apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kyverno
  namespace: kyverno
spec:
  interval: 15m
  releaseName: kyverno
  targetNamespace: kyverno
  chart:
    spec:
      chart: kyverno
      version: 3.9.2
      sourceRef:
        kind: HelmRepository
        name: kyverno
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    config:
      resourceFiltersExcludeNamespaces:
        - kube-system
      webhooks:
        namespaceSelector:
          matchExpressions: []
      matchConditions:
        - name: system-secrets
          expression: '!has(request.namespace) || request.namespace != "kube-system" || request.resource.resource == "secrets"'
    crds:
      install: true
    features:
      forceFailurePolicyIgnore:
        enabled: false
      policyExceptions:
        enabled: true
        namespace: kyverno
    admissionController:
      replicas: 3
      initContainer:
        image:
          tag: v1.19.2@sha256:27f3cc52e628559b56d08363b85316819802086c9808606914f7805a244148f4
      container:
        image:
          tag: v1.19.2@sha256:c8c4dd09e720d2cd7fd24ca73ac28e46651001372f988e0cba3f2f612f04b955
      rbac:
        clusterRole:
          extraResources:
            - apiGroups:
                - cilium.io
              resources:
                - ciliumnetworkpolicies
              verbs:
                - get
                - list
                - watch
            - apiGroups:
                - gateway.networking.k8s.io
              resources:
                - gateways
                - httproutes
                - tcproutes
                - referencegrants
                - grpcroutes
              verbs:
                - get
                - list
                - watch
            - apiGroups:
                - rbac.authorization.k8s.io
              resources:
                - roles
                - clusterroles
              verbs:
                - get
                - list
                - watch
      podDisruptionBudget:
        enabled: true
        minAvailable: 1
      antiAffinity:
        enabled: true
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
                - key: app.kubernetes.io/component
                  operator: In
                  values:
                    - admission-controller
            topologyKey: kubernetes.io/hostname
    backgroundController:
      replicas: 3
      image:
        tag: v1.19.2@sha256:c46e124f21ef8a6bb4b48de57106808b1007edcd5ddd4ff7df5d23b9efa60ce2
      rbac:
        clusterRole:
          extraResources:
            - apiGroups:
                - apps
              resources:
                - deployments
                - daemonsets
                - statefulsets
              verbs:
                - update
            - apiGroups:
                - ""
              resources:
                - secrets
              verbs:
                - get
                - list
                - watch
            - apiGroups:
                - gateway.networking.k8s.io
              resources:
                - gateways
                - httproutes
                - tcproutes
                - referencegrants
                - grpcroutes
              verbs:
                - get
                - list
                - watch
            - apiGroups:
                - rbac.authorization.k8s.io
              resources:
                - roles
                - clusterroles
              verbs:
                - get
                - list
                - watch
      podDisruptionBudget:
        enabled: true
        minAvailable: 1
      antiAffinity:
        enabled: true
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
                - key: app.kubernetes.io/component
                  operator: In
                  values:
                    - background-controller
            topologyKey: kubernetes.io/hostname
    cleanupController:
      replicas: 2
      image:
        tag: v1.19.2@sha256:d7340aa7c9315080c3dafa7b765d090ced37353e89e5cd7a3f9ac69e8fb532b2
      podDisruptionBudget:
        enabled: true
        minAvailable: 1
    reportsController:
      replicas: 2
      image:
        tag: v1.19.2@sha256:5fb6d3e738050dbce84f60ecabaede7665fbe0578d07c1e8c912443b035e79c3
      resources:
        limits:
          memory: 256Mi
      rbac:
        clusterRole:
          extraResources:
            - apiGroups:
                - ""
              resources:
                - secrets
              verbs:
                - get
                - list
                - watch
            - apiGroups:
                - cilium.io
              resources:
                - ciliumnetworkpolicies
                - ciliumclusterwidenetworkpolicies
              verbs:
                - get
                - list
                - watch
            - apiGroups:
                - gateway.networking.k8s.io
              resources:
                - gateways
                - httproutes
                - tcproutes
                - referencegrants
                - grpcroutes
              verbs:
                - get
                - list
                - watch
            - apiGroups:
                - rbac.authorization.k8s.io
              resources:
                - roles
                - clusterroles
              verbs:
                - get
                - list
                - watch
      podDisruptionBudget:
        enabled: true
        minAvailable: 1