diff --git a/charts/kyverno-policies/Chart.yaml b/charts/kyverno-policies/Chart.yaml index 5438607cbc..78d9731fd8 100644 --- a/charts/kyverno-policies/Chart.yaml +++ b/charts/kyverno-policies/Chart.yaml @@ -31,3 +31,5 @@ annotations: description: "Walk back change in PSS policy to send to to_upper" - kind: fixed description: Skip DELETE requests on policies using deny statements + - kind: added + description: Add policyKind to allow changing ClusterPolicy to Policy for all policies diff --git a/charts/kyverno-policies/README.md b/charts/kyverno-policies/README.md index 20aad2ebd3..0d7a5fe660 100644 --- a/charts/kyverno-policies/README.md +++ b/charts/kyverno-policies/README.md @@ -63,6 +63,7 @@ The command removes all the Kubernetes components associated with the chart and | Key | Type | Default | Description | |-----|------|---------|-------------| +| policyKind | string | `"ClusterPolicy"` | Policy kind (`ClusterPolicy`, `Policy`) Set to `Policy` if you need namespaced policies and not cluster policies | | podSecurityStandard | string | `"baseline"` | Pod Security Standard profile (`baseline`, `restricted`, `privileged`, `custom`). For more info https://kyverno.io/policies/pod-security. | | podSecuritySeverity | string | `"medium"` | Pod Security Standard (`low`, `medium`, `high`). | | podSecurityPolicies | list | `[]` | Policies to include when `podSecurityStandard` is `custom`. | diff --git a/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml b/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml index 993a7c776f..80c8f8ff8f 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml @@ -2,7 +2,7 @@ {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} {{- include "kyverno-policies.supportedKyvernoCheck" (dict "top" . "ver" ">= 1.6.0-0") }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml b/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml index 894beec574..0709da5b11 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-host-namespaces" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml b/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml index 8793ef3a0b..c4d142682a 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-host-path.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-host-path" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml b/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml index 67ec3b9c04..cb29db0597 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-host-ports" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml b/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml index 8ad2d0c873..1205f4ecae 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-host-process.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-host-process" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml b/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml index 1d65f0292b..b0ce149ef8 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-privileged-containers" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml b/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml index c607738c73..3d215d0271 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-proc-mount" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml b/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml index 89d0209dc1..d8785a9287 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-selinux.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-selinux" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml b/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml index b58c68771b..3db9a943eb 100644 --- a/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml +++ b/charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml @@ -1,7 +1,7 @@ {{- $name := "restrict-apparmor-profiles" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml b/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml index 99dbcabc32..a62fdfe666 100644 --- a/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml +++ b/charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml @@ -1,7 +1,7 @@ {{- $name := "restrict-seccomp" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml b/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml index 7e3da6ad56..8e74fa8529 100644 --- a/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml +++ b/charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml @@ -1,7 +1,7 @@ {{- $name := "restrict-sysctls" }} {{- if eq (include "kyverno-policies.podSecurityBaseline" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/other/require-non-root-groups.yaml b/charts/kyverno-policies/templates/other/require-non-root-groups.yaml index 759fab90af..411f3ede00 100644 --- a/charts/kyverno-policies/templates/other/require-non-root-groups.yaml +++ b/charts/kyverno-policies/templates/other/require-non-root-groups.yaml @@ -1,7 +1,7 @@ {{- $name := "require-non-root-groups" }} {{- if eq (include "kyverno-policies.podSecurityOther" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml b/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml index 46ea01b10a..8d1bca940c 100644 --- a/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml +++ b/charts/kyverno-policies/templates/restricted/disallow-capabilities-strict.yaml @@ -2,7 +2,7 @@ {{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} {{- include "kyverno-policies.supportedKyvernoCheck" (dict "top" . "ver" ">= 1.6.0-0") }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml b/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml index 687a2eb45f..56148903fa 100644 --- a/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml +++ b/charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml @@ -1,7 +1,7 @@ {{- $name := "disallow-privilege-escalation" }} {{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml b/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml index f40877350e..baeaf07737 100644 --- a/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml +++ b/charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml @@ -1,7 +1,7 @@ {{- $name := "require-run-as-non-root-user" }} {{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml b/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml index 406689f32e..5ec363f700 100644 --- a/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml +++ b/charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml @@ -1,7 +1,7 @@ {{- $name := "require-run-as-nonroot" }} {{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml b/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml index af8888fe56..e5138b6af6 100644 --- a/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml +++ b/charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml @@ -1,7 +1,7 @@ {{- $name := "restrict-seccomp-strict" }} {{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml b/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml index f5e221c70b..31a9cecb4b 100644 --- a/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml +++ b/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml @@ -2,7 +2,7 @@ {{- if eq (include "kyverno-policies.podSecurityRestricted" (merge (dict "name" $name) .)) "true" }} {{- include "kyverno-policies.supportedKyvernoCheck" (dict "top" . "ver" ">= 1.6.0-0") }} apiVersion: kyverno.io/v1 -kind: ClusterPolicy +kind: {{ .Values.policyKind }} metadata: name: {{ $name }} annotations: diff --git a/charts/kyverno-policies/values.yaml b/charts/kyverno-policies/values.yaml index 1c662f70ac..ad61561af6 100644 --- a/charts/kyverno-policies/values.yaml +++ b/charts/kyverno-policies/values.yaml @@ -1,3 +1,7 @@ +# -- Policy kind (`ClusterPolicy`, `Policy`) +# Set to `Policy` if you need namespaced policies and not cluster policies +policyKind: ClusterPolicy + # -- Pod Security Standard profile (`baseline`, `restricted`, `privileged`, `custom`). # For more info https://kyverno.io/policies/pod-security. podSecurityStandard: baseline