homelab/components/kyverno/base/values.yaml

admissionController:
  replicas: 3
  antiAffinity:
    # anti-affinity won't work on SNO
    enabled: false
  resources:
    limits:
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 256Mi

backgroundController:
  replicas: 1
  antiAffinity:
    # anti-affinity won't work on SNO
    enabled: false

cleanupController:
  replicas: 1
  antiAffinity:
    # anti-affinity won't work on SNO
    enabled: false
  resources:
    limits:
      memory: 256Mi
    requests:
      cpu: 100m
      memory: 128Mi

reportsController:
  replicas: 1
  antiAffinity:
    # anti-affinity won't work on SNO
    enabled: false
  resources:
    limits:
      memory: 256Mi
      cpu: 4000m
    requests:
      cpu: 100m
      memory: 128Mi

crds:
  install: true
  annotations:
    argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true

apiVersionOverride:
  podDisruptionBudget: policy/v1

config:
  resourceFilters:
    - '[Event,*,*]'
    - '[*/*,default,*]'
    - '[*/*,kube-system,*]'
    - '[*/*,kube-public,*]'
    - '[*/*,kube-node-lease,*]'
    - '[*/*,openshift,*]'
    - '[*/*, openshift-*, *]'
    - '[*/*,open-cluster-*,*]'
    - '[*/*,hive,*]'
    - '[*/*, multicluster-engine,*]'
    - '[*/*,stackrox,*]'
    - '[*/*,rhacs-operator,*]'
    - '[*/*,costmanagement-metrics-operator,*]'
    - '[Node,*,*]'
    - '[Node/*,*,*]'
    - '[APIService,*,*]'
    - '[APIService/*,*,*]'
    - '[TokenReview,*,*]'
    - '[SubjectAccessReview,*,*]'
    - '[SelfSubjectAccessReview,*,*]'
    - '[Binding,*,*]'
    - '[Pod/binding,*,*]'
    - '[ReplicaSet,*,*]'
    - '[ReplicaSet/*,*,*]'
    - '[AdmissionReport,*,*]'
    - '[AdmissionReport/*,*,*]'
    - '[ClusterAdmissionReport,*,*]'
    - '[ClusterAdmissionReport/*,*,*]'
    - '[BackgroundScanReport,*,*]'
    - '[BackgroundScanReport/*,*,*]'
    - '[ClusterBackgroundScanReport,*,*]'
    - '[ClusterBackgroundScanReport/*,*,*]'
    # exclude resources from the chart
    - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]'
    - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]'
    - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]'
    - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]'
    - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]'
    - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]'
    - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
    - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]'
    - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]'
    - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]'
    - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]'
    - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]'
    - '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]'
    - '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]'
    - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]'
    - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]'
    - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
    - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]'
    - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
    - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]'
    - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
    - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]'
    - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
    - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]'
    - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
    - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
    - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
    - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
    - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]'
    - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]'
    - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]'
    - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]'
    - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]'
    - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]'
    - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
    - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
    - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
    - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
    - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
    - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
    - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
    - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]'
    - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
    - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]'
    - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
    - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]'
    - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
    - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]'
    - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
    - '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]'
    - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
    - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
    - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
    - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
    - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
    - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
    - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
    - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]'
    - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
    - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]'
    - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
    - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]'
    - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
    - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]'
    - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
    - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]'
    - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
    - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]'
    - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
    - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]'
    - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
    - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]'
    - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]'
    - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]'
    - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]'
    - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]'
    - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]'
    - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]'

  webhooks:
    # Exclude namespaces
    - namespaceSelector:
        matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: NotIn
          values:
            # System namespaces
            - default
            - kyverno
            - kube-system
            - kube-node-lease
            # OpenShift layered products
            - assisted-installer
            - cert-manager
            - cert-manager-operator
            - stackrox
            - stackrox-secured-cluster-service
            - rhacs-operator
            - multicluster-engine
            - open-cluster-management
            - open-cluster-management-hub
            - open-cluster-management-observability
            - open-cluster-management-addon-observability
            - open-cluster-management-agent
            - open-cluster-management-agent-addon
            - open-cluster-management-global-set
            # Third Party
            - external-secrets
            # OpenShift namespaces
            - openshift
            - openshift-apiserver
            - openshift-apiserver-operator
            - openshift-authentication
            - openshift-authentication-operator
            - openshift-cloud-controller-manager
            - openshift-cloud-controller-manager-operator
            - openshift-cloud-credential-operator
            - openshift-cloud-network-config-controller
            - openshift-cluster-csi-drivers
            - openshift-cluster-machine-approver
            - openshift-cluster-node-tuning-operator
            - openshift-cluster-samples-operator
            - openshift-cluster-storage-operator
            - openshift-cluster-version
            - openshift-config
            - openshift-config-managed
            - openshift-config-operator
            - openshift-console
            - openshift-console-operator
            - openshift-console-user-settings
            - openshift-controller-manager
            - openshift-controller-manager-operator
            - openshift-dns
            - openshift-dns-operator
            - openshift-etcd
            - openshift-etcd-operator
            - openshift-gitops
            - openshift-host-network
            - openshift-image-registry
            - openshift-infra
            - openshift-ingress
            - openshift-ingress-canary
            - openshift-ingress-operator
            - openshift-insights
            - openshift-kni-infra
            - openshift-kube-apiserver
            - openshift-kube-apiserver-operator
            - openshift-kube-controller-manager
            - openshift-kube-controller-manager-operator
            - openshift-kube-scheduler
            - openshift-kube-scheduler-operator
            - openshift-kube-storage-version-migrator
            - openshift-kube-storage-version-migrator-operator
            - openshift-machine-api
            - openshift-machine-config-operator
            - openshift-marketplace
            - openshift-monitoring
            - openshift-multus
            - openshift-network-diagnostics
            - openshift-network-operator
            - openshift-node
            - openshift-nutanix-infra
            - openshift-oauth-apiserver
            - openshift-openstack-infra
            - openshift-operator-lifecycle-manager
            - openshift-operators
            - openshift-ovirt-infra
            - openshift-ovn-kubernetes
            - openshift-pipelines
            - openshift-route-controller-manager
            - openshift-service-ca
            - openshift-service-ca-operator
            - openshift-storage
            - openshift-user-workload-monitoring
            - openshift-vsphere-infra