policy values.yaml¶
serviceAccount.gatekeeperAdmin.create¶
Type: bool
Default value
true
upstream.nameOverride¶
Type: string
Default value
"gatekeeper"
upstream.fullnameOverride¶
Type: string
Default value
"gatekeeper"
upstream.auditMatchKindOnly¶
Type: bool
Default value
true
upstream.constraintViolationsLimit¶
Type: int
Default value
1000
upstream.disableMutation¶
Type: bool
Default value
true
upstream.validatingWebhookTimeoutSeconds¶
Type: int
Default value
15
upstream.logDenies¶
Type: bool
Default value
true
upstream.logMutations¶
Type: bool
Default value
true
upstream.emitAdmissionEvents¶
Type: bool
Default value
false
upstream.emitAuditEvents¶
Type: bool
Default value
false
upstream.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/openpolicyagent/gatekeeper"
upstream.image.release¶
Type: string
Default value
"v3.23.0"
upstream.image.pullSecrets[0].name¶
Type: string
Default value
"private-registry"
upstream.image.crdRepository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
upstream.preInstall.crdRepository.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
upstream.preInstall.crdRepository.image.tag¶
Type: string
Default value
"v1.35"
upstream.postUpgrade.labelNamespace.serviceAccount.create¶
Type: bool
Default value
false
upstream.postUpgrade.labelNamespace.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
upstream.postUpgrade.labelNamespace.image.tag¶
Type: string
Default value
"v1.35"
upstream.postUpgrade.labelNamespace.image.pullSecrets[0].name¶
Type: string
Default value
"private-registry"
upstream.postUpgrade.labelNamespace.podSecurity¶
Type: list
Default value
[]
upstream.postInstall.labelNamespace.serviceAccount.create¶
Type: bool
Default value
false
upstream.postInstall.labelNamespace.enabled¶
Type: bool
Default value
false
upstream.postInstall.labelNamespace.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
upstream.postInstall.labelNamespace.image.tag¶
Type: string
Default value
"v1.35"
upstream.postInstall.labelNamespace.image.pullSecrets[0].name¶
Type: string
Default value
"private-registry"
upstream.postInstall.labelNamespace.podSecurity¶
Type: list
Default value
[]
upstream.postInstall.probeWebhook.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/big-bang/base"
upstream.postInstall.probeWebhook.image.tag¶
Type: string
Default value
"2.1.0"
upstream.postInstall.probeWebhook.image.pullSecrets[0].name¶
Type: string
Default value
"private-registry"
upstream.preUninstall.deleteWebhookConfigurations.image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
upstream.preUninstall.deleteWebhookConfigurations.image.tag¶
Type: string
Default value
"v1.35"
upstream.preUninstall.deleteWebhookConfigurations.image.pullSecrets[0].name¶
Type: string
Default value
"private-registry"
upstream.podAnnotations.”container.seccomp.security.alpha.kubernetes.io/manager”¶
Type: string
Default value
"runtime/default"
upstream.controllerManager.resources.limits.cpu¶
Type: string
Default value
"175m"
upstream.controllerManager.resources.requests.cpu¶
Type: string
Default value
"175m"
upstream.audit.enablePubsub¶
Type: bool
Default value
false
upstream.audit.resources.limits.cpu¶
Type: float
Default value
1.2
upstream.audit.resources.limits.memory¶
Type: string
Default value
"768Mi"
upstream.audit.resources.requests.cpu¶
Type: float
Default value
1.2
upstream.audit.resources.requests.memory¶
Type: string
Default value
"768Mi"
upstream.upgradeCRDs.enabled¶
Type: bool
Default value
false
upstream.serviceAccount.gatekeeperAdmin.create¶
Type: bool
Default value
false
violations.allowedAppArmorProfiles.enabled¶
Type: bool
Default value
false
violations.allowedAppArmorProfiles.enforcementAction¶
Type: string
Default value
"dryrun"
violations.allowedAppArmorProfiles.kind¶
Type: string
Default value
"K8sPSPAppArmor"
violations.allowedAppArmorProfiles.name¶
Type: string
Default value
"allowed-app-armor-profiles"
violations.allowedAppArmorProfiles.match¶
Type: object
Default value
{}
violations.allowedAppArmorProfiles.parameters.allowedProfiles[0]¶
Type: string
Default value
"runtime/default"
violations.allowedAppArmorProfiles.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedCapabilities.enabled¶
Type: bool
Default value
true
violations.allowedCapabilities.enforcementAction¶
Type: string
Default value
"dryrun"
violations.allowedCapabilities.kind¶
Type: string
Default value
"K8sPSPCapabilities"
violations.allowedCapabilities.name¶
Type: string
Default value
"allowed-capabilities"
violations.allowedCapabilities.match¶
Type: object
Default value
{}
violations.allowedCapabilities.parameters.allowedCapabilities¶
Type: list
Default value
[]
violations.allowedCapabilities.parameters.requiredDropCapabilities[0]¶
Type: string
Default value
"all"
violations.allowedCapabilities.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedDockerRegistries.enabled¶
Type: bool
Default value
true
violations.allowedDockerRegistries.enforcementAction¶
Type: string
Default value
"deny"
violations.allowedDockerRegistries.kind¶
Type: string
Default value
"K8sAllowedRepos"
violations.allowedDockerRegistries.name¶
Type: string
Default value
"allowed-docker-registries"
violations.allowedDockerRegistries.match¶
Type: object
Default value
{}
violations.allowedDockerRegistries.parameters.repos[0]¶
Type: string
Default value
"registry1.dso.mil"
violations.allowedDockerRegistries.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedFlexVolumes.enabled¶
Type: bool
Default value
true
violations.allowedFlexVolumes.enforcementAction¶
Type: string
Default value
"deny"
violations.allowedFlexVolumes.kind¶
Type: string
Default value
"K8sPSPFlexVolumes"
violations.allowedFlexVolumes.name¶
Type: string
Default value
"allowed-flex-volumes"
violations.allowedFlexVolumes.match¶
Type: object
Default value
{}
violations.allowedFlexVolumes.parameters.allowedFlexVolumes¶
Type: list
Default value
[]
violations.allowedFlexVolumes.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedHostFilesystem.enabled¶
Type: bool
Default value
true
violations.allowedHostFilesystem.enforcementAction¶
Type: string
Default value
"deny"
violations.allowedHostFilesystem.kind¶
Type: string
Default value
"K8sPSPHostFilesystem"
violations.allowedHostFilesystem.name¶
Type: string
Default value
"allowed-host-filesystem"
violations.allowedHostFilesystem.match¶
Type: object
Default value
{}
violations.allowedHostFilesystem.parameters.allowedHostPaths¶
Type: list
Default value
[]
violations.allowedHostFilesystem.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedIPs.enabled¶
Type: bool
Default value
true
violations.allowedIPs.enforcementAction¶
Type: string
Default value
"deny"
violations.allowedIPs.kind¶
Type: string
Default value
"K8sExternalIPs"
violations.allowedIPs.name¶
Type: string
Default value
"allowed-ips"
violations.allowedIPs.match¶
Type: object
Default value
{}
violations.allowedIPs.parameters.allowedIPs¶
Type: list
Default value
[]
violations.allowedIPs.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedProcMount.enabled¶
Type: bool
Default value
true
violations.allowedProcMount.enforcementAction¶
Type: string
Default value
"deny"
violations.allowedProcMount.kind¶
Type: string
Default value
"K8sPSPProcMount"
violations.allowedProcMount.name¶
Type: string
Default value
"allowed-proc-mount"
violations.allowedProcMount.match¶
Type: object
Default value
{}
violations.allowedProcMount.parameters.procMount¶
Type: string
Default value
"Default"
violations.allowedProcMount.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedSecCompProfiles.enabled¶
Type: bool
Default value
true
violations.allowedSecCompProfiles.enforcementAction¶
Type: string
Default value
"dryrun"
violations.allowedSecCompProfiles.kind¶
Type: string
Default value
"K8sPSPSeccomp"
violations.allowedSecCompProfiles.name¶
Type: string
Default value
"allowed-sec-comp-profiles"
violations.allowedSecCompProfiles.match¶
Type: object
Default value
{}
violations.allowedSecCompProfiles.parameters.allowedProfiles[0]¶
Type: string
Default value
"runtime/default"
violations.allowedSecCompProfiles.parameters.excludedResources¶
Type: list
Default value
[]
violations.allowedUsers.enabled¶
Type: bool
Default value
true
violations.allowedUsers.enforcementAction¶
Type: string
Default value
"dryrun"
violations.allowedUsers.kind¶
Type: string
Default value
"K8sPSPAllowedUsers"
violations.allowedUsers.name¶
Type: string
Default value
"allowed-users"
violations.allowedUsers.match¶
Type: object
Default value
{}
violations.allowedUsers.parameters.runAsUser.rule¶
Type: string
Default value
"MustRunAsNonRoot"
violations.allowedUsers.parameters.fsGroup.rule¶
Type: string
Default value
"MustRunAs"
violations.allowedUsers.parameters.fsGroup.ranges[0].min¶
Type: int
Default value
1000
violations.allowedUsers.parameters.fsGroup.ranges[0].max¶
Type: int
Default value
65535
violations.allowedUsers.parameters.runAsGroup.rule¶
Type: string
Default value
"MustRunAs"
violations.allowedUsers.parameters.runAsGroup.ranges[0].min¶
Type: int
Default value
1000
violations.allowedUsers.parameters.runAsGroup.ranges[0].max¶
Type: int
Default value
65535
violations.allowedUsers.parameters.supplementalGroups.rule¶
Type: string
Default value
"MustRunAs"
violations.allowedUsers.parameters.supplementalGroups.ranges[0].min¶
Type: int
Default value
1000
violations.allowedUsers.parameters.supplementalGroups.ranges[0].max¶
Type: int
Default value
65535
violations.allowedUsers.parameters.excludedResources¶
Type: list
Default value
[]
violations.bannedImageTags.enabled¶
Type: bool
Default value
true
violations.bannedImageTags.enforcementAction¶
Type: string
Default value
"deny"
violations.bannedImageTags.kind¶
Type: string
Default value
"K8sBannedImageTags"
violations.bannedImageTags.name¶
Type: string
Default value
"banned-image-tags"
violations.bannedImageTags.match¶
Type: object
Default value
{}
violations.bannedImageTags.parameters.tags[0]¶
Type: string
Default value
"latest"
violations.bannedImageTags.parameters.excludedResources¶
Type: list
Default value
[]
violations.blockNodePort.enabled¶
Type: bool
Default value
true
violations.blockNodePort.enforcementAction¶
Type: string
Default value
"dryrun"
violations.blockNodePort.kind¶
Type: string
Default value
"K8sBlockNodePort"
violations.blockNodePort.name¶
Type: string
Default value
"block-node-ports"
violations.blockNodePort.match¶
Type: object
Default value
{}
violations.blockNodePort.parameters.excludedResources¶
Type: list
Default value
[]
violations.containerRatio.enabled¶
Type: bool
Default value
true
violations.containerRatio.enforcementAction¶
Type: string
Default value
"dryrun"
violations.containerRatio.kind¶
Type: string
Default value
"K8sContainerRatios"
violations.containerRatio.name¶
Type: string
Default value
"container-ratios"
violations.containerRatio.match¶
Type: object
Default value
{}
violations.containerRatio.parameters.ratio¶
Type: string
Default value
"2"
violations.containerRatio.parameters.excludedResources¶
Type: list
Default value
[]
violations.hostNetworking.enabled¶
Type: bool
Default value
true
violations.hostNetworking.enforcementAction¶
Type: string
Default value
"deny"
violations.hostNetworking.kind¶
Type: string
Default value
"K8sPSPHostNetworkingPorts"
violations.hostNetworking.name¶
Type: string
Default value
"host-networking"
violations.hostNetworking.match¶
Type: object
Default value
{}
violations.hostNetworking.parameters.hostNetwork¶
Type: bool
Default value
false
violations.hostNetworking.parameters.min¶
Type: int
Default value
0
violations.hostNetworking.parameters.max¶
Type: int
Default value
0
violations.hostNetworking.parameters.excludedResources¶
Type: list
Default value
[]
violations.httpsOnly.enabled¶
Type: bool
Default value
true
violations.httpsOnly.enforcementAction¶
Type: string
Default value
"deny"
violations.httpsOnly.kind¶
Type: string
Default value
"K8sHttpsOnly2"
violations.httpsOnly.name¶
Type: string
Default value
"https-only"
violations.httpsOnly.match¶
Type: object
Default value
{}
violations.httpsOnly.parameters.excludedResources¶
Type: list
Default value
[]
violations.imageDigest.enabled¶
Type: bool
Default value
true
violations.imageDigest.enforcementAction¶
Type: string
Default value
"dryrun"
violations.imageDigest.kind¶
Type: string
Default value
"K8sImageDigests2"
violations.imageDigest.name¶
Type: string
Default value
"image-digest"
violations.imageDigest.match¶
Type: object
Default value
{}
violations.imageDigest.parameters.excludedResources¶
Type: list
Default value
[]
violations.namespacesHaveIstio.enabled¶
Type: bool
Default value
true
violations.namespacesHaveIstio.enforcementAction¶
Type: string
Default value
"dryrun"
violations.namespacesHaveIstio.kind¶
Type: string
Default value
"K8sRequiredLabelValues"
violations.namespacesHaveIstio.name¶
Type: string
Default value
"namespaces-have-istio"
violations.namespacesHaveIstio.match.namespaceSelector.matchExpressions[0].key¶
Type: string
Default value
"admission.gatekeeper.sh/ignore"
violations.namespacesHaveIstio.match.namespaceSelector.matchExpressions[0].operator¶
Type: string
Default value
"DoesNotExist"
violations.namespacesHaveIstio.parameters.labels[0].allowedRegex¶
Type: string
Default value
"^enabled"
violations.namespacesHaveIstio.parameters.labels[0].key¶
Type: string
Default value
"istio-injection"
violations.namespacesHaveIstio.parameters.excludedResources¶
Type: list
Default value
[]
violations.noBigContainers.enabled¶
Type: bool
Default value
true
violations.noBigContainers.enforcementAction¶
Type: string
Default value
"dryrun"
violations.noBigContainers.kind¶
Type: string
Default value
"K8sContainerLimits"
violations.noBigContainers.name¶
Type: string
Default value
"no-big-container"
violations.noBigContainers.match¶
Type: object
Default value
{}
violations.noBigContainers.parameters.cpu¶
Type: string
Default value
"2000m"
violations.noBigContainers.parameters.memory¶
Type: string
Default value
"4G"
violations.noBigContainers.parameters.excludedResources¶
Type: list
Default value
[]
violations.noHostNamespace.enabled¶
Type: bool
Default value
true
violations.noHostNamespace.enforcementAction¶
Type: string
Default value
"deny"
violations.noHostNamespace.kind¶
Type: string
Default value
"K8sPSPHostNamespace2"
violations.noHostNamespace.name¶
Type: string
Default value
"no-host-namespace"
violations.noHostNamespace.match¶
Type: object
Default value
{}
violations.noHostNamespace.parameters.excludedResources¶
Type: list
Default value
[]
violations.noPrivilegedContainers.enabled¶
Type: bool
Default value
true
violations.noPrivilegedContainers.enforcementAction¶
Type: string
Default value
"deny"
violations.noPrivilegedContainers.kind¶
Type: string
Default value
"K8sPSPPrivilegedContainer2"
violations.noPrivilegedContainers.name¶
Type: string
Default value
"no-privileged-containers"
violations.noPrivilegedContainers.match¶
Type: object
Default value
{}
violations.noPrivilegedContainers.parameters.excludedResources¶
Type: list
Default value
[]
violations.noDefaultServiceAccount.enabled¶
Type: bool
Default value
true
violations.noDefaultServiceAccount.enforcementAction¶
Type: string
Default value
"dryrun"
violations.noDefaultServiceAccount.kind¶
Type: string
Default value
"K8sDenySADefault"
violations.noDefaultServiceAccount.name¶
Type: string
Default value
"no-default-service-account"
violations.noDefaultServiceAccount.match¶
Type: object
Default value
{}
violations.noDefaultServiceAccount.parameters.excludedResources¶
Type: list
Default value
[]
violations.noPrivilegedEscalation.enabled¶
Type: bool
Default value
true
violations.noPrivilegedEscalation.enforcementAction¶
Type: string
Default value
"dryrun"
violations.noPrivilegedEscalation.kind¶
Type: string
Default value
"K8sPSPAllowPrivilegeEscalationContainer2"
violations.noPrivilegedEscalation.name¶
Type: string
Default value
"no-privileged-escalation"
violations.noPrivilegedEscalation.match¶
Type: object
Default value
{}
violations.noPrivilegedEscalation.parameters.excludedResources¶
Type: list
Default value
[]
violations.noSysctls.enabled¶
Type: bool
Default value
true
violations.noSysctls.enforcementAction¶
Type: string
Default value
"deny"
violations.noSysctls.kind¶
Type: string
Default value
"K8sPSPForbiddenSysctls"
violations.noSysctls.name¶
Type: string
Default value
"no-sysctls"
violations.noSysctls.match¶
Type: object
Default value
{}
violations.noSysctls.parameters.forbiddenSysctls[0]¶
Type: string
Default value
"*"
violations.noSysctls.parameters.excludedResources¶
Type: list
Default value
[]
violations.podsHaveIstio.enabled¶
Type: bool
Default value
true
violations.podsHaveIstio.enforcementAction¶
Type: string
Default value
"dryrun"
violations.podsHaveIstio.kind¶
Type: string
Default value
"K8sNoAnnotationValues"
violations.podsHaveIstio.name¶
Type: string
Default value
"pods-have-istio"
violations.podsHaveIstio.match¶
Type: object
Default value
{}
violations.podsHaveIstio.parameters.annotations[0].disallowedRegex¶
Type: string
Default value
"^false"
violations.podsHaveIstio.parameters.annotations[0].key¶
Type: string
Default value
"sidecar.istio.io/inject"
violations.podsHaveIstio.parameters.excludedResources¶
Type: list
Default value
[]
violations.readOnlyRoot.enabled¶
Type: bool
Default value
true
violations.readOnlyRoot.enforcementAction¶
Type: string
Default value
"dryrun"
violations.readOnlyRoot.kind¶
Type: string
Default value
"K8sPSPReadOnlyRootFilesystem2"
violations.readOnlyRoot.name¶
Type: string
Default value
"read-only-root"
violations.readOnlyRoot.match¶
Type: object
Default value
{}
violations.readOnlyRoot.parameters.excludedResources¶
Type: list
Default value
[]
violations.requiredLabels.enabled¶
Type: bool
Default value
true
violations.requiredLabels.enforcementAction¶
Type: string
Default value
"dryrun"
violations.requiredLabels.kind¶
Type: string
Default value
"K8sRequiredLabelValues"
violations.requiredLabels.name¶
Type: string
Default value
"required-labels"
violations.requiredLabels.match¶
Type: object
Default value
{}
violations.requiredLabels.parameters.labels[0].allowedRegex¶
Type: string
Default value
""
violations.requiredLabels.parameters.labels[0].key¶
Type: string
Default value
"app.kubernetes.io/name"
violations.requiredLabels.parameters.labels[1].allowedRegex¶
Type: string
Default value
""
violations.requiredLabels.parameters.labels[1].key¶
Type: string
Default value
"app.kubernetes.io/instance"
violations.requiredLabels.parameters.labels[2].allowedRegex¶
Type: string
Default value
""
violations.requiredLabels.parameters.labels[2].key¶
Type: string
Default value
"app.kubernetes.io/version"
violations.requiredLabels.parameters.labels[3].allowedRegex¶
Type: string
Default value
""
violations.requiredLabels.parameters.labels[3].key¶
Type: string
Default value
"app.kubernetes.io/component"
violations.requiredLabels.parameters.labels[4].allowedRegex¶
Type: string
Default value
""
violations.requiredLabels.parameters.labels[4].key¶
Type: string
Default value
"app.kubernetes.io/part-of"
violations.requiredLabels.parameters.labels[5].allowedRegex¶
Type: string
Default value
""
violations.requiredLabels.parameters.labels[5].key¶
Type: string
Default value
"app.kubernetes.io/managed-by"
violations.requiredLabels.parameters.excludedResources¶
Type: list
Default value
[]
violations.requiredProbes.enabled¶
Type: bool
Default value
true
violations.requiredProbes.enforcementAction¶
Type: string
Default value
"dryrun"
violations.requiredProbes.kind¶
Type: string
Default value
"K8sRequiredProbes"
violations.requiredProbes.name¶
Type: string
Default value
"required-probes"
violations.requiredProbes.match¶
Type: object
Default value
{}
violations.requiredProbes.parameters.probeTypes[0]¶
Type: string
Default value
"tcpSocket"
violations.requiredProbes.parameters.probeTypes[1]¶
Type: string
Default value
"httpGet"
violations.requiredProbes.parameters.probeTypes[2]¶
Type: string
Default value
"exec"
violations.requiredProbes.parameters.probes[0]¶
Type: string
Default value
"readinessProbe"
violations.requiredProbes.parameters.probes[1]¶
Type: string
Default value
"livenessProbe"
violations.requiredProbes.parameters.excludedResources¶
Type: list
Default value
[]
violations.restrictedTaint.enabled¶
Type: bool
Default value
true
violations.restrictedTaint.enforcementAction¶
Type: string
Default value
"deny"
violations.restrictedTaint.kind¶
Type: string
Default value
"RestrictedTaintToleration"
violations.restrictedTaint.name¶
Type: string
Default value
"restricted-taint"
violations.restrictedTaint.match¶
Type: object
Default value
{}
violations.restrictedTaint.parameters.allowGlobalToleration¶
Type: bool
Default value
false
violations.restrictedTaint.parameters.restrictedTaint.effect¶
Type: string
Default value
"NoSchedule"
violations.restrictedTaint.parameters.restrictedTaint.key¶
Type: string
Default value
"privileged"
violations.restrictedTaint.parameters.restrictedTaint.value¶
Type: string
Default value
"true"
violations.restrictedTaint.parameters.excludedResources¶
Type: list
Default value
[]
violations.selinuxPolicy.enabled¶
Type: bool
Default value
true
violations.selinuxPolicy.enforcementAction¶
Type: string
Default value
"deny"
violations.selinuxPolicy.kind¶
Type: string
Default value
"K8sPSPSELinuxV2"
violations.selinuxPolicy.name¶
Type: string
Default value
"selinux-policy"
violations.selinuxPolicy.match¶
Type: object
Default value
{}
violations.selinuxPolicy.parameters.allowedSELinuxOptions[0].level¶
Type: string
Default value
""
violations.selinuxPolicy.parameters.allowedSELinuxOptions[0].role¶
Type: string
Default value
""
violations.selinuxPolicy.parameters.allowedSELinuxOptions[0].type¶
Type: string
Default value
""
violations.selinuxPolicy.parameters.allowedSELinuxOptions[0].user¶
Type: string
Default value
""
violations.selinuxPolicy.parameters.excludedResources¶
Type: list
Default value
[]
violations.uniqueIngressHost.enabled¶
Type: bool
Default value
true
violations.uniqueIngressHost.enforcementAction¶
Type: string
Default value
"deny"
violations.uniqueIngressHost.kind¶
Type: string
Default value
"K8sUniqueIngressHost"
violations.uniqueIngressHost.name¶
Type: string
Default value
"unique-ingress-hosts"
violations.uniqueIngressHost.match¶
Type: object
Default value
{}
violations.uniqueIngressHost.parameters.excludedResources¶
Type: list
Default value
[]
violations.volumeTypes.enabled¶
Type: bool
Default value
true
violations.volumeTypes.enforcementAction¶
Type: string
Default value
"deny"
violations.volumeTypes.kind¶
Type: string
Default value
"K8sPSPVolumeTypes"
violations.volumeTypes.name¶
Type: string
Default value
"volume-types"
violations.volumeTypes.match¶
Type: object
Default value
{}
violations.volumeTypes.parameters.volumes[0]¶
Type: string
Default value
"configMap"
violations.volumeTypes.parameters.volumes[1]¶
Type: string
Default value
"emptyDir"
violations.volumeTypes.parameters.volumes[2]¶
Type: string
Default value
"projected"
violations.volumeTypes.parameters.volumes[3]¶
Type: string
Default value
"secret"
violations.volumeTypes.parameters.volumes[4]¶
Type: string
Default value
"downwardAPI"
violations.volumeTypes.parameters.volumes[5]¶
Type: string
Default value
"persistentVolumeClaim"
violations.volumeTypes.parameters.excludedResources¶
Type: list
Default value
[]
upgradeCRDs.enabled¶
Type: bool
Default value
false
cleanupCRDs.enabled¶
Type: bool
Default value
true
cleanupCRDs.containerSecurityContext.allowPrivilegeEscalation¶
Type: bool
Default value
false
cleanupCRDs.containerSecurityContext.capabilities.drop[0]¶
Type: string
Default value
"ALL"
cleanupCRDs.containerSecurityContext.readOnlyRootFilesystem¶
Type: bool
Default value
true
cleanupCRDs.containerSecurityContext.runAsGroup¶
Type: int
Default value
999
cleanupCRDs.containerSecurityContext.runAsNonRoot¶
Type: bool
Default value
true
cleanupCRDs.containerSecurityContext.runAsUser¶
Type: int
Default value
1000
cleanupCRDs.securityContext.runAsGroup¶
Type: int
Default value
999
cleanupCRDs.securityContext.runAsNonRoot¶
Type: bool
Default value
true
cleanupCRDs.securityContext.runAsUser¶
Type: int
Default value
1000
cleanupCRDs.securityContext.fsGroup¶
Type: int
Default value
999
cleanupCRDs.securityContext.supplementalGroups[0]¶
Type: int
Default value
999
image.repository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
image.pullPolicy¶
Type: string
Default value
"IfNotPresent"
image.pullSecrets[0].name¶
Type: string
Default value
"private-registry"
image.crdRepository¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl"
image.crdRelease¶
Type: string
Default value
"v1.35"
monitoring.enabled¶
Type: bool
Default value
false
networkPolicies.enabled¶
Type: bool
Default value
false
networkPolicies.ingress.defaults.allowPrometheusToIstioSidecar.enabled¶
Type: bool
Default value
false
networkPolicies.ingress.definitions.kubeAPI.from[0].ipBlock.cidr¶
Type: string
Default value
"192.168.0.0/16"
networkPolicies.ingress.definitions.kubeAPI.from[1].ipBlock.cidr¶
Type: string
Default value
"172.16.0.0/12"
networkPolicies.ingress.definitions.kubeAPI.from[2].ipBlock.cidr¶
Type: string
Default value
"10.0.0.0/8"
networkPolicies.ingress.to.gatekeeper:8443.from.definition.kubeAPI¶
Type: bool
Default value
true
networkPolicies.ingress.to.gatekeeper:8888.from.k8s.monitoring-monitoring-kube-prometheus@monitoring/prometheus¶
Type: bool
Default value
false
networkPolicies.egress.defaults.allowIstiod.enabled¶
Type: bool
Default value
false
networkPolicies.egress.from.gatekeeper.to.definition.kubeAPI¶
Type: bool
Default value
true
networkPolicies.egress.from.gatekeeper.to.k8s.udp:///:5353.enabled¶
Type: bool
Default value
false
networkPolicies.egress.from.crd-cleanup.podSelector.matchLabels.job-name¶
Type: string
Default value
"{{ .Chart.Name }}-crd-cleanup"
networkPolicies.egress.from.crd-cleanup.to.definition.kubeAPI¶
Type: bool
Default value
true
bbtests.enabled¶
Type: bool
Default value
false
bbtests.scripts.image¶
Type: string
Default value
"registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.35"
bbtests.scripts.securityContext.allowPrivilegeEscalation¶
Type: bool
Default value
false
bbtests.scripts.securityContext.capabilities.drop[0]¶
Type: string
Default value
"ALL"
bbtests.scripts.securityContext.readOnlyRootFilesystem¶
Type: bool
Default value
true
bbtests.scripts.securityContext.runAsGroup¶
Type: int
Default value
999
bbtests.scripts.securityContext.runAsNonRoot¶
Type: bool
Default value
true
bbtests.scripts.securityContext.runAsUser¶
Type: int
Default value
1000
bbtests.scripts.additionalVolumeMounts[0].name¶
Type: string
Default value
"{{ .Chart.Name }}-test-config"
bbtests.scripts.additionalVolumeMounts[0].mountPath¶
Type: string
Default value
"/yaml"
bbtests.scripts.additionalVolumeMounts[1].name¶
Type: string
Default value
"{{ .Chart.Name }}-kube-cache"
bbtests.scripts.additionalVolumeMounts[1].mountPath¶
Type: string
Default value
"/.kube/cache"
bbtests.scripts.additionalVolumes[0].name¶
Type: string
Default value
"{{ .Chart.Name }}-test-config"
bbtests.scripts.additionalVolumes[0].configMap.name¶
Type: string
Default value
"{{ .Chart.Name }}-test-config"
bbtests.scripts.additionalVolumes[1].name¶
Type: string
Default value
"{{ .Chart.Name }}-kube-cache"
bbtests.scripts.additionalVolumes[1].emptyDir¶
Type: object
Default value
{}
bbtests.openshift¶
Type: bool
Default value
false
postInstall.labelNamespace.serviceAccount.name¶
Type: string
Default value
"gatekeeper-update-namespace-label"
postInstall.labelNamespace.serviceAccount.create¶
Type: bool
Default value
true
postInstall.labelNamespace.enabled¶
Type: bool
Default value
true
rbac.create¶
Type: bool
Default value
false
postUpgrade.labelNamespace.serviceAccount.name¶
Type: string
Default value
"gatekeeper-update-namespace-label-post-upgrade"
postUpgrade.labelNamespace.serviceAccount.create¶
Type: bool
Default value
true
postUpgrade.labelNamespace.enabled¶
Type: bool
Default value
true