kyverno

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

global:

# -- Internal settings used with `helm template` to generate install manifest

# @ignored

templating:

enabled: false

debug: false

version: ~

image:

# -- (string) Global value that allows to set a single image registry across all deployments.

# When set, it will override any values set under `.image.registry` across the chart.

registry: ~

# -- (list) Global list of Image pull secrets

# When set, it will override any values set under `imagePullSecrets` under different components across the chart.

imagePullSecrets: []

# -- Resync period for informers

resyncPeriod: 15m

# -- Enable/Disable custom resource watcher to invalidate cache

crdWatcher: false

caCertificates:

# -- Global CA certificates to use with Kyverno deployments

# This value is expected to be one large string of CA certificates

# Individual controller values will override this global value

data: ~

# -- Global value to set single volume to be mounted for CA certificates for all deployments.

# Not used when `.Values.global.caCertificates.data` is defined

# Individual controller values will override this global value

volume: {}

# Example to use hostPath:

# hostPath:

# path: /etc/pki/tls/ca-certificates.crt

# type: File

# -- Global priority class name for pod priority. Non-global values will override the global value.

priorityClassName: ''

# -- Additional container environment variables to apply to all containers and init containers

extraEnvVars: []

# Example setting proxy

# extraEnvVars:

# - name: HTTPS_PROXY

# value: 'https://proxy.example.com:3128'

# -- Global node labels for pod assignment, applied to all chart workloads including controller Deployments, hook Jobs, and Helm test Pods. Non-global (controller) values will override the global value when non-empty. The default `kubernetes.io/os: linux` key is always merged into any user-supplied value and cannot be unset by design, because Kyverno images only run on Linux nodes.

nodeSelector:

kubernetes.io/os: linux

# -- Global List of node taints to tolerate. Non-global values will override the global value.

tolerations: []

# -- (string) Override the name of the chart

nameOverride: ~

# -- (string) Override the expanded name of the chart

fullnameOverride: ~

# -- (string) Override the namespace the chart deploys to

namespaceOverride: ~

upgrade:

# -- Upgrading from v2 to v3 is not allowed by default, set this to true once changes have been reviewed.

fromV2: false

apiVersionOverride:

# -- (string) Override api version used to create `PodDisruptionBudget`` resources.

# When not specified the chart will check if `policy/v1/PodDisruptionBudget` is available to

# determine the api version automatically.

podDisruptionBudget: ~

rbac:

roles:

# -- Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles)

aggregate:

admin: true

view: true

# Use openreports.io as the API group for reporting

openreports:

# -- Enable OpenReports feature in controllers

enabled: false

# -- Whether to install CRDs from the upstream OpenReports chart. Setting this to true requires enabled to also be true.

installCrds: false

# Reports Server configuration

reportsServer:

# -- Enable reports-server deployment alongside Kyverno

enabled: false

# -- Wait for reports-server to be ready before starting Kyverno components

waitForReady: true

# -- Timeout for waiting for reports-server readiness (as duration string, e.g. 300s, 5m)

readinessTimeout: 300s

# CRDs configuration

crds:

# -- Whether to have Helm install the Kyverno CRDs, if the CRDs are not installed by Helm, they must be added before policies can be created

install: true

reportsServer:

# -- Kyverno reports-server is used in your cluster

enabled: false

groups:

# -- Install CRDs in group `kyverno.io`.

# Note: the legacy policy types in this group (`ClusterPolicy`, `Policy`, `ClusterCleanupPolicy`, `CleanupPolicy`, `PolicyException`)

# are deprecated and will be removed in a future release, migrate to the `policies.kyverno.io` policy types

# (see https://kyverno.io/docs/guides/migration-to-cel/).

kyverno:

cleanuppolicies: true

clustercleanuppolicies: true

clusterpolicies: true

globalcontextentries: true

policies: true

policyexceptions: true

updaterequests: true

100

# -- Install CRDs in group `policies.kyverno.io`

101

policies:

102

validatingpolicies: true

103

policyexceptions: true

104

imagevalidatingpolicies: true

105

namespacedimagevalidatingpolicies: true

106

mutatingpolicies: true

107

namespacedmutatingpolicies: true

108

generatingpolicies: true

109

deletingpolicies: true

110

namespaceddeletingpolicies: true

111

namespacedvalidatingpolicies: true

112

# -- Install CRDs in group `reports.kyverno.io`

113

reports:

114

clusterephemeralreports: true

115

ephemeralreports: true

116

# -- Install CRDs in group `wgpolicyk8s.io`

117

wgpolicyk8s:

118

clusterpolicyreports: true

119

policyreports: true

120

# -- Additional CRDs annotations

121

annotations: {}

122

# argocd.argoproj.io/sync-options: Replace=true

123

# strategy.spinnaker.io/replace: 'true'

124

125

# -- Additional CRDs labels

126

customLabels: {}

127

migration:

128

# -- Enable CRDs migration using helm post upgrade hook

129

enabled: true

130

# -- Additional CLI flags passed to the migration job

131

extraArgs: {}

132

# -- Resources to migrate

133

resources:

134

- cleanuppolicies.kyverno.io

135

- clustercleanuppolicies.kyverno.io

136

- clusterpolicies.kyverno.io

137

- globalcontextentries.kyverno.io

138

- policies.kyverno.io

139

- policyexceptions.kyverno.io

140

- updaterequests.kyverno.io

141

# policies.kyverno.io

142

- deletingpolicies.policies.kyverno.io

143

- generatingpolicies.policies.kyverno.io

144

- imagevalidatingpolicies.policies.kyverno.io

145

- mutatingpolicies.policies.kyverno.io

146

- namespaceddeletingpolicies.policies.kyverno.io

147

- namespacedgeneratingpolicies.policies.kyverno.io

148

- namespacedimagevalidatingpolicies.policies.kyverno.io

149

- namespacedmutatingpolicies.policies.kyverno.io

150

- namespacedvalidatingpolicies.policies.kyverno.io

151

- policyexceptions.policies.kyverno.io

152

- validatingpolicies.policies.kyverno.io

153

image:

154

# -- (string) Image registry

155

registry: cgr.dev

156

defaultRegistry: reg.kyverno.io

157

# -- (string) Image repository

158

repository: scratch-images/test-tmp/kyverno-cli-fips

159

# -- (string) Image tag

160

# Defaults to appVersion in Chart.yaml if omitted

161

tag: 1.19.0-r3@sha256:772aef51b9221249b1f49d33dddf83493a3425a7e9f2c80897c5a3cafb948a9c

162

# -- (string) Image pull policy

163

pullPolicy: IfNotPresent

164

# -- Image pull secrets

165

imagePullSecrets: []

166

# - name: secretName

167

168

# -- Security context for the pod

169

podSecurityContext: {}

170

# -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`.

171

nodeSelector: {}

172

# -- List of node taints to tolerate

173

tolerations: []

174

# -- Pod anti affinity constraints.

175

podAntiAffinity: {}

176

# -- Pod affinity constraints.

177

podAffinity: {}

178

# -- Pod labels.

179

podLabels: {}

180

# -- Pod annotations.

181

podAnnotations: {}

182

# -- Node affinity constraints.

183

nodeAffinity: {}

184

# -- Security context for the hook containers

185

securityContext:

186

runAsUser: 65534

187

runAsGroup: 65534

188

runAsNonRoot: true

189

privileged: false

190

allowPrivilegeEscalation: false

191

readOnlyRootFilesystem: true

192

capabilities:

193

drop:

194

- ALL

195

seccompProfile:

196

type: RuntimeDefault

197

podResources:

198

# -- Pod resource limits

199

limits:

200

cpu: 100m

201

memory: 256Mi

202

# -- Pod resource requests

203

requests:

204

cpu: 10m

205

memory: 64Mi

206

serviceAccount:

207

# -- Toggle automounting of the ServiceAccount.

208

# When set to false, a projected service account token is used instead

209

# which provides time-limited and audience-bound tokens for improved security.

210

automountServiceAccountToken: true

211

# -- Projected service account token configuration (only used when automountServiceAccountToken is false)

212

projectedServiceAccountToken:

213

# -- Token expiration time in seconds.

214

# The kubelet will request a new token before the token expires.

215

expirationSeconds: 3600

216

# -- Audience for the projected service account token.

217

# If not set, the token will have no audience restriction.

218

audience: ""

219

# -- Scoped token injected into outbound APICall and CEL http requests.

220

# This token carries a custom audience so that if leaked to an external service

221

# it cannot be replayed against the Kubernetes API server.

222

apiCallToken:

223

# -- Audience for the projected token used in outbound requests.

224

# Set this to the audience your receiving service validates in the OIDC token's

225

# `aud` claim. The default is `kyverno-svc.kyverno.io`, which is a Kyverno-specific

226

# audience and prevents the token from being accepted by the Kubernetes API server.

227

audience: "kyverno-svc.kyverno.io"

228

# -- Token lifetime in seconds for the projected outbound API call token.

229

# The default is `3600` (1 hour). The kubelet requests a replacement before the

230

# token expires, so lowering this reduces token lifetime while increasing rotation

231

# frequency.

232

expirationSeconds: 3600

233

# Configuration

234

config:

235

# -- Create the configmap.

236

create: true

237

# -- Preserve the configmap settings during upgrade.

238

preserve: true

239

# -- (string) The configmap name (required if `create` is `false`).

240

241

# -- Additional annotations to add to the configmap.

242

annotations: {}

243

# -- Enable registry mutation for container images. Enabled by default.

244

enableDefaultRegistryMutation: true

245

# -- The registry hostname used for the image mutation.

246

defaultRegistry: docker.io

247

# -- Exclude groups

248

excludeGroups:

249

- system:nodes

250

# -- Exclude usernames

251

excludeUsernames: []

252

# - '!system:kube-scheduler'

253

254

# -- Exclude roles

255

excludeRoles: []

256

# -- Exclude roles

257

excludeClusterRoles: []

258

# -- Generate success events.

259

generateSuccessEvents: false

260

# -- Comma-separated list of event actions for which success events should be generated.

261

# When set, only success events matching the specified actions are emitted.

262

# Requires `generateSuccessEvents` to be `true`.

263

# Valid values: "Resource Mutated", "Resource Passed", "Resource Generated", "Resource Cleaned Up".

264

# Example: "Resource Mutated" or "Resource Mutated,Resource Generated".

265

# @default -- "" (empty, all success events are emitted when generateSuccessEvents is true)

266

successEventActions: ""

267

# -- Maximum cumulative size of context data during policy evaluation.

268

# Supports Kubernetes quantity format (e.g., 100Mi, 2Gi) or plain bytes (e.g., 2097152).

269

# Limits memory used by context variables to prevent unbounded growth.

270

# Increase if policies legitimately need large context data (e.g., processing large ConfigMaps).

271

# Set to 0 to disable the limit (not recommended for production).

272

# @default -- 2Mi

273

maxContextSize: ~

274

# -- Resource types to be skipped by the Kyverno policy engine.

275

# Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list.

276

# These are joined together without spaces, run through `tpl`, and the result is set in the config map.

277

# @default -- See [values.yaml](values.yaml)

278

resourceFilters:

279

- '[Event,*,*]'

280

- '[*/*,kube-system,*]'

281

- '[*/*,kube-public,*]'

282

- '[*/*,kube-node-lease,*]'

283

- '[Node,*,*]'

284

- '[Node/?*,*,*]'

285

- '[APIService,*,*]'

286

- '[APIService/?*,*,*]'

287

- '[TokenReview,*,*]'

288

- '[SubjectAccessReview,*,*]'

289

- '[SelfSubjectAccessReview,*,*]'

290

- '[Binding,*,*]'

291

- '[Pod/binding,*,*]'

292

- '[ReplicaSet,*,*]'

293

- '[ReplicaSet/?*,*,*]'

294

- '[EphemeralReport,*,*]'

295

- '[ClusterEphemeralReport,*,*]'

296

# exclude resources from the chart

297

- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'

298

- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'

299

- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'

300

- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'

301

- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'

302

- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'

303

- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'

304

- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'

305

- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'

306

- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'

307

- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'

308

- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'

309

- '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'

310

- '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'

311

- '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'

312

- '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'

313

- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'

314

- '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'

315

- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'

316

- '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'

317

- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'

318

- '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'

319

- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'

320

- '[ServiceAccount/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'

321

- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'

322

- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'

323

- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'

324

- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'

325

- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'

326

- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'

327

- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'

328

- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'

329

- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'

330

- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'

331

- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'

332

- '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'

333

- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'

334

- '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'

335

- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

336

- '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

337

- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'

338

- '[Deployment/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'

339

- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'

340

- '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'

341

- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'

342

- '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'

343

- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'

344

- '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'

345

- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'

346

- '[Pod/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'

347

- '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'

348

- '[Job/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'

349

- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'

350

- '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'

351

- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'

352

- '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'

353

- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

354

- '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

355

- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'

356

- '[NetworkPolicy/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'

357

- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'

358

- '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'

359

- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'

360

- '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'

361

- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

362

- '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

363

- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'

364

- '[PodDisruptionBudget/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'

365

- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'

366

- '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'

367

- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'

368

- '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'

369

- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'

370

- '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'

371

- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

372

- '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'

373

- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'

374

- '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'

375

- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'

376

- '[Service/?*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'

377

- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'

378

379

380

381

- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'

382

- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'

383

# -- Sets the threshold for the total number of UpdateRequests generated for mutateExisitng and generate policies.

384

updateRequestThreshold: 1000

385

# -- Defines the `namespaceSelector`/`objectSelector` in the webhook configurations.

386

# The Kyverno namespace is excluded if `excludeKyvernoNamespace` is `true` (default)

387

webhooks:

388

# Exclude namespaces

389

namespaceSelector:

390

matchExpressions:

391

- key: kubernetes.io/metadata.name

392

operator: NotIn

393

values:

394

- kube-system

395

# Exclude objects

396

# objectSelector:

397

# matchExpressions:

398

# - key: webhooks.kyverno.io/exclude

399

# operator: DoesNotExist

400

# -- Defines annotations to set on webhook configurations.

401

webhookAnnotations:

402

# Example to disable admission enforcer on AKS:

403

'admissions.enforcer/disabled': 'true'

404

# -- Defines labels to set on webhook configurations.

405

webhookLabels: {}

406

# Example to adopt webhook resources in ArgoCD:

407

# 'argocd.argoproj.io/instance': 'kyverno'

408

409

# -- Defines match conditions to set on webhook configurations (requires Kubernetes 1.27+).

410

matchConditions: []

411

# -- Exclude Kyverno namespace

412

# Determines if default Kyverno namespace exclusion is enabled for webhooks and resourceFilters

413

excludeKyvernoNamespace: true

414

# -- resourceFilter namespace exclude

415

# Namespaces to exclude from the default resourceFilters

416

resourceFiltersExcludeNamespaces: []

417

# -- resourceFilters exclude list

418

# Items to exclude from config.resourceFilters

419

resourceFiltersExclude: []

420

# -- resourceFilter namespace include

421

# Namespaces to include to the default resourceFilters

422

resourceFiltersIncludeNamespaces: []

423

# -- resourceFilters include list

424

# Items to include to config.resourceFilters

425

resourceFiltersInclude: []

426

# Metrics configuration

427

metricsConfig:

428

# -- Create the configmap.

429

create: true

430

# -- (string) The configmap name (required if `create` is `false`).

431

432

# -- Additional annotations to add to the configmap.

433

annotations: {}

434

namespaces:

435

# -- List of namespaces to capture metrics for.

436

include: []

437

# -- list of namespaces to NOT capture metrics for.

438

439

# -- (string) Rate at which metrics should reset so as to clean up the memory footprint of kyverno metrics, if you might be expecting high memory footprint of Kyverno's metrics. Default: 0, no refresh of metrics. WARNING: This flag is not working since Kyverno 1.8.0

440

metricsRefreshInterval: ~

441

# metricsRefreshInterval: 24h

442

443

# -- (list) Configures the bucket boundaries for all Histogram metrics, changing this configuration requires restart of the kyverno admission controller

444

bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 15, 20, 25, 30]

445

# -- (map) Configures the exposure of individual metrics, by default all metrics and all labels are exported, changing this configuration requires restart of the kyverno admission controller

446

metricsExposure:

447

kyverno_policy_execution_duration_seconds:

448

# bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5]

449

disabledLabelDimensions: ["resource_namespace", "resource_request_operation"]

450

kyverno_validating_policy_execution_duration_seconds:

451

# bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5]

452

disabledLabelDimensions: ["resource_namespace", "resource_request_operation"]

453

kyverno_image_validating_policy_execution_duration_seconds:

454

# bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5]

455

disabledLabelDimensions: ["resource_namespace", "resource_request_operation"]

456

kyverno_mutating_policy_execution_duration_seconds:

457

# bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5]

458

disabledLabelDimensions: ["resource_namespace", "resource_request_operation"]

459

kyverno_generating_policy_execution_duration_seconds:

460

# bucketBoundaries: [0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5]

461

disabledLabelDimensions: ["resource_namespace", "resource_request_operation"]

462

kyverno_admission_review_duration_seconds:

463

# enabled: false

464

disabledLabelDimensions: ["resource_namespace"]

465

kyverno_policy_rule_info_total:

466

disabledLabelDimensions: ["resource_namespace", "policy_namespace"]

467

kyverno_policy_results_total:

468

disabledLabelDimensions: ["resource_namespace", "policy_namespace"]

469

kyverno_admission_requests_total:

470

disabledLabelDimensions: ["resource_namespace"]

471

kyverno_cleanup_controller_deletedobjects_total:

472

disabledLabelDimensions: ["resource_namespace", "policy_namespace"]

473

kyverno_validating_policy_results_total:

474

disabledLabelDimensions: ["resource_namespace", "policy_namespace"]

475

kyverno_mutating_policy_results_total:

476

disabledLabelDimensions: ["resource_namespace", "policy_namespace"]

477

kyverno_generating_policy_results_total:

478

disabledLabelDimensions: ["resource_namespace", "policy_namespace"]

479

kyverno_image_validating_policy_results_total:

480

disabledLabelDimensions: ["resource_namespace", "policy_namespace"]

481

# -- Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument

482

imagePullSecrets: {}

483

# regcred:

484

# registry: foo.example.com

485

# username: foobar

486

# password: secret

487

# regcred2:

488

# registry: bar.example.com

489

# username: barbaz

490

# password: secret2

491

492

# -- Existing Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument

493

existingImagePullSecrets: []

494

# - test-registry

495

# - other-test-registry

496

497

# Tests configuration

498

test:

499

# -- Sleep time before running test

500

sleep: 20

501

image:

502

# -- (string) Image registry

503

registry: cgr.dev

504

# -- Image repository

505

repository: scratch-images/test-tmp/kyverno-readiness-checker-fips

506

# -- Image tag

507

# Defaults to `latest` if omitted

508

tag: 1.19.0-r3@sha256:7b4fc9e254f03828022a89f5db1c99d7ea81ceab826ae866bffe2e1bbc3b1044

509

# -- (string) Image pull policy

510

# Defaults to image.pullPolicy if omitted

511

pullPolicy: ~

512

# -- Image pull secrets

513

imagePullSecrets: []

514

# - name: secretName

515

516

resources:

517

# -- Pod resource limits

518

limits:

519

cpu: 100m

520

memory: 256Mi

521

# -- Pod resource requests

522

requests:

523

cpu: 10m

524

memory: 64Mi

525

# -- Security context for the test containers

526

securityContext:

527

runAsUser: 65534

528

runAsGroup: 65534

529

runAsNonRoot: true

530

privileged: false

531

allowPrivilegeEscalation: false

532

readOnlyRootFilesystem: true

533

capabilities:

534

drop:

535

- ALL

536

seccompProfile:

537

type: RuntimeDefault

538

# -- Toggle automounting of the ServiceAccount.

539

# When set to false, a projected service account token is used instead

540

# which provides time-limited and audience-bound tokens for improved security.

541

automountServiceAccountToken: true

542

# -- Projected service account token configuration (only used when automountServiceAccountToken is false)

543

projectedServiceAccountToken:

544

# -- Token expiration time in seconds.

545

# The kubelet will request a new token before the token expires.

546

expirationSeconds: 3600

547

# -- Audience for the projected service account token.

548

# If not set, the token will have no audience restriction.

549

audience: ""

550

# -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`.

551

nodeSelector: {}

552

# -- Additional Pod annotations

553

podAnnotations: {}

554

# -- List of node taints to tolerate

555

tolerations: []

556

# -- Additional labels

557

customLabels: {}

558

webhooksCleanup:

559

# -- Create a helm pre-delete hook to cleanup webhooks.

560

enabled: true

561

image:

562

# -- (string) Image registry

563

registry: cgr.dev

564

# -- Image repository

565

repository: scratch-images/test-tmp/kyverno-readiness-checker-fips

566

# -- Image tag

567

# Defaults to `latest` if omitted

568

tag: 1.19.0-r3@sha256:7b4fc9e254f03828022a89f5db1c99d7ea81ceab826ae866bffe2e1bbc3b1044

569

# -- (string) Image pull policy

570

# Defaults to image.pullPolicy if omitted

571

pullPolicy: ~

572

# -- Image pull secrets

573

imagePullSecrets: []

574

# -- Security context for the pod

575

podSecurityContext: {}

576

# -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`.

577

nodeSelector: {}

578

# -- List of node taints to tolerate

579

tolerations: []

580

# -- Pod anti affinity constraints.

581

podAntiAffinity: {}

582

# -- Pod affinity constraints.

583

podAffinity: {}

584

# -- Pod labels.

585

podLabels: {}

586

# -- Pod annotations.

587

podAnnotations: {}

588

# -- Node affinity constraints.

589

nodeAffinity: {}

590

# -- Security context for the hook containers

591

securityContext:

592

runAsUser: 65534

593

runAsGroup: 65534

594

runAsNonRoot: true

595

privileged: false

596

allowPrivilegeEscalation: false

597

readOnlyRootFilesystem: true

598

capabilities:

599

drop:

600

- ALL

601

seccompProfile:

602

type: RuntimeDefault

603

resources:

604

# -- Pod resource limits

605

limits:

606

cpu: 100m

607

memory: 256Mi

608

# -- Pod resource requests

609

requests:

610

cpu: 10m

611

memory: 64Mi

612

serviceAccount:

613

# -- Toggle automounting of the ServiceAccount.

614

# When set to false, a projected service account token is used instead

615

# which provides time-limited and audience-bound tokens for improved security.

616

automountServiceAccountToken: true

617

# -- Projected service account token configuration (only used when automountServiceAccountToken is false)

618

projectedServiceAccountToken:

619

# -- Token expiration time in seconds.

620

# The kubelet will request a new token before the token expires.

621

expirationSeconds: 3600

622

# -- Audience for the projected service account token.

623

# If not set, the token will have no audience restriction.

624

audience: ""

625

grafana:

626

# -- Enable grafana dashboard creation.

627

enabled: false

628

# -- Configmap name template.

629

configMapName: '{{ include "kyverno.fullname" . }}-grafana'

630

# -- (string) Namespace to create the grafana dashboard configmap.

631

# If not set, it will be created in the same namespace where the chart is deployed.

632

namespace: ~

633

# -- Grafana dashboard configmap annotations.

634

annotations: {}

635

# -- Grafana dashboard configmap labels

636

labels:

637

grafana_dashboard: "1"

638

# -- create GrafanaDashboard custom resource referencing to the configMap.

639

# according to https://grafana-operator.github.io/grafana-operator/docs/examples/dashboard_from_configmap/readme/

640

grafanaDashboard:

641

create: false

642

folder: kyverno

643

allowCrossNamespaceImport: true

644

matchLabels:

645

dashboards: "grafana"

646

prometheusRule:

647

# -- Enable PrometheusRule resource creation.

648

# Requires prometheus-operator (monitoring.coreos.com/v1 CRD) to be installed —

649

# the same prerequisite as serviceMonitor.enabled.

650

# The resource is only created when `enabled: true` and `spec` is non-empty.

651

enabled: false

652

# -- (string) Namespace to create the PrometheusRule in.

653

# If not set, it will be created in the same namespace as the chart.

654

namespace: ~

655

# -- Additional annotations to add to the PrometheusRule.

656

additionalAnnotations: {}

657

# -- Additional labels to add to the PrometheusRule.

658

# Must match the `ruleSelector` configured on your Prometheus instance

659

# (e.g. `release: prometheus` for kube-prometheus-stack).

660

additionalLabels: {}

661

# -- Alert rule groups. Provide your own rules here; the examples below use

662

# Kyverno's histogram metrics and can serve as starting points.

663

# Thresholds MUST be tuned to your environment's measured baseline —

664

# see https://kyverno.io/docs/guides/monitoring/#alerting for guidance.

665

spec: []

666

# spec:

667

# - name: kyverno.admission

668

# rules:

669

# - alert: KyvernoAdmissionHighLatency

670

# expr: |

671

# histogram_quantile(0.99,

672

# sum(rate(kyverno_admission_review_duration_seconds_bucket[5m])) by (le)

673

# ) > 1

674

# for: 5m

675

# labels:

676

# severity: warning

677

# annotations:

678

# summary: Kyverno admission review p99 latency is elevated

679

# description: >-

680

# Admission review p99 latency is {{ $value | humanizeDuration }},

681

# above the 1s threshold. Kubernetes webhooks hard-timeout at 10s.

682

# runbook_url: https://kyverno.io/docs/guides/monitoring/#admission-latency-high

683

# - alert: KyvernoAdmissionCriticalLatency

684

# expr: |

685

# histogram_quantile(0.99,

686

# sum(rate(kyverno_admission_review_duration_seconds_bucket[5m])) by (le)

687

# ) > 5

688

# for: 5m

689

# labels:

690

# severity: critical

691

# annotations:

692

# summary: Kyverno admission review p99 latency is critically high

693

# description: >-

694

# Admission review p99 latency is {{ $value | humanizeDuration }},

695

# above 5s. Kubernetes webhooks hard-timeout at 10s.

696

# runbook_url: https://kyverno.io/docs/guides/monitoring/#admission-latency-high

697

# - name: kyverno.policy

698

# rules:

699

# - alert: KyvernoPolicyExecutionHighLatency

700

# expr: |

701

# histogram_quantile(0.99,

702

# sum(rate(kyverno_policy_execution_duration_seconds_bucket[5m])) by (le, rule_type)

703

# ) > 0.5

704

# for: 5m

705

# labels:

706

# severity: warning

707

# annotations:

708

# summary: Kyverno policy execution p99 latency is elevated

709

# description: >-

710

# {{ $labels.rule_type }} rule p99 execution latency is

711

# {{ $value | humanizeDuration }}.

712

# runbook_url: https://kyverno.io/docs/guides/monitoring/#policy-execution-latency-high

713

# Features configuration

714

features:

715

admissionReports:

716

# -- Enables the feature

717

enabled: true

718

aggregateReports:

719

# -- Enables the feature

720

enabled: true

721

policyReports:

722

# -- Enables the feature

723

enabled: true

724

validatingAdmissionPolicyReports:

725

# -- Enables the feature

726

enabled: true

727

mutatingAdmissionPolicyReports:

728

# -- Enables the feature

729

enabled: false

730

reporting:

731

# -- Enables the feature

732

validate: true

733

# -- Enables the feature

734

mutate: true

735

# -- Enables the feature

736

mutateExisting: true

737

# -- Enables the feature

738

imageVerify: true

739

# -- Enables the feature

740

generate: true

741

autoUpdateWebhooks:

742

# -- Enables the feature

743

enabled: true

744

excludeBootstrapResources:

745

# -- Excludes cluster bootstrap resources (Node, CertificateSigningRequest) from Fail resource webhooks to avoid a webhook deadlock when the cluster restarts with no Kyverno pods running. Policies targeting these resources are not enforced while enabled.

746

enabled: false

747

backgroundScan:

748

# -- Enables the feature

749

enabled: true

750

# -- Number of background scan workers

751

backgroundScanWorkers: 2

752

# -- Background scan interval

753

backgroundScanInterval: 1h

754

# -- Skips resource filters in background scan

755

skipResourceFilters: true

756

configMapCaching:

757

# -- Enables the feature

758

enabled: true

759

controllerRuntimeMetrics:

760

# -- Bind address for controller-runtime metrics (use "0" to disable it)

761

bindAddress: ":8080"

762

deferredLoading:

763

# -- Enables the feature

764

enabled: true

765

dumpPayload:

766

# -- Enables the feature

767

enabled: false

768

forceFailurePolicyIgnore:

769

# -- Enables the feature

770

enabled: false

771

generateValidatingAdmissionPolicy:

772

# -- Enables the feature

773

enabled: true

774

generateMutatingAdmissionPolicy:

775

# -- Enables the feature

776

enabled: false

777

dumpPatches:

778

# -- Enables the feature

779

enabled: false

780

globalContext:

781

# -- Maximum allowed response size from API Calls. A value of 0 bypasses checks (not recommended)

782

maxApiCallResponseLength: 2000000

783

# -- Timeout for HTTP API calls made by policies. A value of 0s means no timeout.

784

apiCallTimeout: 30s

785

# -- Maximum number of entries in the global context store. A value of 0 means unbounded.

786

maxGlobalContextEntries: 0

787

logging:

788

# -- Logging format

789

format: text

790

# -- Logging verbosity

791

verbosity: 2

792

omitEvents:

793

# -- Events which should not be emitted (possible values `PolicyViolation`, `PolicyApplied`, `PolicyError`, and `PolicySkipped`)

794

eventTypes:

795

- PolicyApplied

796

- PolicySkipped

797

# - PolicyViolation

798

# - PolicyError

799

policyExceptions:

800

# -- Enables the feature

801

enabled: false

802

# -- Restrict policy exceptions to a single namespace

803

# Set to "*" to allow exceptions in all namespaces

804

namespace: ''

805

protectManagedResources:

806

# -- Enables the feature

807

enabled: false

808

registryClient:

809

# -- Allow insecure registry

810

allowInsecure: false

811

# -- Enable registry client helpers

812

credentialHelpers:

813

- default

814

- google

815

- amazon

816

- azure

817

- github

818

ttlController:

819

# -- Reconciliation interval for the label based cleanup manager

820

reconciliationInterval: 1m

821

tuf:

822

# -- Enables the feature

823

enabled: false

824

# -- (string) Path to Tuf root

825

root: ~

826

# -- (string) Raw Tuf root

827

rootRaw: ~

828

# -- (string) Tuf mirror

829

mirror: ~

830

# Admission controller configuration

831

admissionController:

832

autoscaling:

833

# -- Enable horizontal pod autoscaling

834

enabled: false

835

# -- Minimum number of pods

836

minReplicas: 1

837

# -- Maximum number of pods

838

maxReplicas: 10

839

# -- Target CPU utilization percentage

840

targetCPUUtilizationPercentage: 80

841

# -- (int) Target memory utilization percentage

842

targetMemoryUtilizationPercentage: ~

843

# -- Configurable scaling behavior

844

behavior: {}

845

# -- Overrides features defined at the root level

846

featuresOverride:

847

admissionReports:

848

# -- Max number of admission reports allowed in flight until the admission controller stops creating new ones

849

backPressureThreshold: 1000

850

rbac:

851

# -- Create RBAC resources

852

create: true

853

# -- Create rolebinding to view role

854

createViewRoleBinding: true

855

# -- The view role to use in the rolebinding

856

viewRoleName: view

857

serviceAccount:

858

# -- The ServiceAccount name

859

name:

860

# -- Annotations for the ServiceAccount

861

annotations: {}

862

# example.com/annotation: value

863

864

# -- Toggle automounting of the ServiceAccount.

865

# When set to false, a projected service account token is used instead

866

# which provides time-limited and audience-bound tokens for improved security.

867

automountServiceAccountToken: true

868

# -- Projected service account token configuration (only used when automountServiceAccountToken is false)

869

projectedServiceAccountToken:

870

# -- Token expiration time in seconds.

871

# The kubelet will request a new token before the token expires.

872

expirationSeconds: 3600

873

# -- Audience for the projected service account token.

874

# If not set, the token will have no audience restriction.

875

audience: ""

876

coreClusterRole:

877

# -- Extra resource permissions to add in the core cluster role.

878

# This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`.

879

# @default -- See [values.yaml](values.yaml)

880

extraResources: []

881

clusterRole:

882

# -- Extra resource permissions to add in the cluster role

883

extraResources: []

884

# - apiGroups:

885

# - ''

886

# resources:

887

# - pods

888

# verbs:

889

# - create

890

# - update

891

# - delete

892

# -- Create self-signed certificates at deployment time.

893

# The certificates won't be automatically renewed if this is set to `true`.

894

createSelfSignedCert: false

895

# -- Key algorithm for self-signed TLS certificates.

896

# Supported values: RSA, ECDSA, Ed25519

897

# Only used when createSelfSignedCert is false (Kyverno-managed certificates).

898

tlsKeyAlgorithm: RSA

899

# -- Configure cert-manager to manage TLS certificates.

900

# When enabled, cert-manager Certificate resources will be created to provision

901

# the TLS certificates for the admission controller.

902

# Requires cert-manager to be installed in the cluster.

903

# Takes precedence over createSelfSignedCert when enabled.

904

certManager:

905

# -- Enable cert-manager integration for certificate management

906

enabled: false

907

# -- Create a self-signed ClusterIssuer for CA generation.

908

# Set to false if you want to use an existing issuer specified in issuerRef.

909

createSelfSignedIssuer: true

910

# -- Reference to an existing issuer for signing CA certificates.

911

# Only used when createSelfSignedIssuer is false.

912

issuerRef:

913

# -- Name of the issuer

914

915

# -- Kind of the issuer (ClusterIssuer or Issuer)

916

kind: ClusterIssuer

917

# -- Group of the issuer

918

group: cert-manager.io

919

# -- Key algorithm for certificates (RSA, ECDSA, Ed25519)

920

algorithm: RSA

921

# -- Key size for RSA (2048, 4096) or ECDSA (256, 384).

922

# Ignored for Ed25519.

923

size: 2048

924

# -- CA certificate configuration

925

ca:

926

# -- Duration of the CA certificate (default 10 years)

927

duration: 87600h

928

# -- Time before expiry to renew the CA certificate (default 30 days)

929

renewBefore: 720h

930

# -- TLS certificate configuration

931

tls:

932

# -- Duration of the TLS certificate (default 1 year)

933

duration: 8760h

934

# -- Time before expiry to renew the TLS certificate (default 30 days)

935

renewBefore: 720h

936

# -- (int) Desired number of pods

937

replicas: ~

938

# -- The number of revisions to keep

939

revisionHistoryLimit: 10

940

# -- Resync period for informers

941

resyncPeriod: 15m

942

# -- Enable/Disable custom resource watcher to invalidate cache

943

crdWatcher: false

944

# -- Additional labels to add to each pod

945

podLabels: {}

946

# example.com/label: foo

947

948

# -- Additional annotations to add to each pod

949

podAnnotations: {}

950

# example.com/annotation: foo

951

952

# -- Deployment labels.

953

labels: {}

954

# -- Deployment annotations.

955

annotations: {}

956

# -- Deployment update strategy.

957

# Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

958

# @default -- See [values.yaml](values.yaml)

959

updateStrategy:

960

rollingUpdate:

961

maxSurge: 1

962

maxUnavailable: 40%

963

type: RollingUpdate

964

# -- Optional priority class

965

priorityClassName: ''

966

# -- Change `apiPriorityAndFairness` to `true` if you want to insulate the API calls made by Kyverno admission controller activities.

967

# This will help ensure Kyverno stability in busy clusters.

968

# Ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/

969

apiPriorityAndFairness: false

970

# -- Priority level configuration.

971

# The block is directly forwarded into the priorityLevelConfiguration, so you can use whatever specification you want.

972

# ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/#prioritylevelconfiguration

973

# @default -- See [values.yaml](values.yaml)

974

priorityLevelConfigurationSpec:

975

type: Limited

976

limited:

977

nominalConcurrencyShares: 10

978

limitResponse:

979

queuing:

980

queueLengthLimit: 50

981

type: Queue

982

# -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace.

983

# Useful for situations like when you end up dealing with a custom CNI over Amazon EKS.

984

# Update the `dnsPolicy` accordingly as well to suit the host network mode.

985

hostNetwork: false

986

# -- admissionController webhook server port

987

# in case you are using hostNetwork: true, you might want to change the port the webhookServer is listening to

988

webhookServer:

989

port: 9443

990

# -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster.

991

# In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`.

992

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy.

993

dnsPolicy: ClusterFirst

994

# -- `dnsConfig` allows to specify DNS configuration for the pod.

995

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config.

996

dnsConfig: {}

997

# options:

998

# - name: ndots

999

# value: "2"

1000

1001

# -- Startup probe.

1002

# The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want.

1003

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

1004

# @default -- See [values.yaml](values.yaml)

1005

startupProbe:

1006

httpGet:

1007

path: /health/liveness

1008

port: 9443

1009

scheme: HTTPS

1010

failureThreshold: 20

1011

initialDelaySeconds: 2

1012

periodSeconds: 6

1013

# -- Liveness probe.

1014

# The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want.

1015

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

1016

# @default -- See [values.yaml](values.yaml)

1017

livenessProbe:

1018

httpGet:

1019

path: /health/liveness

1020

port: 9443

1021

scheme: HTTPS

1022

initialDelaySeconds: 15

1023

periodSeconds: 30

1024

timeoutSeconds: 5

1025

failureThreshold: 2

1026

successThreshold: 1

1027

# -- Readiness Probe.

1028

# The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want.

1029

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

1030

# @default -- See [values.yaml](values.yaml)

1031

readinessProbe:

1032

httpGet:

1033

path: /health/readiness

1034

port: 9443

1035

scheme: HTTPS

1036

initialDelaySeconds: 5

1037

periodSeconds: 10

1038

timeoutSeconds: 5

1039

failureThreshold: 6

1040

successThreshold: 1

1041

# -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`.

1042

nodeSelector: {}

1043

# -- List of node taints to tolerate

1044

tolerations: []

1045

antiAffinity:

1046

# -- Pod antiAffinities toggle.

1047

# Enabled by default but can be disabled if you want to schedule pods to the same node.

1048

enabled: true

1049

# -- Pod anti affinity constraints.

1050

# @default -- See [values.yaml](values.yaml)

1051

podAntiAffinity:

1052

preferredDuringSchedulingIgnoredDuringExecution:

1053

- weight: 1

1054

podAffinityTerm:

1055

labelSelector:

1056

matchExpressions:

1057

- key: app.kubernetes.io/component

1058

operator: In

1059

values:

1060

- admission-controller

1061

topologyKey: kubernetes.io/hostname

1062

# -- Pod affinity constraints.

1063

podAffinity: {}

1064

# -- Node affinity constraints.

1065

nodeAffinity: {}

1066

# -- Topology spread constraints.

1067

topologySpreadConstraints: []

1068

# -- Security context for the pod

1069

podSecurityContext: {}

1070

podDisruptionBudget:

1071

# -- Enable PodDisruptionBudget.

1072

# Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking.

1073

enabled: false

1074

# -- Configures the minimum available pods for disruptions.

1075

# Cannot be used if `maxUnavailable` is set.

1076

minAvailable: 1

1077

# -- Configures the maximum unavailable pods for disruptions.

1078

# Cannot be used if `minAvailable` is set.

1079

maxUnavailable:

1080

# -- Unhealthy pod eviction policy to be used.

1081

# Possible values are `IfHealthyBudget` or `AlwaysAllow`.

1082

unhealthyPodEvictionPolicy:

1083

# -- A writable volume to use for the TUF root initialization.

1084

tufRootMountPath: /.sigstore

1085

# -- Volume to be mounted in pods for TUF/cosign work.

1086

sigstoreVolume:

1087

emptyDir: {}

1088

caCertificates:

1089

# -- CA certificates to use with Kyverno deployments

1090

# This value is expected to be one large string of CA certificates

1091

data: ~

1092

# -- Volume to be mounted for CA certificates

1093

# Not used when `.Values.admissionController.caCertificates.data` is defined

1094

volume: {}

1095

# Example to use hostPath:

1096

# hostPath:

1097

# path: /etc/pki/tls/ca-certificates.crt

1098

# type: File

1099

# -- Image pull secrets

1100

imagePullSecrets: []

1101

# - secretName

1102

1103

initContainer:

1104

image:

1105

# -- Image registry

1106

registry: cgr.dev

1107

defaultRegistry: reg.kyverno.io

1108

# -- Image repository

1109

repository: scratch-images/test-tmp/kyverno-pre-fips

1110

# -- (string) Image tag

1111

# If missing, defaults to image.tag

1112

tag: 1.19.0-r3@sha256:b907f0693c654ada6d12427db543ade08b7c5f11223247f92777721ee0354c85

1113

# -- (string) Image pull policy

1114

# If missing, defaults to image.pullPolicy

1115

pullPolicy: ~

1116

resources:

1117

# -- Pod resource limits

1118

limits:

1119

cpu: 100m

1120

memory: 256Mi

1121

# -- Pod resource requests

1122

requests:

1123

cpu: 10m

1124

memory: 64Mi

1125

# -- Container security context

1126

securityContext:

1127

runAsUser: 65534

1128

runAsGroup: 65534

1129

runAsNonRoot: true

1130

privileged: false

1131

allowPrivilegeEscalation: false

1132

readOnlyRootFilesystem: true

1133

capabilities:

1134

drop:

1135

- ALL

1136

seccompProfile:

1137

type: RuntimeDefault

1138

# -- Additional container args.

1139

extraArgs: {}

1140

# -- Additional container environment variables.

1141

extraEnvVars: []

1142

# Example setting proxy

1143

# extraEnvVars:

1144

# - name: HTTPS_PROXY

1145

# value: 'https://proxy.example.com:3128'

1146

container:

1147

image:

1148

# -- Image registry

1149

registry: cgr.dev

1150

defaultRegistry: reg.kyverno.io

1151

# -- Image repository

1152

repository: scratch-images/test-tmp/kyverno-fips

1153

# -- (string) Image tag

1154

# Defaults to appVersion in Chart.yaml if omitted

1155

tag: 1.19.0-r3@sha256:d5e64965b296700ced3a982bfda475b1df2b755104fabb787a53f3458ccaa4fe

1156

# -- Image pull policy

1157

pullPolicy: IfNotPresent

1158

resources:

1159

# -- Pod resource limits

1160

limits:

1161

memory: 384Mi

1162

# -- Pod resource requests

1163

requests:

1164

cpu: 100m

1165

memory: 128Mi

1166

# -- Container security context

1167

securityContext:

1168

runAsUser: 65534

1169

runAsGroup: 65534

1170

runAsNonRoot: true

1171

privileged: false

1172

allowPrivilegeEscalation: false

1173

readOnlyRootFilesystem: true

1174

capabilities:

1175

drop:

1176

- ALL

1177

seccompProfile:

1178

type: RuntimeDefault

1179

# -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+.

1180

lifecycle: {}

1181

# Example:

1182

# lifecycle:

1183

# preStop:

1184

# sleep:

1185

# seconds: 10

1186

1187

# -- Additional container args.

1188

extraArgs: {}

1189

# -- Additional container environment variables.

1190

extraEnvVars: []

1191

# Example setting proxy

1192

# extraEnvVars:

1193

# - name: HTTPS_PROXY

1194

# value: 'https://proxy.example.com:3128'

1195

# -- Array of extra init containers

1196

extraInitContainers: []

1197

# - name: init-container

1198

# image: busybox

1199

# command: ['sh', '-c', 'echo Hello']

1200

1201

# -- Array of extra containers to run alongside kyverno

1202

extraContainers: []

1203

# - name: myapp-container

1204

# image: busybox

1205

# command: ['sh', '-c', 'echo Hello && sleep 3600']

1206

1207

# -- Additional volumes to be mounted in the pod

1208

extraVolumes: []

1209

# - name: my-volume

1210

# emptyDir: {}

1211

1212

# -- Additional volumeMounts to be mounted to the main container

1213

extraVolumeMounts: []

1214

# - name: my-volume

1215

# mountPath: /path/to/mount

1216

1217

service:

1218

# -- Service port.

1219

port: 443

1220

# -- Service type.

1221

type: ClusterIP

1222

# -- Service node port.

1223

# Only used if `type` is `NodePort`.

1224

nodePort:

1225

# -- Service annotations.

1226

annotations: {}

1227

# -- (string) Service traffic distribution policy.

1228

# Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs.

1229

trafficDistribution: ~

1230

metricsService:

1231

# -- Create service.

1232

create: true

1233

# -- Service port.

1234

# Kyverno's metrics server will be exposed at this port.

1235

port: 8000

1236

# -- Service type.

1237

type: ClusterIP

1238

# -- Service node port.

1239

# Only used if `type` is `NodePort`.

1240

nodePort:

1241

# -- Service annotations.

1242

annotations: {}

1243

# -- (string) Service traffic distribution policy.

1244

# Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs.

1245

trafficDistribution: ~

1246

networkPolicy:

1247

# -- When true, use a NetworkPolicy to allow ingress to the webhook

1248

# This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.

1249

enabled: false

1250

# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.

1251

ingressFrom: []

1252

serviceMonitor:

1253

# -- Create a `ServiceMonitor` to collect Prometheus metrics.

1254

enabled: false

1255

# -- Additional annotations

1256

additionalAnnotations: {}

1257

# -- Additional labels

1258

additionalLabels: {}

1259

# -- (string) Override namespace

1260

namespace: ~

1261

# -- Interval to scrape metrics

1262

interval: 30s

1263

# -- Timeout if metrics can't be retrieved in given time interval

1264

scrapeTimeout: 25s

1265

# -- Is TLS required for endpoint

1266

secure: false

1267

# -- TLS Configuration for endpoint

1268

tlsConfig: {}

1269

# -- RelabelConfigs to apply to samples before scraping

1270

relabelings: []

1271

# -- MetricRelabelConfigs to apply to samples before ingestion.

1272

metricRelabelings: []

1273

tracing:

1274

# -- Enable tracing

1275

enabled: false

1276

# -- Traces receiver address

1277

address:

1278

# -- Traces receiver port

1279

port:

1280

# -- Traces receiver credentials

1281

creds: ''

1282

metering:

1283

# -- Disable metrics export

1284

disabled: false

1285

# -- Otel configuration, can be `prometheus` or `grpc`

1286

config: prometheus

1287

# -- Prometheus endpoint port

1288

port: 8000

1289

# -- Is TLS required for endpoint

1290

secure: false

1291

# -- Key algorithm for self-signed TLS certificates.

1292

# Supported values: RSA, ECDSA, Ed25519

1293

tlsKeyAlgorithm: RSA

1294

# -- Otel collector endpoint

1295

collector: ''

1296

# -- Otel collector credentials

1297

creds: ''

1298

profiling:

1299

# -- Enable profiling

1300

enabled: false

1301

# -- Profiling endpoint port

1302

port: 6060

1303

# -- Service type.

1304

serviceType: ClusterIP

1305

# -- Service node port.

1306

# Only used if `type` is `NodePort`.

1307

nodePort:

1308

# Background controller configuration

1309

backgroundController:

1310

# -- Overrides features defined at the root level

1311

featuresOverride: {}

1312

# -- Enable background controller.

1313

enabled: true

1314

rbac:

1315

# -- Create RBAC resources

1316

create: true

1317

# -- Create rolebinding to view role

1318

createViewRoleBinding: true

1319

# -- The view role to use in the rolebinding

1320

viewRoleName: view

1321

serviceAccount:

1322

# -- Service account name

1323

name:

1324

# -- Annotations for the ServiceAccount

1325

annotations: {}

1326

# example.com/annotation: value

1327

1328

# -- Toggle automounting of the ServiceAccount.

1329

# When set to false, a projected service account token is used instead

1330

# which provides time-limited and audience-bound tokens for improved security.

1331

automountServiceAccountToken: true

1332

# -- Projected service account token configuration (only used when automountServiceAccountToken is false)

1333

projectedServiceAccountToken:

1334

# -- Token expiration time in seconds.

1335

# The kubelet will request a new token before the token expires.

1336

expirationSeconds: 3600

1337

# -- Audience for the projected service account token.

1338

# If not set, the token will have no audience restriction.

1339

audience: ""

1340

coreClusterRole:

1341

# -- Extra resource permissions to add in the core cluster role.

1342

# This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`.

1343

# @default -- See [values.yaml](values.yaml)

1344

extraResources:

1345

- apiGroups:

1346

- networking.k8s.io

1347

resources:

1348

- ingresses

1349

- ingressclasses

1350

- networkpolicies

1351

verbs:

1352

- create

1353

- update

1354

- patch

1355

- delete

1356

- apiGroups:

1357

- rbac.authorization.k8s.io

1358

resources:

1359

- rolebindings

1360

- roles

1361

verbs:

1362

- create

1363

- update

1364

- patch

1365

- delete

1366

- apiGroups:

1367

- ''

1368

resources:

1369

- configmaps

1370

- resourcequotas

1371

- limitranges

1372

verbs:

1373

- create

1374

- update

1375

- patch

1376

- delete

1377

- apiGroups:

1378

- resource.k8s.io

1379

resources:

1380

- resourceclaims

1381

- resourceclaimtemplates

1382

verbs:

1383

- create

1384

- delete

1385

- update

1386

- patch

1387

- deletecollection

1388

clusterRole:

1389

# -- Extra resource permissions to add in the cluster role

1390

extraResources: []

1391

# - apiGroups:

1392

# - ''

1393

# resources:

1394

# - pods

1395

# verbs:

1396

# - create

1397

# - update

1398

# - delete

1399

# - patch

1400

image:

1401

# -- Image registry

1402

registry: cgr.dev

1403

defaultRegistry: reg.kyverno.io

1404

# -- Image repository

1405

repository: scratch-images/test-tmp/kyverno-background-controller-fips

1406

# -- Image tag

1407

# Defaults to appVersion in Chart.yaml if omitted

1408

tag: 1.19.0-r3@sha256:2c691bb0d5cbc0dfd3de3fe813eb1e0475ccebe10d118adea4db330f9a65c346

1409

# -- Image pull policy

1410

pullPolicy: IfNotPresent

1411

# -- Image pull secrets

1412

imagePullSecrets: []

1413

# - secretName

1414

1415

# -- (int) Desired number of pods

1416

replicas: ~

1417

# -- The number of revisions to keep

1418

revisionHistoryLimit: 10

1419

# -- Resync period for informers

1420

resyncPeriod: 15m

1421

# -- Additional labels to add to each pod

1422

podLabels: {}

1423

# example.com/label: foo

1424

1425

# -- Additional annotations to add to each pod

1426

podAnnotations: {}

1427

# example.com/annotation: foo

1428

1429

# -- Deployment labels.

1430

labels: {}

1431

# -- Deployment annotations.

1432

annotations: {}

1433

# -- Deployment update strategy.

1434

# Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

1435

# @default -- See [values.yaml](values.yaml)

1436

updateStrategy:

1437

rollingUpdate:

1438

maxSurge: 1

1439

maxUnavailable: 40%

1440

type: RollingUpdate

1441

# -- Optional priority class

1442

priorityClassName: ''

1443

# -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace.

1444

# Useful for situations like when you end up dealing with a custom CNI over Amazon EKS.

1445

# Update the `dnsPolicy` accordingly as well to suit the host network mode.

1446

hostNetwork: false

1447

# -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster.

1448

# In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`.

1449

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy.

1450

dnsPolicy: ClusterFirst

1451

# -- `dnsConfig` allows to specify DNS configuration for the pod.

1452

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config.

1453

dnsConfig: {}

1454

# options:

1455

# - name: ndots

1456

# value: "2"

1457

1458

# -- Extra arguments passed to the container on the command line

1459

extraArgs: {}

1460

# -- Additional container environment variables.

1461

extraEnvVars: []

1462

# Example setting proxy

1463

# extraEnvVars:

1464

# - name: HTTPS_PROXY

1465

# value: 'https://proxy.example.com:3128'

1466

1467

resources:

1468

# -- Pod resource limits

1469

limits:

1470

memory: 128Mi

1471

# -- Pod resource requests

1472

requests:

1473

cpu: 100m

1474

memory: 64Mi

1475

# -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`.

1476

nodeSelector: {}

1477

# -- List of node taints to tolerate

1478

tolerations: []

1479

antiAffinity:

1480

# -- Pod antiAffinities toggle.

1481

# Enabled by default but can be disabled if you want to schedule pods to the same node.

1482

enabled: true

1483

# -- Pod anti affinity constraints.

1484

# @default -- See [values.yaml](values.yaml)

1485

podAntiAffinity:

1486

preferredDuringSchedulingIgnoredDuringExecution:

1487

- weight: 1

1488

podAffinityTerm:

1489

labelSelector:

1490

matchExpressions:

1491

- key: app.kubernetes.io/component

1492

operator: In

1493

values:

1494

- background-controller

1495

topologyKey: kubernetes.io/hostname

1496

# -- Pod affinity constraints.

1497

podAffinity: {}

1498

# -- Node affinity constraints.

1499

nodeAffinity: {}

1500

# -- Topology spread constraints.

1501

topologySpreadConstraints: []

1502

# -- Security context for the pod

1503

podSecurityContext: {}

1504

# -- Security context for the containers

1505

securityContext:

1506

runAsUser: 65534

1507

runAsGroup: 65534

1508

runAsNonRoot: true

1509

privileged: false

1510

allowPrivilegeEscalation: false

1511

readOnlyRootFilesystem: true

1512

capabilities:

1513

drop:

1514

- ALL

1515

seccompProfile:

1516

type: RuntimeDefault

1517

# -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+.

1518

lifecycle: {}

1519

# Example:

1520

# lifecycle:

1521

# preStop:

1522

# sleep:

1523

# seconds: 10

1524

1525

podDisruptionBudget:

1526

# -- Enable PodDisruptionBudget.

1527

# Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking.

1528

enabled: false

1529

# -- Configures the minimum available pods for disruptions.

1530

# Cannot be used if `maxUnavailable` is set.

1531

minAvailable: 1

1532

# -- Configures the maximum unavailable pods for disruptions.

1533

# Cannot be used if `minAvailable` is set.

1534

maxUnavailable:

1535

# -- Unhealthy pod eviction policy to be used.

1536

# Possible values are `IfHealthyBudget` or `AlwaysAllow`.

1537

unhealthyPodEvictionPolicy:

1538

caCertificates:

1539

# -- CA certificates to use with Kyverno deployments

1540

# This value is expected to be one large string of CA certificates

1541

data: ~

1542

# -- Volume to be mounted for CA certificates

1543

# Not used when `.Values.backgroundController.caCertificates.data` is defined

1544

volume: {}

1545

# Example to use hostPath:

1546

# hostPath:

1547

# path: /etc/pki/tls/ca-certificates.crt

1548

# type: File

1549

# -- Additional volumes to be mounted in the pod

1550

extraVolumes: []

1551

# - name: my-volume

1552

# emptyDir: {}

1553

1554

# -- Additional volumeMounts to be mounted to the main container

1555

extraVolumeMounts: []

1556

# - name: my-volume

1557

# mountPath: /path/to/mount

1558

1559

metricsService:

1560

# -- Create service.

1561

create: true

1562

# -- Service port.

1563

# Metrics server will be exposed at this port.

1564

port: 8000

1565

# -- Service type.

1566

type: ClusterIP

1567

# -- Service node port.

1568

# Only used if `metricsService.type` is `NodePort`.

1569

nodePort:

1570

# -- Service annotations.

1571

annotations: {}

1572

# -- (string) Service traffic distribution policy.

1573

# Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs.

1574

trafficDistribution: ~

1575

networkPolicy:

1576

# -- When true, use a NetworkPolicy to allow ingress to the webhook

1577

# This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.

1578

enabled: false

1579

# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.

1580

ingressFrom: []

1581

serviceMonitor:

1582

# -- Create a `ServiceMonitor` to collect Prometheus metrics.

1583

enabled: false

1584

# -- Additional annotations

1585

additionalAnnotations: {}

1586

# -- Additional labels

1587

additionalLabels: {}

1588

# -- (string) Override namespace

1589

namespace: ~

1590

# -- Interval to scrape metrics

1591

interval: 30s

1592

# -- Timeout if metrics can't be retrieved in given time interval

1593

scrapeTimeout: 25s

1594

# -- Is TLS required for endpoint

1595

secure: false

1596

# -- TLS Configuration for endpoint

1597

tlsConfig: {}

1598

# -- RelabelConfigs to apply to samples before scraping

1599

relabelings: []

1600

# -- MetricRelabelConfigs to apply to samples before ingestion.

1601

metricRelabelings: []

1602

tracing:

1603

# -- Enable tracing

1604

enabled: false

1605

# -- Traces receiver address

1606

address:

1607

# -- Traces receiver port

1608

port:

1609

# -- Traces receiver credentials

1610

creds: ''

1611

metering:

1612

# -- Disable metrics export

1613

disabled: false

1614

# -- Otel configuration, can be `prometheus` or `grpc`

1615

config: prometheus

1616

# -- Prometheus endpoint port

1617

port: 8000

1618

# -- Is TLS required for endpoint

1619

secure: false

1620

# -- Key algorithm for self-signed TLS certificates.

1621

# Supported values: RSA, ECDSA, Ed25519

1622

tlsKeyAlgorithm: RSA

1623

# -- Otel collector endpoint

1624

collector: ''

1625

# -- Otel collector credentials

1626

creds: ''

1627

# -- backgroundController server port

1628

# in case you are using hostNetwork: true, you might want to change the port the backgroundController is listening to

1629

server:

1630

port: 9443

1631

profiling:

1632

# -- Enable profiling

1633

enabled: false

1634

# -- Profiling endpoint port

1635

port: 6060

1636

# -- Service type.

1637

serviceType: ClusterIP

1638

# -- Service node port.

1639

# Only used if `type` is `NodePort`.

1640

nodePort:

1641

# Cleanup controller configuration

1642

cleanupController:

1643

# -- Overrides features defined at the root level

1644

featuresOverride: {}

1645

# -- Enable cleanup controller.

1646

enabled: true

1647

rbac:

1648

# -- Create RBAC resources

1649

create: true

1650

serviceAccount:

1651

# -- Service account name

1652

name:

1653

# -- Annotations for the ServiceAccount

1654

annotations: {}

1655

# example.com/annotation: value

1656

1657

# -- Toggle automounting of the ServiceAccount.

1658

# When set to false, a projected service account token is used instead

1659

# which provides time-limited and audience-bound tokens for improved security.

1660

automountServiceAccountToken: true

1661

# -- Projected service account token configuration (only used when automountServiceAccountToken is false)

1662

projectedServiceAccountToken:

1663

# -- Token expiration time in seconds.

1664

# The kubelet will request a new token before the token expires.

1665

expirationSeconds: 3600

1666

# -- Audience for the projected service account token.

1667

# If not set, the token will have no audience restriction.

1668

audience: ""

1669

coreClusterRole:

1670

# -- Extra resource permissions to add in the core cluster role.

1671

# This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`.

1672

# @default -- See [values.yaml](values.yaml)

1673

extraResources: []

1674

clusterRole:

1675

# -- Extra resource permissions to add in the cluster role

1676

extraResources: []

1677

# - apiGroups:

1678

# - ''

1679

# resources:

1680

# - pods

1681

# verbs:

1682

# - delete

1683

# - list

1684

# - watch

1685

# -- Create self-signed certificates at deployment time.

1686

# The certificates won't be automatically renewed if this is set to `true`.

1687

createSelfSignedCert: false

1688

# -- Key algorithm for self-signed TLS certificates.

1689

# Supported values: RSA, ECDSA, Ed25519

1690

# Only used when createSelfSignedCert is false (Kyverno-managed certificates).

1691

tlsKeyAlgorithm: RSA

1692

# -- Configure cert-manager to manage TLS certificates.

1693

# When enabled, cert-manager Certificate resources will be created to provision

1694

# the TLS certificates for the cleanup controller.

1695

# Requires cert-manager to be installed in the cluster.

1696

# Takes precedence over createSelfSignedCert when enabled.

1697

certManager:

1698

# -- Enable cert-manager integration for certificate management

1699

enabled: false

1700

# -- Create a self-signed ClusterIssuer for CA generation.

1701

# Set to false if you want to use an existing issuer specified in issuerRef.

1702

createSelfSignedIssuer: true

1703

# -- Reference to an existing issuer for signing CA certificates.

1704

# Only used when createSelfSignedIssuer is false.

1705

issuerRef:

1706

# -- Name of the issuer

1707

1708

# -- Kind of the issuer (ClusterIssuer or Issuer)

1709

kind: ClusterIssuer

1710

# -- Group of the issuer

1711

group: cert-manager.io

1712

# -- Key algorithm for certificates (RSA, ECDSA, Ed25519)

1713

algorithm: RSA

1714

# -- Key size for RSA (2048, 4096) or ECDSA (256, 384).

1715

# Ignored for Ed25519.

1716

size: 2048

1717

# -- CA certificate configuration

1718

ca:

1719

# -- Duration of the CA certificate (default 10 years)

1720

duration: 87600h

1721

# -- Time before expiry to renew the CA certificate (default 30 days)

1722

renewBefore: 720h

1723

# -- TLS certificate configuration

1724

tls:

1725

# -- Duration of the TLS certificate (default 1 year)

1726

duration: 8760h

1727

# -- Time before expiry to renew the TLS certificate (default 30 days)

1728

renewBefore: 720h

1729

image:

1730

# -- Image registry

1731

registry: cgr.dev

1732

defaultRegistry: reg.kyverno.io

1733

# -- Image repository

1734

repository: scratch-images/test-tmp/kyverno-cleanup-controller-fips

1735

# -- (string) Image tag

1736

# Defaults to appVersion in Chart.yaml if omitted

1737

tag: 1.19.0-r3@sha256:5fc56f6488637aef3c3984cc5efbc0373f46f648d57b1825f31090bee6132912

1738

# -- Image pull policy

1739

pullPolicy: IfNotPresent

1740

# -- Image pull secrets

1741

imagePullSecrets: []

1742

# - secretName

1743

1744

# -- (int) Desired number of pods

1745

replicas: ~

1746

# -- The number of revisions to keep

1747

revisionHistoryLimit: 10

1748

# -- Resync period for informers

1749

resyncPeriod: 15m

1750

# -- Additional labels to add to each pod

1751

podLabels: {}

1752

# example.com/label: foo

1753

1754

# -- Additional annotations to add to each pod

1755

podAnnotations: {}

1756

# example.com/annotation: foo

1757

1758

# -- Deployment labels.

1759

labels: {}

1760

# -- Deployment annotations.

1761

annotations: {}

1762

# -- Deployment update strategy.

1763

# Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

1764

# @default -- See [values.yaml](values.yaml)

1765

updateStrategy:

1766

rollingUpdate:

1767

maxSurge: 1

1768

maxUnavailable: 40%

1769

type: RollingUpdate

1770

# -- Optional priority class

1771

priorityClassName: ''

1772

# -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace.

1773

# Useful for situations like when you end up dealing with a custom CNI over Amazon EKS.

1774

# Update the `dnsPolicy` accordingly as well to suit the host network mode.

1775

hostNetwork: false

1776

# -- cleanupController server port

1777

# in case you are using hostNetwork: true, you might want to change the port the cleanupController is listening to

1778

server:

1779

port: 9443

1780

# -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster.

1781

# In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`.

1782

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy.

1783

dnsPolicy: ClusterFirst

1784

# -- `dnsConfig` allows to specify DNS configuration for the pod.

1785

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config.

1786

dnsConfig: {}

1787

# options:

1788

# - name: ndots

1789

# value: "2"

1790

1791

# -- Extra arguments passed to the container on the command line

1792

extraArgs: {}

1793

# -- Additional container environment variables.

1794

extraEnvVars: []

1795

# Example setting proxy

1796

# extraEnvVars:

1797

# - name: HTTPS_PROXY

1798

# value: 'https://proxy.example.com:3128'

1799

1800

resources:

1801

# -- Pod resource limits

1802

limits:

1803

memory: 128Mi

1804

# -- Pod resource requests

1805

requests:

1806

cpu: 100m

1807

memory: 64Mi

1808

# -- Startup probe.

1809

# The block is directly forwarded into the deployment, so you can use whatever startupProbes configuration you want.

1810

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

1811

# @default -- See [values.yaml](values.yaml)

1812

startupProbe:

1813

httpGet:

1814

path: /health/liveness

1815

port: 9443

1816

scheme: HTTPS

1817

failureThreshold: 20

1818

initialDelaySeconds: 2

1819

periodSeconds: 6

1820

# -- Liveness probe.

1821

# The block is directly forwarded into the deployment, so you can use whatever livenessProbe configuration you want.

1822

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

1823

# @default -- See [values.yaml](values.yaml)

1824

livenessProbe:

1825

httpGet:

1826

path: /health/liveness

1827

port: 9443

1828

scheme: HTTPS

1829

initialDelaySeconds: 15

1830

periodSeconds: 30

1831

timeoutSeconds: 5

1832

failureThreshold: 2

1833

successThreshold: 1

1834

# -- Readiness Probe.

1835

# The block is directly forwarded into the deployment, so you can use whatever readinessProbe configuration you want.

1836

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

1837

# @default -- See [values.yaml](values.yaml)

1838

readinessProbe:

1839

httpGet:

1840

path: /health/readiness

1841

port: 9443

1842

scheme: HTTPS

1843

initialDelaySeconds: 5

1844

periodSeconds: 10

1845

timeoutSeconds: 5

1846

failureThreshold: 6

1847

successThreshold: 1

1848

# -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`.

1849

nodeSelector: {}

1850

# -- List of node taints to tolerate

1851

tolerations: []

1852

antiAffinity:

1853

# -- Pod antiAffinities toggle.

1854

# Enabled by default but can be disabled if you want to schedule pods to the same node.

1855

enabled: true

1856

# -- Pod anti affinity constraints.

1857

# @default -- See [values.yaml](values.yaml)

1858

podAntiAffinity:

1859

preferredDuringSchedulingIgnoredDuringExecution:

1860

- weight: 1

1861

podAffinityTerm:

1862

labelSelector:

1863

matchExpressions:

1864

- key: app.kubernetes.io/component

1865

operator: In

1866

values:

1867

- cleanup-controller

1868

topologyKey: kubernetes.io/hostname

1869

# -- Pod affinity constraints.

1870

podAffinity: {}

1871

# -- Node affinity constraints.

1872

nodeAffinity: {}

1873

# -- Topology spread constraints.

1874

topologySpreadConstraints: []

1875

# -- Security context for the pod

1876

podSecurityContext: {}

1877

# -- Security context for the containers

1878

securityContext:

1879

runAsUser: 65534

1880

runAsGroup: 65534

1881

runAsNonRoot: true

1882

privileged: false

1883

allowPrivilegeEscalation: false

1884

readOnlyRootFilesystem: true

1885

capabilities:

1886

drop:

1887

- ALL

1888

seccompProfile:

1889

type: RuntimeDefault

1890

# -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+.

1891

lifecycle: {}

1892

# Example:

1893

# lifecycle:

1894

# preStop:

1895

# sleep:

1896

# seconds: 10

1897

1898

podDisruptionBudget:

1899

# -- Enable PodDisruptionBudget.

1900

# Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking.

1901

enabled: false

1902

# -- Configures the minimum available pods for disruptions.

1903

# Cannot be used if `maxUnavailable` is set.

1904

minAvailable: 1

1905

# -- Configures the maximum unavailable pods for disruptions.

1906

# Cannot be used if `minAvailable` is set.

1907

maxUnavailable:

1908

# -- Unhealthy pod eviction policy to be used.

1909

# Possible values are `IfHealthyBudget` or `AlwaysAllow`.

1910

unhealthyPodEvictionPolicy:

1911

# -- Additional volumes to be mounted in the pod

1912

extraVolumes: []

1913

# - name: my-volume

1914

# emptyDir: {}

1915

1916

# -- Additional volumeMounts to be mounted to the main container

1917

extraVolumeMounts: []

1918

# - name: my-volume

1919

# mountPath: /path/to/mount

1920

1921

service:

1922

# -- Service port.

1923

port: 443

1924

# -- Service type.

1925

type: ClusterIP

1926

# -- Service node port.

1927

# Only used if `service.type` is `NodePort`.

1928

nodePort:

1929

# -- Service annotations.

1930

annotations: {}

1931

# -- (string) Service traffic distribution policy.

1932

# Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs.

1933

trafficDistribution: ~

1934

metricsService:

1935

# -- Create service.

1936

create: true

1937

# -- Service port.

1938

# Metrics server will be exposed at this port.

1939

port: 8000

1940

# -- Service type.

1941

type: ClusterIP

1942

# -- Service node port.

1943

# Only used if `metricsService.type` is `NodePort`.

1944

nodePort:

1945

# -- Service annotations.

1946

annotations: {}

1947

# -- (string) Service traffic distribution policy.

1948

# Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs.

1949

trafficDistribution: ~

1950

networkPolicy:

1951

# -- When true, use a NetworkPolicy to allow ingress to the webhook

1952

# This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.

1953

enabled: false

1954

# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.

1955

ingressFrom: []

1956

serviceMonitor:

1957

# -- Create a `ServiceMonitor` to collect Prometheus metrics.

1958

enabled: false

1959

# -- Additional annotations

1960

additionalAnnotations: {}

1961

# -- Additional labels

1962

additionalLabels: {}

1963

# -- (string) Override namespace

1964

namespace: ~

1965

# -- Interval to scrape metrics

1966

interval: 30s

1967

# -- Timeout if metrics can't be retrieved in given time interval

1968

scrapeTimeout: 25s

1969

# -- Is TLS required for endpoint

1970

secure: false

1971

# -- TLS Configuration for endpoint

1972

tlsConfig: {}

1973

# -- RelabelConfigs to apply to samples before scraping

1974

relabelings: []

1975

# -- MetricRelabelConfigs to apply to samples before ingestion.

1976

metricRelabelings: []

1977

tracing:

1978

# -- Enable tracing

1979

enabled: false

1980

# -- Traces receiver address

1981

address:

1982

# -- Traces receiver port

1983

port:

1984

# -- Traces receiver credentials

1985

creds: ''

1986

metering:

1987

# -- Disable metrics export

1988

disabled: false

1989

# -- Otel configuration, can be `prometheus` or `grpc`

1990

config: prometheus

1991

# -- Prometheus endpoint port

1992

port: 8000

1993

# -- Is TLS required for endpoint

1994

secure: false

1995

# -- Key algorithm for self-signed TLS certificates.

1996

# Supported values: RSA, ECDSA, Ed25519

1997

tlsKeyAlgorithm: RSA

1998

# -- Otel collector endpoint

1999

collector: ''

2000

# -- Otel collector credentials

2001

creds: ''

2002

profiling:

2003

# -- Enable profiling

2004

enabled: false

2005

# -- Profiling endpoint port

2006

port: 6060

2007

# -- Service type.

2008

serviceType: ClusterIP

2009

# -- Service node port.

2010

# Only used if `type` is `NodePort`.

2011

nodePort:

2012

# Reports controller configuration

2013

reportsController:

2014

# -- Overrides features defined at the root level

2015

featuresOverride: {}

2016

# -- Enable reports controller.

2017

enabled: true

2018

rbac:

2019

# -- Create RBAC resources

2020

create: true

2021

# -- Create rolebinding to view role

2022

createViewRoleBinding: true

2023

# -- The view role to use in the rolebinding

2024

viewRoleName: view

2025

serviceAccount:

2026

# -- Service account name

2027

name:

2028

# -- Annotations for the ServiceAccount

2029

annotations: {}

2030

# example.com/annotation: value

2031

2032

# -- Toggle automounting of the ServiceAccount.

2033

# When set to false, a projected service account token is used instead

2034

# which provides time-limited and audience-bound tokens for improved security.

2035

automountServiceAccountToken: true

2036

# -- Projected service account token configuration (only used when automountServiceAccountToken is false)

2037

projectedServiceAccountToken:

2038

# -- Token expiration time in seconds.

2039

# The kubelet will request a new token before the token expires.

2040

expirationSeconds: 3600

2041

# -- Audience for the projected service account token.

2042

# If not set, the token will have no audience restriction.

2043

audience: ""

2044

coreClusterRole:

2045

# -- Extra resource permissions to add in the core cluster role.

2046

# This was introduced to avoid breaking change in the chart but should ideally be moved in `clusterRole.extraResources`.

2047

# @default -- See [values.yaml](values.yaml)

2048

extraResources: []

2049

clusterRole:

2050

# -- Extra resource permissions to add in the cluster role

2051

extraResources: []

2052

# - apiGroups:

2053

# - ''

2054

# resources:

2055

# - pods

2056

image:

2057

# -- Image registry

2058

registry: cgr.dev

2059

defaultRegistry: reg.kyverno.io

2060

# -- Image repository

2061

repository: scratch-images/test-tmp/kyverno-reports-controller-fips

2062

# -- (string) Image tag

2063

# Defaults to appVersion in Chart.yaml if omitted

2064

tag: 1.19.0-r3@sha256:922e1f19a117a3d141cd554271e5d41822e459c0c83c6b91bea25e47fd62ea2d

2065

# -- Image pull policy

2066

pullPolicy: IfNotPresent

2067

# -- Image pull secrets

2068

imagePullSecrets: []

2069

# - secretName

2070

2071

# -- (int) Desired number of pods

2072

replicas: ~

2073

# -- The number of revisions to keep

2074

revisionHistoryLimit: 10

2075

# -- Resync period for informers

2076

resyncPeriod: 15m

2077

# -- Additional labels to add to each pod

2078

podLabels: {}

2079

# example.com/label: foo

2080

2081

# -- Additional annotations to add to each pod

2082

podAnnotations: {}

2083

# example.com/annotation: foo

2084

2085

# -- Deployment labels.

2086

labels: {}

2087

# -- Deployment annotations.

2088

annotations: {}

2089

# -- Deployment update strategy.

2090

# Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

2091

# @default -- See [values.yaml](values.yaml)

2092

updateStrategy:

2093

rollingUpdate:

2094

maxSurge: 1

2095

maxUnavailable: 40%

2096

type: RollingUpdate

2097

# -- Optional priority class

2098

priorityClassName: ''

2099

# -- Change `apiPriorityAndFairness` to `true` if you want to insulate the API calls made by Kyverno reports controller activities.

2100

# This will help ensure Kyverno reports stability in busy clusters.

2101

# Ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/

2102

apiPriorityAndFairness: false

2103

# -- Priority level configuration.

2104

# The block is directly forwarded into the priorityLevelConfiguration, so you can use whatever specification you want.

2105

# ref: https://kubernetes.io/docs/concepts/cluster-administration/flow-control/#prioritylevelconfiguration

2106

# @default -- See [values.yaml](values.yaml)

2107

priorityLevelConfigurationSpec:

2108

type: Limited

2109

limited:

2110

nominalConcurrencyShares: 10

2111

limitResponse:

2112

queuing:

2113

queueLengthLimit: 50

2114

type: Queue

2115

# -- Change `hostNetwork` to `true` when you want the pod to share its host's network namespace.

2116

# Useful for situations like when you end up dealing with a custom CNI over Amazon EKS.

2117

# Update the `dnsPolicy` accordingly as well to suit the host network mode.

2118

hostNetwork: false

2119

# -- `dnsPolicy` determines the manner in which DNS resolution happens in the cluster.

2120

# In case of `hostNetwork: true`, usually, the `dnsPolicy` is suitable to be `ClusterFirstWithHostNet`.

2121

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy.

2122

dnsPolicy: ClusterFirst

2123

# -- `dnsConfig` allows to specify DNS configuration for the pod.

2124

# For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config.

2125

dnsConfig: {}

2126

# options:

2127

# - name: ndots

2128

# value: "2"

2129

2130

# -- Extra arguments passed to the container on the command line

2131

extraArgs: {}

2132

# -- Additional container environment variables.

2133

extraEnvVars: []

2134

# Example setting proxy

2135

# extraEnvVars:

2136

# - name: HTTPS_PROXY

2137

# value: 'https://proxy.example.com:3128'

2138

2139

resources:

2140

# -- Pod resource limits

2141

limits:

2142

memory: 128Mi

2143

# -- Pod resource requests

2144

requests:

2145

cpu: 100m

2146

memory: 64Mi

2147

# -- Node labels for pod assignment. Overrides `global.nodeSelector` when non-empty. When empty, the default is `kubernetes.io/os: linux`.

2148

nodeSelector: {}

2149

# -- List of node taints to tolerate

2150

tolerations: []

2151

antiAffinity:

2152

# -- Pod antiAffinities toggle.

2153

# Enabled by default but can be disabled if you want to schedule pods to the same node.

2154

enabled: true

2155

# -- Pod anti affinity constraints.

2156

# @default -- See [values.yaml](values.yaml)

2157

podAntiAffinity:

2158

preferredDuringSchedulingIgnoredDuringExecution:

2159

- weight: 1

2160

podAffinityTerm:

2161

labelSelector:

2162

matchExpressions:

2163

- key: app.kubernetes.io/component

2164

operator: In

2165

values:

2166

- reports-controller

2167

topologyKey: kubernetes.io/hostname

2168

# -- Pod affinity constraints.

2169

podAffinity: {}

2170

# -- Node affinity constraints.

2171

nodeAffinity: {}

2172

# -- Topology spread constraints.

2173

topologySpreadConstraints: []

2174

# -- Security context for the pod

2175

podSecurityContext: {}

2176

# -- Security context for the containers

2177

securityContext:

2178

runAsUser: 65534

2179

runAsGroup: 65534

2180

runAsNonRoot: true

2181

privileged: false

2182

allowPrivilegeEscalation: false

2183

readOnlyRootFilesystem: true

2184

capabilities:

2185

drop:

2186

- ALL

2187

seccompProfile:

2188

type: RuntimeDefault

2189

# -- Container lifecycle hooks (e.g. a preStop sleep for graceful shutdown). The sleep action requires Kubernetes 1.30+.

2190

lifecycle: {}

2191

# Example:

2192

# lifecycle:

2193

# preStop:

2194

# sleep:

2195

# seconds: 10

2196

2197

podDisruptionBudget:

2198

# -- Enable PodDisruptionBudget.

2199

# Will always be enabled if replicas > 1. This non-declarative behavior should ideally be avoided, but changing it now would be breaking.

2200

enabled: false

2201

# -- Configures the minimum available pods for disruptions.

2202

# Cannot be used if `maxUnavailable` is set.

2203

minAvailable: 1

2204

# -- Configures the maximum unavailable pods for disruptions.

2205

# Cannot be used if `minAvailable` is set.

2206

maxUnavailable:

2207

# -- Unhealthy pod eviction policy to be used.

2208

# Possible values are `IfHealthyBudget` or `AlwaysAllow`.

2209

unhealthyPodEvictionPolicy:

2210

# -- A writable volume to use for the TUF root initialization.

2211

tufRootMountPath: /.sigstore

2212

# -- Volume to be mounted in pods for TUF/cosign work.

2213

sigstoreVolume:

2214

emptyDir: {}

2215

caCertificates:

2216

# -- CA certificates to use with Kyverno deployments

2217

# This value is expected to be one large string of CA certificates

2218

data: ~

2219

# -- Volume to be mounted for CA certificates

2220

# Not used when `.Values.reportsController.caCertificates.data` is defined

2221

volume: {}

2222

# Example to use hostPath:

2223

# hostPath:

2224

# path: /etc/pki/tls/ca-certificates.crt

2225

# type: File

2226

# -- Additional volumes to be mounted in the pod

2227

extraVolumes: []

2228

# - name: my-volume

2229

# emptyDir: {}

2230

2231

# -- Additional volumeMounts to be mounted to the main container

2232

extraVolumeMounts: []

2233

# - name: my-volume

2234

# mountPath: /path/to/mount

2235

2236

metricsService:

2237

# -- Create service.

2238

create: true

2239

# -- Service port.

2240

# Metrics server will be exposed at this port.

2241

port: 8000

2242

# -- Service type.

2243

type: ClusterIP

2244

# -- (string) Service node port.

2245

# Only used if `type` is `NodePort`.

2246

nodePort: ~

2247

# -- Service annotations.

2248

annotations: {}

2249

# -- (string) Service traffic distribution policy.

2250

# Set to `PreferClose` to route traffic to nearby endpoints, reducing latency and cross-zone costs.

2251

trafficDistribution: ~

2252

networkPolicy:

2253

# -- When true, use a NetworkPolicy to allow ingress to the webhook

2254

# This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.

2255

enabled: false

2256

# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.

2257

ingressFrom: []

2258

serviceMonitor:

2259

# -- Create a `ServiceMonitor` to collect Prometheus metrics.

2260

enabled: false

2261

# -- Additional annotations

2262

additionalAnnotations: {}

2263

# -- Additional labels

2264

additionalLabels: {}

2265

# -- (string) Override namespace

2266

namespace: ~

2267

# -- Interval to scrape metrics

2268

interval: 30s

2269

# -- Timeout if metrics can't be retrieved in given time interval

2270

scrapeTimeout: 25s

2271

# -- Is TLS required for endpoint

2272

secure: false

2273

# -- TLS Configuration for endpoint

2274

tlsConfig: {}

2275

# -- RelabelConfigs to apply to samples before scraping

2276

relabelings: []

2277

# -- MetricRelabelConfigs to apply to samples before ingestion.

2278

metricRelabelings: []

2279

tracing:

2280

# -- Enable tracing

2281

enabled: false

2282

# -- (string) Traces receiver address

2283

address: ~

2284

# -- (string) Traces receiver port

2285

port: ~

2286

# -- (string) Traces receiver credentials

2287

creds: ~

2288

metering:

2289

# -- Disable metrics export

2290

disabled: false

2291

# -- Otel configuration, can be `prometheus` or `grpc`

2292

config: prometheus

2293

# -- Prometheus endpoint port

2294

port: 8000

2295

# -- Is TLS required for endpoint

2296

secure: false

2297

# -- Key algorithm for self-signed TLS certificates.

2298

# Supported values: RSA, ECDSA, Ed25519

2299

tlsKeyAlgorithm: RSA

2300

# -- (string) Otel collector endpoint

2301

collector: ~

2302

# -- (string) Otel collector credentials

2303

creds: ~

2304

# -- reportsController server port

2305

# in case you are using hostNetwork: true, you might want to change the port the reportsController is listening to

2306

server:

2307

port: 9443

2308

profiling:

2309

# -- Enable profiling

2310

enabled: false

2311

# -- Profiling endpoint port

2312

port: 6060

2313

# -- Service type.

2314

serviceType: ClusterIP

2315

# -- Service node port.

2316

# Only used if `type` is `NodePort`.

2317

nodePort:

2318

# -- Enable sanity check for reports CRDs

2319

sanityChecks: true

2320

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

kyverno

The trusted source for open source

Product

Solutions

Customers

Resources

Company