43 lines
1.1 KiB
YAML
43 lines
1.1 KiB
YAML
|
# Kyverno: Policy engine for Kubernetes image scanning, Pod security, and admission control
|
||
|
|
# Scan all images, enforce baseline Pod Security Standard, prevent privilege escalation
|
||
|
|
|
||
|
|
replicaCount: 1
|
||
|
|
|
||
|
|
image:
|
||
|
|
registry: ghcr.io
|
||
|
|
repository: kyverno/kyverno
|
||
|
|
tag: "v1.14.0"
|
||
|
|
|
||
|
|
config:
|
||
|
|
# Webhook timeout for policy evaluation. Increase if scanning takes longer.
|
||
|
|
webhookTimeoutSeconds: 30
|
||
|
|
# Failure policy: fail-open (audit/log) vs fail-closed (reject on error)
|
||
|
|
failurePolicy: fail
|
||
|
|
# Resource limits for webhook
|
||
|
|
webhookAnnotations:
|
||
|
|
rules: "allow"
|
||
|
|
|
||
|
|
# Pod security via Kyverno instead of Pod Security Policies (deprecated)
|
||
|
|
# Enforces baseline restrictions cluster-wide, with exceptions for privileged namespaces
|
||
|
|
podSecurityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 1000
|
||
|
|
|
||
|
|
rbac:
|
||
|
|
create: true
|
||
|
|
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
memory: "256Mi"
|
||
|
|
cpu: "100m"
|
||
|
|
limits:
|
||
|
|
memory: "512Mi"
|
||
|
|
cpu: "500m"
|
||
|
|
|
||
|
|
# Webhook configuration
|
||
|
|
webhook:
|
||
|
|
timeoutSeconds: 30
|
||
|
|
# Failure policy: "Fail" (reject on error) or "Ignore" (audit-only)
|
||
|
|
# Set to "Ignore" for initial testing, then change to "Fail"
|
||
|
|
failurePolicy: ignore
|