make all kyverno policies optional and disabled by default (#872)

Signed-off-by: Johannes Kleinlercher <[email protected]>
suxess-it · Nov 26, 2024 · 2637213 · 2637213
1 parent 27e5516
commit 2637213
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 4 deletions.
diff --git a/platform-apps/charts/kyverno/templates/crb-kubevirt-rolebinding.yaml b/platform-apps/charts/kyverno/templates/crb-kubevirt-rolebinding.yaml
@@ -1,3 +1,4 @@
+{{ if has "policy-kubevirt-rolebinding" .Values.kyvernoPolicies }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -9,4 +10,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: kyverno-background-controller
-  namespace: kyverno
+  namespace: kyverno
+{{- end }}
diff --git a/platform-apps/charts/kyverno/templates/policy-add-label-velero.yaml b/platform-apps/charts/kyverno/templates/policy-add-label-velero.yaml
@@ -1,3 +1,4 @@
+{{ if has "add-labels-to-cm-velero" .Values.kyvernoPolicies }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
@@ -31,3 +32,4 @@ spec:
           labels:
             velero.io/exclude-from-backup: "true"
     skipBackgroundRequests: true
+{{- end }}
diff --git a/platform-apps/charts/kyverno/templates/policy-kubevirt-rolebinding.yaml b/platform-apps/charts/kyverno/templates/policy-kubevirt-rolebinding.yaml
@@ -1,3 +1,4 @@
+{{ if has "policy-kubevirt-rolebinding" .Values.kyvernoPolicies }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
@@ -39,4 +40,5 @@ spec:
             kind: ClusterRole
             name: kubevirt-datavolume-permission
             apiGroup: rbac.authorization.k8s.io
+{{- end }}
 
diff --git a/platform-apps/charts/kyverno/values.yaml b/platform-apps/charts/kyverno/values.yaml
@@ -1,6 +1,8 @@
-kyvernoPolicies:
-  - add-ns-quota
-  - kargo-project-name-validation-apps-in-any-ns
+# per default no kyvernoPolicies get applied, add them in the list in your values files to enable them
+kyvernoPolicies: []
+#  - add-ns-quota
+#  - kargo-project-name-validation-apps-in-any-ns
+#  - policy-kubevirt-rolebinding
 
 kyverno:
   admissionController: