diff --git a/charter/packages/kyverno/Architecture.md b/charter/packages/kyverno/Architecture.md index 4518790c0ea1e86138a647f7820eb3ea32069bd6..4a6959370ff6b95194648c153a59765ad059ad36 100644 --- a/charter/packages/kyverno/Architecture.md +++ b/charter/packages/kyverno/Architecture.md @@ -35,13 +35,16 @@ Data from Kyverno is not stored by the app directly, it is stored as objects in When deploying to k3d, istio-system should be added from `excludedNamespaces` under the `allowedDockerRegistries` violations. This can be done by modifying `chart/values.yaml` file or passing an override file with the values set as seen below. This is for development purposes only: production should not allow containers in the `istio-system` namespace to be pulled from outside of Registry1. ```yaml -kyverno: +kyvernopolicies: values: - violations: - allowedDockerRegistries: - match: - excludedNamespaces: - - istio-system # allows creation for loadbalancer pods for various ports and various vendor loadbalancers + exclude: + any: + # Allows k3d load balancer to bypass policies. + - resources: + namespaces: + - istio-system + names: + - svclb-* ``` ## High Availability