diff --git a/chart/templates/kyverno-policies/values.yaml b/chart/templates/kyverno-policies/values.yaml index b667324a8f313d375b2196e651b9945a80e8f355..8ad0974f8472da63ecf290407a4c2ed833cc158a 100644 --- a/chart/templates/kyverno-policies/values.yaml +++ b/chart/templates/kyverno-policies/values.yaml @@ -114,6 +114,41 @@ policies: {{- end }} {{- end }} + # -- Prevent Automounting of Kubernetes API Credentials on Pods and Service Accounts + disallow-auto-mount-service-account-token: + enabled: true + validationFailureAction: Audit + exclude: + any: + {{- if .Values.addons.gitlab.enabled }} + - resources: + namespaces: + - gitlab + kinds: + - Pod + names: + - gitlab-shared-secrets* + {{- end }} + {{- if .Values.addons.gitlabRunner.enabled }} + - resources: + namespaces: + - gitlab-runner + kinds: + - ServiceAccount + names: + - gitlab-runner + {{- end }} + {{- if .Values.kyvernoReporter.enabled }} + - resources: + namespaces: + - kyverno-reporter + kinds: + - Pod + - Deployment + names: + - kyverno-reporter* + {{- end }} + {{- if or .Values.fluentbit.enabled .Values.monitoring.enabled .Values.twistlock.enabled }} disallow-tolerations: exclude: diff --git a/chart/values.yaml b/chart/values.yaml index d055fb15de12250269aec19b9963aaab32097a15..1003a1a90fd8b9cbbeb47382b1f50c1f429b1797 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -506,11 +506,11 @@ kyvernoPolicies: git: repo: https://repo1.dso.mil/big-bang/product/packages/kyverno-policies.git path: ./chart - tag: "3.0.4-bb.3" + tag: "3.0.4-bb.4" helmRepo: repoName: "registry1" chartName: "kyverno-policies" - tag: "3.0.4-bb.3" + tag: "3.0.4-bb.4" # -- Flux reconciliation overrides specifically for the Kyverno Package flux: {}