policy-reporter
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# -- Override the chart name used for all resources
2
nameOverride: ""
3
# -- Overwrite the fullname of all resources
4
fullnameOverride: "policy-reporter"
5
# -- Overwrite the namespace of all resources
6
namespaceOverride: ""
7
# -- Overwrite apiVersion for specific resources
8
apiVersionOverride:
9
podDisruptionBudget: ""
10
image:
11
# -- (string) Image registry
12
registry: cgr.dev
13
# -- (string) Image repository
14
repository: scratch-images/test-tmp/kyverno-policy-reporter-fips
15
# -- (string) Image pullPolicy
16
pullPolicy: IfNotPresent
17
# -- (string) Image tag
18
tag: 3.10.0-r1@sha256:98f7ac4e3c6da385f8915a6cba94264a7df215a03f5983ae3ec98f6088dea79b
19
# -- Image pullSecrets
20
imagePullSecrets: []
21
# -- Deployment priorityClassName
22
priorityClassName: ""
23
# -- Deployment replica count
24
replicaCount: 1
25
# -- The number of revisions to keep
26
revisionHistoryLimit: 10
27
# -- Deployment strategy
28
updateStrategy: {}
29
# rollingUpdate:
30
# maxSurge: 25%
31
# maxUnavailable: 25%
32
# type: RollingUpdate
33
34
# -- Container port
35
port:
36
name: http
37
number: 8080
38
# -- Key/value pairs that are attached to all resources.
39
annotations: {}
40
rbac:
41
# -- Create RBAC resources
42
enabled: true
43
serviceAccount:
44
# -- Create ServiceAccount
45
create: true
46
# -- Enable ServiceAccount automount
47
automount: true
48
# -- Annotations for the ServiceAccount
49
annotations: {}
50
# -- The ServiceAccount name
51
name: ""
52
service:
53
# -- Create Service
54
enabled: true
55
# -- Service type
56
type: ClusterIP
57
# -- Service port
58
port: 8080
59
# -- Service annotations
60
annotations: {}
61
# -- Service labels
62
labels: {}
63
# -- Security context for the pod
64
podSecurityContext:
65
fsGroup: 1234
66
securityContext:
67
runAsUser: 1234
68
runAsNonRoot: true
69
privileged: false
70
allowPrivilegeEscalation: false
71
readOnlyRootFilesystem: true
72
capabilities:
73
drop:
74
- ALL
75
seccompProfile:
76
type: RuntimeDefault
77
# -- Additional annotations to add to each pod
78
podAnnotations: {}
79
# -- Additional labels to add to each pod
80
podLabels: {}
81
# -- Custom selector labels, overwrites the default set
82
selectorLabels: {}
83
# -- Resource constraints
84
resources: {}
85
# limits:
86
# memory: 100Mi
87
# cpu: 10m
88
# requests:
89
# memory: 75Mi
90
# cpu: 5m
91
92
networkPolicy:
93
# -- Create NetworkPolicy
94
enabled: false
95
# -- Egress rule to allow Kubernetes API Server access
96
egress:
97
- to:
98
ports:
99
- protocol: TCP
100
port: 6443
101
ingress: []
102
ingress:
103
# -- Create Ingress
104
# This ingress exposes the policy-reporter core app.
105
enabled: false
106
# -- Ingress className
107
className: ""
108
# -- Labels for the Ingress
109
labels: {}
110
# -- Annotations for the Ingress
111
annotations: {}
112
# kubernetes.io/ingress.class: nginx
113
# kubernetes.io/tls-acme: "true"
114
# -- Ingress host list
115
hosts:
116
# - host: chart-example.local
117
# paths: []
118
# -- Ingress tls list
119
tls: []
120
# - secretName: chart-example-tls
121
# hosts:
122
# - chart-example.local
123
httproute:
124
# -- Enable HTTPRoute resource (Gateway API alternative to Ingress)
125
# Requires Gateway API CRDs (v1) installed in cluster
126
# https://gateway-api.sigs.k8s.io/
127
enabled: false
128
# -- Additional HTTPRoute labels
129
labels: {}
130
# -- Additional HTTPRoute annotations
131
annotations: {}
132
# -- Gateway API parentRefs (list of Gateway references)
133
# Must reference an existing Gateway resource
134
parentRefs: []
135
# - name: example-gateway
136
# namespace: gateway-system
137
# sectionName: https
138
# -- List of hostnames for HTTPRoute
139
hostnames: []
140
# - policy-reporter.example.com
141
# -- HTTPRoute rules configuration
142
# Allows advanced routing with matches and filters
143
rules:
144
- matches:
145
- path:
146
type: PathPrefix
147
value: /
148
# Optional filters:
149
# filters:
150
# - type: RequestHeaderModifier
151
# requestHeaderModifier:
152
# add:
153
# - name: X-Custom-Header
154
# value: value
155
# Optional timeouts configuration:
156
# timeouts:
157
# request: 30s
158
# backendRequest: 30s
159
logging:
160
# -- Enables server access logging
161
server: false
162
# -- Log encoding
163
# possible encodings are console and json
164
encoding: console
165
# -- Log level
166
# default info
167
logLevel: 0
168
rest:
169
# -- Enables the REST API
170
enabled: false
171
metrics:
172
# -- Enables Prometheus Metrics
173
enabled: false
174
# -- Metric Mode allows to customize labels
175
# Allowed values: detailed, simple, custom
176
mode: detailed
177
# -- List of used labels in custom mode
178
# Supported fields are: ["namespace", "rule", "policy", "report" // Report name, "kind" // resource kind, "name" // resource name, "status", "severity", "category", "source"]
179
customLabels: []
180
# -- Filter results to reduce cardinality
181
filter: {}
182
# sources:
183
# exclude: ["Trivy CIS Kube Bench"]
184
# status:
185
# exclude: ["pass", "skip"]
186
187
profiling:
188
# -- Enable profiling with pprof
189
enabled: false
190
# -- Amount of queue workers for Report resource processing
191
worker: 5
192
# -- Filter Report resources to process
193
reportFilter: {}
194
# # -- Filter reports based on an namespace allow- or disallow list, wildcards are supported
195
# namespaces:
196
# include: []
197
# exclude: []
198
# # -- Disable the processing of cluster scoped Reports
199
# disableClusterReports: false
200
201
# -- Customize source specific logic like result ID generation
202
sourceConfig: []
203
# - selector:
204
# source: kyverno
205
# # -- Handles cluster scoped reports for namespaces as self assigned namespace scoped report
206
# selfassignNamespaces: true
207
# customId:
208
# enabled: true
209
# fields: ["resource", "policy", "rule", "category", "result", "message"]
210
211
# Source based Report filter
212
sourceFilters:
213
- selector:
214
# -- select Report by source
215
sources: [kyverno, KyvernoValidatingPolicy, KyvernoImageValidatingPolicy]
216
# -- Filter out Reports of controlled Pods and Jobs, only works for Reports with scope resource
217
uncontrolledOnly: true
218
# -- Filter out cluster scoped Reports
219
disableClusterReports: false
220
# -- Filter out Reports based on the scope resource kind
221
kinds:
222
exclude: []
223
global:
224
# -- additional labels added on each resource
225
labels: {}
226
# basicAuth for APIs and metrics
227
basicAuth:
228
# -- HTTP BasicAuth username
229
username: ""
230
# -- HTTP BasicAuth password
231
password: ""
232
# -- (optional) Secret reference to get username and/or password from
233
secretRef: ""
234
emailReports:
235
# -- (optional) - Displayed in the email report if configured
236
clusterName: ""
237
# -- Title prefix in the email subject
238
titlePrefix: "Report"
239
# -- Resource constraints for the created CronJobs
240
resources: {}
241
smtp:
242
# -- (optional) Secret reference to provide the complete or partial SMTP configuration
243
secret: ""
244
# -- SMTP Server Host
245
host: ""
246
# -- SMTP Server Port
247
port: 465
248
# -- SMTP Username
249
username: ""
250
# -- SMTP Password
251
password: ""
252
# -- Displayed from email address
253
from: ""
254
# -- SMTP Encryption
255
# Default is none, supports ssl/tls and starttls
256
encryption: ""
257
# -- Skip SMTP TLS verification
258
skipTLS: false
259
# -- SMTP Server Certificate file path
260
certificate: ""
261
graphAPI:
262
# -- Enable Microsoft Graph API for E-Mail reports, takes precedence over SMTP
263
enabled: false
264
# -- Microsoft Graph API Tenant ID
265
tenant: ""
266
# -- Microsoft Graph API Client ID
267
clientID: ""
268
# -- Microsoft Graph API Client Secret
269
clientSecret: ""
270
# -- (optional) Name of an existing Secret with a `clientSecret` key, used instead of `clientSecret`
271
secretRef: ""
272
# -- Microsoft Graph API User ID (Sender)
273
userID: ""
274
# -- Microsoft Graph API CC Recipients
275
cc: []
276
# -- Microsoft Graph API BCC Recipients
277
bcc: []
278
# -- Disable saving sent messages to the Sent Items folder
279
disableSaveToSentItems: false
280
# -- Microsoft Graph API Azure AD Endpoint override
281
azureADEndpoint: "https://login.microsoftonline.com"
282
# -- Microsoft Graph API endpoint override
283
graphEndpoint: "https://graph.microsoft.com"
284
summary:
285
# -- Enable Summary E-Mail reports
286
enabled: false
287
# -- CronJob schedule
288
schedule: "0 8 * * *"
289
# -- CronJob activeDeadlineSeconds
290
activeDeadlineSeconds: 300
291
# -- CronJob backoffLimit
292
backoffLimit: 3
293
# -- CronJob ttlSecondsAfterFinished
294
ttlSecondsAfterFinished: 0
295
# -- CronJob restartPolicy
296
restartPolicy: Never
297
# -- List of receiver email addresses
298
to: []
299
# -- (optional) Report filter
300
filter: {}
301
# # remove ClusterPolicyResults from Reports
302
# disableClusterReports: false
303
# namespaces:
304
# include: []
305
# exclude: []
306
# sources:
307
# include: []
308
# exclude: []
309
# -- (optional) Channels can be used to to send only a subset of namespaces / sources to dedicated email addresses
310
channels: []
311
# - to: ['team-a@company.org']
312
# filter:
313
# disableClusterReports: true
314
# namespaces:
315
# include: ['team-a-*']
316
# sources:
317
# include: ['Kyverno']
318
violations:
319
# -- Enable Violation Summary E-Mail reports
320
enabled: false
321
# -- CronJob schedule
322
schedule: "0 8 * * *"
323
# -- CronJob activeDeadlineSeconds
324
activeDeadlineSeconds: 300
325
# -- CronJob backoffLimit
326
backoffLimit: 3
327
# -- CronJob ttlSecondsAfterFinished
328
ttlSecondsAfterFinished: 0
329
# -- CronJob restartPolicy
330
restartPolicy: Never
331
# -- List of receiver email addresses
332
to: []
333
# -- (optional) Report filter
334
filter: {}
335
# disableClusterReports: false # remove ClusterPolicyResults from Reports
336
# namespaces:
337
# include: []
338
# exclude: []
339
# sources:
340
# include: []
341
# exclude: []
342
# -- (optional) Channels can be used to to send only a subset of namespaces / sources to dedicated email addresses
343
channels: []
344
# - to: ['team-a@company.org']
345
# filter:
346
# disableClusterReports: true
347
# namespaces:
348
# include: ['team-a-*']
349
# sources:
350
# include: ['Kyverno']
351
existingTargetConfig:
352
# -- Use an already existing configuration
353
enabled: false
354
# -- Name of the secret with the config
355
name: ""
356
# -- SubPath within the secret (defaults to config.yaml)
357
subPath: ""
358
target:
359
# -- enable and install TargetConfig CRD
360
crd: false
361
loki:
362
# -- Host Address
363
host: ""
364
# -- Loki API, defaults to "/loki/api/v1/push"
365
path: ""
366
# -- Server Certificate file path
367
# Can be added under extraVolumes
368
certificate: ""
369
# -- Skip TLS verification
370
skipTLS: false
371
# -- Read configuration from an already existing Secret
372
secretRef: ""
373
# -- Mounted secret path by Secrets Controller, secret should be in json format
374
mountedSecret: ""
375
# -- Minimum severity: "" < info < low < medium < high < critical
376
minimumSeverity: ""
377
# -- List of sources which should send
378
sources: []
379
# -- Skip already existing report results on startup
380
skipExistingOnStartup: true
381
# -- Added as additional labels
382
customFields: {}
383
# -- Additional HTTP Headers
384
headers: {}
385
# -- HTTP BasicAuth username
386
username: ""
387
# -- HTTP BasicAuth password
388
password: ""
389
# -- Filter Results which should send to this target
390
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
391
# Filters are available for all targets except the UI
392
filter: {}
393
# namespaces:
394
# include: ["develop"]
395
# priorities:
396
# exclude: ["debug", "info", "error"]
397
# labels:
398
# include: ["app", "owner:team-a", "monitoring:*"]
399
# -- List of channels to route results to different configurations
400
channels: []
401
# - host: "http://loki.loki-stack:3100"
402
# sources: []
403
# customLabels: {}
404
# filter:
405
# namespaces:
406
# include: ["develop"]
407
# priorities:
408
# exclude: ["debug", "info", "error"]
409
# reportLabels:
410
# . include: ["app", "owner:team-b"]
411
412
elasticsearch:
413
# -- Host address
414
host: ""
415
# -- Server Certificate file path
416
# Can be added under extraVolumes
417
certificate: ""
418
# -- Skip TLS verification
419
skipTLS: false
420
# -- Additional HTTP Headers
421
headers: {}
422
# -- Elasticsearch index (default: policy-reporter)
423
index: "policy-reporter"
424
# -- Elasticsearch index rotation and index suffix
425
# Possible values: daily, monthly, annually, none (default: daily)
426
rotation: "daily"
427
# -- Enables Elasticsearch typless API
428
# https://www.elastic.co/blog/moving-from-types-to-typeless-apis-in-elasticsearch-7-0 keeping as false for retrocompatibility.
429
typelessApi: false
430
# -- HTTP BasicAuth username
431
username: ""
432
# -- HTTP BasicAuth password
433
password: ""
434
# -- Elasticsearch API Key for api key authentication
435
apiKey: ""
436
# -- Read configuration from an already existing Secret
437
secretRef: ""
438
# -- Mounted secret path by Secrets Controller, secret should be in json format
439
mountedSecret: ""
440
# -- Minimum severity: "" < info < low < medium < high < critical
441
minimumSeverity: ""
442
# -- List of sources which should send
443
sources: []
444
# -- Skip already existing report results on startup
445
skipExistingOnStartup: true
446
# -- Added as additional labels
447
customFields: {}
448
# -- Filter Results which should send to this target
449
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
450
# Filters are available for all targets except the UI
451
filter: {}
452
# -- List of channels to route results to different configurations
453
channels: []
454
slack:
455
# -- Webhook Address
456
webhook: ""
457
# -- Slack Channel
458
channel: ""
459
# -- Read configuration from an already existing Secret
460
secretRef: ""
461
# -- Mounted secret path by Secrets Controller, secret should be in json format
462
mountedSecret: ""
463
# -- Minimum severity: "" < info < low < medium < high < critical
464
minimumSeverity: ""
465
# -- List of sources which should send
466
sources: []
467
# -- Skip already existing report results on startup
468
skipExistingOnStartup: true
469
# -- Added as additional labels
470
customFields: {}
471
# -- Filter Results which should send to this target
472
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
473
# Filters are available for all targets except the UI
474
filter: {}
475
# -- List of channels to route results to different configurations
476
channels: []
477
# - webhook: "https://slack.webhook1"
478
# channel: ""
479
# filter:
480
# namespaces:
481
# include: ["develop"]
482
# priorities:
483
# exclude: ["debug", "info", "error"]
484
# policies:
485
# include: ["require-run-as-nonroot"]
486
# reportLabels:
487
# . include: ["app", "owner:team-b"]
488
# - webhook: "https://slack.webhook2"
489
# minimumSeverity: "warning"
490
# filter:
491
# namespaces:
492
# include: ["team-a-*"]
493
494
discord:
495
# -- Webhook Address
496
webhook: ""
497
# -- Server Certificate file path
498
# Can be added under extraVolumes
499
certificate: ""
500
# -- Skip TLS verification
501
skipTLS: false
502
# -- Additional HTTP Headers
503
headers: {}
504
# -- Read configuration from an already existing Secret
505
secretRef: ""
506
# -- Mounted secret path by Secrets Controller, secret should be in json format
507
mountedSecret: ""
508
# -- Minimum severity: "" < info < low < medium < high < critical
509
minimumSeverity: ""
510
# -- List of sources which should send
511
sources: []
512
# -- Skip already existing report results on startup
513
skipExistingOnStartup: true
514
# -- Added as additional labels
515
customFields: {}
516
# -- Filter Results which should send to this target
517
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
518
# Filters are available for all targets except the UI
519
filter: {}
520
# -- List of channels to route results to different configurations
521
channels: []
522
teams:
523
# -- Webhook Address
524
webhook: ""
525
# -- Server Certificate file path
526
# Can be added under extraVolumes
527
certificate: ""
528
# -- Skip TLS verification
529
skipTLS: false
530
# -- Additional HTTP Headers
531
headers: {}
532
# -- Read configuration from an already existing Secret
533
secretRef: ""
534
# -- Mounted secret path by Secrets Controller, secret should be in json format
535
mountedSecret: ""
536
# -- Minimum severity: "" < info < low < medium < high < critical
537
minimumSeverity: ""
538
# -- List of sources which should send
539
sources: []
540
# -- Skip already existing report results on startup
541
skipExistingOnStartup: true
542
# -- Added as additional labels
543
customFields: {}
544
# -- Filter Results which should send to this target
545
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
546
# Filters are available for all targets except the UI
547
filter: {}
548
# -- List of channels to route results to different configurations
549
channels: []
550
webhook:
551
# -- Webhook Address
552
webhook: ""
553
# -- Server Certificate file path
554
# Can be added under extraVolumes
555
certificate: ""
556
# -- Skip TLS verification
557
skipTLS: false
558
# -- Additional HTTP Headers
559
headers: {}
560
# -- Read configuration from an already existing Secret
561
secretRef: ""
562
# -- Mounted secret path by Secrets Controller, secret should be in json format
563
mountedSecret: ""
564
# -- Minimum severity: "" < info < low < medium < high < critical
565
minimumSeverity: ""
566
# -- List of sources which should send
567
sources: []
568
# -- Skip already existing report results on startup
569
skipExistingOnStartup: true
570
# -- Added as additional labels
571
customFields: {}
572
# -- Keepalive configuration
573
keepalive:
574
# -- Duration string like "30s" for heartbeat interval, '0' - disabled
575
interval: "0"
576
# -- Additional parameters to include in heartbeat payload
577
params: {}
578
# -- Filter Results which should send to this target
579
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
580
# Filters are available for all targets except the UI
581
filter: {}
582
# -- List of channels to route results to different configurations
583
channels: []
584
telegram:
585
# -- Telegram bot token
586
token: ""
587
# -- Telegram chat id
588
chatId: ""
589
# -- (optional) Telegram proxy host
590
host: ""
591
# -- Server Certificate file path
592
# Can be added under extraVolumes
593
certificate: ""
594
# -- Skip TLS verification
595
skipTLS: false
596
# -- Additional HTTP Headers
597
headers: {}
598
# -- Read configuration from an already existing Secret
599
secretRef: ""
600
# -- Mounted secret path by Secrets Controller, secret should be in json format
601
mountedSecret: ""
602
# -- Minimum severity: "" < info < low < medium < high < critical
603
minimumSeverity: ""
604
# -- List of sources which should send
605
sources: []
606
# -- Skip already existing report results on startup
607
skipExistingOnStartup: true
608
# -- Added as additional labels
609
customFields: {}
610
# -- Filter Results which should send to this target
611
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
612
# Filters are available for all targets except the UI
613
filter: {}
614
# -- List of channels to route results to different configurations
615
channels: []
616
googleChat:
617
# -- Webhook Address
618
webhook: ""
619
# -- Server Certificate file path
620
# Can be added under extraVolumes
621
certificate: ""
622
# -- Skip TLS verification
623
skipTLS: false
624
# -- Additional HTTP Headers
625
headers: {}
626
# -- Read configuration from an already existing Secret
627
secretRef: ""
628
# -- Mounted secret path by Secrets Controller, secret should be in json format
629
mountedSecret: ""
630
# -- Minimum severity: "" < info < low < medium < high < critical
631
minimumSeverity: ""
632
# -- List of sources which should send
633
sources: []
634
# -- Skip already existing report results on startup
635
skipExistingOnStartup: true
636
# -- Added as additional labels
637
customFields: {}
638
# -- Filter Results which should send to this target
639
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
640
# Filters are available for all targets except the UI
641
filter: {}
642
# -- List of channels to route results to different configurations
643
channels: []
644
jira:
645
# -- JIRA server URL
646
host: ""
647
# -- JIRA username
648
username: ""
649
# -- JIRA password (use password or apiToken, not both)
650
password: ""
651
# -- JIRA API token (use password or apiToken, not both)
652
apiToken: ""
653
# -- JIRA static labels
654
apiVersion: "v3"
655
# -- JIRA project key
656
projectKey: ""
657
# -- JIRA issue type (default: "Bug")
658
issueType: ""
659
# -- JIRA component names list
660
components: []
661
# -- JIRA static labels
662
labels: []
663
# -- JIRA summary go template, available values: result, customfield
664
# default: "{{ if result.ResourceString }}{{ result.ResourceString }}: {{ end }}Policy Violation: {{ result.Policy }}"
665
summaryTemplate: ""
666
# -- Server Certificate file path
667
# Can be added under extraVolumes
668
certificate: ""
669
# -- Skip TLS verification
670
skipTLS: false
671
# -- Read configuration from an already existing Secret
672
secretRef: ""
673
# -- Mounted secret path by Secrets Controller, secret should be in json format
674
mountedSecret: ""
675
# -- Minimum severity: "" < info < low < medium < high < critical
676
minimumSeverity: ""
677
# -- List of sources which should send
678
sources: []
679
# -- Skip already existing report results on startup
680
skipExistingOnStartup: true
681
# -- Added as additional labels
682
customFields: {}
683
# -- Filter Results which should send to this target
684
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
685
# Filters are available for all targets except the UI
686
filter: {}
687
# -- List of channels to route results to different configurations
688
channels: []
689
alertManager:
690
# -- host address
691
host: ""
692
# -- Server Certificate file path
693
# Can be added under extraVolumes
694
certificate: ""
695
# -- Skip TLS verification
696
skipTLS: false
697
# -- Additional HTTP Headers
698
headers: {}
699
# -- Read configuration from an already existing Secret
700
secretRef: ""
701
# -- Mounted secret path by Secrets Controller, secret should be in json format
702
mountedSecret: ""
703
# -- Minimum severity: "" < info < low < medium < high < critical
704
minimumSeverity: ""
705
# -- List of sources which should send
706
sources: []
707
# -- Skip already existing PolicyReportResults on startup
708
skipExistingOnStartup: true
709
# -- Added as additional labels
710
customFields: {}
711
# -- Filter Results which should send to this target
712
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
713
# Filters are available for all targets except the UI
714
filter: {}
715
# -- List of channels to route results to different configurations
716
channels: []
717
# Authentication via PodIdentity or WebIdentity are also supported
718
s3:
719
# -- (optional) S3 Access key
720
accessKeyId: ""
721
# -- (optional) S3 SecretAccess key
722
secretAccessKey: ""
723
# -- (optional) S3 Storage region
724
region: ""
725
# -- (optional) S3 Storage endpoint
726
endpoint: ""
727
# -- (required) S3 Storage bucket name
728
bucket: ""
729
# -- S3 Storage to use an S3 Bucket Key for object encryption with SSE-KMS
730
bucketKeyEnabled: false
731
# -- S3 Storage KMS Key ID for object encryption with SSE-KMS
732
kmsKeyId: ""
733
# -- S3 Storage server-side encryption algorithm used when storing this object in Amazon S3, AES256, aws:kms
734
serverSideEncryption: ""
735
# -- S3 Storage, force path style configuration
736
pathStyle: false
737
# -- Used prefix, keys will have format: s3://<bucket>/<prefix>/YYYY-MM-DD/YYYY-MM-DDTHH:mm:ss.s+01:00.json
738
prefix: ""
739
# -- Read configuration from an already existing Secret
740
secretRef: ""
741
# -- Mounted secret path by Secrets Controller, secret should be in json format
742
mountedSecret: ""
743
# -- Minimum severity: "" < info < low < medium < high < critical
744
minimumSeverity: ""
745
# -- List of sources which should send
746
sources: []
747
# -- Skip already existing report results on startup
748
skipExistingOnStartup: true
749
# -- Added as additional labels
750
customFields: {}
751
# -- Filter Results which should send to this target
752
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
753
# Filters are available for all targets except the UI
754
filter: {}
755
# -- List of channels to route results to different configurations
756
channels: []
757
# Authentication via PodIdentity or WebIdentity are also supported
758
kinesis:
759
# -- (optional) Access key
760
accessKeyId: ""
761
# -- (optional) SecretAccess key
762
secretAccessKey: ""
763
# -- (optional) Region
764
region: ""
765
# -- (optional) Endpoint
766
endpoint: ""
767
# -- (required) StreamName
768
streamName: ""
769
# -- Read configuration from an already existing Secret
770
secretRef: ""
771
# -- Mounted secret path by Secrets Controller, secret should be in json format
772
mountedSecret: ""
773
# -- Minimum severity: "" < info < low < medium < high < critical
774
minimumSeverity: ""
775
# -- List of sources which should send
776
sources: []
777
# -- Skip already existing report results on startup
778
skipExistingOnStartup: true
779
# -- Added as additional labels
780
customFields: {}
781
# -- Filter Results which should send to this target
782
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
783
# Filters are available for all targets except the UI
784
filter: {}
785
# -- List of channels to route results to different configurations
786
channels: []
787
# Authentication via PodIdentity or WebIdentity are also supported
788
securityHub:
789
# -- (optional) Access key
790
accessKeyId: ""
791
# -- (optional) SecretAccess key
792
secretAccessKey: ""
793
# -- (optional) Region
794
region: ""
795
# -- (optional) Endpoint
796
endpoint: ""
797
# -- (required) AccountId
798
accountId: ""
799
# -- (optional) Used product name, defaults to "Polilcy Reporter"
800
productName: ""
801
# -- (optional) Used company name, defaults to "Kyverno"
802
companyName: ""
803
# -- Enable cleanup listener for SecurityHub
804
synchronize: true
805
# -- Delay between AWS GetFindings API calls, to avoid hitting the API RequestLimit
806
delayInSeconds: 2
807
# -- Read configuration from an already existing Secret
808
secretRef: ""
809
# -- Mounted secret path by Secrets Controller, secret should be in json format
810
mountedSecret: ""
811
# -- Minimum severity: "" < info < low < medium < high < critical
812
minimumSeverity: ""
813
# -- List of sources which should send
814
sources: []
815
# -- Skip already existing report results on startup
816
skipExistingOnStartup: true
817
# -- Added as additional labels
818
customFields: {}
819
# -- Filter Results which should send to this target
820
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
821
# Filters are available for all targets except the UI
822
filter: {}
823
# -- List of channels to route results to different configurations
824
channels: []
825
# Authentication via PodIdentity is also supported
826
gcs:
827
# -- (optional) GCS (Google Cloud Storage) Service Account Credentials
828
credentials: ""
829
# -- (required) GCS Bucket
830
bucket: ""
831
# -- Read configuration from an already existing Secret
832
secretRef: ""
833
# -- Mounted secret path by Secrets Controller, secret should be in json format
834
mountedSecret: ""
835
# -- Minimum severity: "" < info < low < medium < high < critical
836
minimumSeverity: ""
837
# -- List of sources which should send
838
sources: []
839
# -- Skip already existing report results on startup
840
skipExistingOnStartup: true
841
# -- Added as additional labels
842
customFields: {}
843
# -- Filter Results which should send to this target
844
# Wildcars for namespaces and policies are supported, you can either define exclude or include values
845
# Filters are available for all targets except the UI
846
filter: {}
847
# -- List of channels to route results to different configurations
848
channels: []
849
# LeaderElection configuration for HA mode
850
# will be enabled when replicaCount > 1
851
leaderElection:
852
releaseOnCancel: true
853
leaseDuration: 15
854
renewDeadline: 10
855
retryPeriod: 2
856
redis:
857
# -- Enables Redis as external result cache, uses in memory cache by default
858
enabled: false
859
# -- Redis host
860
address: ""
861
# -- Redis database
862
database: 0
863
# -- Redis key prefix
864
prefix: "policy-reporter"
865
# -- (optional) Username
866
username: ""
867
# -- (optional) Password
868
password: ""
869
# -- (optional) Path to a server CA certificate
870
certificate: ""
871
# -- (optional) Path to client certificate for mutual TLS authentication
872
clientCert: ""
873
# -- (optional) Path to client key for mutual TLS authentication
874
clientKey: ""
875
# -- (optional) Secret name to pull username and password from
876
secretRef: ""
877
# -- Skip TLS verification
878
skipTLS: false
879
database:
880
# -- Use an external Database, supported: mysql, postgres, mariadb
881
type: ""
882
# -- Database
883
database: ""
884
# -- Username
885
username: ""
886
# -- Password
887
password: ""
888
# -- Host Address
889
host: ""
890
# -- Enables SSL
891
enableSSL: false
892
# -- Instead of configure the individual values you can also provide an DSN string
893
# example postgres: postgres://postgres:password@localhost:5432/postgres?sslmode=disable
894
# example mysql: root:password@tcp(localhost:3306)/test?tls=false
895
dsn: ""
896
# -- Maximum number of open connections, supported for mysql and postgres
897
maxOpenConnections: 25
898
# -- Maximum number of idle connections, supported for mysql and postgres
899
maxIdleConnections: 25
900
# -- Maximum amount of time in minutes a connection may be reused, supported for mysql and postgres
901
connectionMaxLifetime: 0
902
# -- Maximum amount of time in minutes a connection may be idle, supported for mysql and postgres
903
connectionMaxIdleTime: 0
904
# -- Timeout for database operations in seconds, supported for mysql and postgres
905
timeout: 10
906
# -- Enables database related metrics, connection status and query histogram
907
metrics: false
908
# -- Read configuration from an existing Secret
909
# supported fields: username, password, host, dsn, database
910
secretRef: ""
911
# Read configuration from a mounted Secret, required the information in JSON format
912
# supported fields: username, password, host, dsn, database
913
mountedSecret: ""
914
# Add this configuration section for periodic sync
915
periodicSync:
916
# Enable periodic sync of policy reports
917
enabled: false
918
# Interval in minutes for periodic sync
919
interval: 30
920
autoMemoryLimit:
921
# Enable automatic GOMEMLIMIT configuration based on container or system memory
922
enabled: true
923
# The ratio of reserved GOMEMLIMIT memory to the detected maximum container or system memory. Must be greater than 0 and less than or equal to 1.
924
ratio: 0.9
925
# enabled if replicaCount > 1
926
podDisruptionBudget:
927
# -- Configures the minimum available pods for policy-reporter disruptions.
928
# Cannot be used if `maxUnavailable` is set.
929
minAvailable: 1
930
# -- Configures the maximum unavailable pods for policy-reporter disruptions.
931
# Cannot be used if `minAvailable` is set.
932
maxUnavailable:
933
# -- Node labels for pod assignment
934
# ref: https://kubernetes.io/docs/user-guide/node-selection/
935
nodeSelector: {}
936
# -- Tolerations for pod assignment
937
# ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
938
tolerations: []
939
# -- Anti-affinity to disallow deploying client and master nodes on the same worker node
940
affinity: {}
941
# -- Topology Spread Constraints to better spread pods
942
topologySpreadConstraints: []
943
# -- Deployment livenessProbe for policy-reporter
944
livenessProbe:
945
httpGet:
946
path: /ready
947
port: http
948
# -- Deployment readinessProbe for policy-reporter
949
readinessProbe:
950
httpGet:
951
path: /healthz
952
port: http
953
extraVolumes:
954
# -- Deployment volumeMounts
955
volumeMounts: []
956
# -- Deployment values
957
volumes: []
958
# -- If set the volume for sqlite is freely configurable below "- name: sqlite". If no value is set an emptyDir is used.
959
sqliteVolume: {}
960
# emptyDir:
961
# sizeLimit: 10Mi
962
963
# -- Allow additional env variables to be added
964
envVars: []
965
# -- Allow custom configuration of the /tmp volume
966
tmpVolume: {}
967
ui:
968
# -- (bool) Enable Policy Reporter UI
969
enabled: false
970
image:
971
# -- (string) Image registry
972
registry: cgr.dev
973
# -- (string) Image repository
974
repository: scratch-images/test-tmp/kyverno-policy-reporter-ui-fips
975
# -- (string) Image PullPolicy
976
pullPolicy: IfNotPresent
977
# -- (string) Image tag
978
tag: 2.8.1-r1@sha256:c3e8729570f6a8d9537e3e597be29a4f83af602eb50580e1bdcc553f11cc5199
979
crds:
980
# -- Install UI CustomBoard CRDs
981
customBoard: false
982
# -- Install UI CustomBoard CRDs
983
cluster: false
984
# -- Deployment replica count
985
replicaCount: 1
986
# -- Deployment priorityClassName
987
priorityClassName: ""
988
logging:
989
# -- Enables external api request logging
990
api: false
991
# -- Enables server access logging
992
server: false
993
# -- Log encoding
994
# possible encodings are console and json
995
encoding: console
996
# -- Log level
997
# default info
998
logLevel: 0
999
server:
1000
# -- Application port
1001
port: 8080
1002
# -- Enabled CORS header
1003
cors: true
1004
# -- Overwrites Request Host with Proxy Host and adds `X-Forwarded-Host` and `X-Origin-Host` headers
1005
overwriteHost: true
1006
# -- session configuration
1007
sessions:
1008
storage: filesystem
1009
tempDir: /tmp
1010
openIDConnect:
1011
# -- Enable openID Connect authentication
1012
enabled: false
1013
# -- OpenID Connect Discovery URL
1014
discoveryUrl: ""
1015
# -- OpenID Connect Callback URL
1016
callbackUrl: ""
1017
# -- OpenID Connect ClientID
1018
clientId: ""
1019
# -- OpenID Connect ClientSecret
1020
clientSecret: ""
1021
# -- Optional Group Claim to map user groups to the profile
1022
# groups can be used to define access control for clusters, boards and custom boards.
1023
groupClaim: ""
1024
# -- OpenID Connect allowed Scopes
1025
scopes: []
1026
# -- Enable PKCE (Proof Key for Code Exchange) for OpenID Connect authentication
1027
pkce: false
1028
# -- Skip TLS Verification
1029
skipTLS: false
1030
# -- TLS Certificate file path
1031
certificate: ""
1032
# -- Secret to rea
1033
# -- Provide OpenID Connect configuration via Secret
1034
# supported keys: `discoveryUrl`, `clientId`, `clientSecret`, `certificate`, `skipTLS`
1035
secretRef: ""
1036
oauth:
1037
# -- Enable openID Connect authentication
1038
enabled: false
1039
# -- OAuth2 Provider
1040
# supported: amazon, gitlab, github, apple, google, yandex, azuread
1041
provider: ""
1042
# -- OpenID Connect Callback URL
1043
callbackUrl: ""
1044
# -- OpenID Connect ClientID
1045
clientId: ""
1046
# -- OpenID Connect ClientSecret
1047
clientSecret: ""
1048
# -- OpenID Connect allowed Scopes
1049
scopes: []
1050
# -- Provide OpenID Connect configuration via Secret
1051
# supported keys: `provider`, `clientId`, `clientSecret`
1052
secretRef: ""
1053
# -- optional banner text
1054
banner: ""
1055
logo:
1056
# -- custom logo path
1057
path: ""
1058
# -- disable logo entirely
1059
disabled: false
1060
# -- DisplayMode dark/light/colorblind/colorblinddark
1061
# uses the OS configured preferred color scheme as default
1062
displayMode: ""
1063
# -- Configure access control for all default boards.
1064
boards: {}
1065
# accessControl:
1066
# groups: []
1067
# emails: []
1068
1069
# -- Additional customizable dashboards
1070
customBoards: []
1071
# - name: Team A
1072
# namespaces:
1073
# # -- list of displayed namespaces
1074
# list: []
1075
# # -- selector for displayed namespaces
1076
# labelSelector:
1077
# team: team-a # equal
1078
# workload: * # label exists
1079
# infra: !* # label does not exist
1080
# env: dev,test # label value is one of [dev, test]
1081
# sources:
1082
# # -- list of displayed sources
1083
# list: []
1084
# clusterScope:
1085
# # -- display cluster scoped resources and results
1086
# enabled: false
1087
# display: ""
1088
# filter:
1089
# include:
1090
# results: []
1091
# severities: []
1092
# clusterKinds: []
1093
# namespaceKinds: []
1094
1095
# -- source specific configurations
1096
sources: []
1097
# -- kyverno specific UI configurations
1098
# - name: kyverno
1099
# -- show results per category, other option: severity
1100
# type: result
1101
# -- enabled action button to generate PolicyExceptions from the UI
1102
# exceptions: false
1103
# -- exclude results or (cluster)kinds per source
1104
# excludes:
1105
# results:
1106
# - warn
1107
# - error
1108
1109
## -- Default Cluster name
1110
name: Default
1111
# -- Connected Policy Reporter APIs
1112
clusters: []
1113
# - name: default
1114
# host: http://policy-reporter:8080
1115
# secretRef: ""
1116
# skipTLS: false
1117
# certificate: ""
1118
# plugins:
1119
# - name: kyverno
1120
# host: http://policy-reporter-kyverno-plugin:8080
1121
1122
# -- Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument
1123
imagePullSecrets: []
1124
# regcred:
1125
# registry: foo.example.com
1126
# username: foobar
1127
# password: secret
1128
1129
serviceAccount:
1130
# -- Create ServiceAccount
1131
create: true
1132
# -- Enable ServiceAccount automount
1133
automount: true
1134
# -- Annotations for the ServiceAccount
1135
annotations: {}
1136
# -- The ServiceAccount name
1137
name: ""
1138
# -- Add sidecar containers to the UI deployment
1139
# sidecarContainers:
1140
# oauth-proxy:
1141
# image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
1142
# args:
1143
# - --upstream=http://127.0.0.1:8080
1144
# - --http-address=0.0.0.0:8081
1145
# - ...
1146
# ports:
1147
# - containerPort: 8081
1148
# name: oauth-proxy
1149
# protocol: TCP
1150
# resources: {}
1151
sidecarContainers: {}
1152
# -- Additional annotations to add to each pod
1153
podAnnotations: {}
1154
# -- Additional labels to add to each pod
1155
podLabels: {}
1156
# -- Custom selector labels, overwrites the default set
1157
selectorLabels: {}
1158
# -- Deployment update strategy.
1159
# Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
1160
updateStrategy: {}
1161
# rollingUpdate:
1162
# maxSurge: 1
1163
# maxUnavailable: 40%
1164
# type: RollingUpdate
1165
1166
# -- The number of revisions to keep
1167
revisionHistoryLimit: 10
1168
# -- Security context for the pod
1169
podSecurityContext:
1170
runAsUser: 1234
1171
runAsGroup: 1234
1172
# -- Allow additional env variables to be added
1173
envVars: []
1174
# -- Allow custom configuration of the /tmp volume
1175
tmpVolume: {}
1176
rbac:
1177
# -- Create RBAC resources
1178
enabled: true
1179
securityContext:
1180
runAsUser: 1234
1181
runAsNonRoot: true
1182
privileged: false
1183
allowPrivilegeEscalation: false
1184
readOnlyRootFilesystem: true
1185
capabilities:
1186
drop:
1187
- ALL
1188
seccompProfile:
1189
type: RuntimeDefault
1190
# -- Deployment livenessProbe for policy-reporter-ui
1191
livenessProbe:
1192
httpGet:
1193
path: /healthz
1194
port: http
1195
# -- Deployment readinessProbe for policy-reporter-ui
1196
readinessProbe:
1197
httpGet:
1198
path: /healthz
1199
port: http
1200
service:
1201
# -- Service type.
1202
type: ClusterIP
1203
# -- Service port.
1204
port: 8080
1205
# -- Service annotations.
1206
annotations: {}
1207
# -- Service labels.
1208
labels: {}
1209
# -- Additional service ports for e.g. Sidecars # - name: authenticated
1210
# additionalPorts:
1211
# - name: authenticated
1212
# port: 8081
1213
# targetPort: 8081
1214
additionalPorts: []
1215
ingress:
1216
# -- Create ingress resource.
1217
enabled: false
1218
# -- Redirect ingress to an additional defined port on the service
1219
port: null
1220
# -- Ingress class name.
1221
className: ""
1222
# -- Ingress labels.
1223
labels: {}
1224
# -- Ingress annotations.
1225
annotations: {}
1226
# kubernetes.io/ingress.class: nginx
1227
# kubernetes.io/tls-acme: "true"
1228
# -- List of ingress host configurations.
1229
hosts: []
1230
# - host: chart-example.local
1231
# paths:
1232
# - path: /
1233
# pathType: ImplementationSpecific
1234
# -- List of ingress TLS configurations.
1235
tls: []
1236
# - secretName: chart-example-tls
1237
# hosts:
1238
# - chart-example.local
1239
httproute:
1240
# -- Enable HTTPRoute resource (Gateway API alternative to Ingress)
1241
# Requires Gateway API CRDs (v1) installed in cluster
1242
# https://gateway-api.sigs.k8s.io/
1243
enabled: false
1244
# -- Additional HTTPRoute labels
1245
labels: {}
1246
# -- Additional HTTPRoute annotations
1247
annotations: {}
1248
# -- Gateway API parentRefs (list of Gateway references)
1249
# Must reference an existing Gateway resource
1250
parentRefs: []
1251
# - name: example-gateway
1252
# namespace: gateway-system
1253
# sectionName: https
1254
# -- List of hostnames for HTTPRoute
1255
hostnames: []
1256
# - policy-reporter-ui.example.com
1257
# -- HTTPRoute rules configuration
1258
# Allows advanced routing with matches and filters
1259
rules:
1260
- matches:
1261
- path:
1262
type: PathPrefix
1263
value: /
1264
# Optional filters:
1265
# filters:
1266
# - type: RequestHeaderModifier
1267
# requestHeaderModifier:
1268
# add:
1269
# - name: X-Custom-Header
1270
# value: value
1271
# Optional timeouts configuration:
1272
# timeouts:
1273
# request: 30s
1274
# backendRequest: 30s
1275
networkPolicy:
1276
# -- When true, use a NetworkPolicy to allow ingress to the webhook
1277
# This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.
1278
enabled: false
1279
# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.
1280
# Enables Kubernetes API Server by default
1281
egress:
1282
- ports:
1283
- protocol: TCP
1284
port: 6443
1285
# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.
1286
ingress: []
1287
# -- Resource constraints
1288
resources: {}
1289
# limits:
1290
# cpu: 100m
1291
# memory: 128Mi
1292
# requests:
1293
# cpu: 100m
1294
# memory: 128Mi
1295
1296
# enabled if replicaCount > 1
1297
podDisruptionBudget:
1298
# -- Configures the minimum available pods for kyvernoPlugin disruptions.
1299
# Cannot be used if `maxUnavailable` is set.
1300
minAvailable: 1
1301
# -- Configures the maximum unavailable pods for kyvernoPlugin disruptions.
1302
# Cannot be used if `minAvailable` is set.
1303
maxUnavailable:
1304
# -- Node labels for pod assignment
1305
nodeSelector: {}
1306
# -- List of node taints to tolerate
1307
tolerations: []
1308
# -- Affinity constraints.
1309
affinity: {}
1310
# -- Pod Topology Spread Constraints for the policy-reporter-ui.
1311
topologySpreadConstraints: {}
1312
extraVolumes:
1313
# -- Deployment volumeMounts
1314
volumeMounts: []
1315
# -- Deployment values
1316
volumes: []
1317
# -- Extra configuration options appended to UI settings
1318
extraConfig: {}
1319
plugin:
1320
kyverno:
1321
# -- (bool) Enable Kyverno Plugin
1322
enabled: false
1323
image:
1324
# -- (string) Image registry
1325
registry: cgr.dev
1326
# -- (string) Image repository
1327
repository: scratch-images/test-tmp/kyverno-policy-reporter-plugin-kyverno-fips
1328
# -- (string) Image PullPolicy
1329
pullPolicy: IfNotPresent
1330
# -- (string) Image tag
1331
tag: 0.7.1-r0@sha256:9d290b4ff84a487045af675ffe12758eed5601916dcb9f93f4b90151dd68e5cd
1332
# -- Deployment replica count
1333
replicaCount: 1
1334
# -- Deployment priorityClassName
1335
priorityClassName: ""
1336
logging:
1337
# -- Enables external API request logging
1338
api: false
1339
# -- Enables Server access logging
1340
server: false
1341
# -- log encoding
1342
# possible encodings are console and json
1343
encoding: console
1344
# -- log level
1345
# default info
1346
logLevel: 0
1347
server:
1348
# -- Application port
1349
port: 8080
1350
blockReports:
1351
# -- Enables he BlockReport feature
1352
enabled: false
1353
# -- Watches for Kyverno Events in the configured namespace
1354
# leave blank to watch in all namespaces
1355
eventNamespace: default
1356
# -- Used value for the source field in the created (Cluster)PolicyReports
1357
source: Kyverno Event
1358
results:
1359
# -- Max items per PolicyReport resource
1360
maxPerReport: 200
1361
# -- Keep only the latest of duplicated events
1362
keepOnlyLatest: false
1363
policyReport:
1364
# -- Labels for all created (Cluster)PolicyReports
1365
labels: []
1366
# -- Annotations for all created (Cluster)PolicyReports
1367
annotations: []
1368
# -- Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument
1369
imagePullSecrets: []
1370
# regcred:
1371
# registry: foo.example.com
1372
# username: foobar
1373
# password: secret
1374
1375
serviceAccount:
1376
# -- Create ServiceAccount
1377
create: true
1378
# -- Enable ServiceAccount automount
1379
automount: true
1380
# -- Annotations for the ServiceAccount
1381
annotations: {}
1382
# -- The ServiceAccount name
1383
name: ""
1384
# -- Additional annotations to add to each pod
1385
podAnnotations: {}
1386
# -- Additional labels to add to each pod
1387
podLabels: {}
1388
# -- Custom selector labels, overwrites the default set
1389
selectorLabels: {}
1390
# -- Deployment update strategy.
1391
# Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
1392
updateStrategy: {}
1393
# rollingUpdate:
1394
# maxSurge: 1
1395
# maxUnavailable: 40%
1396
# type: RollingUpdate
1397
1398
# -- The number of revisions to keep
1399
revisionHistoryLimit: 10
1400
# -- Security context for the pod
1401
podSecurityContext:
1402
runAsUser: 1234
1403
runAsGroup: 1234
1404
# -- Allow additional env variables to be added
1405
envVars: []
1406
rbac:
1407
# -- Create RBAC resources
1408
enabled: true
1409
securityContext:
1410
runAsUser: 1234
1411
runAsNonRoot: true
1412
privileged: false
1413
allowPrivilegeEscalation: false
1414
readOnlyRootFilesystem: true
1415
capabilities:
1416
drop:
1417
- ALL
1418
seccompProfile:
1419
type: RuntimeDefault
1420
service:
1421
# -- Service type.
1422
type: ClusterIP
1423
# -- Service port.
1424
port: 8080
1425
# -- Service annotations.
1426
annotations: {}
1427
# -- Service labels.
1428
labels: {}
1429
ingress:
1430
# -- Create ingress resource.
1431
enabled: false
1432
# -- Ingress class name.
1433
className: ""
1434
# -- Ingress labels.
1435
labels: {}
1436
# -- Ingress annotations.
1437
annotations: {}
1438
# kubernetes.io/ingress.class: nginx
1439
# kubernetes.io/tls-acme: "true"
1440
# -- List of ingress host configurations.
1441
hosts: []
1442
# - host: chart-example.local
1443
# paths:
1444
# - path: /
1445
# pathType: ImplementationSpecific
1446
# -- List of ingress TLS configurations.
1447
tls: []
1448
# - secretName: chart-example-tls
1449
# hosts:
1450
# - chart-example.local
1451
networkPolicy:
1452
# -- When true, use a NetworkPolicy to allow ingress to the webhook
1453
# This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.
1454
enabled: false
1455
# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.
1456
# Enables Kubernetes API Server by default
1457
egress:
1458
- ports:
1459
- protocol: TCP
1460
port: 6443
1461
# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.
1462
ingress: []
1463
httproute:
1464
# -- Enable HTTPRoute resource (Gateway API alternative to Ingress)
1465
# Requires Gateway API CRDs (v1) installed in cluster
1466
# https://gateway-api.sigs.k8s.io/
1467
enabled: false
1468
# -- Additional HTTPRoute labels
1469
labels: {}
1470
# -- Additional HTTPRoute annotations
1471
annotations: {}
1472
# -- Gateway API parentRefs (list of Gateway references)
1473
# Must reference an existing Gateway resource
1474
parentRefs: []
1475
# - name: example-gateway
1476
# namespace: gateway-system
1477
# sectionName: https
1478
# -- List of hostnames for HTTPRoute
1479
hostnames: []
1480
# - policy-reporter-kyverno-plugin.example.com
1481
# -- HTTPRoute rules configuration
1482
# Allows advanced routing with matches and filters
1483
rules:
1484
- matches:
1485
- path:
1486
type: PathPrefix
1487
value: /
1488
# Optional filters:
1489
# filters:
1490
# - type: RequestHeaderModifier
1491
# requestHeaderModifier:
1492
# add:
1493
# - name: X-Custom-Header
1494
# value: value
1495
# Optional timeouts configuration:
1496
# timeouts:
1497
# request: 30s
1498
# backendRequest: 30s
1499
# -- Resource constraints
1500
resources: {}
1501
# limits:
1502
# cpu: 100m
1503
# memory: 128Mi
1504
# requests:
1505
# cpu: 100m
1506
# memory: 128Mi
1507
1508
# required for HA mode
1509
# if "blockReports" is disabled, leaderElection is also disabled automatically
1510
# will be enabled when replicaCount > 1
1511
leaderElection:
1512
# -- Lock Name
1513
lockName: kyverno-plugin
1514
# -- Released lock when the run context is cancelled.
1515
releaseOnCancel: true
1516
# -- LeaseDuration is the duration that non-leader candidates will wait to force acquire leadership.
1517
leaseDuration: 15
1518
# -- RenewDeadline is the duration that the acting master will retry refreshing leadership before giving up.
1519
renewDeadline: 10
1520
# -- RetryPeriod is the duration the LeaderElector clients should wait between tries of actions.
1521
retryPeriod: 2
1522
# enabled if replicaCount > 1
1523
podDisruptionBudget:
1524
# -- Configures the minimum available pods for kyvernoPlugin disruptions.
1525
# Cannot be used if `maxUnavailable` is set.
1526
minAvailable: 1
1527
# -- Configures the maximum unavailable pods for kyvernoPlugin disruptions.
1528
# Cannot be used if `minAvailable` is set.
1529
maxUnavailable:
1530
# -- Node labels for pod assignment
1531
nodeSelector: {}
1532
# -- List of node taints to tolerate
1533
tolerations: []
1534
# -- Affinity constraints.
1535
affinity: {}
1536
# -- Pod Topology Spread Constraints for the kyverno plugin.
1537
topologySpreadConstraints: {}
1538
extraVolumes:
1539
# -- Deployment volumeMounts
1540
volumeMounts: []
1541
# -- Deployment values
1542
volumes: []
1543
# -- Extra configuration options appended to kyverno plugin settings
1544
extraConfig: {}
1545
trivy:
1546
# -- (bool) Enable Trivy Operator Plugin
1547
enabled: false
1548
image:
1549
# -- (string) Image registry
1550
registry: cgr.dev
1551
# -- (string) Image repository
1552
repository: scratch-images/test-tmp/kyverno-policy-reporter-plugin-trivy-fips
1553
# -- (string) Image PullPolicy
1554
pullPolicy: IfNotPresent
1555
# -- (string) Image tag
1556
# Defaults to `Chart.AppVersion` if omitted
1557
tag: 0.5.1-r0@sha256:e46223a73eee6e5d33a3c73b72a4cfcdc6fb636ee963575043aa4eb34cef6223
1558
cli:
1559
image:
1560
# -- (string) Image registry
1561
registry: cgr.dev
1562
# -- (string) Image repository
1563
repository: scratch-images/test-tmp/trivy-fips
1564
# -- (string) Image PullPolicy
1565
pullPolicy: IfNotPresent
1566
# -- (string) Image tag
1567
# Defaults to `Chart.AppVersion` if omitted
1568
tag: 0.74.0-r4@sha256:9500b1ce4c1f54981e3775110ca158dd14aa7f1ee747be35f874c1dbeccece64
1569
# -- Additional container args.
1570
extraArgs: {}
1571
cveawg:
1572
# -- (bool) disable external CVEAWG API calls.
1573
disable: false
1574
github:
1575
# -- (bool) disable GitHub API calls.
1576
disable: false
1577
# -- (string) optional github token for authenticated GitHub API calls.
1578
token: ""
1579
# -- If set the volume for dbVolume is freely configurable below "- name: dbVolume". If no value is set an emptyDir is used.
1580
dbVolume: {}
1581
# emptyDir:
1582
# sizeLimit: 10Mi
1583
1584
# -- If set the volume for tmpVolume is freely configurable below "- name: tmpVolume". If no value is set an emptyDir is used.
1585
tmpVolume: {}
1586
# emptyDir:
1587
# sizeLimit: 10Mi
1588
1589
# -- Deployment replica count
1590
replicaCount: 1
1591
# -- Deployment priorityClassName
1592
priorityClassName: ""
1593
logging:
1594
# -- Enables external API request logging
1595
api: false
1596
# -- Enables Server access logging
1597
server: false
1598
# -- log encoding
1599
# possible encodings are console and json
1600
encoding: console
1601
# -- log level
1602
# default info
1603
logLevel: 0
1604
server:
1605
# -- Application port
1606
port: 8080
1607
policyReporter:
1608
# -- Skip TLS Verification
1609
skipTLS: false
1610
# -- TLS Certificate file path
1611
certificate: ""
1612
# -- Secret to read the API configuration from
1613
# supports `host`, `certificate`, `skipTLS`, `username`, `password` key
1614
secretRef: ""
1615
# -- Image pull secrets for image verification policies, this will define the `--imagePullSecrets` argument
1616
imagePullSecrets: []
1617
# regcred:
1618
# registry: foo.example.com
1619
# username: foobar
1620
# password: secret
1621
1622
serviceAccount:
1623
# -- Create ServiceAccount
1624
create: true
1625
# -- Enable ServiceAccount automount
1626
automount: true
1627
# -- Annotations for the ServiceAccount
1628
annotations: {}
1629
# -- The ServiceAccount name
1630
name: ""
1631
# -- Additional annotations to add to each pod
1632
podAnnotations: {}
1633
# -- Additional labels to add to each pod
1634
podLabels: {}
1635
# -- Custom selector labels, overwrites the default set
1636
selectorLabels: {}
1637
# -- Deployment update strategy.
1638
# Ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
1639
updateStrategy: {}
1640
# rollingUpdate:
1641
# maxSurge: 1
1642
# maxUnavailable: 40%
1643
# type: RollingUpdate
1644
1645
# -- The number of revisions to keep
1646
revisionHistoryLimit: 10
1647
# -- Security context for the pod
1648
podSecurityContext:
1649
runAsUser: 1234
1650
runAsGroup: 1234
1651
# -- Deployment livenessProbe for policy-reporter-trivy-plugin
1652
livenessProbe:
1653
timeoutSeconds: 3
1654
httpGet:
1655
path: /vulnr/v1/policies
1656
port: http
1657
# -- Deployment readinessProbe for policy-reporter-trivy-plugin
1658
readinessProbe:
1659
timeoutSeconds: 3
1660
httpGet:
1661
path: /vulnr/v1/policies
1662
port: http
1663
# -- Allow additional env variables to be added
1664
envVars: []
1665
rbac:
1666
# -- Create RBAC resources
1667
enabled: true
1668
securityContext:
1669
runAsUser: 1234
1670
runAsNonRoot: true
1671
privileged: false
1672
allowPrivilegeEscalation: false
1673
readOnlyRootFilesystem: true
1674
capabilities:
1675
drop:
1676
- ALL
1677
seccompProfile:
1678
type: RuntimeDefault
1679
service:
1680
# -- Service type.
1681
type: ClusterIP
1682
# -- Service port.
1683
port: 8080
1684
# -- Service annotations.
1685
annotations: {}
1686
# -- Service labels.
1687
labels: {}
1688
ingress:
1689
# -- Create ingress resource.
1690
enabled: false
1691
# -- Ingress class name.
1692
className: ""
1693
# -- Ingress labels.
1694
labels: {}
1695
# -- Ingress annotations.
1696
annotations: {}
1697
# kubernetes.io/ingress.class: nginx
1698
# kubernetes.io/tls-acme: "true"
1699
# -- List of ingress host configurations.
1700
hosts: []
1701
# - host: chart-example.local
1702
# paths:
1703
# - path: /
1704
# pathType: ImplementationSpecific
1705
# -- List of ingress TLS configurations.
1706
tls: []
1707
# - secretName: chart-example-tls
1708
# hosts:
1709
# - chart-example.local
1710
networkPolicy:
1711
# -- When true, use a NetworkPolicy to allow ingress to the webhook
1712
# This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.
1713
enabled: false
1714
# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.
1715
# Enables Kubernetes API Server by default
1716
egress:
1717
- ports:
1718
- protocol: TCP
1719
port: 6443
1720
# -- A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.
1721
ingress: []
1722
# -- Resource constraints
1723
resources: {}
1724
# limits:
1725
# cpu: 100m
1726
# memory: 128Mi
1727
# requests:
1728
# cpu: 100m
1729
# memory: 128Mi
1730
1731
# enabled if replicaCount > 1
1732
podDisruptionBudget:
1733
# -- Configures the minimum available pods for kyvernoPlugin disruptions.
1734
# Cannot be used if `maxUnavailable` is set.
1735
minAvailable: 1
1736
# -- Configures the maximum unavailable pods for kyvernoPlugin disruptions.
1737
# Cannot be used if `minAvailable` is set.
1738
maxUnavailable:
1739
# -- Node labels for pod assignment
1740
nodeSelector: {}
1741
# -- List of node taints to tolerate
1742
tolerations: []
1743
# -- Affinity constraints.
1744
affinity: {}
1745
# -- Pod Topology Spread Constraints for the trivy plugin.
1746
topologySpreadConstraints: {}
1747
extraVolumes:
1748
# -- Deployment volumeMounts
1749
volumeMounts: []
1750
# -- Deployment values
1751
volumes: []
1752
# -- Extra configuration options appended to trivy plugin settings
1753
extraConfig: {}
1754
monitoring:
1755
# -- Enables the Prometheus Operator integration
1756
enabled: false
1757
# -- Key/value pairs that are attached to all resources.
1758
annotations: {}
1759
serviceMonitor:
1760
enabled: true
1761
# -- HonorLabels chooses the metrics labels on collisions with target labels
1762
honorLabels: false
1763
# -- Allow to override the namespace for serviceMonitor
1764
namespace:
1765
# -- Labels to match the serviceMonitorSelector of the Prometheus Resource
1766
labels: {}
1767
# -- ServiceMonitor Relabelings
1768
# https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig
1769
relabelings: []
1770
# -- See serviceMonitor.relabelings
1771
metricRelabelings: []
1772
# -- (optional) NamespaceSelector
1773
namespaceSelector: {}
1774
# -- (optional) ScrapeTimeout
1775
scrapeTimeout:
1776
# -- (optional) Scrape interval
1777
interval:
1778
# -- Is TLS required for endpoint
1779
secure: false
1780
# -- TLS Configuration for endpoint
1781
tlsConfig: {}
1782
grafana:
1783
# -- Naamespace for configMap of grafana dashboards
1784
namespace:
1785
dashboards:
1786
# -- Enable the deployment of grafana dashboards
1787
enabled: true
1788
# -- Label to find dashboards using the k8s sidecar
1789
label: grafana_dashboard
1790
# -- Label value to find dashboards using the k8s sidecar
1791
value: "1"
1792
# -- List of custom label filter
1793
# Used to add filter for report label based metric labels defined in custom mode
1794
labelFilter: []
1795
multicluster:
1796
# -- Enable cluster filter in all dashboards
1797
enabled: false
1798
# -- Metric Label which is used to filter clusters
1799
label: cluster
1800
enable:
1801
# -- Enable the Overview Dashboard
1802
overview: true
1803
# -- Enable the PolicyReport Dashboard
1804
policyReportDetails: true
1805
# -- Enable the ClusterPolicyReport Dashboard
1806
clusterPolicyReportDetails: true
1807
folder:
1808
# -- Annotation to enable folder storage using the k8s sidecar
1809
annotation: grafana_folder
1810
# -- Grafana folder in which to store the dashboards
1811
name: Policy Reporter
1812
datasource:
1813
# -- Grafana Datasource Label
1814
label: Prometheus
1815
# -- Grafana Datasource PluginId
1816
pluginId: prometheus
1817
# -- Grafana Datasource PluginName
1818
pluginName: Prometheus
1819
grafanaDashboard:
1820
# -- Create GrafanaDashboard custom resource referencing to the configMap.
1821
# according to https://grafana-operator.github.io/grafana-operator/docs/examples/dashboard_from_configmap/readme/
1822
enabled: false
1823
# -- Dashboard folder
1824
folder: kyverno
1825
# -- Allow cross Namespace import
1826
allowCrossNamespaceImport: true
1827
# -- Label match selector
1828
matchLabels:
1829
dashboards: "grafana"
1830
# Customize the Grafana PolicyReport Dashboard
1831
policyReportDetails:
1832
firstStatusRow:
1833
height: 8
1834
secondStatusRow:
1835
enabled: true
1836
height: 2
1837
statusTimeline:
1838
enabled: true
1839
height: 8
1840
passTable:
1841
enabled: true
1842
height: 8
1843
failTable:
1844
enabled: true
1845
height: 8
1846
warningTable:
1847
enabled: true
1848
height: 4
1849
errorTable:
1850
enabled: true
1851
height: 4
1852
# Customize the Grafana ClusterPolicyReport Dashboard
1853
clusterPolicyReportDetails:
1854
statusRow:
1855
height: 6
1856
statusTimeline:
1857
enabled: true
1858
height: 8
1859
passTable:
1860
enabled: true
1861
height: 8
1862
failTable:
1863
enabled: true
1864
height: 8
1865
warningTable:
1866
enabled: true
1867
height: 4
1868
errorTable:
1869
enabled: true
1870
height: 4
1871
# Customize the Grafana Overview Dashboard
1872
policyReportOverview:
1873
failingSummaryRow:
1874
height: 8
1875
failingTimeline:
1876
height: 10
1877
failingPolicyRuleTable:
1878
height: 10
1879
failingClusterPolicyRuleTable:
1880
height: 10
1881
# -- list of extra manifests
1882
extraManifests: []
1883
# -- Extra configuration options appended to core policy reporter
1884
extraConfig: {}
1885
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.