kyverno helm

Kyverno is a policy engine for Kubernetes that enables you to define and enforce policies for your cluster resources. It provides a flexible and scalable solution for managing your cluster configuration, allowing you to enforce best practices, prevent misconfigurations, and enforce compliance requirements.

The kyverno/policies offer all kinds of security and best practice policies that you could use.

Install

Install with:

helm repo add kyverno oci://ghcr.io/kyverno/charts/
helm install kyverno kyverno/kyverno -f values.yaml

Examples

See examples from other people.

Top Repositories (5 out of 48)

NameRepoStarsVersionTimestamp
kyvernoxunholy/k8s-gitops4763.2.212 days ago
kyvernoaxeII/home-ops413.2.618 days ago
kyvernoishioni/homelab-ops943.2.6a month ago
kyvernoharaldkoch/kochhaus-home1093.2.62 months ago
kyvernotyriis/home-ops373.2.62 months ago

Values

See the most popular values for this chart:

KeyTypes
cleanupController.serviceMonitor.enabled (32)
true
boolean
cleanupController.serviceMonitor.interval (2)
string
cleanupController.metricsService.create (1)
boolean
cleanupController.replicas (1)
number
grafana.enabled (32)
true
boolean
grafana.annotations.grafana_folder (18)
System
string
grafana.annotations."grafana.io/folder" (2)
string
grafana.namespace (1)
string
reportsController.serviceMonitor.enabled (32)
true
boolean
reportsController.serviceMonitor.interval (2)
string
reportsController.resources.limits.memory (2)
string
reportsController.metricsService.create (1)
boolean
reportsController.replicas (1)
number
backgroundController.serviceMonitor.enabled (31)
true
boolean
backgroundController.serviceMonitor.interval (1)
string
backgroundController.rbac.clusterRole.extraResources[].apiGroups[] (29)
-
string
backgroundController.rbac.clusterRole.extraResources[].resources[] (29)
- pods
string
backgroundController.rbac.clusterRole.extraResources[].verbs[] (27)
- create
- update
- patch
- delete
- get
- list
string
backgroundController.resources.limits.memory (9)
1Gi
string
backgroundController.resources.limits.cpu (1)
string
backgroundController.resources.requests.cpu (7)
100m
string
backgroundController.resources.requests.memory (4)
string
backgroundController.enabled (1)
boolean
backgroundController.metricsService.create (1)
boolean
backgroundController.replicas (1)
number
backgroundController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/component" (1)
string
backgroundController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (1)
string
backgroundController.topologySpreadConstraints[].maxSkew (1)
number
backgroundController.topologySpreadConstraints[].topologyKey (1)
string
backgroundController.topologySpreadConstraints[].whenUnsatisfiable (1)
string
crds.install (31)
true
boolean
admissionController.replicas (30)
3
number
admissionController.serviceMonitor.enabled (30)
true
boolean
admissionController.serviceMonitor.interval (2)
string
admissionController.rbac.clusterRole.extraResources[].apiGroups[] (29)
-
string
admissionController.rbac.clusterRole.extraResources[].resources[] (29)
- pods
string
admissionController.rbac.clusterRole.extraResources[].verbs[] (29)
- create
- update
- delete
string
admissionController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (28)
kyverno
string
admissionController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/component" (27)
kyverno
string
admissionController.topologySpreadConstraints[].maxSkew (28)
1
number
admissionController.topologySpreadConstraints[].topologyKey (28)
kubernetes.io/hostname
string
admissionController.topologySpreadConstraints[].whenUnsatisfiable (28)
DoNotSchedule
string
admissionController.container.resources.limits.memory (7)
string
admissionController.container.resources.requests.cpu (5)
string
admissionController.container.resources.requests.memory (5)
string
admissionController.container.extraArgs.clientRateLimitBurst (2)
number
admissionController.container.extraArgs.clientRateLimitQPS (2)
number
admissionController.tolerations[].key (2)
string
admissionController.tolerations[].operator (2)
string
admissionController.apiPriorityAndFairness (1)
boolean
admissionController.metricsService.create (1)
boolean
admissionController.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1)
string
admissionController.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1)
string
admissionController.priorityClassName (1)
string
admissionController.resources.limits.memory (1)
string
admissionController.resources.requests.cpu (1)
string
admissionController.resources.requests.memory (1)
string
admissionController.updateStrategy.rollingUpdate.maxSurge (1)
number
admissionController.updateStrategy.type (1)
string
installCRDs (11)
true
boolean
serviceMonitor.enabled (11)
true
boolean
serviceMonitor.interval (2)
string
topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (11)
kyverno
string
topologySpreadConstraints[].maxSkew (11)
1
number
topologySpreadConstraints[].topologyKey (11)
kubernetes.io/hostname
string
topologySpreadConstraints[].whenUnsatisfiable (11)
DoNotSchedule
string
replicaCount (9)
3
number
updateStrategy.rollingUpdate.maxSurge (7)
1
number
updateStrategy.type (7)
RollingUpdate
string
config.webhooks[].objectSelector.matchExpressions[].key (5)
webhooks.kyverno.io/exclude
string
config.webhooks[].objectSelector.matchExpressions[].operator (5)
DoesNotExist
string
config.webhooks[].objectSelector.matchExpressions[].values[] (1)
string
config.metricsConfig.create (1)
boolean
resources.requests.cpu (4)
247m
string
resources.requests.memory (4)
443M
string
resources.limits.memory (3)
1336M
string
extraArgs[] (3)
- --autogenInternals=false
- --clientRateLimitQPS=30
- --clientRateLimitBurst=60
string
cleanupJobs.admissionReports.enabled (1)
boolean
cleanupJobs.admissionReports.threshold (1)
number
cleanupJobs.clusterAdmissionReports.enabled (1)
boolean
cleanupJobs.clusterAdmissionReports.threshold (1)
number
customLabels."egress.home.arpa/apiserver" (1)
string
customLabels."egress.home.arpa/host" (1)
string
customLabels."ingress.home.arpa/apiserver" (1)
string
customLabels."ingress.home.arpa/host" (1)
string
customLabels."prom.home.arpa/kps" (1)
string
features.logging.format (1)
string
namespaceOverride (1)
string
upgrade.fromV2 (1)
boolean