kyverno-policies values.yaml¶
enabled¶
Type: bool
true
Description: Enable policy deployments
validationFailureAction¶
Type: string
""
Description: Override all policies’ validation failure action with “Audit” or “Enforce”. If blank, uses policy setting.
failurePolicy¶
Type: string
"Fail"
Description: API server behavior if the webhook fails to respond (‘Ignore’, ‘Fail’) For more info: https://kyverno.io/docs/policy-types/cluster-policy/policy-settings/
background¶
Type: bool
true
Description: Policies background mode
webhookTimeoutSeconds¶
Type: int
30
Description: Override all policies’ time to wait for admission webhook to respond. If blank, uses policy setting or default (10). Range is 1 to 30.
autogenControllers¶
Type: string
"Deployment,ReplicaSet,DaemonSet,StatefulSet"
Description: Customize the target Pod controllers for the auto-generated rules. (Eg. none, Deployment, DaemonSet,Deployment,StatefulSet) For more info https://kyverno.io/docs/policy-types/cluster-policy/autogen/.
customLabels¶
Type: object
{}
Description: Additional labels to apply to all policies.
policies¶
Type: object
add-default-capability-drop:
enabled: false
add-default-securitycontext:
enabled: false
parameters:
fsGroup: 65534
runAsGroup: 65534
runAsNonRoot: true
runAsUser: 65534
autogenControllers: ''
background: ''
block-ephemeral-containers:
enabled: false
validationFailureAction: ''
clone-configs:
enabled: false
generateExisting: false
parameters:
clone: []
synchronize: true
disallow-annotations:
enabled: false
parameters:
disallow: []
validationFailureAction: ''
disallow-auto-mount-service-account-token:
enabled: false
validationFailureAction: ''
disallow-deprecated-apis:
enabled: false
validationFailureAction: ''
disallow-host-namespaces:
enabled: false
validationFailureAction: ''
disallow-image-tags:
enabled: false
parameters:
disallow:
- latest
validationFailureAction: ''
disallow-istio-injection-bypass:
enabled: false
validationFailureAction: ''
disallow-labels:
enabled: false
parameters:
disallow: []
validationFailureAction: ''
disallow-namespaces:
autogenControllers: Deployment,ReplicaSet,DaemonSet,StatefulSet,Job,CronJob
enabled: false
parameters:
disallow:
- default
validationFailureAction: ''
disallow-nodeport-services:
enabled: false
validationFailureAction: ''
disallow-pod-exec:
enabled: false
validationFailureAction: ''
disallow-privilege-escalation:
enabled: false
validationFailureAction: ''
disallow-privileged-containers:
enabled: false
validationFailureAction: ''
disallow-rbac-on-default-serviceaccounts:
enabled: false
matchConditions:
- expression: object.metadata.name != 'system:service-account-issuer-discovery'
name: exclude-service-account-issuer-discovery
validationFailureAction: ''
disallow-selinux-options:
enabled: false
parameters:
disallow:
- user
- role
validationFailureAction: ''
disallow-tolerations:
autogenControllers: Deployment,ReplicaSet,DaemonSet,StatefulSet,Job,CronJob
enabled: false
parameters:
disallow:
- key: node-role\.kubernetes\.io/master
validationFailureAction: ''
excludeContainers: []
excludeNamespaces: []
mpolFailurePolicy: ''
require-annotations:
enabled: false
parameters:
require: []
validationFailureAction: ''
require-cpu-limit:
enabled: false
parameters:
maxCPU: '10'
validationFailureAction: ''
require-drop-all-capabilities:
enabled: false
validationFailureAction: ''
require-image-signature:
enabled: false
parameters:
attestors:
- cosign:
ctlog:
ctLogPubKey: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpMBtyH6FHw55roUqrgLuWJcbmA4i
iWy4NU17Cs2awqUOvF1Qs1cOznUJcOwqXbQ2rluvUHHkQkHvyFBvo3OgiQ==
-----END PUBLIC KEY-----'
insecureIgnoreSCT: true
insecureIgnoreTlog: true
rekorPubKey: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpMBtyH6FHw55roUqrgLuWJcbmA4i
iWy4NU17Cs2awqUOvF1Qs1cOznUJcOwqXbQ2rluvUHHkQkHvyFBvo3OgiQ==
-----END PUBLIC KEY-----'
url: https://rekor.sigstore.dev/
key:
data: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7CjMGH005DFFz6mffqTIGurBt6fL
UfTZxuEDFRBS8mFJx1xw8DEVvjMibLTtqmAoJxUmzmGFgzz+LV875syVEg==
-----END PUBLIC KEY-----'
name: ironbank
credentials:
secrets:
- private-registry
matchImageReferences:
- glob: registry1.dso.mil/ironbank/*
validationConfigurations:
mutateDigest: false
verifyDigest: false
validationFailureAction: ''
require-istio-on-namespaces:
enabled: false
validationFailureAction: ''
require-labels:
enabled: false
parameters:
require: []
validationFailureAction: ''
require-memory-limit:
enabled: false
parameters:
maxMemory: 64Gi
validationFailureAction: ''
require-non-root-group:
enabled: false
validationFailureAction: ''
require-non-root-user:
enabled: false
validationFailureAction: ''
require-probes:
autogenControllers: DaemonSet,Deployment,StatefulSet
enabled: false
parameters:
livenessProbe: true
readinessProbe: true
startupProbe: false
validationFailureAction: ''
require-requests-equal-limits:
enabled: false
validationFailureAction: ''
require-ro-rootfs:
enabled: false
validationFailureAction: ''
restrict-apparmor:
enabled: false
parameters:
allow:
- runtime/default
- localhost/*
validationFailureAction: ''
restrict-capabilities:
enabled: false
parameters:
allow:
- NET_BIND_SERVICE
validationFailureAction: ''
restrict-external-ips:
enabled: false
parameters:
allow: []
validationFailureAction: ''
restrict-external-names:
enabled: false
parameters:
allow: []
validationFailureAction: ''
restrict-group-id:
enabled: false
parameters:
allow:
- min: 1000
deny: []
validationFailureAction: ''
restrict-host-path-mount:
enabled: false
parameters:
allow: []
validationFailureAction: ''
restrict-host-path-mount-pv:
enabled: false
parameters:
allow: []
validationFailureAction: ''
restrict-host-path-write:
enabled: false
parameters:
allow: []
validationFailureAction: ''
restrict-host-ports:
enabled: false
parameters:
allow: []
validationFailureAction: ''
restrict-image-registries:
enabled: false
parameters:
allow: []
validationFailureAction: ''
restrict-proc-mount:
enabled: false
parameters:
default: true
unmasked: false
validationFailureAction: ''
restrict-seccomp:
enabled: false
parameters:
localhost: true
runtimeDefault: true
unconfined: false
validationFailureAction: ''
restrict-selinux-type:
enabled: false
parameters:
allow:
- container_t
- container_init_t
- container_kvm_t
validationFailureAction: ''
restrict-sysctls:
enabled: false
parameters:
allow:
- kernel\.shm_rmid_forced
- net\.ipv4\.ip_local_port_range
- net\.ipv4\.ip_unprivileged_port_start
- net\.ipv4\.tcp_syncookies
- net\.ipv4\.ping_group_range
- net\.ipv4\.ip_local_reserved_ports
- net\.ipv4\.tcp_keepalive_time
- net\.ipv4\.tcp_fin_timeout
- net\.ipv4\.tcp_keepalive_intvl
- net\.ipv4\.tcp_keepalive_probes
validationFailureAction: ''
restrict-user-id:
enabled: false
parameters:
allow:
- min: 1000
deny: []
validationFailureAction: ''
restrict-volume-types:
enabled: false
parameters:
allow:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- persistentVolumeClaim
- projected
- secret
validationFailureAction: ''
update-automountserviceaccounttokens:
autogenControllers: Deployment,StatefulSet
enabled: false
update-automountserviceaccounttokens-default:
enabled: false
namespaces: []
update-image-pull-policy:
enabled: false
parameters:
update:
- to: Always
update-image-registry:
enabled: false
parameters:
update: []
vpolFailurePolicy: ''
webhookTimeoutSeconds: ''
Description: Policies with no tunables omit the parameters key entirely.
policies.vpolFailurePolicy¶
Type: string
""
Description: ValidatingPolicies.
policies.mpolFailurePolicy¶
Type: string
""
Description: No auto-derive from validationFailureAction because MPols don’t validate.
policies.background¶
Type: string
""
Description: Background scanning (true/false). Empty = falls through to top-level .Values.background.
policies.webhookTimeoutSeconds¶
Type: string
""
Description: Webhook timeout 1-30s. Empty = falls through to top-level .Values.webhookTimeoutSeconds.
policies.autogenControllers¶
Type: string
""
Description: Autogen controller list. Same comma-separated CamelCase format as top-level. Empty = falls through to top-level .Values.autogenControllers.
policies.excludeNamespaces¶
Type: list
[]
Description: subjects, roles), use per-policy matchConditions with CEL expressions.
policies.excludeContainers¶
Type: list
[]
Description: Merged with per-policy excludeContainers.
policies.add-default-capability-drop¶
Type: object
enabled: false
Description: Add default capability drops when absent (MutatingPolicy)
policies.add-default-securitycontext¶
Type: object
enabled: false
parameters:
fsGroup: 65534
runAsGroup: 65534
runAsNonRoot: true
runAsUser: 65534
Description: Add default pod securityContext fields when absent (MutatingPolicy)
policies.add-default-securitycontext.parameters.runAsNonRoot¶
Type: bool
true
Description: Default pod securityContext values (applied only when field is absent)
policies.block-ephemeral-containers¶
Type: object
enabled: false
validationFailureAction: ''
Description: Block ephemeral (debug) containers (VPol)
policies.block-ephemeral-containers.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.clone-configs¶
Type: object
enabled: false
generateExisting: false
parameters:
clone: []
synchronize: true
Description: Clone ConfigMaps/Secrets into new namespaces (GeneratingPolicy)
policies.clone-configs.parameters.clone¶
Type: list
[]
Description: ConfigMaps or Secrets to clone. Same structure as the CPol clone-configs policy. When enabled is true, this list must be non-empty or templating fails.
policies.clone-configs.generateExisting¶
Type: bool
false
Description: Whether to retroactively clone into existing namespaces
policies.clone-configs.synchronize¶
Type: bool
true
Description: Keep cloned resources in sync with the source
policies.disallow-annotations¶
Type: object
enabled: false
parameters:
disallow: []
validationFailureAction: ''
Description: Disallow specified annotations on all pods (VPol)
policies.disallow-annotations.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-annotations.parameters.disallow¶
Type: list
[]
Description: Annotations disallowed on all pods. Each entry has a key (RE2 regex) and an optional value (RE2 regex). Both are auto-anchored with ^ and $. If value is omitted, any pod with a matching key is rejected regardless of value.
policies.disallow-deprecated-apis¶
Type: object
enabled: false
validationFailureAction: ''
Description: Disallow deprecated Kubernetes APIs (VPol)
policies.disallow-deprecated-apis.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-auto-mount-service-account-token¶
Type: object
enabled: false
validationFailureAction: ''
Description: Prevent automounting of Kubernetes API credentials on Pods and ServiceAccounts (VPol)
policies.disallow-auto-mount-service-account-token.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-host-namespaces¶
Type: object
enabled: false
validationFailureAction: ''
Description: Disallow host namespaces (VPol)
policies.disallow-host-namespaces.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-image-tags¶
Type: object
enabled: false
parameters:
disallow:
- latest
validationFailureAction: ''
Description: Disallow specified image tags on container images (VPol)
policies.disallow-image-tags.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-image-tags.parameters.disallow¶
Type: list
- latest
Description: Image tags disallowed on every container. Match is exact and case-sensitive; an image is rejected if it ends with :<tag> for any entry. Empty list keeps only the require-tag check active.
policies.disallow-istio-injection-bypass¶
Type: object
enabled: false
validationFailureAction: ''
Description: Disallow Istio sidecar injection bypass (VPol)
policies.disallow-istio-injection-bypass.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-labels¶
Type: object
enabled: false
parameters:
disallow: []
validationFailureAction: ''
Description: Disallow specified labels on all pods (VPol)
policies.disallow-labels.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-labels.parameters.disallow¶
Type: list
[]
Description: Labels disallowed on all pods. Each entry has a key (RE2 regex) and an optional value (RE2 regex). Both are auto-anchored with ^ and $. If value is omitted, any pod with a matching key is rejected regardless of value.
policies.disallow-namespaces¶
Type: object
autogenControllers: Deployment,ReplicaSet,DaemonSet,StatefulSet,Job,CronJob
enabled: false
parameters:
disallow:
- default
validationFailureAction: ''
Description: Disallow workloads in specified namespaces (VPol)
policies.disallow-namespaces.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-namespaces.autogenControllers¶
Type: string
"Deployment,ReplicaSet,DaemonSet,StatefulSet,Job,CronJob"
Description: Default autogen list adds Job and CronJob so workload kinds the CPol matched directly are still covered.
policies.disallow-namespaces.parameters.disallow¶
Type: list
- default
Description: Namespace names workloads must not be deployed into. Match is exact.
policies.disallow-nodeport-services¶
Type: object
enabled: false
validationFailureAction: ''
Description: Disallow NodePort Services (VPol)
policies.disallow-nodeport-services.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-pod-exec¶
Type: object
enabled: false
validationFailureAction: ''
Description: Disallow exec and attach on pods (VPol)
policies.disallow-pod-exec.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-privilege-escalation¶
Type: object
enabled: false
validationFailureAction: ''
Description: Disallow privilege escalation on containers (VPol)
policies.disallow-privilege-escalation.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-privileged-containers¶
Type: object
enabled: false
validationFailureAction: ''
Description: Prevent containers that run as privileged (VPol)
policies.disallow-privileged-containers.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-rbac-on-default-serviceaccounts¶
Type: object
enabled: false
matchConditions:
- expression: object.metadata.name != 'system:service-account-issuer-discovery'
name: exclude-service-account-issuer-discovery
validationFailureAction: ''
Description: Disallow RoleBinding and ClusterRoleBinding subjects that grant access to default ServiceAccounts or service account groups (VPol)
policies.disallow-rbac-on-default-serviceaccounts.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-rbac-on-default-serviceaccounts.matchConditions¶
Type: list
- expression: object.metadata.name != 'system:service-account-issuer-discovery'
name: exclude-service-account-issuer-discovery
Description: Additional CEL matchConditions. Default preserves the CPol exclusion for Kubernetes service account issuer discovery RBAC. Set to [] to remove this default exclusion.
policies.disallow-selinux-options¶
Type: object
enabled: false
parameters:
disallow:
- user
- role
validationFailureAction: ''
Description: Disallow specified SELinux options (VPol)
policies.disallow-selinux-options.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-selinux-options.parameters.disallow¶
Type: list
- user
- role
Description: SELinux option fields to disallow. Valid values: user, role, type, level. Defaults from https://kubernetes.io/docs/concepts/security/pod-security-standards
policies.disallow-tolerations¶
Type: object
autogenControllers: Deployment,ReplicaSet,DaemonSet,StatefulSet,Job,CronJob
enabled: false
parameters:
disallow:
- key: node-role\.kubernetes\.io/master
validationFailureAction: ''
Description: Disallow tolerations that bypass specified taints (VPol) The same parameters key feeds two rendered VPols: disallow-tolerations (Pod + autogen for controllers/CronJob) and disallow-tolerations-runtimeclass (RuntimeClass scheduling.tolerations).
policies.disallow-tolerations.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.disallow-tolerations.autogenControllers¶
Type: string
"Deployment,ReplicaSet,DaemonSet,StatefulSet,Job,CronJob"
Description: Default autogen list adds Job and CronJob so workload kinds the CPol matched directly are still covered.
policies.disallow-tolerations.parameters.disallow¶
Type: list
- key: node-role\.kubernetes\.io/master
Description: Disallowed taint patterns. Each entry can have key, value, and/or effect, all of which are RE2 regex (auto-anchored ^…$). A toleration is blocked when every present field on the disallow entry either matches the toleration or is absent from it — absent toleration fields are treated as wildcards, so {key: X} rejects a keyless operator: Exists toleration that would tolerate every taint including X.
policies.restrict-apparmor¶
Type: object
enabled: false
parameters:
allow:
- runtime/default
- localhost/*
validationFailureAction: ''
Description: Restrict AppArmor profiles to the specified list (VPol)
policies.restrict-apparmor.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-apparmor.parameters.allow¶
Type: list
- runtime/default
- localhost/*
Description: List of allowed AppArmor annotation values. Supports the same values as the CPol: runtime/default, localhost/<profile>, and wildcard patterns such as localhost/*. Defaults pulled from https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
policies.restrict-capabilities¶
Type: object
enabled: false
parameters:
allow:
- NET_BIND_SERVICE
validationFailureAction: ''
Description: Restrict the Linux capabilities containers may add (VPol)
policies.restrict-capabilities.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-capabilities.parameters.allow¶
Type: list
- NET_BIND_SERVICE
Description: List of capabilities that are allowed to be added. Defaults pulled from https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted See https://man7.org/linux/man-pages/man7/capabilities.7.html for the capability list. The CAP_ prefix is stripped in Kubernetes names. Empty list denies any addition.
policies.restrict-proc-mount¶
Type: object
enabled: false
parameters:
default: true
unmasked: false
validationFailureAction: ''
Description: Restrict mounting /proc to the specified mask (VPol)
policies.restrict-proc-mount.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-proc-mount.parameters.default¶
Type: bool
true
Description: Allow containers to set procMount: Default.
policies.restrict-proc-mount.parameters.unmasked¶
Type: bool
false
Description: Allow containers to set procMount: Unmasked.
policies.restrict-seccomp¶
Type: object
enabled: false
parameters:
localhost: true
runtimeDefault: true
unconfined: false
validationFailureAction: ''
Description: Restrict seccomp profile types to the specified list (VPol)
policies.restrict-seccomp.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-seccomp.parameters.localhost¶
Type: bool
true
Description: Allow pods and containers to set seccompProfile.type: Localhost.
policies.restrict-seccomp.parameters.runtimeDefault¶
Type: bool
true
Description: Allow pods and containers to set seccompProfile.type: RuntimeDefault.
policies.restrict-seccomp.parameters.unconfined¶
Type: bool
false
Description: Allow pods and containers to set seccompProfile.type: Unconfined.
policies.restrict-selinux-type¶
Type: object
enabled: false
parameters:
allow:
- container_t
- container_init_t
- container_kvm_t
validationFailureAction: ''
Description: Restrict SELinux types to the specified list (VPol)
policies.restrict-selinux-type.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-selinux-type.parameters.allow¶
Type: list
- container_t
- container_init_t
- container_kvm_t
Description: List of allowed values for the type field. Defaults pulled from https://kubernetes.io/docs/concepts/security/pod-security-standards
policies.restrict-sysctls¶
Type: object
enabled: false
parameters:
allow:
- kernel\.shm_rmid_forced
- net\.ipv4\.ip_local_port_range
- net\.ipv4\.ip_unprivileged_port_start
- net\.ipv4\.tcp_syncookies
- net\.ipv4\.ping_group_range
- net\.ipv4\.ip_local_reserved_ports
- net\.ipv4\.tcp_keepalive_time
- net\.ipv4\.tcp_fin_timeout
- net\.ipv4\.tcp_keepalive_intvl
- net\.ipv4\.tcp_keepalive_probes
validationFailureAction: ''
Description: Restrict sysctls to the specified list (VPol)
policies.restrict-sysctls.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-sysctls.parameters.allow¶
Type: list
- kernel\.shm_rmid_forced
- net\.ipv4\.ip_local_port_range
- net\.ipv4\.ip_unprivileged_port_start
- net\.ipv4\.tcp_syncookies
- net\.ipv4\.ping_group_range
- net\.ipv4\.ip_local_reserved_ports
- net\.ipv4\.tcp_keepalive_time
- net\.ipv4\.tcp_fin_timeout
- net\.ipv4\.tcp_keepalive_intvl
- net\.ipv4\.tcp_keepalive_probes
Description: List of allowed sysctls as RE2 regex patterns (auto-anchored ^…$). Example: “net\.ipv4\..+” to allow any sysctl under net.ipv4. Defaults pulled from https://kubernetes.io/docs/concepts/security/pod-security-standards
policies.require-annotations¶
Type: object
enabled: false
parameters:
require: []
validationFailureAction: ''
Description: Require specified annotations on all pods (VPol)
policies.require-annotations.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-annotations.parameters.require¶
Type: list
[]
Description: Annotations required on all pods. Each entry has a key (RE2 regex) and an optional value (RE2 regex). Both are auto-anchored with ^ and $. If value is omitted, any non-empty value is accepted.
policies.require-cpu-limit¶
Type: object
enabled: false
parameters:
maxCPU: '10'
validationFailureAction: ''
Description: Require containers have CPU limits defined (VPol)
policies.require-cpu-limit.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-cpu-limit.parameters.maxCPU¶
Type: string
"10"
Description: not a tight limit. Set to empty string to disable the upper-bound check.
policies.require-drop-all-capabilities¶
Type: object
enabled: false
validationFailureAction: ''
Description: Require containers to drop all Linux capabilities (VPol)
policies.require-drop-all-capabilities.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-image-signature¶
Type: object
enabled: false
parameters:
attestors:
- cosign:
ctlog:
ctLogPubKey: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpMBtyH6FHw55roUqrgLuWJcbmA4i
iWy4NU17Cs2awqUOvF1Qs1cOznUJcOwqXbQ2rluvUHHkQkHvyFBvo3OgiQ==
-----END PUBLIC KEY-----'
insecureIgnoreSCT: true
insecureIgnoreTlog: true
rekorPubKey: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpMBtyH6FHw55roUqrgLuWJcbmA4i
iWy4NU17Cs2awqUOvF1Qs1cOznUJcOwqXbQ2rluvUHHkQkHvyFBvo3OgiQ==
-----END PUBLIC KEY-----'
url: https://rekor.sigstore.dev/
key:
data: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7CjMGH005DFFz6mffqTIGurBt6fL
UfTZxuEDFRBS8mFJx1xw8DEVvjMibLTtqmAoJxUmzmGFgzz+LV875syVEg==
-----END PUBLIC KEY-----'
name: ironbank
credentials:
secrets:
- private-registry
matchImageReferences:
- glob: registry1.dso.mil/ironbank/*
validationConfigurations:
mutateDigest: false
verifyDigest: false
validationFailureAction: ''
Description: Require Cosign signatures on container images (IVPol) Renders an ImageValidatingPolicy (not a ValidatingPolicy) because CEL validation alone cannot run Cosign — the IVPol CRD ships a CEL environment with verifyImageSignatures that pulls signatures from the OCI registry.
policies.require-image-signature.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-image-signature.parameters.matchImageReferences¶
Type: list
- glob: registry1.dso.mil/ironbank/*
Description: Image globs that the policy applies to. Each entry is a glob or a CEL expression; images that don’t match any rule are skipped. See https://kyverno.io/docs/policy-types/image-validating-policy/.
policies.require-image-signature.parameters.attestors¶
Type: list
- cosign:
ctlog:
ctLogPubKey: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpMBtyH6FHw55roUqrgLuWJcbmA4i
iWy4NU17Cs2awqUOvF1Qs1cOznUJcOwqXbQ2rluvUHHkQkHvyFBvo3OgiQ==
-----END PUBLIC KEY-----'
insecureIgnoreSCT: true
insecureIgnoreTlog: true
rekorPubKey: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpMBtyH6FHw55roUqrgLuWJcbmA4i
iWy4NU17Cs2awqUOvF1Qs1cOznUJcOwqXbQ2rluvUHHkQkHvyFBvo3OgiQ==
-----END PUBLIC KEY-----'
url: https://rekor.sigstore.dev/
key:
data: '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7CjMGH005DFFz6mffqTIGurBt6fL
UfTZxuEDFRBS8mFJx1xw8DEVvjMibLTtqmAoJxUmzmGFgzz+LV875syVEg==
-----END PUBLIC KEY-----'
name: ironbank
Description: Cosign attestors (signing identities). Each entry needs a name and a cosign block with the public key and ctlog settings. The default ignores Rekor transparency log and SCT because Iron Bank images are signed offline.
policies.require-image-signature.parameters.credentials¶
Type: object
secrets:
- private-registry
Description: Registry credentials the Kyverno controller uses to fetch image manifests and signature artifacts. secrets references dockerconfig secrets that must exist in the Kyverno namespace (not the workload namespace). Required for private registries like registry1.dso.mil.
policies.require-image-signature.parameters.validationConfigurations¶
Type: object
mutateDigest: false
verifyDigest: false
Description: Whether to mutate image refs to include the resolved digest, and whether to require images to already have a digest. Iron Bank tags are mutable (nightly rebuilds) so both are off by default.
policies.require-istio-on-namespaces¶
Type: object
enabled: false
validationFailureAction: ''
Description: Require Istio sidecar injection label on namespaces (VPol)
policies.require-istio-on-namespaces.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-labels¶
Type: object
enabled: false
parameters:
require: []
validationFailureAction: ''
Description: Require specified labels on all pods (VPol)
policies.require-labels.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-labels.parameters.require¶
Type: list
[]
Description: Labels required on all pods. Each entry has a key (RE2 regex) and an optional value (RE2 regex). Both are auto-anchored with ^ and $. If value is omitted, any non-empty value is accepted.
policies.require-memory-limit¶
Type: object
enabled: false
parameters:
maxMemory: 64Gi
validationFailureAction: ''
Description: Require containers have memory limits defined (VPol)
policies.require-memory-limit.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-memory-limit.parameters.maxMemory¶
Type: string
"64Gi"
Description: Upper bound on memory limits. Rejects containers requesting more than this. Default “64Gi” approximates the CPol’s “<64Gi” ceiling (VPol uses <=, so exactly 64Gi is allowed unlike the CPol’s strict <64Gi). Not a tight limit. Set to empty string to disable the upper-bound check.
policies.require-non-root-group¶
Type: object
enabled: false
validationFailureAction: ''
Description: Require containers run with non-root group IDs (VPol)
policies.require-non-root-group.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-non-root-user¶
Type: object
enabled: false
validationFailureAction: ''
Description: Require containers run as non-root user (VPol)
policies.require-non-root-user.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-probes¶
Type: object
autogenControllers: DaemonSet,Deployment,StatefulSet
enabled: false
parameters:
livenessProbe: true
readinessProbe: true
startupProbe: false
validationFailureAction: ''
Description: Require liveness/readiness probes on containers (VPol)
policies.require-probes.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-probes.parameters.readinessProbe¶
Type: bool
true
Description: Require readinessProbe on all containers
policies.require-probes.parameters.livenessProbe¶
Type: bool
true
Description: Require livenessProbe on all containers
policies.require-probes.parameters.startupProbe¶
Type: bool
false
Description: Require startupProbe on all containers
policies.require-requests-equal-limits¶
Type: object
enabled: false
validationFailureAction: ''
Description: Require CPU and memory requests equal limits so containers get the Guaranteed QoS class (VPol)
policies.require-requests-equal-limits.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.require-ro-rootfs¶
Type: object
enabled: false
validationFailureAction: ''
Description: Require containers run with a read-only root filesystem (VPol)
policies.require-ro-rootfs.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-external-ips¶
Type: object
enabled: false
parameters:
allow: []
validationFailureAction: ''
Description: Restrict services with External IPs to an allow-list (VPol)
policies.restrict-external-ips.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-external-ips.parameters.allow¶
Type: list
[]
Description: List of RE2 regex patterns (auto-anchored ^…$). Example: “192\.168\.0\..+” to allow any IP in 192.168.0.0/24.
policies.restrict-external-names¶
Type: object
enabled: false
parameters:
allow: []
validationFailureAction: ''
Description: Restrict services with External Names to an allow-list (VPol)
policies.restrict-external-names.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-external-names.parameters.allow¶
Type: list
[]
Description: List of allowed external names as RE2 regex patterns (auto-anchored ^…$). Plain strings remain exact matches. Empty, missing, null, or empty-string input denies all ExternalName Services.
policies.restrict-group-id¶
Type: object
enabled: false
parameters:
allow:
- min: 1000
deny: []
validationFailureAction: ''
Description: Restrict runAsGroup, fsGroup, and supplementalGroups IDs to allowed ranges (VPol)
policies.restrict-group-id.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-group-id.parameters.allow¶
Type: list
- min: 1000
Description: Allowed group ID ranges. Each entry must set min, max, or both (both inclusive). A group ID passes if it falls in any allow range and no deny range. Empty allow means no positive constraint (any ID passes unless caught by deny).
policies.restrict-group-id.parameters.deny¶
Type: list
[]
Description: Excluded group ID ranges. A group ID fails if it falls in any deny range, even if also covered by allow. Same {min, max} shape.
policies.restrict-host-path-mount¶
Type: object
enabled: false
parameters:
allow: []
validationFailureAction: ''
Description: Restrict hostPath volume paths to the specified list (VPol)
policies.restrict-host-path-mount.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-host-path-mount.parameters.allow¶
Type: list
[]
Description: List of allowed hostPath volume paths as RE2 regex patterns (auto-anchored ^…$). Plain strings remain exact matches. Empty list denies all hostPath volumes.
policies.restrict-host-path-mount-pv¶
Type: object
enabled: false
parameters:
allow: []
validationFailureAction: ''
Description: Restrict the paths that can be mounted by PersistentVolume hostPath volumes to the allowed list (VPol)
policies.restrict-host-path-mount-pv.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-host-path-mount-pv.parameters.allow¶
Type: list
[]
Description: List of allowed paths for PersistentVolume hostPath volumes to mount. Supports literal paths and * wildcards, matching the legacy CPol values shape.
policies.restrict-host-path-write¶
Type: object
enabled: false
parameters:
allow: []
validationFailureAction: ''
Description: Require hostPath volumes to be mounted readOnly, with an allow-list of paths that may be writable (VPol)
policies.restrict-host-path-write.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-host-path-write.parameters.allow¶
Type: list
[]
Description: List of hostPath volume paths that may be mounted read/write as RE2 regex patterns (auto-anchored ^…$). Plain strings remain exact matches. Empty list requires all hostPath mounts to be readOnly.
policies.restrict-host-ports¶
Type: object
enabled: false
parameters:
allow: []
validationFailureAction: ''
Description: Restrict the host ports that containers may bind via hostPort (VPol)
policies.restrict-host-ports.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-host-ports.parameters.allow¶
Type: list
[]
Description: Allowed hostPort ranges. Each entry must set min, max, or both (both inclusive). A hostPort passes if it falls in any range. Empty list denies all host ports.
policies.restrict-image-registries¶
Type: object
enabled: false
parameters:
allow: []
validationFailureAction: ''
Description: Restricts container images to registries in the specified list (VPol)
policies.restrict-image-registries.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-image-registries.parameters.allow¶
Type: list
[]
Description: List of allowed registries that images may use
policies.restrict-user-id¶
Type: object
enabled: false
parameters:
allow:
- min: 1000
deny: []
validationFailureAction: ''
Description: Restrict runAsUser IDs to allowed ranges (VPol)
policies.restrict-user-id.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-user-id.parameters.allow¶
Type: list
- min: 1000
Description: Allowed user ID ranges. Each entry must set min, max, or both (both inclusive). A user ID passes if it falls in any allow range and no deny range. Empty allow means no positive constraint (any ID passes unless caught by deny).
policies.restrict-user-id.parameters.deny¶
Type: list
[]
Description: Excluded user ID ranges. A user ID fails if it falls in any deny range, even if also covered by allow. Same {min, max} shape.
policies.restrict-volume-types¶
Type: object
enabled: false
parameters:
allow:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- persistentVolumeClaim
- projected
- secret
validationFailureAction: ''
Description: Restrict volume types to the specified list (VPol)
policies.restrict-volume-types.validationFailureAction¶
Type: string
""
Description: Empty string falls through to the global validationFailureAction
policies.restrict-volume-types.parameters.allow¶
Type: list
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- persistentVolumeClaim
- projected
- secret
Description: List of allowed Volume types. Valid values are the volume types listed here: https://kubernetes.io/docs/concepts/storage/volumes/#volume-types Defaults pulled from https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
policies.update-automountserviceaccounttokens¶
Type: object
autogenControllers: Deployment,StatefulSet
enabled: false
Description: names are interpreted as anchored RE2 regexes.
policies.update-automountserviceaccounttokens.autogenControllers¶
Type: string
"Deployment,StatefulSet"
Description: Pinned to the kinds covered by the legacy ClusterPolicy. Override only if you also want DaemonSet / Job / CronJob template coverage.
policies.update-automountserviceaccounttokens-default¶
Type: object
enabled: false
namespaces: []
Description: Disable automounting the API token on the default ServiceAccount in the listed namespaces (MutatingPolicy)
policies.update-automountserviceaccounttokens-default.namespaces¶
Type: list
[]
Description: Namespaces whose default ServiceAccount should have API token automounting disabled. Existing and future default ServiceAccounts are both patched.
policies.update-image-pull-policy¶
Type: object
enabled: false
parameters:
update:
- to: Always
Description: Set imagePullPolicy on tagged (non-digest-pinned) container images (MutatingPolicy)
policies.update-image-pull-policy.parameters.update¶
Type: list
- to: Always
Description: List of imagePullPolicy rewrites applied to tagged images. An entry with an empty from rewrites every tagged image; a set from only rewrites containers whose current imagePullPolicy equals it. to must be one of Always, Never, or IfNotPresent. Later entries take precedence.
policies.update-image-registry¶
Type: object
enabled: false
parameters:
update: []
Description: Rewrite an existing image registry to a new one in containers, e.g. a local proxy or approved mirror (MutatingPolicy)
policies.update-image-registry.parameters.update¶
Type: list
[]
Description: List of registry rewrites applied to every container image. from is an RE2 regex matched against the image; the matched text is replaced with the literal to (no capture-group references). Later entries see earlier rewrites, so they can be chained.
additionalPolicies¶
Type: object
samplePolicy:
annotations:
policies.kyverno.io/category: Examples
policies.kyverno.io/description: This sample policy blocks pods from deploying
into the 'default' namespace.
policies.kyverno.io/severity: low
policies.kyverno.io/subject: Pod
policies.kyverno.io/title: Sample Policy
enabled: false
kind: ValidatingPolicy
spec:
matchConstraints:
resourceRules:
- apiGroups:
- ''
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- pods
validationActions:
- Audit
validations:
- expression: object.metadata.namespace != 'default'
message: Using 'default' namespace is not allowed.
Description: Adds custom CEL-based policies. See https://kyverno.io/docs/policy-types/overview/ .
additionalPolicies.samplePolicy¶
Type: object
annotations:
policies.kyverno.io/category: Examples
policies.kyverno.io/description: This sample policy blocks pods from deploying into
the 'default' namespace.
policies.kyverno.io/severity: low
policies.kyverno.io/subject: Pod
policies.kyverno.io/title: Sample Policy
enabled: false
kind: ValidatingPolicy
spec:
matchConstraints:
resourceRules:
- apiGroups:
- ''
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- pods
validationActions:
- Audit
validations:
- expression: object.metadata.namespace != 'default'
message: Using 'default' namespace is not allowed.
Description: Name of the policy. Additional policies can be added by adding a key.
additionalPolicies.samplePolicy.enabled¶
Type: bool
false
Description: Controls policy deployment
additionalPolicies.samplePolicy.kind¶
Type: string
"ValidatingPolicy"
Description: Kind of policy. One of ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy, DeletingPolicy.
additionalPolicies.samplePolicy.annotations¶
Type: object
policies.kyverno.io/category: Examples
policies.kyverno.io/description: This sample policy blocks pods from deploying into
the 'default' namespace.
policies.kyverno.io/severity: low
policies.kyverno.io/subject: Pod
policies.kyverno.io/title: Sample Policy
Description: Policy annotations to add
additionalPolicies.samplePolicy.annotations.”policies.kyverno.io/title”¶
Type: string
"Sample Policy"
Description: Human readable name of policy
additionalPolicies.samplePolicy.annotations.”policies.kyverno.io/category”¶
Type: string
"Examples"
Description: Category of policy. Arbitrary.
additionalPolicies.samplePolicy.annotations.”policies.kyverno.io/severity”¶
Type: string
"low"
Description: Severity of policy if a violation occurs. Choose “critical”, “high”, “medium”, “low”.
additionalPolicies.samplePolicy.annotations.”policies.kyverno.io/subject”¶
Type: string
"Pod"
Description: Type of resource policy applies to (e.g. Pod, Service, Namespace)
additionalPolicies.samplePolicy.annotations.”policies.kyverno.io/description”¶
Type: string
"This sample policy blocks pods from deploying into the 'default' namespace."
Description: Description of what the policy does, why it is important, and what items are allowed or unallowed.
additionalPolicies.samplePolicy.spec¶
Type: object
matchConstraints:
resourceRules:
- apiGroups:
- ''
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- pods
validationActions:
- Audit
validations:
- expression: object.metadata.namespace != 'default'
message: Using 'default' namespace is not allowed.
Description: Policy specification. See kubectl explain validatingpolicies.spec
additionalPolicyExceptions¶
Type: string
nil
Description: Adds additional policyExceptions. See https://kyverno.io/docs/policy-types/validating-policy/#exceptions
bbtests¶
Type: object
chainsawEnabled: false
enabled: false
imagePullSecret: private-registry
kyvernoCliEnabled: true
scripts:
additionalVolumeMounts:
- mountPath: /vpol
name: kyverno-policies-bbtest-vpol
- mountPath: /mpol
name: kyverno-policies-bbtest-mpol
- mountPath: /gpol
name: kyverno-policies-bbtest-gpol
- mountPath: /.kube/cache
name: kyverno-policies-bbtest-kube-cache
- mountPath: /tmp
name: kyverno-policies-bbtest-tmp
additionalVolumes:
- configMap:
name: kyverno-policies-bbtest-vpol
name: kyverno-policies-bbtest-vpol
- configMap:
name: kyverno-policies-bbtest-mpol
name: kyverno-policies-bbtest-mpol
- configMap:
name: kyverno-policies-bbtest-gpol
name: kyverno-policies-bbtest-gpol
- emptyDir: {}
name: kyverno-policies-bbtest-kube-cache
- emptyDir: {}
name: kyverno-policies-bbtest-tmp
envs:
CHAINSAW_ENABLED: '{{ .Values.bbtests.chainsawEnabled }}'
IMAGE_PULL_SECRET: '{{ .Values.bbtests.imagePullSecret }}'
KYVERNO_CLI_TESTS_ENABLED: '{{ .Values.bbtests.kyvernoCliEnabled }}'
image: registry1.dso.mil/ironbank/big-bang/devops-tester:1.2
permissions:
apiGroups:
- ''
resources:
- configmaps
- namespaces
verbs:
- create
- delete
- list
- get
Description: Reserved values for Big Bang test automation
waitJob.enabled¶
Type: bool
true
waitJob.kind¶
Type: string
"ClusterRole"
waitJob.permissions.apiGroups[0]¶
Type: string
"kyverno.io"
waitJob.permissions.resources[0]¶
Type: string
"clusterpolicies"
waitJob.permissions.resources[1]¶
Type: string
"policies"