values.yaml

{{- $pkg := "kyvernopolicies" }}

{{- if .Values.kyvernopolicies.enabled }}
{{- include "values-secret" (dict "root" $ "package" (dict "values" (fromYaml (include "bigbang.overlays.kyvernopolicies" .))) "name" "kyvernopolicies" "defaults" (include "bigbang.defaults.kyvernopolicies" .)) }}
{{- end }}

{{- define "bigbang.defaults.kyvernopolicies" -}}

{{- $deployRestic := (and .Values.addons.velero.enabled (dig "deployRestic" false .Values.addons.velero.values)) }}

waitforready:
  imagePullSecrets:
  - name: private-registry

policies:

  {{- if .Values.twistlock.enabled }}
  disallow-host-namespaces:
    exclude:
      any:
      {{- if .Values.twistlock.enabled }}
      # Twistlock, by default, does its own network monitoring. hostNetworking is enabled by default for this purpose
      # With hostNetworking enabled, Istio sidecar injection is disabled. If this function is disabled, Twistlock will
      # not be able to self monitor. If both Istio sidecar injection and TL monitoring are disabled, a security gap will
      # be created for network monitoring in Twistlock.  So, it is important to make sure at least one is enabled.
      - resources:
          namespaces:
          - twistlock
          names:
          - twistlock-defender-ds*
        {{- end }}
  {{- end }}

  disallow-image-tags:
    validationFailureAction: enforce

  disallow-istio-injection-bypass:
    enabled: {{ .Values.istio.enabled }}
    exclude:
      any:
      # Istio does not inject itself
      - resources:
          namespaces:
          - istio-system

  disallow-namespaces:
    validationFailureAction: enforce
    parameters:
      disallow:
      - bigbang
      - default

  {{- if .Values.fluentbit.enabled }}
  disallow-privileged-containers:
    exclude:
      any:
      {{- if .Values.fluentbit.enabled }}
      # NEEDS FURTHER JUSTIFICATION
      # Fluentbit needs privileged to read and store the buffer for tailing logs from the nodes
      - resources:
          namespaces:
          - logging
          names:
          - logging-fluent-bit*
      {{- end }}
  {{- end }}

  {{- if .Values.addons.gitlab.enabled }}
  disallow-shared-subpath-volume-writes:
    # Subpath volumes can be used in combination with symlinks to break out into the host filesystem