wbsong111
a79e959c60
* kyverno 3.9.0(appVersion v1.19.0) 차트 추가 — 자체 빌드 이미지 사용 업스트림 이미지가 CVE 스캔 불가능한 베이스를 써서 자체 빌드로 대체한다(빌드 정의·근거는 hardened-containers). custom-values.yaml이 docker.io/paasup/* 7개 이미지를 가리키도록 고정했다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * kyverno 3.4.1 삭제 3.9.0 추가 후 정리 --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
82 lines
3.9 KiB
Plaintext
82 lines
3.9 KiB
Plaintext
Chart version: {{ .Chart.Version }}
|
|
Kyverno version: {{ default .Chart.AppVersion (default .Values.admissionController.container.image.tag .Values.admissionController.initContainer.image.tag) }}
|
|
|
|
Thank you for installing {{ .Chart.Name }}! Your release is named {{ .Release.Name }}.
|
|
|
|
The following components have been installed in your cluster:
|
|
{{- if .Values.crds.install }}
|
|
- CRDs
|
|
{{- end }}
|
|
- Admission controller
|
|
{{- if .Values.reportsController.enabled }}
|
|
- Reports controller
|
|
{{- end }}
|
|
{{- if .Values.cleanupController.enabled }}
|
|
- Cleanup controller
|
|
{{- end }}
|
|
{{- if .Values.backgroundController.enabled }}
|
|
- Background controller
|
|
{{- end }}
|
|
{{- if .Values.reportsServer.enabled }}
|
|
- Reports server
|
|
{{- end }}
|
|
{{- if .Values.grafana.enabled }}
|
|
- Grafana dashboard
|
|
{{- end }}
|
|
|
|
{{- if .Values.reportsServer.enabled }}
|
|
|
|
## Reports Server Integration
|
|
|
|
The Kyverno chart has been configured to install reports-server alongside Kyverno components.
|
|
|
|
Reports-server provides centralized storage for policy reports and enables advanced reporting capabilities.
|
|
|
|
{{- if .Values.reportsServer.waitForReady }}
|
|
All Kyverno components have been configured to wait for reports-server to be ready before starting.
|
|
This ensures proper initialization sequence.
|
|
{{- end }}
|
|
|
|
To access reports-server, use:
|
|
kubectl port-forward -n {{ include "kyverno.namespace" . }} svc/reports-server 8080:443
|
|
|
|
|
|
|
|
{{- end }}
|
|
|
|
{{ if not .Values.admissionController.replicas }}
|
|
⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode.
|
|
{{- else if lt (int .Values.admissionController.replicas) 2 }}
|
|
⚠️ WARNING: Setting the admission controller replica count below 2 means Kyverno is not running in high availability mode.
|
|
{{- end }}
|
|
|
|
{{- if semverCompare "<1.21.0" .Capabilities.KubeVersion.Version }}
|
|
⚠️ WARNING: The minimal Kubernetes version officially supported by Kyverno is 1.21. Earlier versions are untested and Kyverno is not guaranteed to work with Kubernetes {{ .Capabilities.KubeVersion.Version }}.
|
|
{{- end }}
|
|
|
|
{{- with .Values.config.matchConditions }}
|
|
⚠️ WARNING: Match conditions require a Kubernetes 1.27+ cluster with `AdmissionWebhookMatchConditions` feature gate enabled.
|
|
{{- end }}
|
|
|
|
{{- with .Values.features.generateMutatingAdmissionPolicy.enabled }}
|
|
⚠️ WARNING: Generating MutatingAdmissionPolicy requires a Kubernetes 1.32+ cluster with `MutatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled.
|
|
{{- end }}
|
|
|
|
{{- with .Values.features.mutatingAdmissionPolicyReports.enabled }}
|
|
⚠️ WARNING: Generating reports from MutatingAdmissionPolicies requires a Kubernetes 1.32+ cluster with `MutatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled.
|
|
{{- end }}
|
|
|
|
{{ if not .Values.features.policyExceptions.enabled }}
|
|
⚠️ WARNING: PolicyExceptions are disabled by default. To enable them, set '--enablePolicyException' to true.
|
|
{{- end }}
|
|
|
|
{{- if and .Values.crds.install (or .Values.crds.groups.kyverno.clusterpolicies .Values.crds.groups.kyverno.policies .Values.crds.groups.kyverno.cleanuppolicies .Values.crds.groups.kyverno.clustercleanuppolicies .Values.crds.groups.kyverno.policyexceptions) }}
|
|
⚠️ WARNING: The legacy kyverno.io policy types are deprecated and will be removed in a future release. Migrate to their policies.kyverno.io replacements:
|
|
- ClusterPolicy / Policy → ValidatingPolicy, MutatingPolicy, GeneratingPolicy, ImageValidatingPolicy (and their namespaced variants)
|
|
- ClusterCleanupPolicy / CleanupPolicy → DeletingPolicy / NamespacedDeletingPolicy
|
|
- PolicyException (kyverno.io) → PolicyException (policies.kyverno.io)
|
|
See https://kyverno.io/docs/guides/migration-to-cel/ for the migration guide.
|
|
{{- end }}
|
|
|
|
💡 Note: There is a trade-off when deciding which approach to take regarding Namespace exclusions. Please see the documentation at https://kyverno.io/docs/installation/#security-vs-operability to understand the risks.
|