# Kyverno: Policy engine for Kubernetes image scanning, Pod security, and admission control
# Scan all images, enforce baseline Pod Security Standard, prevent privilege escalation

replicaCount: 1

image:
  registry: ghcr.io
  repository: kyverno/kyverno
  tag: "v1.14.0"

config:
  # Webhook timeout for policy evaluation. Increase if scanning takes longer.
  webhookTimeoutSeconds: 30
  # Failure policy: fail-open (audit/log) vs fail-closed (reject on error)
  failurePolicy: fail
  # Resource limits for webhook
  webhookAnnotations:
    rules: "allow"

# Pod security via Kyverno instead of Pod Security Policies (deprecated)
# Enforces baseline restrictions cluster-wide, with exceptions for privileged namespaces
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 1000

rbac:
  create: true

resources:
  requests:
    memory: "256Mi"
    cpu: "100m"
  limits:
    memory: "512Mi"
    cpu: "500m"

# Webhook configuration
webhook:
  timeoutSeconds: 30
  # Failure policy: "Fail" (reject on error) or "Ignore" (audit-only)
  # Set to "Ignore" for initial testing, then change to "Fail"
  failurePolicy: ignore