EPMDEDP-17300: feat: add kyverno add-on

README.md

@@ -209,6 +209,7 @@ The repository provides a wide range of pre-configured add-ons for Kubernetes cl
 | kuberocketci-pipelines       | N/A       | N/A          | krci                   | False             | False    |
 | kuberocketci-rbac            | 0.1.0     | 0.1.0        | krci-security          | False             | False    |
 | kuberocketci                 | 3.15.0    | 3.15.0       | krci                   | False             | False    |
+| kyverno                      | 3.9.0     | 1.19.0       | kyverno                | True              | False    |
 | minio-operator               | 7.1.1     | v7.1.1       | minio-operator         | False             | False    |
 | moon                         | 2.7.11    | 2.7.11       | moon                   | False             | False    |
 | nexus-ce                     | 0.1.1     | 3.82.0       | nexus                  | False             | False    |

clusters/core/addons/kyverno/Chart.yaml

@@ -0,0 +1,20 @@
+apiVersion: v2
+name: kyverno
+description: A Helm chart for Kyverno policy engine
+
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+type: application
+
+# The chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+version: 3.9.0
+
+# Version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application.
+appVersion: "1.19.0"
+
+dependencies:
+- name: kyverno
+  version: 3.9.0
+  repository: https://kyverno.github.io/kyverno

clusters/core/addons/kyverno/README.md

@@ -0,0 +1,25 @@
+# kyverno
+
+![Version: 3.9.0](https://img.shields.io/badge/Version-3.9.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.19.0](https://img.shields.io/badge/AppVersion-1.19.0-informational?style=flat-square)
+
+A Helm chart for Kyverno policy engine
+
+## Requirements
+
+| Repository | Name | Version |
+|------------|------|---------|
+| https://kyverno.github.io/kyverno | kyverno | 3.9.0 |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| kyverno.admissionController.replicas | int | `1` |  |
+| kyverno.admissionController.resources.limits.memory | string | `"512Mi"` |  |
+| kyverno.admissionController.resources.requests.cpu | string | `"100m"` |  |
+| kyverno.admissionController.resources.requests.memory | string | `"128Mi"` |  |
+| kyverno.backgroundController.enabled | bool | `false` |  |
+| kyverno.cleanupController.enabled | bool | `false` |  |
+| kyverno.crds.install | bool | `true` |  |
+| kyverno.reportsController.enabled | bool | `false` |  |
+

clusters/core/addons/kyverno/values.yaml

@@ -0,0 +1,25 @@
+kyverno:
+  crds:
+    install: true
+
+  # Admission-only footprint: policies are enforced by the admission controller.
+  # Enable the extra controllers when mutate-existing, cleanup, or policy
+  # reports are needed.
+  admissionController:
+    # Set to 3 for HA on production clusters.
+    replicas: 1
+    resources:
+      limits:
+        memory: 512Mi
+      requests:
+        cpu: 100m
+        memory: 128Mi
+
+  backgroundController:
+    enabled: false
+
+  cleanupController:
+    enabled: false
+
+  reportsController:
+    enabled: false

clusters/core/apps/README.md

@@ -114,6 +114,7 @@ EDP Cluster Addons that extend the Kubernetes Cluster Functionality
 | kuberocketci.createNamespace | bool | `false` |  |
 | kuberocketci.enable | bool | `false` |  |
 | kuberocketci.namespace | string | `"krci"` |  |
+| kyverno | object | `{"createNamespace":true,"enable":false,"namespace":"kyverno"}` | Kyverno policy engine — admission control for the platform (e.g. Tekton PipelineRun guardrails) |
 | minio-operator.createNamespace | bool | `false` |  |
 | minio-operator.enable | bool | `false` |  |
 | minio-operator.namespace | string | `"minio-operator"` |  |

clusters/core/apps/templates/kyverno.yaml

@@ -0,0 +1,37 @@
+{{- if and (.Values.kyverno) (.Values.kyverno.enable) -}}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ .Values.destinationServer }}-kyverno
+  namespace: {{ .Values.argoNamespace | default "argocd" }}
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  project: {{ .Values.argoProject | default "default" }}
+  source:
+    repoURL: {{ .Values.repoUrl }}
+    path: clusters/{{ .Values.clusterName }}/addons/kyverno
+    targetRevision: {{ .Values.targetRevision }}
+    helm:
+      releaseName: kyverno
+  destination:
+    name: {{ .Values.destinationServer | default "in-cluster" }}
+    namespace: {{ index .Values "kyverno" "namespace" }}
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace={{ .Values.kyverno.createNamespace }}
+      # Kyverno CRDs exceed the client-side apply annotation size limit.
+      - ServerSideApply=true
+    retry:
+      limit: 1
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 1m
+  ignoreDifferences:
+    # Aggregated ClusterRoles are filled in by the API server at runtime.
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRole
+      jqPathExpressions:
+      - .rules
+{{- end -}}

clusters/core/apps/values.yaml

@@ -227,6 +227,12 @@ kuberocketci:
   enable: false
   namespace: krci
 
+# -- Kyverno policy engine — admission control for the platform (e.g. Tekton PipelineRun guardrails)
+kyverno:
+  createNamespace: true
+  enable: false
+  namespace: kyverno
+
 minio-operator:
   createNamespace: false
   enable: false

ct.yaml

@@ -36,6 +36,7 @@ chart-repos:
   - jetstack=https://charts.jetstack.io
   - keda=https://kedacore.github.io/charts
   - krakend=https://helm.equinixmetal.com
+  - kyverno=https://kyverno.github.io/kyverno
   - minio-operator=https://operator.min.io
   - moon2=https://charts.aerokube.com
   - oauth2-proxy=https://oauth2-proxy.github.io/manifests