# Kyverno

[Kyverno](https://kyverno.io) is a Kubernetes Native Policy Management engine. It allows you to:

- Manage policies as Kubernetes resources (no new language required.)
- Validate, mutate, and generate resource configurations.
- Select resources based on labels and wildcards.
- View policy enforcement as events.
- Scan existing resources for violations.

Access the complete user documentation and guides at: https://kyverno.io.

## TL;DR

```console
## Add the Kyverno Helm repository
$ helm repo add kyverno https://kyverno.github.io/kyverno/

## Install the Kyverno Helm chart
$ helm install kyverno --namespace kyverno kyverno/kyverno --create-namespace
```

## Introduction

This chart bootstraps a Kyverno deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.

## Installing the Chart

**Add the Kyverno Helm repository:**

```console
$ helm repo add kyverno https://kyverno.github.io/kyverno/
```

**Create a namespace:**

You can install Kyverno in any namespace. The examples use `kyverno` as the namespace.

```console
$ kubectl create namespace kyverno
```

**Install the Kyverno chart:**

```console
$ helm install kyverno --namespace kyverno kyverno ./charts/kyverno
```

The command deploys Kyverno on the Kubernetes cluster with default configuration. The [installation](https://kyverno.io/docs/installation/) guide lists the parameters that can be configured during installation.

## Uninstalling the Chart

To uninstall/delete the `kyverno` deployment:

```console
$ helm delete -n kyverno kyverno
```

The command removes all the Kubernetes components associated with the chart and deletes the release.

## Configuration

The following table lists the configurable parameters of the kyverno chart and their default values.

| Parameter                          | Description                                                                                                                                                                                                                                                  | Default                                                                                                                                                                           |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `affinity`                         | node/pod affinities                                                                                                                                                                                                                                          | `nil`                                                                                                                                                                             |
| `topologySpreadConstraints`        | node/pod topology spread constrains                                                                                                                                                                                                                          | `[]`                                                                                                                                                                             |
| `createSelfSignedCert`             | generate a self signed cert and certificate authority. Kyverno defaults to using kube-controller-manager CA-signed certificate or existing cert secret if false.                                                                                             | `false`                                                                                                                                                                           |
| `config.existingConfig`            | existing Kubernetes configmap to use for the resource filters configuration                                                                                                                                                                                  | `nil`                                                                                                                                                                             |
| `config.resourceFilters`           | list of resource types to be skipped by kyverno policy engine. See [documentation](https://kyverno.io/docs/installation/#resource-filters) for details | `[Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*][Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][SelfSubjectAccessReview,*,*][*,kyverno,*][Binding,*,*][ReplicaSet,*,*][ReportChangeRequest,*,*][ClusterReportChangeRequest,*,*]` |
| `config.webhooks`            | customize webhook configurations for both MutatingWebhookConfiguration and ValidatingWebhookConfiguration of Kubernetes resources, only `namespaceSelector` can be configured with Kyverno v1.4.0                                            | `nil`                                                                                                                                                                             |
| `customLabels` | Additional labels | `{}`
| `dnsPolicy`                        | Sets the DNS Policy which determines the manner in which DNS resolution happens across the cluster. For further reference, see [the official Kubernetes docs](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy)                | `ClusterFirst`                                                                                                                                                                    |
| `envVarsInit`                      | Extra environment variables to pass to kyverno initContainers 
| `envVars`                          | Extra environment variables to pass to Kyverno                                                                                                                                                                                                               | {}                                                                                                                                                                                |
| `extraArgs`                        | list of extra arguments to give the binary                                                                                                                                                                                                                   | `[]`                                                                                                                                                                              |
| `fullnameOverride`                 | override the expanded name of the chart                                                                                                                                                                                                                      | `nil`                                                                                                                                                                             |
| `generatecontrollerExtraResources` | extra resource type Kyverno is allowed to generate                                                                                                                                                                                                           | `[]`                                                                                                                                                                              |
| `hostNetwork`                      | Use the host network's namespace. Set it to `true` when dealing with a custom CNI over Amazon EKS                                                                                                                                                            | `false`                                                                                                                                                                           |
| `image.pullPolicy`                 | Image pull policy                                                                                                                                                                                                                                            | `IfNotPresent`                                                                                                                                                                    |
| `image.pullSecrets`                | Specify image pull secrets                                                                                                                                                                                                                                   | `[]` (does not add image pull secrets to deployed pods)                                                                                                                           |
| `image.repository`                 | Image repository                                                                                                                                                                                                                                             | `ghcr.io/kyverno/kyverno`                                                                                                                                                         |
| `image.tag`                        | Image tag                                                                                                                                                                                                                                                    | `nil`                                                                                                                                                                             |
| `initImage.pullPolicy`             | Init image pull policy                                                                                                                                                                                                                                       | `nil`                                                                                                                                                                             |
| `initImage.repository`             | Init image repository                                                                                                                                                                                                                                        | `ghcr.io/kyverno/kyvernopre`                                                                                                                                                      |
| `initImage.tag`                    | Init image tag                                                                                                                                                                                                                                               | `nil`                                                                                                                                                                             |
| `livenessProbe`                    | liveness probe configuration                                                                                                                                                                                                                                 | `{}`                                                                                                                                                                              |
| `nameOverride`                     | override the name of the chart                                                                                                                                                                                                                               | `nil`                                                                                                                                                                             |
| `namespace`                        | namespace the chart deploy to                                                                                                                                                                                                                                | `nil`                                                                                                                                                                             |
| `nodeSelector`                     | node labels for pod assignment                                                                                                                                                                                                                               | `{}`                                                                                                                                                                              |
| `podAnnotations`                   | annotations to add to each pod                                                                                                                                                                                                                               | `{}`                                                                                                                                                                              |
| `podLabels`                        | additional labels to add to each pod                                                                                                                                                                                                                         | `{}`                                                                                                                                                                              |
| `podSecurityContext`               | security context for the pod                                                                                                                                                                                                                                 | `{}`                                                                                                                                                                              |
| `priorityClassName`                | priorityClassName                                                                                                                                                                                                                                            | `nil`                                                                                                                                                                             |
| `rbac.create`                      | create ClusterRoles, ClusterRoleBindings, and ServiceAccount                                                                                                                                                                                             | `true`                                                                                                                                                                            |
| `rbac.serviceAccount.create`       | create a ServiceAccount                                                                                                                                                                                                                                     | `true`                                                                                                                                                                            |
| `rbac.serviceAccount.name`         | the ServiceAccount name                                                                                                                                                                                                                                     | `nil`                                                                                                                                                                             |
| `rbac.serviceAccount.annotations`  | annotations for the ServiceAccount                                                                                                                                                                                                                          | `{}`                                                                                                                                                                              |
| `readinessProbe`                   | readiness probe configuration                                                                                                                                                                                                                                | `{}`                                                                                                                                                                              |
| `replicaCount`                     | desired number of pods                                                                                                                                                                                                                                       | `1`                                                                                                                                                                               |
| `resources`                        | pod resource requests and limits                                                                                                                                                                                                                               | `{}`                                                                                                                                                                              |
| `service.annotations`              | annotations to add to the service                                                                                                                                                                                                                            | `{}`                                                                                                                                                                              |
| `service.nodePort`                 | node port                                                                                                                                                                                                                                                    | `nil`                                                                                                                                                                             |
| `service.port`                     | port for the service                                                                                                                                                                                                                                         | `443`                                                                                                                                                                             |
| `service.type`                     | type of service                                                                                                                                                                                                                                              | `ClusterIP`                                                                                                                                                                       |
| `serviceMonitor.enabled`                     | create a ServiceMonitor(Requires Prometheus)                                                                                                                                                                                                                                            | `false`                                                                                                                                                                       |
| `serviceMonitor.additionalLabels`                     | additional labels to add for ServiceMonitor                                                                                                                                                                                                                                           | `nil`                                                                                                                                                                       |

| `serviceMonitor.interval`                     | interval to scrape metrics                                                                                                                                                                                                                                           | `30s`                                                                                                                                                                       |

| `serviceMonitor.scrapeTimeout`                     | timeout if metrics can't be retrieved in given time interval                                                                                                                                                                                                                                           | `25s`                                                                                                                                                                       |

| `serviceMonitor.secure`                     | is TLS required for endpoint                                                                                                                                                                                                                                          | `false`                                                                                                                                                                       |

| `serviceMonitor.tlsConfig`                     | TLS Configuration for endpoint                                                                                                                                                                                                                                           | `[]`                                                                                                                                                                       |

| `tolerations`                      | list of node taints to tolerate                                                                                                                                                                                                                              | `[]`                                                                                                                                                                              |
| `securityContext`                  | security context configuration                                                                                                                                                                                                                               | `{}`                                                                                                                                                                              |
| `podSecurityStandard`              | set desired pod security level `privileged`, `baseline`, `restricted`, `custom`. Set to `restricted` for maximum security for your cluster. See: https://kyverno.io/policies/pod-security/                                                                    | `baseline`                                                                                                                                                                         |
| `podSecuritySeverity`              | set desired pod security severity `low`, `medium`, `high`. Used severity level in PolicyReportResults for the selected pod security policies.                                                                    | `medium`                                                                                                                                                                         |
| `podSecurityPolicies`              | Policies to include when `podSecurityStandard` is set to `custom`                                                                                                                                                                                            | `[]`                                                                                                                                                                              |
| `validationFailureAction`          | set to get response in failed validation check. Supported values are `audit` and `enforce`. See: https://kyverno.io/docs/writing-policies/validate/                                                                                                                | `audit`                                                                                                                                                                           |

Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,

```console
$ helm install --namespace kyverno kyverno ./charts/kyverno \
  --set=image.tag=v0.0.2,resources.limits.cpu=200m
```

Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,

```console
$ helm install --namespace kyverno kyverno ./charts/kyverno -f values.yaml
```

> **Tip**: You can use the default [values.yaml](values.yaml)

## TLS Configuration

If `createSelfSignedCert` is `true`, Helm will take care of the steps of creating an external self-signed certificate described in option 2 of the [installation documentation](https://kyverno.io/docs/installation/#option-2-use-your-own-ca-signed-certificate)

If `createSelfSignedCert` is `false`, Kyverno will generate a self-signed CA and a certificate, or you can provide your own TLS CA and signed-key pair and create the secret yourself as described in the [documentation](https://kyverno.io/docs/installation/#customize-the-installation-of-kyverno).

## Kyverno CLI

See: https://kyverno.io/docs/kyverno-cli/
