values.yaml

{{- if or .Values.gatekeeper.enabled .Values.clusterAuditor.enabled }}
{{- include "values-secret" (dict "root" $ "package" (dict "values" (fromYaml (include "bigbang.overlays.gatekeeper" .))) "name" "gatekeeper" "defaults" (include "bigbang.defaults.gatekeeper" .)) }}
{{- end }}

{{- define "bigbang.defaults.gatekeeper" -}}
image:
  pullSecrets:
  - name: private-registry
postInstall:
  labelNamespace:
    enabled: false
    image:
      pullSecrets:
      - name: private-registry
postUpgrade:
  cleanupCRD:
    image:
      pullSecrets:
      - name: private-registry

networkPolicies:
  enabled: {{ .Values.networkPolicies.enabled }}
  controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
violations:  # Try to keep this in alpha order to make it easier to find keys

  allowedDockerRegistries:
    parameters:
      repos:
        - registry1.dso.mil
        - registry.dso.mil

  {{- if or .Values.monitoring.enabled .Values.fluentbit.enabled .Values.twistlock.enabled .Values.promtail.enabled }}
  allowedHostFilesystem:
    parameters:
      excludedResources:
      {{- if .Values.monitoring.enabled }}
      # Prometheus-node-exporter needs access to host to get node metrics
      - monitoring/monitoring-monitoring-prometheus-node-exporter-.*
      {{- end }}
      {{- if .Values.fluentbit.enabled }}
      # Fluentbit pods need access to host to get log files
      - logging/logging-fluent-bit-.*
      {{- end }}
      {{- if .Values.twistlock.enabled }}
      - twistlock/twistlock-defender-ds-.*
      {{- end }}
      {{- if .Values.promtail.enabled }}
      # promtail requires hostpath volume mounts
      # https://github.com/grafana/helm-charts/blob/main/charts/promtail/templates/daemonset.yaml#L120
      - logging/logging-promtail-.*
      {{- end }}
  {{- end }}

  {{- if .Values.twistlock.enabled }}
  hostNetworking:
    parameters:
      excludedResources:
        # Twistlock, by default, does its own network monitoring. hostNetworking is enabled by default for this purpose
        # With hostNetworking enabled, Istio sidecar injection is disabled. If this function is disabled, Twistlock wil
        # not be able to self monitor. If both Istio sidecar injection and TL monitoring are disabled, a security gap will
        # be created for network monitoring in Twistlock, so it is  important to make sure at least one is enabled.
        - twistlock/twistlock-defender-ds-.*
  noHostNamespace:
    parameters:
      excludedResources:
        - twistlock/twistlock-defender-ds-.*
  {{- end }}

  imageDigest:
    enabled: false