diff --git a/helm/kyverno-policies/charts/kyverno-policies/.helmignore b/helm/kyverno-policies/charts/kyverno-policies/.helmignore
index 20b07486..85df807a 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/.helmignore
+++ b/helm/kyverno-policies/charts/kyverno-policies/.helmignore
@@ -1,2 +1,3 @@
+.helmignore
ci/
README.md.gotmpl
diff --git a/helm/kyverno-policies/charts/kyverno-policies/Chart.yaml b/helm/kyverno-policies/charts/kyverno-policies/Chart.yaml
index 1c41bfc5..60053a78 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/Chart.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/Chart.yaml
@@ -1,8 +1,8 @@
apiVersion: v2
type: application
name: kyverno-policies
-version: 3.0.4
-appVersion: v1.10.3
+version: 3.2.2
+appVersion: v1.12.2
icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png
description: Kubernetes Pod Security Standards implemented as Kyverno policies
keywords:
@@ -15,19 +15,9 @@ home: https://kyverno.io/policies/
sources:
- https://github.com/kyverno/policies
maintainers:
- - name: Nirmata
- url: https://kyverno.io/
-kubeVersion: ">=1.16.0-0"
+ - name: kyverno-maintainers
+ email: cncf-kyverno-maintainers@lists.cncf.io
+kubeVersion: ">=1.25.0-0"
annotations:
artifacthub.io/operator: "false"
artifacthub.io/prerelease: "false"
- # valid kinds are: added, changed, deprecated, removed, fixed and security
- artifacthub.io/changes: |
- - kind: added
- description: Add ability to configure autogen behavior
- - kind: fixed
- description: Support for customLabels, they were ignored up to now
- - kind: removed
- description: "Walk back change in PSS policy to send to to_upper"
- - kind: fixed
- description: Skip DELETE requests on policies using deny statements
diff --git a/helm/kyverno-policies/charts/kyverno-policies/README.md b/helm/kyverno-policies/charts/kyverno-policies/README.md
index 6a5ffeee..38a6abcd 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/README.md
+++ b/helm/kyverno-policies/charts/kyverno-policies/README.md
@@ -2,7 +2,7 @@
Kubernetes Pod Security Standards implemented as Kyverno policies
-![Version: 3.0.4](https://img.shields.io/badge/Version-3.0.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.10.3](https://img.shields.io/badge/AppVersion-v1.10.3-informational?style=flat-square)
+![Version: 3.2.2](https://img.shields.io/badge/Version-3.2.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.12.2](https://img.shields.io/badge/AppVersion-v1.12.2-informational?style=flat-square)
## About
@@ -63,13 +63,14 @@ The command removes all the Kubernetes components associated with the chart and
| Key | Type | Default | Description |
|-----|------|---------|-------------|
+| policyKind | string | `"ClusterPolicy"` | Policy kind (`ClusterPolicy`, `Policy`) Set to `Policy` if you need namespaced policies and not cluster policies |
| podSecurityStandard | string | `"baseline"` | Pod Security Standard profile (`baseline`, `restricted`, `privileged`, `custom`). For more info https://kyverno.io/policies/pod-security. |
| podSecuritySeverity | string | `"medium"` | Pod Security Standard (`low`, `medium`, `high`). |
| podSecurityPolicies | list | `[]` | Policies to include when `podSecurityStandard` is `custom`. |
| includeOtherPolicies | list | `[]` | Additional policies to include from `other`. |
| includeRestrictedPolicies | list | `[]` | Additional policies to include from `restricted`. |
| failurePolicy | string | `"Fail"` | API server behavior if the webhook fails to respond ('Ignore', 'Fail') For more info: https://kyverno.io/docs/writing-policies/policy-settings/ |
-| validationFailureAction | string | `"audit"` | Validation failure action (`audit`, `enforce`). For more info https://kyverno.io/docs/writing-policies/validate. |
+| validationFailureAction | string | `"Audit"` | Validation failure action (`Audit`, `Enforce`). For more info https://kyverno.io/docs/writing-policies/validate. |
| validationFailureActionByPolicy | object | `{}` | Define validationFailureActionByPolicy for specific policies. Override the defined `validationFailureAction` with a individual validationFailureAction for individual Policies. |
| validationFailureActionOverrides | object | `{"all":[]}` | Define validationFailureActionOverrides for specific policies. The overrides for `all` will apply to all policies. |
| policyExclude | object | `{}` | Exclude resources from individual policies. Policies with multiple rules can have individual rules excluded by using the name of the rule as the key in the `policyExclude` map. |
@@ -78,6 +79,7 @@ The command removes all the Kubernetes components associated with the chart and
| nameOverride | string | `nil` | Name override. |
| customLabels | object | `{}` | Additional labels. |
| background | bool | `true` | Policies background mode |
+| skipBackgroundRequests | bool | `nil` | SkipBackgroundRequests bypasses admission requests that are sent by the background controller |
| kyvernoVersion | string | `"autodetect"` | Kyverno version The default of "autodetect" will try to determine the currently installed version from the deployment |
## Source Code
@@ -86,13 +88,13 @@ The command removes all the Kubernetes components associated with the chart and
## Requirements
-Kubernetes: `>=1.16.0-0`
+Kubernetes: `>=1.25.0-0`
## Maintainers
| Name | Email | Url |
| ---- | ------ | --- |
-| Nirmata | | |
+| kyverno-maintainers | | |
## Changes
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml
index 993a7c77..c93d4601 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml
@@ -2,7 +2,7 @@
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
{{- include "kyverno-policies.supportedKyvernoCheck" (dict "top" . "ver" ">= 1.6.0-0") }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -64,6 +64,9 @@ spec:
operator: NotEquals
value: DELETE
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Any capabilities added beyond the allowed list (AUDIT_WRITE, CHOWN, DAC_OVERRIDE, FOWNER,
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml
index 894beec5..58c33e22 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-host-namespaces" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -48,6 +48,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Sharing the host namespaces is disallowed. The fields spec.hostNetwork,
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml
index 8793ef3a..5585a0d8 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-host-path" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -47,6 +47,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
HostPath volumes are forbidden. The field spec.volumes[*].hostPath must be unset.
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml
index 67ec3b9c..cf3bd191 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-host-ports" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -47,6 +47,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Use of host ports is disallowed. The fields spec.containers[*].ports[*].hostPort
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml
index 8ad2d0c8..3f925251 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-host-process" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -48,6 +48,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
HostProcess containers are disallowed. The fields spec.securityContext.windowsOptions.hostProcess,
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml
index 1d65f029..10f222bf 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-privileged-containers" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -46,6 +46,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Privileged mode is disallowed. The fields spec.containers[*].securityContext.privileged
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml
index c607738c..c9ebfb20 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-proc-mount" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -48,6 +48,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Changing the proc mount from the default is not allowed. The fields
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml
index 89d0209d..f6045308 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-selinux" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -46,6 +46,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Setting the SELinux type is restricted. The fields
@@ -83,6 +86,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Setting the SELinux user or role is forbidden. The fields
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml
index b58c6877..4e261d87 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml
@@ -1,7 +1,7 @@
{{- $name := "restrict-apparmor-profiles" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -49,6 +49,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Specifying other AppArmor profiles is disallowed. The annotation
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml
index 99dbcabc..0798a645 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml
@@ -1,7 +1,7 @@
{{- $name := "restrict-seccomp" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -47,6 +47,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Use of custom Seccomp profiles is disallowed. The fields
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml
index 7e3da6ad..f8a3f54a 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml
@@ -1,7 +1,7 @@
{{- $name := "restrict-sysctls" }}
{{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -50,6 +50,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Setting additional sysctls above the allowed type is disallowed.
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/other/require-non-root-groups.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/other/require-non-root-groups.yaml
index 759fab90..4e0b74d1 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/other/require-non-root-groups.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/other/require-non-root-groups.yaml
@@ -1,7 +1,7 @@
{{- $name := "require-non-root-groups" }}
{{- if eq (include "kyverno-policies.podSecurityOther" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -48,6 +48,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Running with root group IDs is disallowed. The fields
@@ -92,6 +95,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Containers cannot run with a root primary or supplementary GID. The field
@@ -111,6 +117,9 @@ spec:
exclude:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Containers cannot run with a root primary or supplementary GID. The field
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml
index 46ea01b1..ff563f15 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml
@@ -2,7 +2,7 @@
{{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }}
{{- include "kyverno-policies.supportedKyvernoCheck" (dict "top" . "ver" ">= 1.6.0-0") }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -65,6 +65,9 @@ spec:
operator: NotEquals
value: DELETE
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Containers must drop `ALL` capabilities.
@@ -107,6 +110,9 @@ spec:
operator: NotEquals
value: DELETE
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Any capabilities added other than NET_BIND_SERVICE are disallowed.
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml
index 687a2eb4..646cb48a 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml
@@ -1,7 +1,7 @@
{{- $name := "disallow-privilege-escalation" }}
{{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -46,6 +46,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Privilege escalation is disallowed. The fields
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml
index f4087735..7bb165be 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml
@@ -1,7 +1,7 @@
{{- $name := "require-run-as-non-root-user" }}
{{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -46,6 +46,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Running as root is not allowed. The fields spec.securityContext.runAsUser,
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml
index 406689f3..8b1e5895 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml
@@ -1,7 +1,7 @@
{{- $name := "require-run-as-nonroot" }}
{{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -47,6 +47,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Running as root is not allowed. Either the field spec.securityContext.runAsNonRoot
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml
index af8888fe..28482459 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml
@@ -1,7 +1,7 @@
{{- $name := "restrict-seccomp-strict" }}
{{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -49,6 +49,9 @@ spec:
preconditions:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Use of custom Seccomp profiles is disallowed. The fields
diff --git a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml
index f5e221c7..57aae652 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml
@@ -2,7 +2,7 @@
{{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }}
{{- include "kyverno-policies.supportedKyvernoCheck" (dict "top" . "ver" ">= 1.6.0-0") }}
apiVersion: kyverno.io/v1
-kind: ClusterPolicy
+kind: {{ .Values.policyKind }}
metadata:
name: {{ $name }}
annotations:
@@ -66,6 +66,9 @@ spec:
operator: NotEquals
value: DELETE
{{- end }}
+ {{- if not (quote .Values.skipBackgroundRequests | empty) }}
+ skipBackgroundRequests: {{ .Values.skipBackgroundRequests }}
+ {{- end }}
validate:
message: >-
Only the following types of volumes may be used: configMap, csi, downwardAPI,
diff --git a/helm/kyverno-policies/charts/kyverno-policies/values.yaml b/helm/kyverno-policies/charts/kyverno-policies/values.yaml
index 4fe5dc7f..ceb9dadd 100644
--- a/helm/kyverno-policies/charts/kyverno-policies/values.yaml
+++ b/helm/kyverno-policies/charts/kyverno-policies/values.yaml
@@ -1,3 +1,7 @@
+# -- Policy kind (`ClusterPolicy`, `Policy`)
+# Set to `Policy` if you need namespaced policies and not cluster policies
+policyKind: ClusterPolicy
+
# -- Pod Security Standard profile (`baseline`, `restricted`, `privileged`, `custom`).
# For more info https://kyverno.io/policies/pod-security.
podSecurityStandard: baseline
@@ -20,9 +24,9 @@ includeRestrictedPolicies: []
# For more info: https://kyverno.io/docs/writing-policies/policy-settings/
failurePolicy: Fail
-# -- Validation failure action (`audit`, `enforce`).
+# -- Validation failure action (`Audit`, `Enforce`).
# For more info https://kyverno.io/docs/writing-policies/validate.
-validationFailureAction: audit
+validationFailureAction: Audit
# -- Define validationFailureActionByPolicy for specific policies.
# Override the defined `validationFailureAction` with a individual validationFailureAction for individual Policies.
@@ -97,6 +101,9 @@ customLabels: {}
# -- Policies background mode
background: true
+# -- (bool) SkipBackgroundRequests bypasses admission requests that are sent by the background controller
+skipBackgroundRequests: ~
+
# -- Kyverno version
# The default of "autodetect" will try to determine the currently installed version from the deployment
kyvernoVersion: autodetect
diff --git a/vendir.lock.yml b/vendir.lock.yml
index 4664ea3e..b3b90325 100644
--- a/vendir.lock.yml
+++ b/vendir.lock.yml
@@ -2,10 +2,10 @@ apiVersion: vendir.k14s.io/v1alpha1
directories:
- contents:
- git:
- commitTitle: release 1.10.3 (#8006)...
- sha: 8137b4b8afd7ab1464a42e717dc83f1cc471a4a1
+ commitTitle: Release v1.12.2 (#10298)...
+ sha: 36051a7af4cf6f4a1a1585a58ecbcfd6e2d62c93
tags:
- - v1.10.3
+ - v1.12.2
path: .
path: helm/kyverno-policies/charts/kyverno-policies
kind: LockConfig
diff --git a/vendir.yml b/vendir.yml
index 3fbb575b..64617ae9 100644
--- a/vendir.yml
+++ b/vendir.yml
@@ -6,7 +6,7 @@ directories:
- path: .
git:
url: https://github.com/giantswarm/kyverno
- ref: v1.10.3
+ ref: v1.12.2
includePaths:
- charts/kyverno-policies/**
newRootPath: charts/kyverno-policies