# Kyverno Policy Engine - Zero Trust Configuration
# All policies start in Audit mode to avoid breaking existing workloads

admissionController:
  replicas: 3
  resources:
    limits:
      memory: 384Mi
    requests:
      cpu: 50m
      memory: 128Mi
  serviceMonitor:
    enabled: true

backgroundController:
  replicas: 2
  resources:
    limits:
      memory: 256Mi
    requests:
      cpu: 50m
      memory: 64Mi
  serviceMonitor:
    enabled: true

cleanupController:
  replicas: 1
  resources:
    limits:
      memory: 128Mi
    requests:
      cpu: 50m
      memory: 64Mi
  serviceMonitor:
    enabled: true

reportsController:
  replicas: 1
  resources:
    limits:
      memory: 256Mi
    requests:
      cpu: 50m
      memory: 64Mi
  serviceMonitor:
    enabled: true

# Enable metrics for Prometheus
metricsConfig:
  metricsExposure:
    enabled: true

# Exclude system namespaces from webhook
config:
  webhooks:
    namespaceSelector:
      matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: NotIn
          values:
            - kube-system
            - kube-public
            - kube-node-lease
            - cattle-system
            - cattle-fleet-system
            - cattle-fleet-local-system
            - cattle-capi-system
            - cattle-turtles-system
            - cattle-ui-plugin-system
            - cattle-impersonation-system
            - cattle-global-data
            - cattle-local-user-passwords
            - cattle-fleet-clusters-system
            - fleet-default
            - fleet-local
            - local
  excludeGroups:
    - system:serviceaccounts:kube-system
    - system:nodes
  resourceFiltersExcludeNamespaces:
    # Core Kubernetes
    - kube-system
    - kube-public
    - kube-node-lease
    - kyverno
    # Rancher (exact names)
    - cattle-system
    - cattle-fleet-system
    - cattle-fleet-local-system
    - cattle-capi-system
    - cattle-turtles-system
    - cattle-ui-plugin-system
    - cattle-impersonation-system
    - cattle-global-data
    - cattle-local-user-passwords
    - cattle-fleet-clusters-system
    - fleet-default
    - fleet-local
    - local
    # Rancher dynamic namespaces (wildcard)
    - c-*
    - p-*
    - u-*
    - user-*
    - cluster-fleet-*
    # Infrastructure operators and system namespaces
    - rook-ceph
    - cnpg-system
    - redis-operator
    - mariadb-system
    - cert-manager
    - istio-system
    - external-secrets
    - scylla-operator
    - scylla-manager
    - kiali-operator
    - envoy-gateway-system
    - reloader
    - tetragon
    - cilium-secrets
    - vault
    - prometheus
    - netbird-operator

features:
  policyExceptions:
    enabled: true
    namespace: kyverno