policy values.yamlš£
openshiftš£
Type: bool
Default value
false
replicasš£
Type: int
Default value
3
auditIntervalš£
Type: int
Default value
300
metricsBackends[0]š£
Type: string
Default value
"prometheus"
auditMatchKindOnlyš£
Type: bool
Default value
true
constraintViolationsLimitš£
Type: int
Default value
1000
auditFromCacheš£
Type: bool
Default value
false
disableMutationš£
Type: bool
Default value
true
disableValidatingWebhookš£
Type: bool
Default value
false
validatingWebhookTimeoutSecondsš£
Type: int
Default value
15
validatingWebhookFailurePolicyš£
Type: string
Default value
"Ignore"
validatingWebhookExemptNamespacesLabelsš£
Type: object
Default value
{}
Default value (formatted)
{}
validatingWebhookObjectSelectorš£
Type: object
Default value
{}
Default value (formatted)
{}
validatingWebhookCheckIgnoreFailurePolicyš£
Type: string
Default value
"Fail"
validatingWebhookCustomRulesš£
Type: object
Default value
{}
Default value (formatted)
{}
enableDeleteOperationsš£
Type: bool
Default value
false
enableExternalDataš£
Type: bool
Default value
false
enableTLSHealthcheckš£
Type: bool
Default value
false
mutatingWebhookFailurePolicyš£
Type: string
Default value
"Ignore"
mutatingWebhookReinvocationPolicyš£
Type: string
Default value
"Never"
mutatingWebhookExemptNamespacesLabelsš£
Type: object
Default value
{}
Default value (formatted)
{}
mutatingWebhookObjectSelectorš£
Type: object
Default value
{}
Default value (formatted)
{}
mutatingWebhookTimeoutSecondsš£
Type: int
Default value
1
mutatingWebhookCustomRulesš£
Type: object
Default value
{}
Default value (formatted)
{}
mutationAnnotationsš£
Type: bool
Default value
false
auditChunkSizeš£
Type: int
Default value
500
logLevelš£
Type: string
Default value
"INFO"
logDeniesš£
Type: bool
Default value
true
logMutationsš£
Type: bool
Default value
true
emitAdmissionEventsš£
Type: bool
Default value
false
emitAuditEventsš£
Type: bool
Default value
false
resourceQuotaš£
Type: bool
Default value
true
postUpgrade.labelNamespace.enabledš£
Type: bool
Default value
false
postUpgrade.labelNamespace.image.repositoryš£
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
postUpgrade.labelNamespace.image.tagš£
Type: string
Default value
"v1.25.2"
postUpgrade.labelNamespace.image.pullPolicyš£
Type: string
Default value
"IfNotPresent"
postUpgrade.labelNamespace.image.pullSecretsš£
Type: list
Default value
[]
Default value (formatted)
[]
postUpgrade.labelNamespace.extraNamespacesš£
Type: list
Default value
[]
Default value (formatted)
[]
postUpgrade.securityContext.allowPrivilegeEscalationš£
Type: bool
Default value
false
postUpgrade.securityContext.capabilities.drop[0]š£
Type: string
Default value
"all"
postUpgrade.securityContext.readOnlyRootFilesystemš£
Type: bool
Default value
true
postUpgrade.securityContext.runAsGroupš£
Type: int
Default value
999
postUpgrade.securityContext.runAsNonRootš£
Type: bool
Default value
true
postUpgrade.securityContext.runAsUserš£
Type: int
Default value
1000
postInstall.labelNamespace.extraRulesš£
Type: list
Default value
[]
Default value (formatted)
[]
postInstall.labelNamespace.enabledš£
Type: bool
Default value
true
postInstall.labelNamespace.image.repositoryš£
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
postInstall.labelNamespace.image.tagš£
Type: string
Default value
"v1.25.2"
postInstall.labelNamespace.image.pullPolicyš£
Type: string
Default value
"IfNotPresent"
postInstall.labelNamespace.image.pullSecretsš£
Type: list
Default value
[]
Default value (formatted)
[]
postInstall.labelNamespace.extraNamespacesš£
Type: list
Default value
[]
Default value (formatted)
[]
postInstall.probeWebhook.enabledš£
Type: bool
Default value
true
postInstall.probeWebhook.image.repositoryš£
Type: string
Default value
"registry1.dso.mil/ironbank/big-bang/base"
postInstall.probeWebhook.image.tagš£
Type: string
Default value
"2.0.0"
postInstall.probeWebhook.image.pullPolicyš£
Type: string
Default value
"IfNotPresent"
postInstall.probeWebhook.image.pullSecretsš£
Type: list
Default value
[]
Default value (formatted)
[]
postInstall.probeWebhook.waitTimeoutš£
Type: int
Default value
60
postInstall.probeWebhook.httpTimeoutš£
Type: int
Default value
2
postInstall.probeWebhook.insecureHTTPSš£
Type: bool
Default value
false
postInstall.securityContext.allowPrivilegeEscalationš£
Type: bool
Default value
false
postInstall.securityContext.capabilities.drop[0]š£
Type: string
Default value
"all"
postInstall.securityContext.readOnlyRootFilesystemš£
Type: bool
Default value
true
postInstall.securityContext.runAsGroupš£
Type: int
Default value
999
postInstall.securityContext.runAsNonRootš£
Type: bool
Default value
true
postInstall.securityContext.runAsUserš£
Type: int
Default value
1000
preUninstall.deleteWebhookConfigurations.extraRulesš£
Type: list
Default value
[]
Default value (formatted)
[]
preUninstall.deleteWebhookConfigurations.enabledš£
Type: bool
Default value
false
preUninstall.deleteWebhookConfigurations.image.repositoryš£
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
preUninstall.deleteWebhookConfigurations.image.tagš£
Type: string
Default value
"v1.25.2"
preUninstall.deleteWebhookConfigurations.image.pullPolicyš£
Type: string
Default value
"IfNotPresent"
preUninstall.deleteWebhookConfigurations.image.pullSecretsš£
Type: list
Default value
[]
Default value (formatted)
[]
preUninstall.securityContext.allowPrivilegeEscalationš£
Type: bool
Default value
false
preUninstall.securityContext.capabilities.drop[0]š£
Type: string
Default value
"all"
preUninstall.securityContext.readOnlyRootFilesystemš£
Type: bool
Default value
true
preUninstall.securityContext.runAsGroupš£
Type: int
Default value
999
preUninstall.securityContext.runAsNonRootš£
Type: bool
Default value
true
preUninstall.securityContext.runAsUserš£
Type: int
Default value
1000
image.repositoryš£
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/openpolicyagent/gatekeeper"
image.releaseš£
Type: string
Default value
"v3.9.0"
image.pullPolicyš£
Type: string
Default value
"IfNotPresent"
image.pullSecrets[0].nameš£
Type: string
Default value
"private-registry"
image.crdRepositoryš£
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
image.crdReleaseš£
Type: string
Default value
"v1.25.2"
podAnnotations.”container.seccomp.security.alpha.kubernetes.io/manager”š£
Type: string
Default value
"runtime/default"
podLabelsš£
Type: object
Default value
{}
Default value (formatted)
{}
podCountLimitš£
Type: int
Default value
100
secretAnnotationsš£
Type: object
Default value
{}
Default value (formatted)
{}
enableRuntimeDefaultSeccompProfileš£
Type: bool
Default value
true
controllerManager.exemptNamespacesš£
Type: list
Default value
[]
Default value (formatted)
[]
controllerManager.exemptNamespacePrefixesš£
Type: list
Default value
[]
Default value (formatted)
[]
controllerManager.hostNetworkš£
Type: bool
Default value
false
controllerManager.dnsPolicyš£
Type: string
Default value
"ClusterFirst"
controllerManager.portš£
Type: int
Default value
8443
controllerManager.metricsPortš£
Type: int
Default value
8888
controllerManager.healthPortš£
Type: int
Default value
9090
controllerManager.priorityClassNameš£
Type: string
Default value
"system-cluster-critical"
controllerManager.disableCertRotationš£
Type: bool
Default value
false
controllerManager.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].podAffinityTerm.labelSelector.matchExpressions[0].keyš£
Type: string
Default value
"gatekeeper.sh/operation"
controllerManager.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].podAffinityTerm.labelSelector.matchExpressions[0].operatorš£
Type: string
Default value
"In"
controllerManager.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].podAffinityTerm.labelSelector.matchExpressions[0].values[0]š£
Type: string
Default value
"webhook"
controllerManager.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].podAffinityTerm.topologyKeyš£
Type: string
Default value
"kubernetes.io/hostname"
controllerManager.affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution[0].weightš£
Type: int
Default value
100
controllerManager.tolerationsš£
Type: list
Default value
[]
Default value (formatted)
[]
controllerManager.nodeSelector.”kubernetes.io/os”š£
Type: string
Default value
"linux"
controllerManager.resources.limits.cpuš£
Type: string
Default value
"175m"
controllerManager.resources.limits.memoryš£
Type: string
Default value
"512Mi"
controllerManager.resources.requests.cpuš£
Type: string
Default value
"175m"
controllerManager.resources.requests.memoryš£
Type: string
Default value
"512Mi"
controllerManager.securityContext.allowPrivilegeEscalationš£
Type: bool
Default value
false
controllerManager.securityContext.capabilities.drop[0]š£
Type: string
Default value
"all"
controllerManager.securityContext.readOnlyRootFilesystemš£
Type: bool
Default value
true
controllerManager.securityContext.runAsGroupš£
Type: int
Default value
999
controllerManager.securityContext.runAsNonRootš£
Type: bool
Default value
true
controllerManager.securityContext.runAsUserš£
Type: int
Default value
1000
controllerManager.podSecurityContext.fsGroupš£
Type: int
Default value
999
controllerManager.podSecurityContext.supplementalGroups[0]š£
Type: int
Default value
999
controllerManager.extraRulesš£
Type: list
Default value
[]
Default value (formatted)
[]
audit.hostNetworkš£
Type: bool
Default value
false
audit.dnsPolicyš£
Type: string
Default value
"ClusterFirst"
audit.metricsPortš£
Type: int
Default value
8888
audit.healthPortš£
Type: int
Default value
9090
audit.priorityClassNameš£
Type: string
Default value
"system-cluster-critical"
audit.disableCertRotationš£
Type: bool
Default value
true
audit.affinityš£
Type: object
Default value
{}
Default value (formatted)
{}
audit.tolerationsš£
Type: list
Default value
[]
Default value (formatted)
[]
audit.nodeSelector.”kubernetes.io/os”š£
Type: string
Default value
"linux"
audit.writeToRAMDiskš£
Type: bool
Default value
false
audit.resources.limits.cpuš£
Type: float
Default value
1.2
audit.resources.limits.memoryš£
Type: string
Default value
"768Mi"
audit.resources.requests.cpuš£
Type: float
Default value
1.2
audit.resources.requests.memoryš£
Type: string
Default value
"768Mi"
audit.securityContext.allowPrivilegeEscalationš£
Type: bool
Default value
false
audit.securityContext.capabilities.drop[0]š£
Type: string
Default value
"all"
audit.securityContext.readOnlyRootFilesystemš£
Type: bool
Default value
true
audit.securityContext.runAsGroupš£
Type: int
Default value
999
audit.securityContext.runAsNonRootš£
Type: bool
Default value
true
audit.securityContext.runAsUserš£
Type: int
Default value
1000
audit.podSecurityContext.fsGroupš£
Type: int
Default value
999
audit.podSecurityContext.supplementalGroups[0]š£
Type: int
Default value
999
audit.extraRulesš£
Type: list
Default value
[]
Default value (formatted)
[]
crds.resourcesš£
Type: object
Default value
{}
Default value (formatted)
{}
crds.securityContext.allowPrivilegeEscalationš£
Type: bool
Default value
false
crds.securityContext.capabilities.drop[0]š£
Type: string
Default value
"all"
crds.securityContext.readOnlyRootFilesystemš£
Type: bool
Default value
true
crds.securityContext.runAsGroupš£
Type: int
Default value
65532
crds.securityContext.runAsNonRootš£
Type: bool
Default value
true
crds.securityContext.runAsUserš£
Type: int
Default value
65532
pdb.controllerManager.minAvailableš£
Type: int
Default value
1
serviceš£
Type: object
Default value
{}
Default value (formatted)
{}
disabledBuiltins[0]š£
Type: string
Default value
"{http.send}"
psp.enabledš£
Type: bool
Default value
false
upgradeCRDs.enabledš£
Type: bool
Default value
true
upgradeCRDs.tolerationsš£
Type: list
Default value
[]
Default value (formatted)
[]
upgradeCRDs.extraRulesš£
Type: list
Default value
[]
Default value (formatted)
[]
cleanupCRDs.enabledš£
Type: bool
Default value
true
rbac.createš£
Type: bool
Default value
true
violations.allowedAppArmorProfiles.enabledš£
Type: bool
Default value
false
violations.allowedAppArmorProfiles.enforcementActionš£
Type: string
Default value
"dryrun"
violations.allowedAppArmorProfiles.kindš£
Type: string
Default value
"K8sPSPAppArmor"
violations.allowedAppArmorProfiles.nameš£
Type: string
Default value
"allowed-app-armor-profiles"
violations.allowedAppArmorProfiles.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedAppArmorProfiles.parameters.allowedProfiles[0]š£
Type: string
Default value
"runtime/default"
violations.allowedAppArmorProfiles.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedCapabilities.enabledš£
Type: bool
Default value
true
violations.allowedCapabilities.enforcementActionš£
Type: string
Default value
"dryrun"
violations.allowedCapabilities.kindš£
Type: string
Default value
"K8sPSPCapabilities"
violations.allowedCapabilities.nameš£
Type: string
Default value
"allowed-capabilities"
violations.allowedCapabilities.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedCapabilities.parameters.allowedCapabilitiesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedCapabilities.parameters.requiredDropCapabilities[0]š£
Type: string
Default value
"all"
violations.allowedCapabilities.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedDockerRegistries.enabledš£
Type: bool
Default value
true
violations.allowedDockerRegistries.enforcementActionš£
Type: string
Default value
"deny"
violations.allowedDockerRegistries.kindš£
Type: string
Default value
"K8sAllowedRepos"
violations.allowedDockerRegistries.nameš£
Type: string
Default value
"allowed-docker-registries"
violations.allowedDockerRegistries.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedDockerRegistries.parameters.repos[0]š£
Type: string
Default value
"registry1.dso.mil"
violations.allowedDockerRegistries.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedFlexVolumes.enabledš£
Type: bool
Default value
true
violations.allowedFlexVolumes.enforcementActionš£
Type: string
Default value
"deny"
violations.allowedFlexVolumes.kindš£
Type: string
Default value
"K8sPSPFlexVolumes"
violations.allowedFlexVolumes.nameš£
Type: string
Default value
"allowed-flex-volumes"
violations.allowedFlexVolumes.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedFlexVolumes.parameters.allowedFlexVolumesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedFlexVolumes.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedHostFilesystem.enabledš£
Type: bool
Default value
true
violations.allowedHostFilesystem.enforcementActionš£
Type: string
Default value
"deny"
violations.allowedHostFilesystem.kindš£
Type: string
Default value
"K8sPSPHostFilesystem"
violations.allowedHostFilesystem.nameš£
Type: string
Default value
"allowed-host-filesystem"
violations.allowedHostFilesystem.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedHostFilesystem.parameters.allowedHostPathsš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedHostFilesystem.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedIPs.enabledš£
Type: bool
Default value
true
violations.allowedIPs.enforcementActionš£
Type: string
Default value
"deny"
violations.allowedIPs.kindš£
Type: string
Default value
"K8sExternalIPs"
violations.allowedIPs.nameš£
Type: string
Default value
"allowed-ips"
violations.allowedIPs.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedIPs.parameters.allowedIPsš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedIPs.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedProcMount.enabledš£
Type: bool
Default value
true
violations.allowedProcMount.enforcementActionš£
Type: string
Default value
"deny"
violations.allowedProcMount.kindš£
Type: string
Default value
"K8sPSPProcMount"
violations.allowedProcMount.nameš£
Type: string
Default value
"allowed-proc-mount"
violations.allowedProcMount.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedProcMount.parameters.procMountš£
Type: string
Default value
"Default"
violations.allowedProcMount.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedSecCompProfiles.enabledš£
Type: bool
Default value
true
violations.allowedSecCompProfiles.enforcementActionš£
Type: string
Default value
"dryrun"
violations.allowedSecCompProfiles.kindš£
Type: string
Default value
"K8sPSPSeccomp"
violations.allowedSecCompProfiles.nameš£
Type: string
Default value
"allowed-sec-comp-profiles"
violations.allowedSecCompProfiles.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedSecCompProfiles.parameters.allowedProfiles[0]š£
Type: string
Default value
"runtime/default"
violations.allowedSecCompProfiles.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.allowedUsers.enabledš£
Type: bool
Default value
true
violations.allowedUsers.enforcementActionš£
Type: string
Default value
"dryrun"
violations.allowedUsers.kindš£
Type: string
Default value
"K8sPSPAllowedUsers"
violations.allowedUsers.nameš£
Type: string
Default value
"allowed-users"
violations.allowedUsers.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.allowedUsers.parameters.runAsUser.ruleš£
Type: string
Default value
"MustRunAsNonRoot"
violations.allowedUsers.parameters.fsGroup.ruleš£
Type: string
Default value
"MustRunAs"
violations.allowedUsers.parameters.fsGroup.ranges[0].minš£
Type: int
Default value
1000
violations.allowedUsers.parameters.fsGroup.ranges[0].maxš£
Type: int
Default value
65535
violations.allowedUsers.parameters.runAsGroup.ruleš£
Type: string
Default value
"MustRunAs"
violations.allowedUsers.parameters.runAsGroup.ranges[0].minš£
Type: int
Default value
1000
violations.allowedUsers.parameters.runAsGroup.ranges[0].maxš£
Type: int
Default value
65535
violations.allowedUsers.parameters.supplementalGroups.ruleš£
Type: string
Default value
"MustRunAs"
violations.allowedUsers.parameters.supplementalGroups.ranges[0].minš£
Type: int
Default value
1000
violations.allowedUsers.parameters.supplementalGroups.ranges[0].maxš£
Type: int
Default value
65535
violations.allowedUsers.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.bannedImageTags.enabledš£
Type: bool
Default value
true
violations.bannedImageTags.enforcementActionš£
Type: string
Default value
"deny"
violations.bannedImageTags.kindš£
Type: string
Default value
"K8sBannedImageTags"
violations.bannedImageTags.nameš£
Type: string
Default value
"banned-image-tags"
violations.bannedImageTags.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.bannedImageTags.parameters.tags[0]š£
Type: string
Default value
"latest"
violations.bannedImageTags.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.blockNodePort.enabledš£
Type: bool
Default value
true
violations.blockNodePort.enforcementActionš£
Type: string
Default value
"dryrun"
violations.blockNodePort.kindš£
Type: string
Default value
"K8sBlockNodePort"
violations.blockNodePort.nameš£
Type: string
Default value
"block-node-ports"
violations.blockNodePort.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.blockNodePort.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.containerRatio.enabledš£
Type: bool
Default value
true
violations.containerRatio.enforcementActionš£
Type: string
Default value
"dryrun"
violations.containerRatio.kindš£
Type: string
Default value
"K8sContainerRatios"
violations.containerRatio.nameš£
Type: string
Default value
"container-ratios"
violations.containerRatio.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.containerRatio.parameters.ratioš£
Type: string
Default value
"2"
violations.containerRatio.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.hostNetworking.enabledš£
Type: bool
Default value
true
violations.hostNetworking.enforcementActionš£
Type: string
Default value
"deny"
violations.hostNetworking.kindš£
Type: string
Default value
"K8sPSPHostNetworkingPorts"
violations.hostNetworking.nameš£
Type: string
Default value
"host-networking"
violations.hostNetworking.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.hostNetworking.parameters.hostNetworkš£
Type: bool
Default value
false
violations.hostNetworking.parameters.minš£
Type: int
Default value
0
violations.hostNetworking.parameters.maxš£
Type: int
Default value
0
violations.hostNetworking.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.httpsOnly.enabledš£
Type: bool
Default value
true
violations.httpsOnly.enforcementActionš£
Type: string
Default value
"deny"
violations.httpsOnly.kindš£
Type: string
Default value
"K8sHttpsOnly2"
violations.httpsOnly.nameš£
Type: string
Default value
"https-only"
violations.httpsOnly.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.httpsOnly.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.imageDigest.enabledš£
Type: bool
Default value
true
violations.imageDigest.enforcementActionš£
Type: string
Default value
"dryrun"
violations.imageDigest.kindš£
Type: string
Default value
"K8sImageDigests2"
violations.imageDigest.nameš£
Type: string
Default value
"image-digest"
violations.imageDigest.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.imageDigest.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.namespacesHaveIstio.enabledš£
Type: bool
Default value
true
violations.namespacesHaveIstio.enforcementActionš£
Type: string
Default value
"dryrun"
violations.namespacesHaveIstio.kindš£
Type: string
Default value
"K8sRequiredLabelValues"
violations.namespacesHaveIstio.nameš£
Type: string
Default value
"namespaces-have-istio"
violations.namespacesHaveIstio.match.namespaceSelector.matchExpressions[0].keyš£
Type: string
Default value
"admission.gatekeeper.sh/ignore"
violations.namespacesHaveIstio.match.namespaceSelector.matchExpressions[0].operatorš£
Type: string
Default value
"DoesNotExist"
violations.namespacesHaveIstio.parameters.labels[0].allowedRegexš£
Type: string
Default value
"^enabled"
violations.namespacesHaveIstio.parameters.labels[0].keyš£
Type: string
Default value
"istio-injection"
violations.namespacesHaveIstio.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.noBigContainers.enabledš£
Type: bool
Default value
true
violations.noBigContainers.enforcementActionš£
Type: string
Default value
"dryrun"
violations.noBigContainers.kindš£
Type: string
Default value
"K8sContainerLimits"
violations.noBigContainers.nameš£
Type: string
Default value
"no-big-container"
violations.noBigContainers.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.noBigContainers.parameters.cpuš£
Type: string
Default value
"2000m"
violations.noBigContainers.parameters.memoryš£
Type: string
Default value
"4G"
violations.noBigContainers.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.noHostNamespace.enabledš£
Type: bool
Default value
true
violations.noHostNamespace.enforcementActionš£
Type: string
Default value
"deny"
violations.noHostNamespace.kindš£
Type: string
Default value
"K8sPSPHostNamespace2"
violations.noHostNamespace.nameš£
Type: string
Default value
"no-host-namespace"
violations.noHostNamespace.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.noHostNamespace.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.noPrivilegedContainers.enabledš£
Type: bool
Default value
true
violations.noPrivilegedContainers.enforcementActionš£
Type: string
Default value
"deny"
violations.noPrivilegedContainers.kindš£
Type: string
Default value
"K8sPSPPrivilegedContainer2"
violations.noPrivilegedContainers.nameš£
Type: string
Default value
"no-privileged-containers"
violations.noPrivilegedContainers.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.noPrivilegedContainers.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.noDefaultServiceAccount.enabledš£
Type: bool
Default value
true
violations.noDefaultServiceAccount.enforcementActionš£
Type: string
Default value
"dryrun"
violations.noDefaultServiceAccount.kindš£
Type: string
Default value
"K8sDenySADefault"
violations.noDefaultServiceAccount.nameš£
Type: string
Default value
"no-default-service-account"
violations.noDefaultServiceAccount.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.noDefaultServiceAccount.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.noPrivilegedEscalation.enabledš£
Type: bool
Default value
true
violations.noPrivilegedEscalation.enforcementActionš£
Type: string
Default value
"dryrun"
violations.noPrivilegedEscalation.kindš£
Type: string
Default value
"K8sPSPAllowPrivilegeEscalationContainer2"
violations.noPrivilegedEscalation.nameš£
Type: string
Default value
"no-privileged-escalation"
violations.noPrivilegedEscalation.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.noPrivilegedEscalation.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.noSysctls.enabledš£
Type: bool
Default value
true
violations.noSysctls.enforcementActionš£
Type: string
Default value
"deny"
violations.noSysctls.kindš£
Type: string
Default value
"K8sPSPForbiddenSysctls"
violations.noSysctls.nameš£
Type: string
Default value
"no-sysctls"
violations.noSysctls.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.noSysctls.parameters.forbiddenSysctls[0]š£
Type: string
Default value
"*"
violations.noSysctls.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.podsHaveIstio.enabledš£
Type: bool
Default value
true
violations.podsHaveIstio.enforcementActionš£
Type: string
Default value
"dryrun"
violations.podsHaveIstio.kindš£
Type: string
Default value
"K8sNoAnnotationValues"
violations.podsHaveIstio.nameš£
Type: string
Default value
"pods-have-istio"
violations.podsHaveIstio.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.podsHaveIstio.parameters.annotations[0].disallowedRegexš£
Type: string
Default value
"^false"
violations.podsHaveIstio.parameters.annotations[0].keyš£
Type: string
Default value
"sidecar.istio.io/inject"
violations.podsHaveIstio.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.readOnlyRoot.enabledš£
Type: bool
Default value
true
violations.readOnlyRoot.enforcementActionš£
Type: string
Default value
"dryrun"
violations.readOnlyRoot.kindš£
Type: string
Default value
"K8sPSPReadOnlyRootFilesystem2"
violations.readOnlyRoot.nameš£
Type: string
Default value
"read-only-root"
violations.readOnlyRoot.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.readOnlyRoot.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.requiredLabels.enabledš£
Type: bool
Default value
true
violations.requiredLabels.enforcementActionš£
Type: string
Default value
"dryrun"
violations.requiredLabels.kindš£
Type: string
Default value
"K8sRequiredLabelValues"
violations.requiredLabels.nameš£
Type: string
Default value
"required-labels"
violations.requiredLabels.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.requiredLabels.parameters.labels[0].allowedRegexš£
Type: string
Default value
""
violations.requiredLabels.parameters.labels[0].keyš£
Type: string
Default value
"app.kubernetes.io/name"
violations.requiredLabels.parameters.labels[1].allowedRegexš£
Type: string
Default value
""
violations.requiredLabels.parameters.labels[1].keyš£
Type: string
Default value
"app.kubernetes.io/instance"
violations.requiredLabels.parameters.labels[2].allowedRegexš£
Type: string
Default value
""
violations.requiredLabels.parameters.labels[2].keyš£
Type: string
Default value
"app.kubernetes.io/version"
violations.requiredLabels.parameters.labels[3].allowedRegexš£
Type: string
Default value
""
violations.requiredLabels.parameters.labels[3].keyš£
Type: string
Default value
"app.kubernetes.io/component"
violations.requiredLabels.parameters.labels[4].allowedRegexš£
Type: string
Default value
""
violations.requiredLabels.parameters.labels[4].keyš£
Type: string
Default value
"app.kubernetes.io/part-of"
violations.requiredLabels.parameters.labels[5].allowedRegexš£
Type: string
Default value
""
violations.requiredLabels.parameters.labels[5].keyš£
Type: string
Default value
"app.kubernetes.io/managed-by"
violations.requiredLabels.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.requiredProbes.enabledš£
Type: bool
Default value
true
violations.requiredProbes.enforcementActionš£
Type: string
Default value
"dryrun"
violations.requiredProbes.kindš£
Type: string
Default value
"K8sRequiredProbes"
violations.requiredProbes.nameš£
Type: string
Default value
"required-probes"
violations.requiredProbes.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.requiredProbes.parameters.probeTypes[0]š£
Type: string
Default value
"tcpSocket"
violations.requiredProbes.parameters.probeTypes[1]š£
Type: string
Default value
"httpGet"
violations.requiredProbes.parameters.probeTypes[2]š£
Type: string
Default value
"exec"
violations.requiredProbes.parameters.probes[0]š£
Type: string
Default value
"readinessProbe"
violations.requiredProbes.parameters.probes[1]š£
Type: string
Default value
"livenessProbe"
violations.requiredProbes.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.restrictedTaint.enabledš£
Type: bool
Default value
true
violations.restrictedTaint.enforcementActionš£
Type: string
Default value
"deny"
violations.restrictedTaint.kindš£
Type: string
Default value
"RestrictedTaintToleration"
violations.restrictedTaint.nameš£
Type: string
Default value
"restricted-taint"
violations.restrictedTaint.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.restrictedTaint.parameters.allowGlobalTolerationš£
Type: bool
Default value
false
violations.restrictedTaint.parameters.restrictedTaint.effectš£
Type: string
Default value
"NoSchedule"
violations.restrictedTaint.parameters.restrictedTaint.keyš£
Type: string
Default value
"privileged"
violations.restrictedTaint.parameters.restrictedTaint.valueš£
Type: string
Default value
"true"
violations.restrictedTaint.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.selinuxPolicy.enabledš£
Type: bool
Default value
true
violations.selinuxPolicy.enforcementActionš£
Type: string
Default value
"deny"
violations.selinuxPolicy.kindš£
Type: string
Default value
"K8sPSPSELinuxV2"
violations.selinuxPolicy.nameš£
Type: string
Default value
"selinux-policy"
violations.selinuxPolicy.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.selinuxPolicy.parameters.allowedSELinuxOptionsš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.selinuxPolicy.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.uniqueIngressHost.enabledš£
Type: bool
Default value
true
violations.uniqueIngressHost.enforcementActionš£
Type: string
Default value
"deny"
violations.uniqueIngressHost.kindš£
Type: string
Default value
"K8sUniqueIngressHost"
violations.uniqueIngressHost.nameš£
Type: string
Default value
"unique-ingress-hosts"
violations.uniqueIngressHost.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.uniqueIngressHost.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
violations.volumeTypes.enabledš£
Type: bool
Default value
true
violations.volumeTypes.enforcementActionš£
Type: string
Default value
"deny"
violations.volumeTypes.kindš£
Type: string
Default value
"K8sPSPVolumeTypes"
violations.volumeTypes.nameš£
Type: string
Default value
"volume-types"
violations.volumeTypes.matchš£
Type: object
Default value
{}
Default value (formatted)
{}
violations.volumeTypes.parameters.volumes[0]š£
Type: string
Default value
"configMap"
violations.volumeTypes.parameters.volumes[1]š£
Type: string
Default value
"emptyDir"
violations.volumeTypes.parameters.volumes[2]š£
Type: string
Default value
"projected"
violations.volumeTypes.parameters.volumes[3]š£
Type: string
Default value
"secret"
violations.volumeTypes.parameters.volumes[4]š£
Type: string
Default value
"downwardAPI"
violations.volumeTypes.parameters.volumes[5]š£
Type: string
Default value
"persistentVolumeClaim"
violations.volumeTypes.parameters.excludedResourcesš£
Type: list
Default value
[]
Default value (formatted)
[]
monitoring.enabledš£
Type: bool
Default value
false
networkPolicies.enabledš£
Type: bool
Default value
false
networkPolicies.controlPlaneCidrš£
Type: string
Default value
"0.0.0.0/0"
bbtests.enabledš£
Type: bool
Default value
false
bbtests.scripts.imageš£
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.25.2"
bbtests.scripts.additionalVolumeMounts[0].nameš£
Type: string
Default value
"{{ .Chart.Name }}-test-config"
bbtests.scripts.additionalVolumeMounts[0].mountPathš£
Type: string
Default value
"/yaml"
bbtests.scripts.additionalVolumeMounts[1].nameš£
Type: string
Default value
"{{ .Chart.Name }}-kube-cache"
bbtests.scripts.additionalVolumeMounts[1].mountPathš£
Type: string
Default value
"/.kube/cache"
bbtests.scripts.additionalVolumes[0].nameš£
Type: string
Default value
"{{ .Chart.Name }}-test-config"
bbtests.scripts.additionalVolumes[0].configMap.nameš£
Type: string
Default value
"{{ .Chart.Name }}-test-config"
bbtests.scripts.additionalVolumes[1].nameš£
Type: string
Default value
"{{ .Chart.Name }}-kube-cache"
bbtests.scripts.additionalVolumes[1].emptyDirš£
Type: object
Default value
{}
Default value (formatted)
{}