Initial commit

infrastructure/kyverno/values.yaml

@@ -0,0 +1,128 @@
+# Kyverno Policy Engine - Zero Trust Configuration
+# All policies start in Audit mode to avoid breaking existing workloads
+
+admissionController:
+  replicas: 3
+  resources:
+    limits:
+      memory: 384Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  serviceMonitor:
+    enabled: true
+
+backgroundController:
+  replicas: 2
+  resources:
+    limits:
+      memory: 256Mi
+    requests:
+      cpu: 50m
+      memory: 64Mi
+  serviceMonitor:
+    enabled: true
+
+cleanupController:
+  replicas: 1
+  resources:
+    limits:
+      memory: 128Mi
+    requests:
+      cpu: 50m
+      memory: 64Mi
+  serviceMonitor:
+    enabled: true
+
+reportsController:
+  replicas: 1
+  resources:
+    limits:
+      memory: 256Mi
+    requests:
+      cpu: 50m
+      memory: 64Mi
+  serviceMonitor:
+    enabled: true
+
+# Enable metrics for Prometheus
+metricsConfig:
+  metricsExposure:
+    enabled: true
+
+# Exclude system namespaces from webhook
+config:
+  webhooks:
+    namespaceSelector:
+      matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: NotIn
+          values:
+            - kube-system
+            - kube-public
+            - kube-node-lease
+            - cattle-system
+            - cattle-fleet-system
+            - cattle-fleet-local-system
+            - cattle-capi-system
+            - cattle-turtles-system
+            - cattle-ui-plugin-system
+            - cattle-impersonation-system
+            - cattle-global-data
+            - cattle-local-user-passwords
+            - cattle-fleet-clusters-system
+            - fleet-default
+            - fleet-local
+            - local
+  excludeGroups:
+    - system:serviceaccounts:kube-system
+    - system:nodes
+  resourceFiltersExcludeNamespaces:
+    # Core Kubernetes
+    - kube-system
+    - kube-public
+    - kube-node-lease
+    - kyverno
+    # Rancher (exact names)
+    - cattle-system
+    - cattle-fleet-system
+    - cattle-fleet-local-system
+    - cattle-capi-system
+    - cattle-turtles-system
+    - cattle-ui-plugin-system
+    - cattle-impersonation-system
+    - cattle-global-data
+    - cattle-local-user-passwords
+    - cattle-fleet-clusters-system
+    - fleet-default
+    - fleet-local
+    - local
+    # Rancher dynamic namespaces (wildcard)
+    - c-*
+    - p-*
+    - u-*
+    - user-*
+    - cluster-fleet-*
+    # Infrastructure operators and system namespaces
+    - rook-ceph
+    - cnpg-system
+    - redis-operator
+    - mariadb-system
+    - cert-manager
+    - istio-system
+    - external-secrets
+    - scylla-operator
+    - scylla-manager
+    - kiali-operator
+    - envoy-gateway-system
+    - reloader
+    - tetragon
+    - cilium-secrets
+    - vault
+    - prometheus
+    - netbird-operator
+
+features:
+  policyExceptions:
+    enabled: true
+    namespace: kyverno