wbsong111
a79e959c60
* kyverno 3.9.0(appVersion v1.19.0) 차트 추가 — 자체 빌드 이미지 사용 업스트림 이미지가 CVE 스캔 불가능한 베이스를 써서 자체 빌드로 대체한다(빌드 정의·근거는 hardened-containers). custom-values.yaml이 docker.io/paasup/* 7개 이미지를 가리키도록 고정했다. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * kyverno 3.4.1 삭제 3.9.0 추가 후 정리 --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
{{- if .Values.config.create -}}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ template "kyverno.config.configMapName" . }}
|
|
namespace: {{ template "kyverno.namespace" . }}
|
|
labels:
|
|
{{- include "kyverno.config.labels" . | nindent 4 }}
|
|
annotations:
|
|
{{- with .Values.annotations }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- if .Values.config.preserve }}
|
|
helm.sh/resource-policy: "keep"
|
|
{{- end }}
|
|
data:
|
|
enableDefaultRegistryMutation: {{ .Values.config.enableDefaultRegistryMutation | quote }}
|
|
{{- with .Values.config.defaultRegistry }}
|
|
defaultRegistry: {{ . | quote }}
|
|
{{- end }}
|
|
generateSuccessEvents: {{ .Values.config.generateSuccessEvents | quote }}
|
|
{{- with .Values.config.successEventActions }}
|
|
successEventActions: {{ . | quote }}
|
|
{{- end }}
|
|
{{- with .Values.config.excludeGroups }}
|
|
excludeGroups: {{ join "," . | quote }}
|
|
{{- end -}}
|
|
{{- with .Values.config.excludeUsernames }}
|
|
excludeUsernames: {{ join "," . | quote }}
|
|
{{- end -}}
|
|
{{- with .Values.config.excludeRoles }}
|
|
excludeRoles: {{ join "," . | quote }}
|
|
{{- end -}}
|
|
{{- with .Values.config.excludeClusterRoles }}
|
|
excludeClusterRoles: {{ join "," . | quote }}
|
|
{{- end -}}
|
|
{{- if .Values.config.resourceFilters }}
|
|
resourceFilters: >-
|
|
{{- include "kyverno.config.resourceFilters" . | trim | nindent 4 }}
|
|
{{- end -}}
|
|
{{- with .Values.config.updateRequestThreshold }}
|
|
updateRequestThreshold: {{ . | quote }}
|
|
{{- end -}}
|
|
{{- if and .Values.config.webhooks .Values.config.excludeKyvernoNamespace }}
|
|
webhooks: {{ include "kyverno.config.webhooks" . | quote }}
|
|
{{- else if .Values.config.webhooks }}
|
|
webhooks: {{ .Values.config.webhooks | toJson | quote }}
|
|
{{- else if .Values.config.excludeKyvernoNamespace }}
|
|
webhooks: '{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["{{ include "kyverno.namespace" . }}"]}]}}'
|
|
{{- end -}}
|
|
{{- with .Values.config.webhookAnnotations }}
|
|
webhookAnnotations: {{ toJson . | quote }}
|
|
{{- end }}
|
|
{{- with .Values.config.webhookLabels }}
|
|
webhookLabels: {{ toJson . | quote }}
|
|
{{- end }}
|
|
{{- with .Values.config.matchConditions }}
|
|
matchConditions: {{ toJson . | quote }}
|
|
{{- end }}
|
|
{{- with .Values.config.maxContextSize }}
|
|
maxContextSize: {{ . | quote }}
|
|
{{- end }}
|
|
{{- end -}}
|