kyverno helm

Kyverno is a policy engine for Kubernetes that enables you to define and enforce policies for your cluster resources. It provides a flexible and scalable solution for managing your cluster configuration, allowing you to enforce best practices, prevent misconfigurations, and enforce compliance requirements.

The kyverno/policies offer all kinds of security and best practice policies that you could use.

Install

Install with:

helm repo add kyverno oci://ghcr.io/kyverno/charts/
helm install kyverno kyverno/kyverno -f values.yaml

Examples

See examples from other people.

Top Repositories (5 out of 57)

NameRepoStarsVersionTimestamp
kyvernoauricom/home-ops1763.3.36 days ago
kyvernoburoa/k8s-gitops1843.3.37 days ago
kyvernoharaldkoch/kochhaus-home1183.3.37 days ago
kyvernoonedr0p/home-ops20353.3.38 days ago
kyvernobudimanjojo/home-cluster1653.3.38 days ago

Resources

226Mi246Mi443Mi
35m92m247m

Values

See the most popular values for this chart:

KeyTypes
cleanupController.serviceMonitor.enabled (40)
true
boolean
cleanupController.serviceMonitor.interval (1)
string
cleanupController.metricsService.create (1)
boolean
cleanupController.replicas (1)
number
crds.install (40)
true
boolean
grafana.enabled (40)
true
boolean
grafana.annotations.grafana_folder (18)
System
string
grafana.annotations."grafana.io/folder" (2)
string
grafana.namespace (1)
string
reportsController.serviceMonitor.enabled (40)
true
boolean
reportsController.serviceMonitor.interval (1)
string
reportsController.clusterRole.extraResources[].apiGroups[] (7)
- *
string
reportsController.clusterRole.extraResources[].resources[] (7)
- *
string
reportsController.clusterRole.extraResources[].verbs[] (7)
- get
- list
- watch
string
reportsController.metricsService.create (1)
boolean
reportsController.replicas (1)
number
reportsController.resources.limits.memory (1)
string
admissionController.serviceMonitor.enabled (39)
true
boolean
admissionController.serviceMonitor.interval (1)
string
admissionController.replicas (32)
3
number
admissionController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (31)
kyverno
string
admissionController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/component" (28)
kyverno
string
admissionController.topologySpreadConstraints[].maxSkew (31)
1
number
admissionController.topologySpreadConstraints[].topologyKey (31)
kubernetes.io/hostname
string
admissionController.topologySpreadConstraints[].whenUnsatisfiable (31)
DoNotSchedule
string
admissionController.rbac.clusterRole.extraResources[].apiGroups[] (30)
-
string
admissionController.rbac.clusterRole.extraResources[].resources[] (30)
- pods
string
admissionController.rbac.clusterRole.extraResources[].verbs[] (30)
- create
- update
- delete
string
admissionController.clusterRole.extraResources[].apiGroups[] (7)
- *
string
admissionController.clusterRole.extraResources[].resources[] (7)
- *
string
admissionController.clusterRole.extraResources[].verbs[] (7)
- get
- list
- watch
string
admissionController.container.resources.limits.memory (6)
string
admissionController.container.resources.requests.cpu (4)
string
admissionController.container.resources.requests.memory (4)
string
admissionController.container.extraArgs.clientRateLimitBurst (1)
number
admissionController.container.extraArgs.clientRateLimitQPS (1)
number
admissionController.tolerations[].key (2)
string
admissionController.tolerations[].operator (2)
string
admissionController.updateStrategy.rollingUpdate.maxSurge (2)
number
admissionController.updateStrategy.type (2)
string
admissionController.apiPriorityAndFairness (1)
boolean
admissionController.metricsService.create (1)
boolean
admissionController.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].key (1)
string
admissionController.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms[].matchExpressions[].operator (1)
string
admissionController.priorityClassName (1)
string
admissionController.resources.limits.memory (1)
string
admissionController.resources.requests.cpu (1)
string
admissionController.resources.requests.memory (1)
string
backgroundController.serviceMonitor.enabled (38)
true
boolean
backgroundController.serviceMonitor.interval (1)
string
backgroundController.rbac.clusterRole.extraResources[].apiGroups[] (31)
-
string
backgroundController.rbac.clusterRole.extraResources[].resources[] (31)
- pods
string
backgroundController.rbac.clusterRole.extraResources[].verbs[] (30)
- create
- update
- patch
- delete
- get
- list
string
backgroundController.resources.limits.memory (19)
1Gi
string
backgroundController.resources.limits.cpu (1)
string
backgroundController.resources.requests.cpu (17)
100m
string
backgroundController.resources.requests.memory (4)
string
backgroundController.clusterRole.extraResources[].apiGroups[] (7)
- *
string
backgroundController.clusterRole.extraResources[].resources[] (7)
- *
string
backgroundController.clusterRole.extraResources[].verbs[] (7)
- get
- list
- watch
string
backgroundController.enabled (1)
boolean
backgroundController.metricsService.create (1)
boolean
backgroundController.replicas (1)
number
backgroundController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/component" (1)
string
backgroundController.topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (1)
string
backgroundController.topologySpreadConstraints[].maxSkew (1)
number
backgroundController.topologySpreadConstraints[].topologyKey (1)
string
backgroundController.topologySpreadConstraints[].whenUnsatisfiable (1)
string
installCRDs (10)
true
boolean
serviceMonitor.enabled (10)
true
boolean
serviceMonitor.interval (2)
string
replicaCount (9)
3
number
topologySpreadConstraints[].labelSelector.matchLabels."app.kubernetes.io/instance" (9)
kyverno
string
topologySpreadConstraints[].maxSkew (9)
1
number
topologySpreadConstraints[].topologyKey (9)
kubernetes.io/hostname
string
topologySpreadConstraints[].whenUnsatisfiable (9)
DoNotSchedule
string
updateStrategy.rollingUpdate.maxSurge (7)
1
number
updateStrategy.type (7)
RollingUpdate
string
resources.requests.cpu (5)
247m
string
resources.requests.memory (5)
443M
string
resources.limits.memory (4)
1336M
string
config.resourceFilters[] (4)
string
config.webhooks[].objectSelector.matchExpressions[].key (4)
webhooks.kyverno.io/exclude
string
config.webhooks[].objectSelector.matchExpressions[].operator (4)
DoesNotExist
string
config.webhooks[].objectSelector.matchExpressions[].values[] (1)
string
config.excludeKyvernoNamespace (1)
boolean
config.metricsConfig.create (1)
boolean
cleanupJobs.admissionReports.enabled (1)
boolean
cleanupJobs.admissionReports.threshold (1)
number
cleanupJobs.clusterAdmissionReports.enabled (1)
boolean
cleanupJobs.clusterAdmissionReports.threshold (1)
number
customLabels."egress.home.arpa/apiserver" (1)
string
customLabels."egress.home.arpa/host" (1)
string
customLabels."ingress.home.arpa/apiserver" (1)
string
customLabels."ingress.home.arpa/host" (1)
string
customLabels."prom.home.arpa/kps" (1)
string
extraArgs[] (1)
string
features.logging.format (1)
string
namespaceOverride (1)
string
upgrade.fromV2 (1)
boolean