kyverno-policies

# -- Policy kind (`ClusterPolicy`, `Policy`)

# Set to `Policy` if you need namespaced policies and not cluster policies.

# Only used when `policyType` is `ClusterPolicy` (the legacy kyverno.io types);

# with the default `policyType: ValidatingPolicy` cluster-wide CEL policies are installed.

policyKind: ClusterPolicy

# -- Policy engine type (`ClusterPolicy`, `ValidatingPolicy`)

# `ValidatingPolicy` installs CEL-based policies (policies.kyverno.io, requires Kyverno 1.17+).

# Set to `ClusterPolicy` to keep installing the legacy kyverno.io policy types,

# which are deprecated and will be removed in a future release

# (see https://kyverno.io/docs/guides/migration-to-cel/).

policyType: ValidatingPolicy

# -- Pod Security Standard profile (`baseline`, `restricted`, `privileged`, `custom`).

# For more info https://kyverno.io/policies/pod-security.

podSecurityStandard: baseline

# -- Pod Security Standard severity (`low`, `medium`, `high`).

podSecuritySeverity: medium

# -- Define podSecuritySeverity overrides for specific policies.

# Override the global `podSecuritySeverity` with an individual severity for individual policies.

# An empty string per-policy entry suppresses the annotation entirely.

podSecuritySeverityByPolicy: {}

# disallow-host-path: high

# disallow-privileged-containers: high

# -- Policies to include when `podSecurityStandard` is `custom`.

podSecurityPolicies: []

# -- Enable the Kubernetes Pod Security Admission relaxation for user namespace pods

# for ValidatingPolicy templates only.

# When `true`, the `disallow-proc-mount` (Baseline), `require-run-as-nonroot` and

# `require-run-as-non-root-user` (Restricted) ValidatingPolicies skip Pods that explicitly

# set `spec.hostUsers` to `false`. A Pod that omits `hostUsers` or sets it to `true` is

# always checked. The Restricted `disallow-proc-mount-strict` ValidatingPolicy never

# relaxes, and neither does `disallow-proc-mount` when the Restricted profile is installed.

# This setting has no effect on legacy `ClusterPolicy` templates.

podSecurityUserNamespaces: false

# -- Additional policies to include from `other`.

includeOtherPolicies: []

# - require-non-root-groups

# -- Additional policies to include from `restricted`.

includeRestrictedPolicies: []

# - require-run-as-non-root-user

# -- Additional custom policies to include.

customPolicies: []

# - apiVersion: kyverno.io/v1

# kind: ClusterPolicy

# metadata: # metadata

# spec: # spec

# -- API server behavior if the webhook fails to respond ('Ignore', 'Fail')

# For more info: https://kyverno.io/docs/policy-types/cluster-policy/policy-settings/

failurePolicy: Fail

# -- Validation failure action (`Audit`, `Enforce`).

# For more info https://kyverno.io/docs/policy-types/cluster-policy/validate.

validationFailureAction: Audit

# -- Define validationFailureActionByPolicy for specific policies.

# Override the defined `validationFailureAction` with a individual validationFailureAction for individual Policies.

validationFailureActionByPolicy: {}

# disallow-capabilities-strict: Enforce

# disallow-host-path: Enforce

# disallow-host-ports: Enforce

# -- Define validationFailureActionOverrides for specific policies.

# The overrides for `all` will apply to all policies.

validationFailureActionOverrides:

all: []

# all:

# - action: Audit

# namespaces:

# - ingress-nginx

# disallow-host-path:

# - action: Audit

# namespaces:

# - fluent

# -- Default audit annotations applied to all ValidatingPolicy policies (policyType: ValidatingPolicy only).

# Map of annotation key to CEL valueExpression. Audit annotations are recorded in the API server audit log.

# For more info https://kyverno.io/docs/policy-types/validating-policy/#using-auditannotations-to-add-custom-data

auditAnnotations: {}

# policy-evaluated-by: "'kyverno-policies-helm'"

# -- Define audit annotations for specific ValidatingPolicy policies (policyType: ValidatingPolicy only).

# Per-policy entries override defaults when they share the same key.

auditAnnotationsByPolicy: {}

# disallow-host-path:

# violation-details: >-

# has(object.spec.volumes) ? 'hostPath volumes found: ' + object.spec.volumes.filter(v, has(v.hostPath)).map(v, v.name).join(', ') : 'no volumes'

# -- Validate already existing resources.

# For more info https://kyverno.io/docs/policy-types/.

validationAllowExistingViolations: true

# -- Exclude resources from individual policies (policyType: ClusterPolicy only).

# Policies with multiple rules can have individual rules excluded by using the name of the rule as the key in the `policyExclude` map.

# NOTE: This setting only applies when policyType is set to ClusterPolicy. For ValidatingPolicy, use vpolExclude/vpolExcludeByPolicy instead.

policyExclude: {}

# # Exclude resources from individual policies

# disallow-host-path:

# all:

# - resources:

# kinds:

# - Pod

# namespaces:

# - fluent

# # Policies with multiple rules can have individual rules excluded

# adding-capabilities-strict:

# any:

# - resources:

# kinds:

# - Pod

# namespaces:

# - kube-system

# -- Default excludes applied to ALL ValidatingPolicy policies (policyType: ValidatingPolicy only).

# NOTE: This setting only applies when policyType is set to ValidatingPolicy. For ClusterPolicy, use policyExclude instead.

# Supports the following optional keys:

# excludeResourceRules: list of Kubernetes NamedRuleWithOperations (native VAP excludes)

# excludeNamespaces: list of namespace names to exclude (generates CEL matchCondition)

# excludeSubjects: list of subjects to exclude (generates CEL matchCondition)

# matchConditions: list of CEL matchConditions for advanced filtering (passthrough of custom condition)

# Per-policy overrides via vpolExcludeByPolicy replace these defaults entirely for that policy.

vpolExclude: {}

# excludeNamespaces:

# - kube-system

# excludeSubjects:

# - kind: Group

# name: system:masters

# -- Per-policy excludes for individual ValidatingPolicy policies (policyType: ValidatingPolicy only).

# When set for a policy, it completely replaces the global vpolExclude defaults for that policy.

# NOTE: This setting only applies when policyType is set to ValidatingPolicy. For ClusterPolicy, use policyExclude instead.

# Each policy name maps to an object with the same keys as vpolExclude.

vpolExcludeByPolicy: {}

# disallow-host-path:

# excludeResourceRules:

# - apiGroups:

# - ""

# apiVersions:

# - v1

# operations:

# - CREATE

# - UPDATE

# resources:

# - pods

# # optional - exact resource names to exclude

# resourceNames:

# - specific-pod-name

# excludeNamespaces:

# - kube-system

# - monitoring

# excludeSubjects:

# - kind: Group

# name: system:masters

# - kind: User

# name: admin@example.com

# - kind: ServiceAccount

# namespace: kube-system

# name: default

# matchConditions:

# - name: exclude-custom

# expression: "!object.metadata.name.startsWith('temp-')"

# -- Add preconditions to individual policies.

# Policies with multiple rules can have individual rules excluded by using the name of the rule as the key in the `policyPreconditions` map.

policyPreconditions: {}

# # Exclude resources from individual policies

# require-run-as-non-root-user:

# all:

# - key: "{{ request.object.metadata.name }}"

# operator: NotEquals

# value: "dcgm-exporter*"

# # Policies with multiple rules can have individual rules excluded

# require-drop-all:

# any:

# - key: "{{ request.object.metadata.name }}"

# operator: NotEquals

# value: "dcgm-exporter*"

# adding-capabilities-strict:

# all:

# - key: "{{ request.object.metadata.name }}"

# operator: NotEquals

# value: "dcgm-exporter*"

# -- Customize the target Pod controllers for the auto-generated rules. (Eg. `none`, `Deployment`, `DaemonSet,Deployment,StatefulSet`)

# For more info https://kyverno.io/docs/policy-types/cluster-policy/autogen/.

autogenControllers: ""

# -- Name override.

nameOverride:

# -- Additional Annotations.

customAnnotations: {}

# -- Define custom annotations for specific policies.

# Per-policy entries override defaults when they share the same key.

customAnnotationsByPolicy: {}

# disallow-host-path:

# my-custom-annotation: "some-value"

# -- Additional labels.

customLabels: {}

# -- Policies background mode

background: true

# -- (bool) SkipBackgroundRequests bypasses admission requests that are sent by the background controller

skipBackgroundRequests: ~

# -- Kyverno version

# The default of "autodetect" will try to determine the currently installed version from the deployment

kyvernoVersion: autodetect

# -- Kubernetes version override

# Override default value of kubeVersion set by release team taken from Chart.yaml with custom value. Ideally range of versions no more than two prior (ex., 1.28-1.31), must be enclosed in quotes.

kubeVersionOverride: