270 lines
15 KiB
YAML
270 lines
15 KiB
YAML
admissionController:
|
|
replicas: 3
|
|
antiAffinity:
|
|
# anti-affinity won't work on SNO
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
|
|
backgroundController:
|
|
replicas: 1
|
|
antiAffinity:
|
|
# anti-affinity won't work on SNO
|
|
enabled: false
|
|
|
|
cleanupController:
|
|
replicas: 1
|
|
antiAffinity:
|
|
# anti-affinity won't work on SNO
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
|
|
reportsController:
|
|
replicas: 1
|
|
antiAffinity:
|
|
# anti-affinity won't work on SNO
|
|
enabled: false
|
|
resources:
|
|
limits:
|
|
memory: 256Mi
|
|
cpu: 4000m
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
|
|
crds:
|
|
install: true
|
|
annotations:
|
|
argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true
|
|
|
|
apiVersionOverride:
|
|
podDisruptionBudget: policy/v1
|
|
|
|
config:
|
|
resourceFilters:
|
|
- '[Event,*,*]'
|
|
- '[*/*,default,*]'
|
|
- '[*/*,kube-system,*]'
|
|
- '[*/*,kube-public,*]'
|
|
- '[*/*,kube-node-lease,*]'
|
|
- '[*/*,openshift,*]'
|
|
- '[*/*, openshift-*, *]'
|
|
- '[*/*,open-cluster-*,*]'
|
|
- '[*/*,hive,*]'
|
|
- '[*/*, multicluster-engine,*]'
|
|
- '[*/*,stackrox,*]'
|
|
- '[*/*,rhacs-operator,*]'
|
|
- '[*/*,costmanagement-metrics-operator,*]'
|
|
- '[Node,*,*]'
|
|
- '[Node/*,*,*]'
|
|
- '[APIService,*,*]'
|
|
- '[APIService/*,*,*]'
|
|
- '[TokenReview,*,*]'
|
|
- '[SubjectAccessReview,*,*]'
|
|
- '[SelfSubjectAccessReview,*,*]'
|
|
- '[Binding,*,*]'
|
|
- '[Pod/binding,*,*]'
|
|
- '[ReplicaSet,*,*]'
|
|
- '[ReplicaSet/*,*,*]'
|
|
- '[AdmissionReport,*,*]'
|
|
- '[AdmissionReport/*,*,*]'
|
|
- '[ClusterAdmissionReport,*,*]'
|
|
- '[ClusterAdmissionReport/*,*,*]'
|
|
- '[BackgroundScanReport,*,*]'
|
|
- '[BackgroundScanReport/*,*,*]'
|
|
- '[ClusterBackgroundScanReport,*,*]'
|
|
- '[ClusterBackgroundScanReport/*,*,*]'
|
|
# exclude resources from the chart
|
|
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'
|
|
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'
|
|
- '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'
|
|
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'
|
|
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'
|
|
- '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'
|
|
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
|
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'
|
|
- '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'
|
|
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'
|
|
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'
|
|
- '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'
|
|
- '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'
|
|
- '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'
|
|
- '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
|
- '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'
|
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
|
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
|
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
|
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
|
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
|
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
|
|
- '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
|
|
- '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
|
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
|
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
|
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
|
- '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
|
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
|
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
|
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
|
|
- '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
|
|
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'
|
|
- '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'
|
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
|
- '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
|
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
|
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
|
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
|
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
|
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
|
|
- '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
|
|
- '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
|
|
- '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
|
|
- '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
|
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
|
- '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
|
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
|
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
|
- '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
|
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
|
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
|
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
|
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
|
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
|
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
|
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
|
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
|
|
- '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
|
|
- '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
|
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'
|
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]'
|
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]'
|
|
- '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]'
|
|
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
|
|
- '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
|
|
|
|
webhooks:
|
|
# Exclude namespaces
|
|
- namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: NotIn
|
|
values:
|
|
# System namespaces
|
|
- default
|
|
- kyverno
|
|
- kube-system
|
|
- kube-node-lease
|
|
# OpenShift layered products
|
|
- assisted-installer
|
|
- cert-manager
|
|
- cert-manager-operator
|
|
- stackrox
|
|
- stackrox-secured-cluster-service
|
|
- rhacs-operator
|
|
- multicluster-engine
|
|
- open-cluster-management
|
|
- open-cluster-management-hub
|
|
- open-cluster-management-observability
|
|
- open-cluster-management-addon-observability
|
|
- open-cluster-management-agent
|
|
- open-cluster-management-agent-addon
|
|
- open-cluster-management-global-set
|
|
# Third Party
|
|
- external-secrets
|
|
# OpenShift namespaces
|
|
- openshift
|
|
- openshift-apiserver
|
|
- openshift-apiserver-operator
|
|
- openshift-authentication
|
|
- openshift-authentication-operator
|
|
- openshift-cloud-controller-manager
|
|
- openshift-cloud-controller-manager-operator
|
|
- openshift-cloud-credential-operator
|
|
- openshift-cloud-network-config-controller
|
|
- openshift-cluster-csi-drivers
|
|
- openshift-cluster-machine-approver
|
|
- openshift-cluster-node-tuning-operator
|
|
- openshift-cluster-samples-operator
|
|
- openshift-cluster-storage-operator
|
|
- openshift-cluster-version
|
|
- openshift-config
|
|
- openshift-config-managed
|
|
- openshift-config-operator
|
|
- openshift-console
|
|
- openshift-console-operator
|
|
- openshift-console-user-settings
|
|
- openshift-controller-manager
|
|
- openshift-controller-manager-operator
|
|
- openshift-dns
|
|
- openshift-dns-operator
|
|
- openshift-etcd
|
|
- openshift-etcd-operator
|
|
- openshift-gitops
|
|
- openshift-host-network
|
|
- openshift-image-registry
|
|
- openshift-infra
|
|
- openshift-ingress
|
|
- openshift-ingress-canary
|
|
- openshift-ingress-operator
|
|
- openshift-insights
|
|
- openshift-kni-infra
|
|
- openshift-kube-apiserver
|
|
- openshift-kube-apiserver-operator
|
|
- openshift-kube-controller-manager
|
|
- openshift-kube-controller-manager-operator
|
|
- openshift-kube-scheduler
|
|
- openshift-kube-scheduler-operator
|
|
- openshift-kube-storage-version-migrator
|
|
- openshift-kube-storage-version-migrator-operator
|
|
- openshift-machine-api
|
|
- openshift-machine-config-operator
|
|
- openshift-marketplace
|
|
- openshift-monitoring
|
|
- openshift-multus
|
|
- openshift-network-diagnostics
|
|
- openshift-network-operator
|
|
- openshift-node
|
|
- openshift-nutanix-infra
|
|
- openshift-oauth-apiserver
|
|
- openshift-openstack-infra
|
|
- openshift-operator-lifecycle-manager
|
|
- openshift-operators
|
|
- openshift-ovirt-infra
|
|
- openshift-ovn-kubernetes
|
|
- openshift-pipelines
|
|
- openshift-route-controller-manager
|
|
- openshift-service-ca
|
|
- openshift-service-ca-operator
|
|
- openshift-storage
|
|
- openshift-user-workload-monitoring
|
|
- openshift-vsphere-infra
|