policy-reporter

Policy Reporter

Chainguard's redistribution of the Policy Reporter Helm chart, pre-configured with hardened Chainguard Images.

Policy Reporter watches for PolicyReport and ClusterPolicyReport resources and forwards their results to targets such as Loki, Elasticsearch, Slack, Discord, Teams, S3, and more. An optional UI, a Kyverno plugin, and a Trivy plugin extend the core service with dashboards and source-specific views.

Prerequisites

Authentication is required to access this chart and its images. First, authenticate with Chainguard and configure your environment:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create an image pull secret for the cluster:

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace policy-reporter

Installation

The upstream chart configures imagePullSecrets per component rather than globally. Set it for every component you enable:

helm install policy-reporter oci://cgr.dev/ORGANIZATION/charts/policy-reporter \
  --namespace policy-reporter \
  --create-namespace \
  --set imagePullSecrets[0].name=cgr-pull-secret \
  --set ui.enabled=true \
  --set ui.imagePullSecrets[0].name=cgr-pull-secret \
  --set plugin.kyverno.enabled=true \
  --set plugin.kyverno.imagePullSecrets[0].name=cgr-pull-secret

Enable the Trivy plugin the same way when you need it:

--set plugin.trivy.enabled=true \
--set plugin.trivy.imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream Policy Reporter Helm chart. All upstream configuration options and documentation apply.

For full documentation, see: https://kyverno.github.io/policy-reporter/core/