278 lines
7.6 KiB
YAML
278 lines
7.6 KiB
YAML
#gatekeeper:
|
|
# replicas: 3
|
|
# revisionHistoryLimit: 10
|
|
# auditInterval: 60
|
|
# metricsBackends: ["prometheus"]
|
|
# auditMatchKindOnly: false
|
|
# constraintViolationsLimit: 20
|
|
# auditFromCache: false
|
|
# disableMutation: false
|
|
# disableValidatingWebhook: false
|
|
# validatingWebhookName: gatekeeper-validating-webhook-configuration
|
|
# validatingWebhookTimeoutSeconds: 3
|
|
# validatingWebhookFailurePolicy: Ignore
|
|
# validatingWebhookAnnotations: {}
|
|
# validatingWebhookExemptNamespacesLabels: {}
|
|
# validatingWebhookObjectSelector: {}
|
|
# validatingWebhookCheckIgnoreFailurePolicy: Fail
|
|
# validatingWebhookCustomRules: {}
|
|
# validatingWebhookURL: null
|
|
# enableDeleteOperations: false
|
|
# enableExternalData: true
|
|
# enableGeneratorResourceExpansion: true
|
|
# enableTLSHealthcheck: false
|
|
# maxServingThreads: -1
|
|
# mutatingWebhookName: gatekeeper-mutating-webhook-configuration
|
|
# mutatingWebhookFailurePolicy: Ignore
|
|
# mutatingWebhookReinvocationPolicy: Never
|
|
# mutatingWebhookAnnotations: {}
|
|
# mutatingWebhookExemptNamespacesLabels: {}
|
|
# mutatingWebhookObjectSelector: {}
|
|
# mutatingWebhookTimeoutSeconds: 1
|
|
# mutatingWebhookCustomRules: {}
|
|
# mutatingWebhookURL: null
|
|
# mutationAnnotations: false
|
|
# auditChunkSize: 500
|
|
# logLevel: INFO
|
|
# logDenies: false
|
|
# logMutations: false
|
|
# emitAdmissionEvents: false
|
|
# emitAuditEvents: false
|
|
# admissionEventsInvolvedNamespace: false
|
|
# auditEventsInvolvedNamespace: false
|
|
# resourceQuota: true
|
|
# externaldataProviderResponseCacheTTL: 3m
|
|
# image:
|
|
# repository: openpolicyagent/gatekeeper
|
|
# crdRepository: openpolicyagent/gatekeeper-crds
|
|
# release: v3.15.0-beta.0
|
|
# pullPolicy: Always
|
|
# pullSecrets: []
|
|
# preInstall:
|
|
# crdRepository:
|
|
# image:
|
|
# repository: null
|
|
# tag: v3.15.0-beta.0
|
|
# postUpgrade:
|
|
# labelNamespace:
|
|
# enabled: false
|
|
# image:
|
|
# repository: openpolicyagent/gatekeeper-crds
|
|
# tag: v3.15.0-beta.0
|
|
# pullPolicy: IfNotPresent
|
|
# pullSecrets: []
|
|
# extraNamespaces: []
|
|
# podSecurity: ["pod-security.kubernetes.io/audit=restricted",
|
|
# "pod-security.kubernetes.io/audit-version=latest",
|
|
# "pod-security.kubernetes.io/warn=restricted",
|
|
# "pod-security.kubernetes.io/warn-version=latest",
|
|
# "pod-security.kubernetes.io/enforce=restricted",
|
|
# "pod-security.kubernetes.io/enforce-version=v1.24"]
|
|
# extraAnnotations: {}
|
|
# priorityClassName: ""
|
|
# affinity: {}
|
|
# tolerations: []
|
|
# nodeSelector: {kubernetes.io/os: linux}
|
|
# resources: {}
|
|
# securityContext:
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsGroup: 999
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
# postInstall:
|
|
# labelNamespace:
|
|
# enabled: true
|
|
# extraRules: []
|
|
# image:
|
|
# repository: openpolicyagent/gatekeeper-crds
|
|
# tag: v3.15.0-beta.0
|
|
# pullPolicy: IfNotPresent
|
|
# pullSecrets: []
|
|
# extraNamespaces: []
|
|
# podSecurity: ["pod-security.kubernetes.io/audit=restricted",
|
|
# "pod-security.kubernetes.io/audit-version=latest",
|
|
# "pod-security.kubernetes.io/warn=restricted",
|
|
# "pod-security.kubernetes.io/warn-version=latest",
|
|
# "pod-security.kubernetes.io/enforce=restricted",
|
|
# "pod-security.kubernetes.io/enforce-version=v1.24"]
|
|
# extraAnnotations: {}
|
|
# priorityClassName: ""
|
|
# probeWebhook:
|
|
# enabled: true
|
|
# image:
|
|
# repository: curlimages/curl
|
|
# tag: 7.83.1
|
|
# pullPolicy: IfNotPresent
|
|
# pullSecrets: []
|
|
# waitTimeout: 60
|
|
# httpTimeout: 2
|
|
# insecureHTTPS: false
|
|
# priorityClassName: ""
|
|
# affinity: {}
|
|
# tolerations: []
|
|
# nodeSelector: {kubernetes.io/os: linux}
|
|
# securityContext:
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsGroup: 999
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
# preUninstall:
|
|
# deleteWebhookConfigurations:
|
|
# extraRules: []
|
|
# enabled: false
|
|
# image:
|
|
# repository: openpolicyagent/gatekeeper-crds
|
|
# tag: v3.15.0-beta.0
|
|
# pullPolicy: IfNotPresent
|
|
# pullSecrets: []
|
|
# priorityClassName: ""
|
|
# affinity: {}
|
|
# tolerations: []
|
|
# nodeSelector: {kubernetes.io/os: linux}
|
|
# resources: {}
|
|
# securityContext:
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsGroup: 999
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
# podAnnotations: {}
|
|
# auditPodAnnotations: {}
|
|
# podLabels: {}
|
|
# podCountLimit: "100"
|
|
# secretAnnotations: {}
|
|
# enableRuntimeDefaultSeccompProfile: true
|
|
# controllerManager:
|
|
# exemptNamespaces: []
|
|
# exemptNamespacePrefixes: []
|
|
# hostNetwork: false
|
|
# dnsPolicy: ClusterFirst
|
|
# port: 8443
|
|
# metricsPort: 8888
|
|
# healthPort: 9090
|
|
# readinessTimeout: 1
|
|
# livenessTimeout: 1
|
|
# priorityClassName: system-cluster-critical
|
|
# disableCertRotation: false
|
|
# tlsMinVersion: 1.3
|
|
# clientCertName: ""
|
|
# strategyType: RollingUpdate
|
|
# affinity:
|
|
# podAntiAffinity:
|
|
# preferredDuringSchedulingIgnoredDuringExecution:
|
|
# - podAffinityTerm:
|
|
# labelSelector:
|
|
# matchExpressions:
|
|
# - key: gatekeeper.sh/operation
|
|
# operator: In
|
|
# values:
|
|
# - webhook
|
|
# topologyKey: kubernetes.io/hostname
|
|
# weight: 100
|
|
# topologySpreadConstraints: []
|
|
# tolerations: []
|
|
# nodeSelector: {kubernetes.io/os: linux}
|
|
# resources:
|
|
# limits:
|
|
# memory: 512Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 512Mi
|
|
# securityContext:
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsGroup: 999
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
# podSecurityContext:
|
|
# fsGroup: 999
|
|
# supplementalGroups:
|
|
# - 999
|
|
# extraRules: []
|
|
# networkPolicy:
|
|
# enabled: false
|
|
# ingress: { }
|
|
# # - from:
|
|
# # - ipBlock:
|
|
# # cidr: 0.0.0.0/0
|
|
# audit:
|
|
# enablePubsub: false
|
|
# connection: audit-connection
|
|
# channel: audit-channel
|
|
# hostNetwork: false
|
|
# dnsPolicy: ClusterFirst
|
|
# metricsPort: 8888
|
|
# healthPort: 9090
|
|
# readinessTimeout: 1
|
|
# livenessTimeout: 1
|
|
# priorityClassName: system-cluster-critical
|
|
# disableCertRotation: false
|
|
# affinity: {}
|
|
# tolerations: []
|
|
# nodeSelector: {kubernetes.io/os: linux}
|
|
# resources:
|
|
# limits:
|
|
# memory: 512Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 512Mi
|
|
# securityContext:
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsGroup: 999
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
# podSecurityContext:
|
|
# fsGroup: 999
|
|
# supplementalGroups:
|
|
# - 999
|
|
# writeToRAMDisk: false
|
|
# extraRules: []
|
|
# crds:
|
|
# affinity: {}
|
|
# tolerations: []
|
|
# nodeSelector: {kubernetes.io/os: linux}
|
|
# resources: {}
|
|
# securityContext:
|
|
# allowPrivilegeEscalation: false
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsGroup: 65532
|
|
# runAsNonRoot: true
|
|
# runAsUser: 65532
|
|
# pdb:
|
|
# controllerManager:
|
|
# minAvailable: 1
|
|
# service: {}
|
|
# disabledBuiltins: ["{http.send}"]
|
|
# psp:
|
|
# enabled: true
|
|
# upgradeCRDs:
|
|
# enabled: true
|
|
# extraRules: []
|
|
# priorityClassName: ""
|
|
# rbac:
|
|
# create: true
|
|
# externalCertInjection:
|
|
# enabled: false
|
|
# secretName: gatekeeper-webhook-server-cert
|
|
# |