kyverno values.yaml💣
templating💣
Type: object
{"debug":false,"enabled":false,"version":null}
Default value (formatted)
{
"debug": false,
"enabled": false,
"version": null
}
Description: Internal settings used with helm template to generate install manifest @ignored
nameOverride💣
Type: string
nil
Description: Override the name of the chart
fullnameOverride💣
Type: string
nil
Description: Override the expanded name of the chart
namespace💣
Type: string
nil
Description: Namespace the chart deploys to
customLabels💣
Type: object
{}
Default value (formatted)
{}
Description: Additional labels
rbac.create💣
Type: bool
true
Description: Create ClusterRoles, ClusterRoleBindings, and ServiceAccount
rbac.serviceAccount.create💣
Type: bool
true
Description: Create a ServiceAccount
rbac.serviceAccount.name💣
Type: string
nil
Description: The ServiceAccount name
rbac.serviceAccount.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Annotations for the ServiceAccount
image.registry💣
Type: string
nil
Description: Image registry
image.repository💣
Type: string
"registry1.dso.mil/ironbank/nirmata/kyverno"
Description: Image repository
image.tag💣
Type: string
nil
Description: Image tag Defaults to appVersion in Chart.yaml if omitted
image.pullPolicy💣
Type: string
"IfNotPresent"
Description: Image pull policy
image.pullSecrets💣
Type: list
[]
Default value (formatted)
[]
Description: Image pull secrets
initImage.registry💣
Type: string
nil
Description: Image registry
initImage.repository💣
Type: string
"registry1.dso.mil/ironbank/nirmata/kyvernopre"
Description: Image repository
initImage.tag💣
Type: string
nil
Description: Image tag If initImage.tag is missing, defaults to image.tag
initImage.pullPolicy💣
Type: string
nil
Description: Image pull policy If initImage.pullPolicy is missing, defaults to image.pullPolicy
initContainer.extraArgs💣
Type: list
["--loggingFormat=text"]
Default value (formatted)
[
"--loggingFormat=text"
]
Description: Extra arguments to give to the kyvernopre binary.
testImage.registry💣
Type: string
nil
Description: Image registry
testImage.repository💣
Type: string
"registry1.dso.mil/ironbank/redhat/ubi/ubi8-minimal"
Description: Image repository Defaults to busybox if omitted
testImage.tag💣
Type: float
8.7
Description: Image tag Defaults to latest if omitted
testImage.pullPolicy💣
Type: string
nil
Description: Image pull policy Defaults to image.pullPolicy if omitted
replicaCount💣
Type: int
1
Description: Desired number of pods
podLabels💣
Type: object
{}
Default value (formatted)
{}
Description: Additional labels to add to each pod
podAnnotations💣
Type: object
{}
Default value (formatted)
{}
Description: Additional annotations to add to each pod
podSecurityContext💣
Type: object
{}
Default value (formatted)
{}
Description: Security context for the pod
securityContext💣
Type: object
{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}
Default value (formatted)
{
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"ALL"
]
},
"privileged": false,
"readOnlyRootFilesystem": true,
"runAsNonRoot": true,
"seccompProfile": {
"type": "RuntimeDefault"
}
}
Description: Security context for the containers
testSecurityContext💣
Type: object
{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}
Default value (formatted)
{
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"ALL"
]
},
"privileged": false,
"readOnlyRootFilesystem": true,
"runAsGroup": 65534,
"runAsNonRoot": true,
"runAsUser": 65534,
"seccompProfile": {
"type": "RuntimeDefault"
}
}
Description: Security context for the test containers
priorityClassName💣
Type: string
""
Description: Optional priority class to be used for kyverno pods
antiAffinity.enable💣
Type: bool
true
Description: Pod antiAffinities toggle. Enabled by default but can be disabled if you want to schedule pods to the same node.
podAffinity💣
Type: object
{}
Default value (formatted)
{}
Description: Pod affinity constraints.
nodeAffinity💣
Type: object
{}
Default value (formatted)
{}
Description: Node affinity constraints.
podDisruptionBudget.minAvailable💣
Type: int
1
Description: Configures the minimum available pods for kyverno disruptions. Cannot be used if maxUnavailable is set.
podDisruptionBudget.maxUnavailable💣
Type: string
nil
Description: Configures the maximum unavailable pods for kyverno disruptions. Cannot be used if minAvailable is set.
nodeSelector💣
Type: object
{}
Default value (formatted)
{}
Description: Node labels for pod assignment
tolerations💣
Type: list
[]
Default value (formatted)
[]
Description: List of node taints to tolerate
hostNetwork💣
Type: bool
false
Description: Change hostNetwork to true when you want the kyverno’s pod to share its host’s network namespace. Useful for situations like when you end up dealing with a custom CNI over Amazon EKS. Update the dnsPolicy accordingly as well to suit the host network mode.
dnsPolicy💣
Type: string
"ClusterFirst"
Description: dnsPolicy determines the manner in which DNS resolution happens in the cluster. In case of hostNetwork: true, usually, the dnsPolicy is suitable to be ClusterFirstWithHostNet. For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy.
envVarsInit💣
Type: object
{}
Default value (formatted)
{}
Description: Env variables for initContainers.
envVars💣
Type: object
{}
Default value (formatted)
{}
Description: Env variables for containers.
extraArgs💣
Type: list
["--clientRateLimitQPS=25","--clientRateLimitBurst=50","--autogenInternals=false","--loggingFormat=text","--exceptionNamespace={{ include \"kyverno.namespace\" . }}"]
Default value (formatted)
[
"--clientRateLimitQPS=25",
"--clientRateLimitBurst=50",
"--autogenInternals=false",
"--loggingFormat=text",
"--exceptionNamespace={{ include \"kyverno.namespace\" . }}"
]
Description: Extra arguments to give to the binary.
extraInitContainers💣
Type: list
[]
Default value (formatted)
[]
Description: Array of extra init containers
extraContainers💣
Type: list
[]
Default value (formatted)
[]
Description: Array of extra containers to run alongside kyverno
imagePullSecrets💣
Type: object
{}
Default value (formatted)
{}
Description: Image pull secrets for image verify and imageData policies. This will define the --imagePullSecrets Kyverno argument.
existingImagePullSecrets💣
Type: list
["private-registry"]
Default value (formatted)
[
"private-registry"
]
Description: Existing Image pull secrets for image verify and imageData policies. This will define the --imagePullSecrets Kyverno argument.
resources.limits💣
Type: object
{"cpu":"500m","memory":"512Mi"}
Default value (formatted)
{
"cpu": "500m",
"memory": "512Mi"
}
Description: Pod resource limits
resources.requests💣
Type: object
{"cpu":"500m","memory":"512Mi"}
Default value (formatted)
{
"cpu": "500m",
"memory": "512Mi"
}
Description: Pod resource requests
initResources.limits💣
Type: object
{"cpu":"100m","memory":"256Mi"}
Default value (formatted)
{
"cpu": "100m",
"memory": "256Mi"
}
Description: Pod resource limits
initResources.requests💣
Type: object
{"cpu":"100m","memory":"256Mi"}
Default value (formatted)
{
"cpu": "100m",
"memory": "256Mi"
}
Description: Pod resource requests
testResources.limits💣
Type: object
{"cpu":"100m","memory":"256Mi"}
Default value (formatted)
{
"cpu": "100m",
"memory": "256Mi"
}
Description: Pod resource limits
testResources.requests💣
Type: object
{"cpu":"10m","memory":"64Mi"}
Default value (formatted)
{
"cpu": "10m",
"memory": "64Mi"
}
Description: Pod resource requests
generatecontrollerExtraResources💣
Type: list
[]
Default value (formatted)
[]
Description: Additional resources to be added to controller RBAC permissions.
excludeKyvernoNamespace💣
Type: bool
true
Description: Exclude Kyverno namespace Determines if default Kyverno namespace exclusion is enabled for webhooks and resourceFilters
resourceFiltersExcludeNamespaces💣
Type: list
[]
Default value (formatted)
[]
Description: resourceFilter namespace exclude Namespaces to exclude from the default resourceFilters
config.existingConfig💣
Type: string
""
Description: Name of an existing config map (ignores default/provided resourceFilters)
config.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Additional annotations to add to the configmap
config.excludeGroupRole💣
Type: string
nil
Description: Exclude group role
config.excludeUsername💣
Type: string
nil
Description: Exclude username
config.webhooks💣
Type: string
nil
Description: Defines the namespaceSelector in the webhook configurations. Note that it takes a list of namespaceSelector and/or objectSelector in the JSON format, and only the first element will be forwarded to the webhook configurations. The Kyverno namespace is excluded if excludeKyvernoNamespace is true (default)
config.generateSuccessEvents💣
Type: bool
false
Description: Generate success events.
config.metricsConfig💣
Type: object
{"annotations":{},"namespaces":{"exclude":[],"include":[]}}
Default value (formatted)
{
"annotations": {},
"namespaces": {
"exclude": [],
"include": []
}
}
Description: Metrics config.
config.metricsConfig.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Additional annotations to add to the metricsconfigmap
service.port💣
Type: int
443
Description: Service port.
service.type💣
Type: string
"ClusterIP"
Description: Service type.
service.nodePort💣
Type: string
nil
Description: Service node port. Only used if service.type is NodePort.
service.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Service annotations.
topologySpreadConstraints💣
Type: list
[]
Default value (formatted)
[]
Description: Topology spread constraints.
metricsService.create💣
Type: bool
true
Description: Create service.
metricsService.port💣
Type: int
8000
Description: Service port. Kyverno’s metrics server will be exposed at this port.
metricsService.type💣
Type: string
"ClusterIP"
Description: Service type.
metricsService.nodePort💣
Type: string
nil
Description: Service node port. Only used if metricsService.type is NodePort.
metricsService.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Service annotations.
serviceMonitor.enabled💣
Type: bool
false
Description: Create a ServiceMonitor to collect Prometheus metrics.
serviceMonitor.additionalLabels💣
Type: string
nil
Description: Additional labels
serviceMonitor.namespace💣
Type: string
nil
Description: Override namespace (default is the same as kyverno)
serviceMonitor.interval💣
Type: string
"30s"
Description: Interval to scrape metrics
serviceMonitor.scrapeTimeout💣
Type: string
"25s"
Description: Timeout if metrics can’t be retrieved in given time interval
serviceMonitor.secure💣
Type: bool
false
Description: Is TLS required for endpoint
serviceMonitor.tlsConfig💣
Type: object
{}
Default value (formatted)
{}
Description: TLS Configuration for endpoint
serviceMonitor.dashboards.namespace💣
Type: string
nil
serviceMonitor.dashboards.label💣
Type: string
"grafana_dashboard"
createSelfSignedCert💣
Type: bool
false
Description: Kyverno requires a certificate key pair and corresponding certificate authority to properly register its webhooks. This can be done in one of 3 ways: 1) Use kube-controller-manager to generate a CA-signed certificate (preferred) 2) Provide your own CA and cert. In this case, you will need to create a certificate with a specific name and data structure. As long as you follow the naming scheme, it will be automatically picked up. kyverno-svc.(namespace).svc.kyverno-tls-ca (with data entries named tls.key and tls.crt) kyverno-svc.kyverno.svc.kyverno-tls-pair (with data entries named tls.key and tls.crt) 3) Let Helm generate a self signed cert, by setting createSelfSignedCert true If letting Kyverno create its own CA or providing your own, make createSelfSignedCert is false
installCRDs💣
Type: bool
true
Description: Whether to have Helm install the Kyverno CRDs. If the CRDs are not installed by Helm, they must be added before policies can be created.
crds.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Additional CRDs annotations.
networkPolicy.enabled💣
Type: bool
false
Description: When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup.
networkPolicy.ingressFrom💣
Type: list
[]
Default value (formatted)
[]
Description: A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies.
webhooksCleanup.enable💣
Type: bool
false
Description: Create a helm pre-delete hook to cleanup webhooks.
webhooksCleanup.image💣
Type: string
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.26.4"
Description: kubectl image to run commands for deleting webhooks.
tufRootMountPath💣
Type: string
"/.sigstore"
Description: A writable volume to use for the TUF root initialization.
registries💣
Type: object
{"ports":[{"port":443,"protocol":"TCP"}]}
Default value (formatted)
{
"ports": [
{
"port": 443,
"protocol": "TCP"
}
]
}
Description: A list of registry ports to be accepted
networkPolicies.enabled💣
Type: bool
false
networkPolicies.controlPlaneCidr💣
Type: string
"0.0.0.0/0"
istio.enabled💣
Type: bool
false
openshift💣
Type: bool
false
bbtests.enabled💣
Type: bool
false
bbtests.scripts.image💣
Type: string
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.26.4"
bbtests.scripts.additionalVolumeMounts[0].name💣
Type: string
"kyverno-bbtest-manifest"
bbtests.scripts.additionalVolumeMounts[0].mountPath💣
Type: string
"/yaml"
bbtests.scripts.additionalVolumes[0].name💣
Type: string
"kyverno-bbtest-manifest"
bbtests.scripts.additionalVolumes[0].configMap.name💣
Type: string
"kyverno-bbtest-manifest"
grafana.enabled💣
Type: bool
false
Description: Enable grafana dashboard creation.
grafana.namespace💣
Type: string
nil
Description: Namespace to create the grafana dashboard configmap. If not set, it will be created in the same namespace where the chart is deployed.
grafana.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Grafana dashboard configmap annotations.
cleanupController.enabled💣
Type: bool
false
Description: Enable cleanup controller.
cleanupController.rbac.create💣
Type: bool
true
Description: Create RBAC resources
cleanupController.rbac.serviceAccount.name💣
Type: string
nil
Description: Service account name
cleanupController.rbac.clusterRole.extraResources💣
Type: list
[]
Default value (formatted)
[]
Description: Extra resource permissions to add in the cluster role
cleanupController.createSelfSignedCert💣
Type: bool
false
Description: Create self-signed certificates at deployment time. The certificates won’t be automatically renewed if this is set to true.
cleanupController.image.registry💣
Type: string
nil
Description: Image registry
cleanupController.image.repository💣
Type: string
"ghcr.io/kyverno/cleanup-controller"
Description: Image repository
cleanupController.image.tag💣
Type: string
nil
Description: Image tag Defaults to appVersion in Chart.yaml if omitted
cleanupController.image.pullPolicy💣
Type: string
"IfNotPresent"
Description: Image pull policy
cleanupController.image.pullSecrets💣
Type: list
[]
Default value (formatted)
[]
Description: Image pull secrets
cleanupController.replicas💣
Type: int
nil
Description: Desired number of pods
cleanupController.priorityClassName💣
Type: string
""
Description: Optional priority class
cleanupController.hostNetwork💣
Type: bool
false
Description: Change hostNetwork to true when you want the pod to share its host’s network namespace. Useful for situations like when you end up dealing with a custom CNI over Amazon EKS. Update the dnsPolicy accordingly as well to suit the host network mode.
cleanupController.dnsPolicy💣
Type: string
"ClusterFirst"
Description: dnsPolicy determines the manner in which DNS resolution happens in the cluster. In case of hostNetwork: true, usually, the dnsPolicy is suitable to be ClusterFirstWithHostNet. For further reference: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy.
cleanupController.extraArgs💣
Type: list
[]
Default value (formatted)
[]
Description: Extra arguments passed to the container on the command line
cleanupController.resources.limits💣
Type: object
{"memory":"128Mi"}
Default value (formatted)
{
"memory": "128Mi"
}
Description: Pod resource limits
cleanupController.resources.requests💣
Type: object
{"cpu":"100m","memory":"64Mi"}
Default value (formatted)
{
"cpu": "100m",
"memory": "64Mi"
}
Description: Pod resource requests
cleanupController.nodeSelector💣
Type: object
{}
Default value (formatted)
{}
Description: Node labels for pod assignment
cleanupController.tolerations💣
Type: list
[]
Default value (formatted)
[]
Description: List of node taints to tolerate
cleanupController.antiAffinity.enabled💣
Type: bool
true
Description: Pod antiAffinities toggle. Enabled by default but can be disabled if you want to schedule pods to the same node.
cleanupController.podAffinity💣
Type: object
{}
Default value (formatted)
{}
Description: Pod affinity constraints.
cleanupController.nodeAffinity💣
Type: object
{}
Default value (formatted)
{}
Description: Node affinity constraints.
cleanupController.topologySpreadConstraints💣
Type: list
[]
Default value (formatted)
[]
Description: Topology spread constraints.
cleanupController.podSecurityContext💣
Type: object
{}
Default value (formatted)
{}
Description: Security context for the pod
cleanupController.securityContext💣
Type: object
{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}
Default value (formatted)
{
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"ALL"
]
},
"privileged": false,
"readOnlyRootFilesystem": true,
"runAsNonRoot": true,
"seccompProfile": {
"type": "RuntimeDefault"
}
}
Description: Security context for the containers
cleanupController.podDisruptionBudget.minAvailable💣
Type: int
1
Description: Configures the minimum available pods for disruptions. Cannot be used if maxUnavailable is set.
cleanupController.podDisruptionBudget.maxUnavailable💣
Type: string
nil
Description: Configures the maximum unavailable pods for disruptions. Cannot be used if minAvailable is set.
cleanupController.service.port💣
Type: int
443
Description: Service port.
cleanupController.service.type💣
Type: string
"ClusterIP"
Description: Service type.
cleanupController.service.nodePort💣
Type: string
nil
Description: Service node port. Only used if service.type is NodePort.
cleanupController.service.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Service annotations.
cleanupController.metricsService.create💣
Type: bool
true
Description: Create service.
cleanupController.metricsService.port💣
Type: int
8000
Description: Service port. Metrics server will be exposed at this port.
cleanupController.metricsService.type💣
Type: string
"ClusterIP"
Description: Service type.
cleanupController.metricsService.nodePort💣
Type: string
nil
Description: Service node port. Only used if metricsService.type is NodePort.
cleanupController.metricsService.annotations💣
Type: object
{}
Default value (formatted)
{}
Description: Service annotations.
cleanupController.serviceMonitor.enabled💣
Type: bool
false
Description: Create a ServiceMonitor to collect Prometheus metrics.
cleanupController.serviceMonitor.additionalLabels💣
Type: string
nil
Description: Additional labels
cleanupController.serviceMonitor.namespace💣
Type: string
nil
Description: Override namespace (default is the same as kyverno)
cleanupController.serviceMonitor.interval💣
Type: string
"30s"
Description: Interval to scrape metrics
cleanupController.serviceMonitor.scrapeTimeout💣
Type: string
"25s"
Description: Timeout if metrics can’t be retrieved in given time interval
cleanupController.serviceMonitor.secure💣
Type: bool
false
Description: Is TLS required for endpoint
cleanupController.serviceMonitor.tlsConfig💣
Type: object
{}
Default value (formatted)
{}
Description: TLS Configuration for endpoint
cleanupController.tracing.enabled💣
Type: bool
false
Description: Enable tracing
cleanupController.tracing.address💣
Type: string
nil
Description: Traces receiver address
cleanupController.tracing.port💣
Type: string
nil
Description: Traces receiver port
cleanupController.tracing.creds💣
Type: string
""
Description: Traces receiver credentials
cleanupController.logging.format💣
Type: string
"text"
Description: Logging format
cleanupController.metering.disabled💣
Type: bool
false
Description: Disable metrics export
cleanupController.metering.config💣
Type: string
"prometheus"
Description: Otel configuration, can be prometheus or grpc
cleanupController.metering.port💣
Type: int
8000
Description: Prometheus endpoint port
cleanupController.metering.collector💣
Type: string
""
Description: Otel collector endpoint
cleanupController.metering.creds💣
Type: string
""
Description: Otel collector credentials