Changing policyType to podSecurityStandard

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>

charts/kyverno/README.md

@@ -99,7 +99,7 @@ Parameter | Description | Default
 `service.type` | type of service | `ClusterIP`
 `tolerations` | list of node taints to tolerate | `[]`
 `securityContext` | security context configuration | `{}`
-
+`podSecurityStandard` | set desired pod security level `privileged`, `default`, `restricted`. Set to `restricted` for maximum security for your cluster. See:  https://kyverno.io/policies/pod-security/ | `default`
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
 

charts/kyverno/templates/policies/default/disallow-adding-capabilities.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/disallow-host-namespaces.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/disallow-host-path.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/disallow-host-ports.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/disallow-privileged-containers.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/disallow-proc-mount.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/disallow-selinux.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/restrict-apparmor-profiles.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/default/restrict-sysctls.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "default" }}
+{{- if eq .Values.podSecurityStandard "default" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/restricted/deny-privilege-escalation.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "restricted" }}
+{{- if eq .Values.podSecurityStandard "restricted" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/restricted/require-non-root-groups.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "restricted" }}
+{{- if eq .Values.podSecurityStandard "restricted" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/restricted/require-run-as-nonroot.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "restricted" }}
+{{- if eq .Values.podSecurityStandard "restricted" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/restricted/restrict-seccomp.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "restricted" }}
+{{- if eq .Values.podSecurityStandard "restricted" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/templates/policies/restricted/restrict-volume-types.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.policyType "restricted" }}
+{{- if eq .Values.podSecurityStandard "restricted" }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:

charts/kyverno/values.yaml

@@ -1,8 +1,9 @@
 nameOverride:
 fullnameOverride:
 namespace:
-# Supported- default/restricted
-policyType: default
+# Supported- default/restricted/privileged
+# For more info- https://kyverno.io/policies/pod-security
+podSecurityStandard: default
 
 rbac:
   create: true