diff --git a/charts/kyverno/README.md b/charts/kyverno/README.md index 94746e99fb..6bdb29b261 100644 --- a/charts/kyverno/README.md +++ b/charts/kyverno/README.md @@ -99,7 +99,7 @@ Parameter | Description | Default `service.type` | type of service | `ClusterIP` `tolerations` | list of node taints to tolerate | `[]` `securityContext` | security context configuration | `{}` - +`podSecurityStandard` | set desired pod security level `privileged`, `default`, `restricted`. Set to `restricted` for maximum security for your cluster. See: https://kyverno.io/policies/pod-security/ | `default` Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml b/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml index 287f58906b..0127a8e0a9 100644 --- a/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml +++ b/charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml b/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml index d3eaa04100..79b0861917 100644 --- a/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml +++ b/charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/disallow-host-path.yaml b/charts/kyverno/templates/policies/default/disallow-host-path.yaml index b69eddffb6..92cec7443f 100644 --- a/charts/kyverno/templates/policies/default/disallow-host-path.yaml +++ b/charts/kyverno/templates/policies/default/disallow-host-path.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/disallow-host-ports.yaml b/charts/kyverno/templates/policies/default/disallow-host-ports.yaml index 29f09458f8..dabcb2730e 100644 --- a/charts/kyverno/templates/policies/default/disallow-host-ports.yaml +++ b/charts/kyverno/templates/policies/default/disallow-host-ports.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml b/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml index 78d20a29c4..96545eacd6 100644 --- a/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml +++ b/charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml b/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml index a78c9827e4..142c328405 100644 --- a/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml +++ b/charts/kyverno/templates/policies/default/disallow-proc-mount.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/disallow-selinux.yaml b/charts/kyverno/templates/policies/default/disallow-selinux.yaml index 8d5e777b1b..d288481ce8 100644 --- a/charts/kyverno/templates/policies/default/disallow-selinux.yaml +++ b/charts/kyverno/templates/policies/default/disallow-selinux.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml b/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml index 3d8cb9a3ea..f8c6389702 100644 --- a/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml +++ b/charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/default/restrict-sysctls.yaml b/charts/kyverno/templates/policies/default/restrict-sysctls.yaml index fdf7113a9a..2d5589a399 100644 --- a/charts/kyverno/templates/policies/default/restrict-sysctls.yaml +++ b/charts/kyverno/templates/policies/default/restrict-sysctls.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "default" }} +{{- if eq .Values.podSecurityStandard "default" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml b/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml index c2ed2b762e..99266c44e7 100644 --- a/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml +++ b/charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "restricted" }} +{{- if eq .Values.podSecurityStandard "restricted" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml b/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml index 3b7808b698..f7c53bf607 100644 --- a/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml +++ b/charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "restricted" }} +{{- if eq .Values.podSecurityStandard "restricted" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml b/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml index 4fa000c1de..21b870cdec 100644 --- a/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml +++ b/charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "restricted" }} +{{- if eq .Values.podSecurityStandard "restricted" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml b/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml index 2644bd6732..9af9849bd9 100644 --- a/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml +++ b/charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "restricted" }} +{{- if eq .Values.podSecurityStandard "restricted" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml b/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml index 75228f57cb..2c6b80d74e 100644 --- a/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml +++ b/charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml @@ -1,4 +1,4 @@ -{{- if eq .Values.policyType "restricted" }} +{{- if eq .Values.podSecurityStandard "restricted" }} apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: diff --git a/charts/kyverno/values.yaml b/charts/kyverno/values.yaml index eefd7bff36..cf0d45fcb8 100644 --- a/charts/kyverno/values.yaml +++ b/charts/kyverno/values.yaml @@ -1,8 +1,9 @@ nameOverride: fullnameOverride: namespace: -# Supported- default/restricted -policyType: default +# Supported- default/restricted/privileged +# For more info- https://kyverno.io/policies/pod-security +podSecurityStandard: default rbac: create: true