port: 9443 # -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster. # In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. dnsPolicy: ClusterFirst # -- `dnsConfig` allows to specify DNS configuration for the pod. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config. dnsConfig: {} # options: # - name: ndots # value: "2" # -- Extra arguments passed to the container on the command line extraArgs: {} # -- Additional container environment variables. extraEnvVars: [] # Example setting proxy # extraEnvVars: # - name: HTTPS_PROXY # value: 'https://proxy.example.com:3128' resources: # -- Pod resource limits limits: memory: 128Mi # -- Pod resource requests requests: cpu: 100m memory: 64Mi # -- Startup probe. # The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want. # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ # @default -- See [values.yaml](values.yaml) startupProbe: httpGet: path: /health/liveness port: 9443 scheme: HTTPS failureThreshold: 20 initialDelaySeconds: 2 periodSeconds: 6 # -- Liveness probe. # The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want. # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ # @default -- See [values.yaml](values.yaml) livenessProbe: httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 timeoutSeconds: 5 failureThreshold: 2 successThreshold: 1 # -- Readiness Probe. # The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want. # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ # @default -- See [values.yaml](values.yaml) readinessProbe: httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 timeoutSeconds: 5 failureThreshold: 6 successThreshold: 1 # -- Node labels for pod assignment nodeSelector: kubernetes.io/os: linux # -- List of node taints to tolerate tolerations: [] antiAffinity: # -- Pod antiAffinities toggle. # Enabled by default but can be disabled if you want to schedule pods to the same node. enabled: true # -- Pod anti affinity constraints. # @default -- See [values.yaml](values.yaml) podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - cleanup-controller topologyKey: kubernetes.io/hostname # -- Pod affinity constraints. podAffinity: {} # -- Node affinity constraints. nodeAffinity: {} # -- Topology spread constraints. topologySpreadConstraints: [] # -- Security context for the pod podSecurityContext: {} # -- Security context for the containers securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault podDisruptionBudget: # -- Enable PodDisruptionBudget. # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1 # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: # -- Unhealthy pod eviction policy to be used. # Possible values are `IfHealthyBudget` or `AlwaysAllow`. unhealthyPodEvictionPolicy: # -- Additional volumes to be mounted in the pod extraVolumes: [] # - name: my-volume # emptyDir: {} # -- Additional volumeMounts to be mounted to the main container extraVolumeMounts: [] # - name: my-volume # mountPath: /path/to/mount service: # -- Service port. port: 443 # -- Service type. type: ClusterIP # -- Service node port. # Only used if `service.type` is `NodePort`. nodePort: # -- Service annotations. annotations: {} # -- (string) Service traffic distribution policy. # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. trafficDistribution: ~ metricsService: # -- Create service. create: true # -- Service port. # Metrics server will be exposed at this port. port: 8000 # -- Service type. type: ClusterIP # -- Service node port. # Only used if `metricsService.type` is `NodePort`. nodePort: # -- Service annotations. annotations: {} # -- (string) Service traffic distribution policy. # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. trafficDistribution: ~ networkPolicy: # -- When true, use a NetworkPolicy to allow ingress to the webhook # This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. enabled: false # -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. ingressFrom: [] serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false # -- Additional annotations additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace namespace: ~ # -- Interval to scrape metrics interval: 30s # -- Timeout if metrics can't be retrieved in given time interval scrapeTimeout: 25s # -- Is TLS required for endpoint secure: false # -- TLS Configuration for endpoint tlsConfig: {} # -- RelabelConfigs to apply to samples before scraping relabelings: [] # -- MetricRelabelConfigs to apply to samples before ingestion. metricRelabelings: [] tracing: # -- Enable tracing enabled: false # -- Traces receiver address address: # -- Traces receiver port port: # -- Traces receiver credentials creds: '' metering: # -- Disable metrics export disabled: false # -- Otel configuration, can be `prometheus` or `grpc` config: prometheus # -- Prometheus endpoint port port: 8000 # -- Is TLS required for endpoint secure: false # -- Key algorithm for self-signed TLS certificates. # Supported values: RSA, ECDSA, Ed25519 tlsKeyAlgorithm: RSA # -- Otel collector endpoint collector: '' # -- Otel collector credentials creds: '' profiling: # -- Enable profiling enabled: false # -- Profiling endpoint port port: 6060 # -- Service type. serviceType: ClusterIP # -- Service node port. # Only used if `type` is `NodePort`. nodePort: # Reports controller configuration reportsController: # -- Overrides features defined at the root level featuresOverride: {} # -- Enable reports controller. enabled: true rbac: # -- Create RBAC resources create: true # -- Create rolebinding to view role createViewRoleBinding: true # -- The view role to use in the rolebinding viewRoleName: view serviceAccount: # -- Service account name name: # -- Annotations for the ServiceAccount annotations: {} # example.com/annotation: value # -- Toggle automounting of the ServiceAccount. # When set to false, a projected service account token is used instead # which provides time-limited and audience-bound tokens for improved security. automountServiceAccountToken: true # -- Projected service account token configuration (only used when automountServiceAccountToken is false) projectedServiceAccountToken: # -- Token expiration time in seconds. # The kubelet will request a new token before the token expires. expirationSeconds: 3600 # -- Audience for the projected service account token. # If not set, the token will have no audience restriction. audience: "" coreClusterRole: # -- Extra resource permissions to add in the core cluster role. # This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`. # @default -- See [values.yaml](values.yaml) extraResources: [] clusterRole: # -- Extra resource permissions to add in the cluster role extraResources: [] # - apiGroups: # - '' # resources: # - pods image: # -- Image registry registry: ~ defaultRegistry: reg.kyverno.io # -- Image repository repository: kyverno/reports-controller # -- (string) Image tag # Defaults to appVersion in Chart.yaml if omitted tag: ~ # -- Image pull policy pullPolicy: IfNotPresent # -- Image pull secrets imagePullSecrets: [] # - secretName # -- (int) Desired number of pods replicas: ~ # -- The number of revisions to keep revisionHistoryLimit: 10 # -- Resync period for informers resyncPeriod: 15m # -- Additional labels to add to each pod podLabels: {} # example.com/label: foo # -- Additional annotations to add to each pod podAnnotations: {} # example.com/annotation: foo # -- Deployment labels. labels: {} # -- Deployment annotations. annotations: {} # -- Deployment update strategy. # Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy # @default -- See [values.yaml](values.yaml) updateStrategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate # -- Optional priority class priorityClassName: '' # -- Change `apiPriorityAndFairness` to `true` if you want to insulate the API calls made by Kyverno reports controller activities. # This will help ensure Kyverno reports stability in busy clusters. # Ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/ apiPriorityAndFairness: false # -- Priority level configuration. # The block is directly forwarded into the priorityLevelConfiguration, so you can use whatever specification you want. # ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/#prioritylevelconfiguration # @default -- See [values.yaml](values.yaml) priorityLevelConfigurationSpec: type: Limited limited: nominalConcurrencyShares: 10 limitResponse: queuing: queueLengthLimit: 50 type: Queue # -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace. # Useful for situations like when you end up dealing with a custom CNI over Amazon EKS. # Update the `dnsPolicy` accordingly as well to suit the host network mode. hostNetwork: false # -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster. # In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. dnsPolicy: ClusterFirst # -- `dnsConfig` allows to specify DNS configuration for the pod. # For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config. dnsConfig: {} # options: # - name: ndots # value: "2" # -- Extra arguments passed to the container on the command line extraArgs: {} # -- Additional container environment variables. extraEnvVars: [] # Example setting proxy # extraEnvVars: # - name: HTTPS_PROXY # value: 'https://proxy.example.com:3128' resources: # -- Pod resource limits limits: memory: 128Mi # -- Pod resource requests requests: cpu: 100m memory: 64Mi # -- Node labels for pod assignment nodeSelector: kubernetes.io/os: linux # -- List of node taints to tolerate tolerations: [] antiAffinity: # -- Pod antiAffinities toggle. # Enabled by default but can be disabled if you want to schedule pods to the same node. enabled: true # -- Pod anti affinity constraints. # @default -- See [values.yaml](values.yaml) podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1 podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - reports-controller topologyKey: kubernetes.io/hostname # -- Pod affinity constraints. podAffinity: {} # -- Node affinity constraints. nodeAffinity: {} # -- Topology spread constraints. topologySpreadConstraints: [] # -- Security context for the pod podSecurityContext: {} # -- Security context for the containers securityContext: runAsUser: 65534 runAsGroup: 65534 runAsNonRoot: true privileged: false allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL seccompProfile: type: RuntimeDefault podDisruptionBudget: # -- Enable PodDisruptionBudget. # Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking. enabled: false # -- Configures the minimum available pods for disruptions. # Cannot be used if `maxUnavailable` is set. minAvailable: 1 # -- Configures the maximum unavailable pods for disruptions. # Cannot be used if `minAvailable` is set. maxUnavailable: # -- Unhealthy pod eviction policy to be used. # Possible values are `IfHealthyBudget` or `AlwaysAllow`. unhealthyPodEvictionPolicy: # -- A writable volume to use for the TUF root initialization. tufRootMountPath: /.sigstore # -- Volume to be mounted in pods for TUF/cosign work. sigstoreVolume: emptyDir: {} caCertificates: # -- CA certificates to use with Kyverno deployments # This value is expected to be one large string of CA certificates data: ~ # -- Volume to be mounted for CA certificates # Not used when `.Values.reportsController.caCertificates.data` is defined volume: {} # Example to use hostPath: # hostPath: # path: /etc/pki/tls/ca-certificates.crt # type: File # -- Additional volumes to be mounted in the pod extraVolumes: [] # - name: my-volume # emptyDir: {} # -- Additional volumeMounts to be mounted to the main container extraVolumeMounts: [] # - name: my-volume # mountPath: /path/to/mount metricsService: # -- Create service. create: true # -- Service port. # Metrics server will be exposed at this port. port: 8000 # -- Service type. type: ClusterIP # -- (string) Service node port. # Only used if `type` is `NodePort`. nodePort: ~ # -- Service annotations. annotations: {} # -- (string) Service traffic distribution policy. # Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs. trafficDistribution: ~ networkPolicy: # -- When true, use a NetworkPolicy to allow ingress to the webhook # This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. enabled: false # -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. ingressFrom: [] serviceMonitor: # -- Create a `ServiceMonitor` to collect Prometheus metrics. enabled: false # -- Additional annotations additionalAnnotations: {} # -- Additional labels additionalLabels: {} # -- (string) Override namespace namespace: ~ # -- Interval to scrape metrics interval: 30s # -- Timeout if metrics can't be retrieved in given time interval scrapeTimeout: 25s # -- Is TLS required for endpoint secure: false # -- TLS Configuration for endpoint tlsConfig: {} # -- RelabelConfigs to apply to samples before scraping relabelings: [] # -- MetricRelabelConfigs to apply to samples before ingestion. metricRelabelings: [] tracing: # -- Enable tracing enabled: false # -- (string) Traces receiver address address: ~ # -- (string) Traces receiver port port: ~ # -- (string) Traces receiver credentials creds: ~ metering: # -- Disable metrics export disabled: false # -- Otel configuration, can be `prometheus` or `grpc` config: prometheus # -- Prometheus endpoint port port: 8000 # -- Is TLS required for endpoint secure: false # -- Key algorithm for self-signed TLS certificates. # Supported values: RSA, ECDSA, Ed25519 tlsKeyAlgorithm: RSA # -- (string) Otel collector endpoint collector: ~ # -- (string) Otel collector credentials creds: ~ # -- reportsController server port # in case you are using hostNetwork: true, you might want to change the port the reportsController is listening to server: port: 9443 profiling: # -- Enable profiling enabled: false # -- Profiling endpoint port port: 6060 # -- Service type. serviceType: ClusterIP # -- Service node port. # Only used if `type` is `NodePort`. nodePort: # -- Enable sanity check for reports CRDs sanityChecks: true