Community
addon-kyverno
By upboundLast changed 5 months ago
Availability
Community
Standard
Enterprise
Business Critical
Security & Maintenance
Backporting
Source Code
Apache-2.0
Notice something off about this package? Help us keep the marketplace safe and trustworthy by reporting inappropriate content or behavior.
Report this packageOverview
Kyverno is a cloud native policy engine.
| admissionController.antiAffinity.enabled | true |
| admissionController.apiPriorityAndFairness | |
| admissionController.autoscaling.enabled | |
| admissionController.autoscaling.maxReplicas | 10 |
| admissionController.autoscaling.minReplicas | 1 |
| admissionController.autoscaling.targetCPUUtilizationPercentage | 80 |
| admissionController.caCertificates.data | |
| admissionController.certManager.algorithm | RSA |
| admissionController.certManager.ca.duration | 87600h |
| admissionController.certManager.ca.renewBefore | 720h |
| admissionController.certManager.createSelfSignedIssuer | true |
| admissionController.certManager.enabled | |
| admissionController.certManager.issuerRef.group | cert-manager.io |
| admissionController.certManager.issuerRef.kind | ClusterIssuer |
| admissionController.certManager.issuerRef.name | |
| admissionController.certManager.size | 2048 |
| admissionController.certManager.tls.duration | 8760h |
| admissionController.certManager.tls.renewBefore | 720h |
| admissionController.container.extraEnvVars | [] |
| admissionController.container.image.defaultRegistry | reg.kyverno.io |
| admissionController.container.image.pullPolicy | IfNotPresent |
| admissionController.container.image.registry | |
| admissionController.container.image.repository | kyverno/kyverno |
| admissionController.container.image.tag | |
| admissionController.container.resources.limits.memory | 384Mi |
| admissionController.container.resources.requests.cpu | 100m |
| admissionController.container.resources.requests.memory | 128Mi |
| admissionController.container.securityContext.allowPrivilegeEscalation | |
| admissionController.container.securityContext.capabilities.drop | ["ALL"] |
| admissionController.container.securityContext.privileged | |
| admissionController.container.securityContext.readOnlyRootFilesystem | true |
| admissionController.container.securityContext.runAsNonRoot | true |
| admissionController.container.securityContext.seccompProfile.type | RuntimeDefault |
| admissionController.crdWatcher | |
| admissionController.createSelfSignedCert | |
| admissionController.dnsPolicy | ClusterFirst |
| admissionController.extraContainers | [] |
| admissionController.extraInitContainers | [] |
| admissionController.featuresOverride.admissionReports.backPressureThreshold | 1000 |
| admissionController.hostNetwork | |
| admissionController.imagePullSecrets | [] |
| admissionController.initContainer.extraEnvVars | [] |
| admissionController.initContainer.image.defaultRegistry | reg.kyverno.io |
| admissionController.initContainer.image.pullPolicy | |
| admissionController.initContainer.image.registry | |
| admissionController.initContainer.image.repository | kyverno/kyvernopre |
| admissionController.initContainer.image.tag | |
| admissionController.initContainer.resources.limits.cpu | 100m |
| admissionController.initContainer.resources.limits.memory | 256Mi |
| admissionController.initContainer.resources.requests.cpu | 10m |
| admissionController.initContainer.resources.requests.memory | 64Mi |
| admissionController.initContainer.securityContext.allowPrivilegeEscalation | |
| admissionController.initContainer.securityContext.capabilities.drop | ["ALL"] |
| admissionController.initContainer.securityContext.privileged | |
| admissionController.initContainer.securityContext.readOnlyRootFilesystem | true |
| admissionController.initContainer.securityContext.runAsNonRoot | true |
| admissionController.initContainer.securityContext.seccompProfile.type | RuntimeDefault |
| admissionController.livenessProbe.failureThreshold | 2 |
| admissionController.livenessProbe.httpGet.path | /health/liveness |
| admissionController.livenessProbe.httpGet.port | 9443 |
| admissionController.livenessProbe.httpGet.scheme | HTTPS |
| admissionController.livenessProbe.initialDelaySeconds | 15 |
| admissionController.livenessProbe.periodSeconds | 30 |
| admissionController.livenessProbe.successThreshold | 1 |
| admissionController.livenessProbe.timeoutSeconds | 5 |
| admissionController.metering.collector | |
| admissionController.metering.config | prometheus |
| admissionController.metering.creds | |
| admissionController.metering.disabled | |
| admissionController.metering.port | 8000 |
| admissionController.metricsService.create | true |
| admissionController.metricsService.nodePort | |
| admissionController.metricsService.port | 8000 |
| admissionController.metricsService.trafficDistribution | |
| admissionController.metricsService.type | ClusterIP |
| admissionController.networkPolicy.enabled | |
| admissionController.networkPolicy.ingressFrom | [] |
| admissionController.nodeSelector.kubernetes.io/os | linux |
| admissionController.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution | [{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/component","operator":"In","values":["admission-controller"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":1}] |
| admissionController.podDisruptionBudget.enabled | |
| admissionController.podDisruptionBudget.maxUnavailable | |
| admissionController.podDisruptionBudget.minAvailable | 1 |
| admissionController.podDisruptionBudget.unhealthyPodEvictionPolicy | |
| admissionController.priorityClassName | |
| admissionController.priorityLevelConfigurationSpec.limited.limitResponse.queuing.queueLengthLimit | 50 |
| admissionController.priorityLevelConfigurationSpec.limited.limitResponse.type | Queue |
| admissionController.priorityLevelConfigurationSpec.limited.nominalConcurrencyShares | 10 |
| admissionController.priorityLevelConfigurationSpec.type | Limited |
| admissionController.profiling.enabled | |
| admissionController.profiling.nodePort | |
| admissionController.profiling.port | 6060 |
| admissionController.profiling.serviceType | ClusterIP |
| admissionController.rbac.clusterRole.extraResources | [] |
| admissionController.rbac.coreClusterRole.extraResources | [] |
| admissionController.rbac.create | true |
| admissionController.rbac.createViewRoleBinding | true |
| admissionController.rbac.serviceAccount.automountServiceAccountToken | true |
| admissionController.rbac.serviceAccount.name | |
| admissionController.rbac.viewRoleName | view |
| admissionController.readinessProbe.failureThreshold | 6 |
| admissionController.readinessProbe.httpGet.path | /health/readiness |
| admissionController.readinessProbe.httpGet.port | 9443 |
| admissionController.readinessProbe.httpGet.scheme | HTTPS |
| admissionController.readinessProbe.initialDelaySeconds | 5 |
| admissionController.readinessProbe.periodSeconds | 10 |
| admissionController.readinessProbe.successThreshold | 1 |
| admissionController.readinessProbe.timeoutSeconds | 5 |
| admissionController.replicas | |
| admissionController.resyncPeriod | 15m |
| admissionController.revisionHistoryLimit | 10 |
| admissionController.service.nodePort | |
| admissionController.service.port | 443 |
| admissionController.service.trafficDistribution | |
| admissionController.service.type | ClusterIP |
| admissionController.serviceMonitor.enabled | |
| admissionController.serviceMonitor.interval | 30s |
| admissionController.serviceMonitor.metricRelabelings | [] |
| admissionController.serviceMonitor.namespace | |
| admissionController.serviceMonitor.relabelings | [] |
| admissionController.serviceMonitor.scrapeTimeout | 25s |
| admissionController.serviceMonitor.secure | |
| admissionController.startupProbe.failureThreshold | 20 |
| admissionController.startupProbe.httpGet.path | /health/liveness |
| admissionController.startupProbe.httpGet.port | 9443 |
| admissionController.startupProbe.httpGet.scheme | HTTPS |
| admissionController.startupProbe.initialDelaySeconds | 2 |
| admissionController.startupProbe.periodSeconds | 6 |
| admissionController.tlsKeyAlgorithm | RSA |
| admissionController.tolerations | [] |
| admissionController.topologySpreadConstraints | [] |
| admissionController.tracing.address | |
| admissionController.tracing.creds | |
| admissionController.tracing.enabled | |
| admissionController.tracing.port | |
| admissionController.tufRootMountPath | /.sigstore |
| admissionController.updateStrategy.rollingUpdate.maxSurge | 1 |
| admissionController.updateStrategy.rollingUpdate.maxUnavailable | 40% |
| admissionController.updateStrategy.type | RollingUpdate |
| admissionController.webhookServer.port | 9443 |
| apiVersionOverride.podDisruptionBudget | |
| backgroundController.antiAffinity.enabled | true |
| backgroundController.caCertificates.data | |
| backgroundController.dnsPolicy | ClusterFirst |
| backgroundController.enabled | true |
| backgroundController.extraEnvVars | [] |
| backgroundController.hostNetwork | |
| backgroundController.image.defaultRegistry | reg.kyverno.io |
| backgroundController.image.pullPolicy | IfNotPresent |
| backgroundController.image.registry | |
| backgroundController.image.repository | kyverno/background-controller |
| backgroundController.image.tag | |
| backgroundController.imagePullSecrets | [] |
| backgroundController.metering.collector | |
| backgroundController.metering.config | prometheus |
| backgroundController.metering.creds | |
| backgroundController.metering.disabled | |
| backgroundController.metering.port | 8000 |
| backgroundController.metricsService.create | true |
| backgroundController.metricsService.nodePort | |
| backgroundController.metricsService.port | 8000 |
| backgroundController.metricsService.trafficDistribution | |
| backgroundController.metricsService.type | ClusterIP |
| backgroundController.networkPolicy.enabled | |
| backgroundController.networkPolicy.ingressFrom | [] |
| backgroundController.nodeSelector.kubernetes.io/os | linux |
| backgroundController.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution | [{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/component","operator":"In","values":["background-controller"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":1}] |
| backgroundController.podDisruptionBudget.enabled | |
| backgroundController.podDisruptionBudget.maxUnavailable | |
| backgroundController.podDisruptionBudget.minAvailable | 1 |
| backgroundController.podDisruptionBudget.unhealthyPodEvictionPolicy | |
| backgroundController.priorityClassName | |
| backgroundController.profiling.enabled | |
| backgroundController.profiling.nodePort | |
| backgroundController.profiling.port | 6060 |
| backgroundController.profiling.serviceType | ClusterIP |
| backgroundController.rbac.clusterRole.extraResources | [] |
| backgroundController.rbac.coreClusterRole.extraResources | [{"apiGroups":["networking.k8s.io"],"resources":["ingresses","ingressclasses","networkpolicies"],"verbs":["create","update","patch","delete"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["rolebindings","roles"],"verbs":["create","update","patch","delete"]},{"apiGroups":[""],"resources":["configmaps","resourcequotas","limitranges"],"verbs":["create","update","patch","delete"]},{"apiGroups":["resource.k8s.io"],"resources":["resourceclaims","resourceclaimtemplates"],"verbs":["create","delete","update","patch","deletecollection"]}] |
| backgroundController.rbac.create | true |
| backgroundController.rbac.createViewRoleBinding | true |
| backgroundController.rbac.serviceAccount.automountServiceAccountToken | true |
| backgroundController.rbac.serviceAccount.name | |
| backgroundController.rbac.viewRoleName | view |
| backgroundController.replicas | |
| backgroundController.resources.limits.memory | 128Mi |
| backgroundController.resources.requests.cpu | 100m |
| backgroundController.resources.requests.memory | 64Mi |
| backgroundController.resyncPeriod | 15m |
| backgroundController.revisionHistoryLimit | 10 |
| backgroundController.securityContext.allowPrivilegeEscalation | |
| backgroundController.securityContext.capabilities.drop | ["ALL"] |
| backgroundController.securityContext.privileged | |
| backgroundController.securityContext.readOnlyRootFilesystem | true |
| backgroundController.securityContext.runAsNonRoot | true |
| backgroundController.securityContext.seccompProfile.type | RuntimeDefault |
| backgroundController.server.port | 9443 |
| backgroundController.serviceMonitor.enabled | |
| backgroundController.serviceMonitor.interval | 30s |
| backgroundController.serviceMonitor.metricRelabelings | [] |
| backgroundController.serviceMonitor.namespace | |
| backgroundController.serviceMonitor.relabelings | [] |
| backgroundController.serviceMonitor.scrapeTimeout | 25s |
| backgroundController.serviceMonitor.secure | |
| backgroundController.tolerations | [] |
| backgroundController.topologySpreadConstraints | [] |
| backgroundController.tracing.address | |
| backgroundController.tracing.creds | |
| backgroundController.tracing.enabled | |
| backgroundController.tracing.port | |
| backgroundController.updateStrategy.rollingUpdate.maxSurge | 1 |
| backgroundController.updateStrategy.rollingUpdate.maxUnavailable | 40% |
| backgroundController.updateStrategy.type | RollingUpdate |
| cleanupController.antiAffinity.enabled | true |
| cleanupController.certManager.algorithm | RSA |
| cleanupController.certManager.ca.duration | 87600h |
| cleanupController.certManager.ca.renewBefore | 720h |
| cleanupController.certManager.createSelfSignedIssuer | true |
| cleanupController.certManager.enabled | |
| cleanupController.certManager.issuerRef.group | cert-manager.io |
| cleanupController.certManager.issuerRef.kind | ClusterIssuer |
| cleanupController.certManager.issuerRef.name | |
| cleanupController.certManager.size | 2048 |
| cleanupController.certManager.tls.duration | 8760h |
| cleanupController.certManager.tls.renewBefore | 720h |
| cleanupController.createSelfSignedCert | |
| cleanupController.dnsPolicy | ClusterFirst |
| cleanupController.enabled | true |
| cleanupController.extraEnvVars | [] |
| cleanupController.hostNetwork | |
| cleanupController.image.defaultRegistry | reg.kyverno.io |
| cleanupController.image.pullPolicy | IfNotPresent |
| cleanupController.image.registry | |
| cleanupController.image.repository | kyverno/cleanup-controller |
| cleanupController.image.tag | |
| cleanupController.imagePullSecrets | [] |
| cleanupController.livenessProbe.failureThreshold | 2 |
| cleanupController.livenessProbe.httpGet.path | /health/liveness |
| cleanupController.livenessProbe.httpGet.port | 9443 |
| cleanupController.livenessProbe.httpGet.scheme | HTTPS |
| cleanupController.livenessProbe.initialDelaySeconds | 15 |
| cleanupController.livenessProbe.periodSeconds | 30 |
| cleanupController.livenessProbe.successThreshold | 1 |
| cleanupController.livenessProbe.timeoutSeconds | 5 |
| cleanupController.metering.collector | |
| cleanupController.metering.config | prometheus |
| cleanupController.metering.creds | |
| cleanupController.metering.disabled | |
| cleanupController.metering.port | 8000 |
| cleanupController.metricsService.create | true |
| cleanupController.metricsService.nodePort | |
| cleanupController.metricsService.port | 8000 |
| cleanupController.metricsService.trafficDistribution | |
| cleanupController.metricsService.type | ClusterIP |
| cleanupController.networkPolicy.enabled | |
| cleanupController.networkPolicy.ingressFrom | [] |
| cleanupController.nodeSelector.kubernetes.io/os | linux |
| cleanupController.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution | [{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/component","operator":"In","values":["cleanup-controller"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":1}] |
| cleanupController.podDisruptionBudget.enabled | |
| cleanupController.podDisruptionBudget.maxUnavailable | |
| cleanupController.podDisruptionBudget.minAvailable | 1 |
| cleanupController.podDisruptionBudget.unhealthyPodEvictionPolicy | |
| cleanupController.priorityClassName | |
| cleanupController.profiling.enabled | |
| cleanupController.profiling.nodePort | |
| cleanupController.profiling.port | 6060 |
| cleanupController.profiling.serviceType | ClusterIP |
| cleanupController.rbac.clusterRole.extraResources | [] |
| cleanupController.rbac.create | true |
| cleanupController.rbac.serviceAccount.automountServiceAccountToken | true |
| cleanupController.rbac.serviceAccount.name | |
| cleanupController.readinessProbe.failureThreshold | 6 |
| cleanupController.readinessProbe.httpGet.path | /health/readiness |
| cleanupController.readinessProbe.httpGet.port | 9443 |
| cleanupController.readinessProbe.httpGet.scheme | HTTPS |
| cleanupController.readinessProbe.initialDelaySeconds | 5 |
| cleanupController.readinessProbe.periodSeconds | 10 |
| cleanupController.readinessProbe.successThreshold | 1 |
| cleanupController.readinessProbe.timeoutSeconds | 5 |
| cleanupController.replicas | |
| cleanupController.resources.limits.memory | 128Mi |
| cleanupController.resources.requests.cpu | 100m |
| cleanupController.resources.requests.memory | 64Mi |
| cleanupController.resyncPeriod | 15m |
| cleanupController.revisionHistoryLimit | 10 |
| cleanupController.securityContext.allowPrivilegeEscalation | |
| cleanupController.securityContext.capabilities.drop | ["ALL"] |
| cleanupController.securityContext.privileged | |
| cleanupController.securityContext.readOnlyRootFilesystem | true |
| cleanupController.securityContext.runAsNonRoot | true |
| cleanupController.securityContext.seccompProfile.type | RuntimeDefault |
| cleanupController.server.port | 9443 |
| cleanupController.service.nodePort | |
| cleanupController.service.port | 443 |
| cleanupController.service.trafficDistribution | |
| cleanupController.service.type | ClusterIP |
| cleanupController.serviceMonitor.enabled | |
| cleanupController.serviceMonitor.interval | 30s |
| cleanupController.serviceMonitor.metricRelabelings | [] |
| cleanupController.serviceMonitor.namespace | |
| cleanupController.serviceMonitor.relabelings | [] |
| cleanupController.serviceMonitor.scrapeTimeout | 25s |
| cleanupController.serviceMonitor.secure | |
| cleanupController.startupProbe.failureThreshold | 20 |
| cleanupController.startupProbe.httpGet.path | /health/liveness |
| cleanupController.startupProbe.httpGet.port | 9443 |
| cleanupController.startupProbe.httpGet.scheme | HTTPS |
| cleanupController.startupProbe.initialDelaySeconds | 2 |
| cleanupController.startupProbe.periodSeconds | 6 |
| cleanupController.tlsKeyAlgorithm | RSA |
| cleanupController.tolerations | [] |
| cleanupController.topologySpreadConstraints | [] |
| cleanupController.tracing.address | |
| cleanupController.tracing.creds | |
| cleanupController.tracing.enabled | |
| cleanupController.tracing.port | |
| cleanupController.updateStrategy.rollingUpdate.maxSurge | 1 |
| cleanupController.updateStrategy.rollingUpdate.maxUnavailable | 40% |
| cleanupController.updateStrategy.type | RollingUpdate |
| config.create | true |
| config.defaultRegistry | docker.io |
| config.enableDefaultRegistryMutation | true |
| config.excludeClusterRoles | [] |
| config.excludeGroups | ["system:nodes"] |
| config.excludeKyvernoNamespace | true |
| config.excludeRoles | [] |
| config.excludeUsernames | [] |
| config.generateSuccessEvents | |
| config.matchConditions | [] |
| config.maxContextSize | |
| config.name | |
| config.preserve | true |
| config.resourceFilters | ["[Event,*,*]","[*/*,kube-system,*]","[*/*,kube-public,*]","[*/*,kube-node-lease,*]","[Node,*,*]","[Node/?*,*,*]","[APIService,*,*]","[APIService/?*,*,*]","[TokenReview,*,*]","[SubjectAccessReview,*,*]","[SelfSubjectAccessReview,*,*]","[Binding,*,*]","[Pod/binding,*,*]","[ReplicaSet,*,*]","[ReplicaSet/?*,*,*]","[EphemeralReport,*,*]","[ClusterEphemeralReport,*,*]","[ClusterRole,*,{{ template \"kyverno.admission-controller.roleName\" . }}]","[ClusterRole,*,{{ template \"kyverno.admission-controller.roleName\" . }}:core]","[ClusterRole,*,{{ template \"kyverno.admission-controller.roleName\" . }}:additional]","[ClusterRole,*,{{ template \"kyverno.background-controller.roleName\" . }}]","[ClusterRole,*,{{ template \"kyverno.background-controller.roleName\" . }}:core]","[ClusterRole,*,{{ template \"kyverno.background-controller.roleName\" . }}:additional]","[ClusterRole,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}]","[ClusterRole,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}:core]","[ClusterRole,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}:additional]","[ClusterRole,*,{{ template \"kyverno.reports-controller.roleName\" . }}]","[ClusterRole,*,{{ template \"kyverno.reports-controller.roleName\" . }}:core]","[ClusterRole,*,{{ template \"kyverno.reports-controller.roleName\" . }}:additional]","[ClusterRoleBinding,*,{{ template \"kyverno.admission-controller.roleName\" . }}]","[ClusterRoleBinding,*,{{ template \"kyverno.background-controller.roleName\" . }}]","[ClusterRoleBinding,*,{{ template \"kyverno.cleanup-controller.roleName\" . }}]","[ClusterRoleBinding,*,{{ template \"kyverno.reports-controller.roleName\" . }}]","[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceAccountName\" . }}]","[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceAccountName\" . }}]","[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.serviceAccountName\" . }}]","[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.serviceAccountName\" . }}]","[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.serviceAccountName\" . }}]","[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.serviceAccountName\" . }}]","[ServiceAccount,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.serviceAccountName\" . }}]","[ServiceAccount/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.serviceAccountName\" . }}]","[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.roleName\" . }}]","[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.roleName\" . }}]","[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.roleName\" . }}]","[Role,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.roleName\" . }}]","[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.roleName\" . }}]","[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.roleName\" . }}]","[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.roleName\" . }}]","[RoleBinding,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.roleName\" . }}]","[ConfigMap,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.config.configMapName\" . }}]","[ConfigMap,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.config.metricsConfigMapName\" . }}]","[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]","[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]","[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]","[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]","[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[Deployment,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]","[Deployment/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]","[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}-*]","[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}-*]","[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-*]","[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-*]","[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-*]","[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-*]","[Pod,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-*]","[Pod/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-*]","[Job,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.fullname\" . }}-hook-pre-delete]","[Job/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.fullname\" . }}-hook-pre-delete]","[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]","[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]","[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]","[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]","[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[NetworkPolicy,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]","[NetworkPolicy/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]","[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]","[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.name\" . }}]","[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]","[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}]","[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[PodDisruptionBudget,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]","[PodDisruptionBudget/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}]","[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}]","[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}]","[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}-metrics]","[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}-metrics]","[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-metrics]","[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.background-controller.name\" . }}-metrics]","[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-metrics]","[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}-metrics]","[Service,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-metrics]","[Service/?*,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.reports-controller.name\" . }}-metrics]","[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.admission-controller.name\" . }}]","[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.background-controller.name\" . }}]","[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.cleanup-controller.name\" . }}]","[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template \"kyverno.namespace\" . }}{{ end }},{{ template \"kyverno.reports-controller.name\" . }}]","[Secret,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.admission-controller.serviceName\" . }}.{{ template \"kyverno.namespace\" . }}.svc.*]","[Secret,{{ include \"kyverno.namespace\" . }},{{ template \"kyverno.cleanup-controller.name\" . }}.{{ template \"kyverno.namespace\" . }}.svc.*]"] |
| config.resourceFiltersExclude | [] |
| config.resourceFiltersExcludeNamespaces | [] |
| config.resourceFiltersInclude | [] |
| config.resourceFiltersIncludeNamespaces | [] |
| config.updateRequestThreshold | 1000 |
| config.webhookAnnotations.admissions.enforcer/disabled | true |
| config.webhooks.namespaceSelector.matchExpressions | [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kube-system"]}] |
| crds.groups.kyverno.cleanuppolicies | true |
| crds.groups.kyverno.clustercleanuppolicies | true |
| crds.groups.kyverno.clusterpolicies | true |
| crds.groups.kyverno.globalcontextentries | true |
| crds.groups.kyverno.policies | true |
| crds.groups.kyverno.policyexceptions | true |
| crds.groups.kyverno.updaterequests | true |
| crds.groups.policies.deletingpolicies | true |
| crds.groups.policies.generatingpolicies | true |
| crds.groups.policies.imagevalidatingpolicies | true |
| crds.groups.policies.mutatingpolicies | true |
| crds.groups.policies.namespaceddeletingpolicies | true |
| crds.groups.policies.namespacedimagevalidatingpolicies | true |
| crds.groups.policies.namespacedmutatingpolicies | true |
| crds.groups.policies.namespacedvalidatingpolicies | true |
| crds.groups.policies.policyexceptions | true |
| crds.groups.policies.validatingpolicies | true |
| crds.groups.reports.clusterephemeralreports | true |
| crds.groups.reports.ephemeralreports | true |
| crds.groups.wgpolicyk8s.clusterpolicyreports | true |
| crds.groups.wgpolicyk8s.policyreports | true |
| crds.install | true |
| crds.migration.enabled | true |
| crds.migration.image.defaultRegistry | reg.kyverno.io |
| crds.migration.image.pullPolicy | IfNotPresent |
| crds.migration.image.registry | |
| crds.migration.image.repository | kyverno/kyverno-cli |
| crds.migration.image.tag | |
| crds.migration.imagePullSecrets | [] |
| crds.migration.podResources.limits.cpu | 100m |
| crds.migration.podResources.limits.memory | 256Mi |
| crds.migration.podResources.requests.cpu | 10m |
| crds.migration.podResources.requests.memory | 64Mi |
| crds.migration.resources | ["cleanuppolicies.kyverno.io","clustercleanuppolicies.kyverno.io","clusterpolicies.kyverno.io","globalcontextentries.kyverno.io","policies.kyverno.io","policyexceptions.kyverno.io","updaterequests.kyverno.io","deletingpolicies.policies.kyverno.io","generatingpolicies.policies.kyverno.io","imagevalidatingpolicies.policies.kyverno.io","mutatingpolicies.policies.kyverno.io","namespaceddeletingpolicies.policies.kyverno.io","namespacedgeneratingpolicies.policies.kyverno.io","namespacedimagevalidatingpolicies.policies.kyverno.io","namespacedmutatingpolicies.policies.kyverno.io","namespacedvalidatingpolicies.policies.kyverno.io","policyexceptions.policies.kyverno.io","validatingpolicies.policies.kyverno.io"] |
| crds.migration.securityContext.allowPrivilegeEscalation | |
| crds.migration.securityContext.capabilities.drop | ["ALL"] |
| crds.migration.securityContext.privileged | |
| crds.migration.securityContext.readOnlyRootFilesystem | true |
| crds.migration.securityContext.runAsGroup | 65534 |
| crds.migration.securityContext.runAsNonRoot | true |
| crds.migration.securityContext.runAsUser | 65534 |
| crds.migration.securityContext.seccompProfile.type | RuntimeDefault |
| crds.migration.serviceAccount.automountServiceAccountToken | true |
| crds.migration.tolerations | [] |
| crds.reportsServer.enabled | |
| existingImagePullSecrets | [] |
| features.admissionReports.enabled | true |
| features.aggregateReports.enabled | true |
| features.autoUpdateWebhooks.enabled | true |
| features.backgroundScan.backgroundScanInterval | 1h |
| features.backgroundScan.backgroundScanWorkers | 2 |
| features.backgroundScan.enabled | true |
| features.backgroundScan.skipResourceFilters | true |
| features.configMapCaching.enabled | true |
| features.controllerRuntimeMetrics.bindAddress | :8080 |
| features.deferredLoading.enabled | true |
| features.dumpPatches.enabled | |
| features.dumpPayload.enabled | |
| features.forceFailurePolicyIgnore.enabled | |
| features.generateMutatingAdmissionPolicy.enabled | |
| features.generateValidatingAdmissionPolicy.enabled | true |
| features.globalContext.maxApiCallResponseLength | 2000000 |
| features.logging.format | text |
| features.logging.verbosity | 2 |
| features.mutatingAdmissionPolicyReports.enabled | |
| features.omitEvents.eventTypes | ["PolicyApplied","PolicySkipped"] |
| features.policyExceptions.enabled | |
| features.policyExceptions.namespace | |
| features.policyReports.enabled | true |
| features.protectManagedResources.enabled | |
| features.registryClient.allowInsecure | |
| features.registryClient.credentialHelpers | ["default","google","amazon","azure","github"] |
| features.reporting.generate | true |
| features.reporting.imageVerify | true |
| features.reporting.mutate | true |
| features.reporting.mutateExisting | true |
| features.reporting.validate | true |
| features.ttlController.reconciliationInterval | 1m |
| features.tuf.enabled | |
| features.tuf.mirror | |
| features.tuf.root | |
| features.tuf.rootRaw | |
| features.validatingAdmissionPolicyReports.enabled | true |
| fullnameOverride | |
| global.caCertificates.data | |
| global.crdWatcher | |
| global.extraEnvVars | [] |
| global.image.registry | |
| global.imagePullSecrets | [] |
| global.resyncPeriod | 15m |
| global.templating.debug | |
| global.templating.enabled | |
| global.templating.version | |
| global.tolerations | [] |
| grafana.configMapName | {{ include "kyverno.fullname" . }}-grafana |
| grafana.enabled | |
| grafana.grafanaDashboard.allowCrossNamespaceImport | true |
| grafana.grafanaDashboard.create | |
| grafana.grafanaDashboard.folder | kyverno |
| grafana.grafanaDashboard.matchLabels.dashboards | grafana |
| grafana.labels.grafana_dashboard | 1 |
| grafana.namespace | |
| metricsConfig.bucketBoundaries | [0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10,15,20,25,30] |
| metricsConfig.create | true |
| metricsConfig.metricsExposure.kyverno_admission_requests_total.disabledLabelDimensions | ["resource_namespace"] |
| metricsConfig.metricsExposure.kyverno_admission_review_duration_seconds.disabledLabelDimensions | ["resource_namespace"] |
| metricsConfig.metricsExposure.kyverno_cleanup_controller_deletedobjects_total.disabledLabelDimensions | ["resource_namespace","policy_namespace"] |
| metricsConfig.metricsExposure.kyverno_generating_policy_execution_duration_seconds.disabledLabelDimensions | ["resource_namespace","resource_request_operation"] |
| metricsConfig.metricsExposure.kyverno_image_validating_policy_execution_duration_seconds.disabledLabelDimensions | ["resource_namespace","resource_request_operation"] |
| metricsConfig.metricsExposure.kyverno_mutating_policy_execution_duration_seconds.disabledLabelDimensions | ["resource_namespace","resource_request_operation"] |
| metricsConfig.metricsExposure.kyverno_policy_execution_duration_seconds.disabledLabelDimensions | ["resource_namespace","resource_request_operation"] |
| metricsConfig.metricsExposure.kyverno_policy_results_total.disabledLabelDimensions | ["resource_namespace","policy_namespace"] |
| metricsConfig.metricsExposure.kyverno_policy_rule_info_total.disabledLabelDimensions | ["resource_namespace","policy_namespace"] |
| metricsConfig.metricsExposure.kyverno_validating_policy_execution_duration_seconds.disabledLabelDimensions | ["resource_namespace","resource_request_operation"] |
| metricsConfig.metricsRefreshInterval | |
| metricsConfig.name | |
| metricsConfig.namespaces.exclude | [] |
| metricsConfig.namespaces.include | [] |
| nameOverride | |
| namespaceOverride | |
| openreports.enabled | |
| openreports.installCrds | |
| rbac.roles.aggregate.admin | true |
| rbac.roles.aggregate.view | true |
| reportsController.antiAffinity.enabled | true |
| reportsController.apiPriorityAndFairness | |
| reportsController.caCertificates.data | |
| reportsController.dnsPolicy | ClusterFirst |
| reportsController.enabled | true |
| reportsController.extraEnvVars | [] |
| reportsController.hostNetwork | |
| reportsController.image.defaultRegistry | reg.kyverno.io |
| reportsController.image.pullPolicy | IfNotPresent |
| reportsController.image.registry | |
| reportsController.image.repository | kyverno/reports-controller |
| reportsController.image.tag | |
| reportsController.imagePullSecrets | [] |
| reportsController.metering.collector | |
| reportsController.metering.config | prometheus |
| reportsController.metering.creds | |
| reportsController.metering.disabled | |
| reportsController.metering.port | 8000 |
| reportsController.metricsService.create | true |
| reportsController.metricsService.nodePort | |
| reportsController.metricsService.port | 8000 |
| reportsController.metricsService.trafficDistribution | |
| reportsController.metricsService.type | ClusterIP |
| reportsController.networkPolicy.enabled | |
| reportsController.networkPolicy.ingressFrom | [] |
| reportsController.nodeSelector.kubernetes.io/os | linux |
| reportsController.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution | [{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"app.kubernetes.io/component","operator":"In","values":["reports-controller"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":1}] |
| reportsController.podDisruptionBudget.enabled | |
| reportsController.podDisruptionBudget.maxUnavailable | |
| reportsController.podDisruptionBudget.minAvailable | 1 |
| reportsController.podDisruptionBudget.unhealthyPodEvictionPolicy | |
| reportsController.priorityClassName | |
| reportsController.priorityLevelConfigurationSpec.limited.limitResponse.queuing.queueLengthLimit | 50 |
| reportsController.priorityLevelConfigurationSpec.limited.limitResponse.type | Queue |
| reportsController.priorityLevelConfigurationSpec.limited.nominalConcurrencyShares | 10 |
| reportsController.priorityLevelConfigurationSpec.type | Limited |
| reportsController.profiling.enabled | |
| reportsController.profiling.nodePort | |
| reportsController.profiling.port | 6060 |
| reportsController.profiling.serviceType | ClusterIP |
| reportsController.rbac.clusterRole.extraResources | [] |
| reportsController.rbac.coreClusterRole.extraResources | [] |
| reportsController.rbac.create | true |
| reportsController.rbac.createViewRoleBinding | true |
| reportsController.rbac.serviceAccount.automountServiceAccountToken | true |
| reportsController.rbac.serviceAccount.name | |
| reportsController.rbac.viewRoleName | view |
| reportsController.replicas | |
| reportsController.resources.limits.memory | 128Mi |
| reportsController.resources.requests.cpu | 100m |
| reportsController.resources.requests.memory | 64Mi |
| reportsController.resyncPeriod | 15m |
| reportsController.revisionHistoryLimit | 10 |
| reportsController.sanityChecks | true |
| reportsController.securityContext.allowPrivilegeEscalation | |
| reportsController.securityContext.capabilities.drop | ["ALL"] |
| reportsController.securityContext.privileged | |
| reportsController.securityContext.readOnlyRootFilesystem | true |
| reportsController.securityContext.runAsNonRoot | true |
| reportsController.securityContext.seccompProfile.type | RuntimeDefault |
| reportsController.server.port | 9443 |
| reportsController.serviceMonitor.enabled | |
| reportsController.serviceMonitor.interval | 30s |
| reportsController.serviceMonitor.metricRelabelings | [] |
| reportsController.serviceMonitor.namespace | |
| reportsController.serviceMonitor.relabelings | [] |
| reportsController.serviceMonitor.scrapeTimeout | 25s |
| reportsController.serviceMonitor.secure | |
| reportsController.tolerations | [] |
| reportsController.topologySpreadConstraints | [] |
| reportsController.tracing.address | |
| reportsController.tracing.creds | |
| reportsController.tracing.enabled | |
| reportsController.tracing.port | |
| reportsController.tufRootMountPath | /.sigstore |
| reportsController.updateStrategy.rollingUpdate.maxSurge | 1 |
| reportsController.updateStrategy.rollingUpdate.maxUnavailable | 40% |
| reportsController.updateStrategy.type | RollingUpdate |
| reportsServer.enabled | |
| reportsServer.readinessTimeout | 300 |
| reportsServer.waitForReady | true |
| test.automountServiceAccountToken | true |
| test.image.pullPolicy | |
| test.image.registry | ghcr.io |
| test.image.repository | kyverno/readiness-checker |
| test.image.tag | v0.1.0 |
| test.imagePullSecrets | [] |
| test.resources.limits.cpu | 100m |
| test.resources.limits.memory | 256Mi |
| test.resources.requests.cpu | 10m |
| test.resources.requests.memory | 64Mi |
| test.securityContext.allowPrivilegeEscalation | |
| test.securityContext.capabilities.drop | ["ALL"] |
| test.securityContext.privileged | |
| test.securityContext.readOnlyRootFilesystem | true |
| test.securityContext.runAsGroup | 65534 |
| test.securityContext.runAsNonRoot | true |
| test.securityContext.runAsUser | 65534 |
| test.securityContext.seccompProfile.type | RuntimeDefault |
| test.sleep | 20 |
| test.tolerations | [] |
| upgrade.fromV2 | |
| webhooksCleanup.autoDeleteWebhooks.enabled | |
| webhooksCleanup.enabled | true |
| webhooksCleanup.image.pullPolicy | |
| webhooksCleanup.image.registry | registry.k8s.io |
| webhooksCleanup.image.repository | kubectl |
| webhooksCleanup.image.tag | v1.34.3 |
| webhooksCleanup.imagePullSecrets | [] |
| webhooksCleanup.resources.limits.cpu | 100m |
| webhooksCleanup.resources.limits.memory | 256Mi |
| webhooksCleanup.resources.requests.cpu | 10m |
| webhooksCleanup.resources.requests.memory | 64Mi |
| webhooksCleanup.securityContext.allowPrivilegeEscalation | |
| webhooksCleanup.securityContext.capabilities.drop | ["ALL"] |
| webhooksCleanup.securityContext.privileged | |
| webhooksCleanup.securityContext.readOnlyRootFilesystem | true |
| webhooksCleanup.securityContext.runAsGroup | 65534 |
| webhooksCleanup.securityContext.runAsNonRoot | true |
| webhooksCleanup.securityContext.runAsUser | 65534 |
| webhooksCleanup.securityContext.seccompProfile.type | RuntimeDefault |
| webhooksCleanup.serviceAccount.automountServiceAccountToken | true |
| webhooksCleanup.tolerations | [] |