admissionController: replicas: 3 antiAffinity: # anti-affinity won't work on SNO enabled: false resources: limits: memory: 512Mi requests: cpu: 100m memory: 256Mi backgroundController: replicas: 1 antiAffinity: # anti-affinity won't work on SNO enabled: false cleanupController: replicas: 1 antiAffinity: # anti-affinity won't work on SNO enabled: false resources: limits: memory: 256Mi requests: cpu: 100m memory: 128Mi reportsController: replicas: 1 antiAffinity: # anti-affinity won't work on SNO enabled: false resources: limits: memory: 256Mi cpu: 4000m requests: cpu: 100m memory: 128Mi crds: install: true annotations: argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true apiVersionOverride: podDisruptionBudget: policy/v1 config: resourceFilters: - '[Event,*,*]' - '[*/*,default,*]' - '[*/*,kube-system,*]' - '[*/*,kube-public,*]' - '[*/*,kube-node-lease,*]' - '[*/*,openshift,*]' - '[*/*, openshift-*, *]' - '[*/*,open-cluster-*,*]' - '[*/*,hive,*]' - '[*/*, multicluster-engine,*]' - '[*/*,stackrox,*]' - '[*/*,rhacs-operator,*]' - '[*/*,costmanagement-metrics-operator,*]' - '[Node,*,*]' - '[Node/*,*,*]' - '[APIService,*,*]' - '[APIService/*,*,*]' - '[TokenReview,*,*]' - '[SubjectAccessReview,*,*]' - '[SelfSubjectAccessReview,*,*]' - '[Binding,*,*]' - '[Pod/binding,*,*]' - '[ReplicaSet,*,*]' - '[ReplicaSet/*,*,*]' - '[AdmissionReport,*,*]' - '[AdmissionReport/*,*,*]' - '[ClusterAdmissionReport,*,*]' - '[ClusterAdmissionReport/*,*,*]' - '[BackgroundScanReport,*,*]' - '[BackgroundScanReport/*,*,*]' - '[ClusterBackgroundScanReport,*,*]' - '[ClusterBackgroundScanReport/*,*,*]' # exclude resources from the chart - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]' - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]' - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]' - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]' - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]' - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]' - '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]' - '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]' - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]' - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]' - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]' - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]' - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]' webhooks: # Exclude namespaces - namespaceSelector: matchExpressions: - key: kubernetes.io/metadata.name operator: NotIn values: # System namespaces - default - kyverno - kube-system - kube-node-lease # OpenShift layered products - assisted-installer - cert-manager - cert-manager-operator - stackrox - stackrox-secured-cluster-service - rhacs-operator - multicluster-engine - open-cluster-management - open-cluster-management-hub - open-cluster-management-observability - open-cluster-management-addon-observability - open-cluster-management-agent - open-cluster-management-agent-addon - open-cluster-management-global-set # Third Party - external-secrets # OpenShift namespaces - openshift - openshift-apiserver - openshift-apiserver-operator - openshift-authentication - openshift-authentication-operator - openshift-cloud-controller-manager - openshift-cloud-controller-manager-operator - openshift-cloud-credential-operator - openshift-cloud-network-config-controller - openshift-cluster-csi-drivers - openshift-cluster-machine-approver - openshift-cluster-node-tuning-operator - openshift-cluster-samples-operator - openshift-cluster-storage-operator - openshift-cluster-version - openshift-config - openshift-config-managed - openshift-config-operator - openshift-console - openshift-console-operator - openshift-console-user-settings - openshift-controller-manager - openshift-controller-manager-operator - openshift-dns - openshift-dns-operator - openshift-etcd - openshift-etcd-operator - openshift-gitops - openshift-host-network - openshift-image-registry - openshift-infra - openshift-ingress - openshift-ingress-canary - openshift-ingress-operator - openshift-insights - openshift-kni-infra - openshift-kube-apiserver - openshift-kube-apiserver-operator - openshift-kube-controller-manager - openshift-kube-controller-manager-operator - openshift-kube-scheduler - openshift-kube-scheduler-operator - openshift-kube-storage-version-migrator - openshift-kube-storage-version-migrator-operator - openshift-machine-api - openshift-machine-config-operator - openshift-marketplace - openshift-monitoring - openshift-multus - openshift-network-diagnostics - openshift-network-operator - openshift-node - openshift-nutanix-infra - openshift-oauth-apiserver - openshift-openstack-infra - openshift-operator-lifecycle-manager - openshift-operators - openshift-ovirt-infra - openshift-ovn-kubernetes - openshift-pipelines - openshift-route-controller-manager - openshift-service-ca - openshift-service-ca-operator - openshift-storage - openshift-user-workload-monitoring - openshift-vsphere-infra