diff --git a/chart/templates/kyverno/gitrepository.yaml b/chart/templates/kyverno/gitrepository.yaml
index ea916bee5fc508e627ec990816420c11ea629e56..0b3f56aa375777f1e01374038d9831b75edbedf5 100644
--- a/chart/templates/kyverno/gitrepository.yaml
+++ b/chart/templates/kyverno/gitrepository.yaml
@@ -1,4 +1,4 @@
-{{- if and (not .Values.offline) (or .Values.kyverno.enabled .Values.kyvernopolicies.enabled) }}
+{{- if and (not .Values.offline) (or .Values.kyverno.enabled .Values.kyvernopolicies.enabled .Values.kyvernoreporter.enabled) }}
apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: GitRepository
metadata:
diff --git a/chart/templates/kyverno/helmrelease.yaml b/chart/templates/kyverno/helmrelease.yaml
index b2e388e016f071a8445e86f0575793fd90ca0d1e..938e492fbd8c7719eed2af5ab7f56a0bc96c25ba 100644
--- a/chart/templates/kyverno/helmrelease.yaml
+++ b/chart/templates/kyverno/helmrelease.yaml
@@ -1,5 +1,5 @@
{{- $fluxSettingskyverno := merge .Values.kyverno.flux .Values.flux -}}
-{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled }}
+{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled .Values.kyvernoreporter.enabled }}
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
diff --git a/chart/templates/kyverno/imagepullsecret.yaml b/chart/templates/kyverno/imagepullsecret.yaml
index a143b186485cceda5feb3fe1c9cefceabe791b29..a2681b2c51535c0cec91ec39d079ba01b4a4d70e 100644
--- a/chart/templates/kyverno/imagepullsecret.yaml
+++ b/chart/templates/kyverno/imagepullsecret.yaml
@@ -1,4 +1,4 @@
-{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled }}
+{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled .Values.kyvernoreporter.enabled }}
{{- if ( include "imagePullSecret" . ) }}
apiVersion: v1
kind: Secret
diff --git a/chart/templates/kyverno/namespace.yaml b/chart/templates/kyverno/namespace.yaml
index ec5d46706f34d47281f4c91fc4ef2dd0be5294d7..24bd7bc3bca14b4e8ecc3d4e28b7b081df65ea8a 100644
--- a/chart/templates/kyverno/namespace.yaml
+++ b/chart/templates/kyverno/namespace.yaml
@@ -1,4 +1,4 @@
-{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled }}
+{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled .Values.kyvernoreporter.enabled }}
apiVersion: v1
kind: Namespace
metadata:
diff --git a/chart/templates/kyverno/policies/values.yaml b/chart/templates/kyverno/policies/values.yaml
index 89be84b9b4b3a2be9da55909b471f2f1581caedb..093e00083405c0ea3f4dee6a67576113bc5e4186 100644
--- a/chart/templates/kyverno/policies/values.yaml
+++ b/chart/templates/kyverno/policies/values.yaml
@@ -1,6 +1,6 @@
{{- $pkg := "kyvernopolicies" }}
-{{- if .Values.kyvernopolicies.enabled }}
+{{- if (get .Values $pkg).enabled }}
{{- include "values-secret" (dict "root" $ "package" (dict "values" (fromYaml (include "bigbang.overlays.kyvernopolicies" .))) "name" "kyvernopolicies" "defaults" (include "bigbang.defaults.kyvernopolicies" .)) }}
{{- end }}
diff --git a/chart/templates/kyverno/reporter/gitrepository.yaml b/chart/templates/kyverno/reporter/gitrepository.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..8856c4c13ff4fad4b56dcd567d0bf587946c73ee
--- /dev/null
+++ b/chart/templates/kyverno/reporter/gitrepository.yaml
@@ -0,0 +1,18 @@
+{{- $pkg := "kyvernoreporter" }}
+{{- if (get .Values $pkg).enabled }}
+apiVersion: source.toolkit.fluxcd.io/v1beta1
+kind: GitRepository
+metadata:
+ name: {{ $pkg }}
+ namespace: {{ .Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: {{ $pkg }}
+ {{- include "commonLabels" . | nindent 4}}
+spec:
+ interval: {{ .Values.flux.interval }}
+ url: {{ (get .Values $pkg).git.repo }}
+ ref:
+ {{- include "validRef" (get .Values $pkg).git | nindent 4 }}
+ {{ include "gitIgnore" . }}
+ {{- include "gitCreds" . | nindent 2 }}
+{{- end }}
\ No newline at end of file
diff --git a/chart/templates/kyverno/reporter/helmrelease.yaml b/chart/templates/kyverno/reporter/helmrelease.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..7e2cdba317cafb04b16210bc38551e8dff8f82a5
--- /dev/null
+++ b/chart/templates/kyverno/reporter/helmrelease.yaml
@@ -0,0 +1,54 @@
+{{- $pkg := "kyvernoreporter" }}
+{{- $fluxSettings := merge (get .Values $pkg).flux .Values.flux -}}
+{{- if (get .Values $pkg).enabled }}
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+ name: {{ $pkg }}
+ namespace: {{ .Release.Namespace }}
+ labels:
+ app.kubernetes.io/name: {{ $pkg }}
+ {{- include "commonLabels" . | nindent 4}}
+spec:
+ targetNamespace: kyverno-reporter
+ chart:
+ spec:
+ chart: {{ (get .Values $pkg).git.path }}
+ interval: 5m
+ sourceRef:
+ kind: GitRepository
+ name: {{ $pkg }}
+ namespace: {{ .Release.Namespace }}
+
+ {{- toYaml $fluxSettings | nindent 2 }}
+
+ {{- if (get .Values $pkg).postRenderers }}
+ postRenderers:
+ {{ toYaml (get .Values $pkg).postRenderers | nindent 4 }}
+ {{- end }}
+ valuesFrom:
+ - name: {{ .Release.Name }}-{{ $pkg }}-values
+ kind: Secret
+ valuesKey: "common"
+ - name: {{ .Release.Name }}-{{ $pkg }}-values
+ kind: Secret
+ valuesKey: "defaults"
+ - name: {{ .Release.Name }}-{{ $pkg }}-values
+ kind: Secret
+ valuesKey: "overlays"
+ dependsOn:
+ - name: kyverno
+ namespace: {{ .Release.Namespace }}
+ {{- if .Values.kyvernopolicies.enabled }}
+ - name: kyvernopolicies
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
+ {{- if .Values.monitoring.enabled }}
+ - name: monitoring
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
+ {{- if .Values.istio.enabled }}
+ - name: istio
+ namespace: {{ .Release.Namespace }}
+ {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/chart/templates/kyverno/reporter/imagepullsecret.yaml b/chart/templates/kyverno/reporter/imagepullsecret.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..3fb580619f7bb8f31cc4ecf27ba0c5e1d1c5cd70
--- /dev/null
+++ b/chart/templates/kyverno/reporter/imagepullsecret.yaml
@@ -0,0 +1,16 @@
+{{- $pkg := "kyvernoreporter" }}
+{{- if (get .Values $pkg).enabled }}
+{{- if ( include "imagePullSecret" . ) }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: private-registry
+ namespace: kyverno-reporter
+ labels:
+ app.kubernetes.io/name: {{ $pkg }}
+ {{- include "commonLabels" . | nindent 4}}
+type: kubernetes.io/dockerconfigjson
+data:
+ .dockerconfigjson: {{ template "imagePullSecret" . }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/chart/templates/kyverno/reporter/namespace.yaml b/chart/templates/kyverno/reporter/namespace.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..52ab1656e4bb6ec5accea272b180adff2642c2af
--- /dev/null
+++ b/chart/templates/kyverno/reporter/namespace.yaml
@@ -0,0 +1,12 @@
+{{- $pkg := "kyvernoreporter" }}
+{{- if (get .Values $pkg).enabled }}
+apiVersion: v1
+kind: Namespace
+metadata:
+ labels:
+ app.kubernetes.io/name: {{ $pkg }}
+ app.kubernetes.io/component: "core"
+ {{- include "commonLabels" . | nindent 4}}
+ istio-injection: enabled
+ name: kyverno-reporter
+{{- end }}
\ No newline at end of file
diff --git a/chart/templates/kyverno/reporter/values.yaml b/chart/templates/kyverno/reporter/values.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..35007eba6a5d1e1923b8456e2d42f6e4133a87e2
--- /dev/null
+++ b/chart/templates/kyverno/reporter/values.yaml
@@ -0,0 +1,55 @@
+{{- $pkg := "kyvernoreporter" }}
+
+{{- if (get .Values $pkg).enabled }}
+{{- include "values-secret" (dict "root" $ "package" (get .Values $pkg) "name" $pkg "defaults" (include (printf "bigbang.defaults.%s" $pkg) .)) }}
+{{- end }}
+
+{{- define "bigbang.defaults.kyvernoreporter" -}}
+
+global:
+ fullnameOverride: kyverno-reporter
+
+image:
+ pullPolicy: {{ .Values.imagePullPolicy }}
+imagePullSecrets:
+- name: private-registry
+
+{{- if .Values.istio.enabled }}
+istio:
+ enabled: true
+podAnnotations:
+ {{ include "istioAnnotation" . }}
+{{- end }}
+
+kyvernoPlugin:
+ image:
+ pullPolicy: {{ .Values.imagePullPolicy }}
+ imagePullSecrets:
+ - name: private-registry
+ {{- if .Values.istio.enabled }}
+ podAnnotations:
+ {{ include "istioAnnotation" . }}
+ {{- end }}
+
+ui:
+ image:
+ pullPolicy: {{ .Values.imagePullPolicy }}
+ imagePullSecrets:
+ - name: private-registry
+ {{- if .Values.istio.enabled }}
+ podAnnotations:
+ {{ include "istioAnnotation" . }}
+ {{- end }}
+
+monitoring:
+ enabled: {{ .Values.monitoring.enabled }}
+ grafana:
+ namespace: monitoring
+
+openshift: {{ .Values.openshift }}
+
+networkPolicies:
+ enabled: {{ .Values.networkPolicies.enabled }}
+ controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
+
+{{- end -}}
\ No newline at end of file
diff --git a/chart/templates/kyverno/values.yaml b/chart/templates/kyverno/values.yaml
index 44ed591664b4e3842dc2f05be1761cfc23a1eff0..a3363ac57b92de1fd8f01e6e615ff1b2f6870ec6 100644
--- a/chart/templates/kyverno/values.yaml
+++ b/chart/templates/kyverno/values.yaml
@@ -1,4 +1,4 @@
-{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled }}
+{{- if or .Values.kyverno.enabled .Values.kyvernopolicies.enabled .Values.kyvernoreporter.enabled }}
{{- include "values-secret" (dict "root" $ "package" .Values.kyverno "name" "kyverno" "defaults" (include "bigbang.defaults.kyverno" .)) }}
{{- end }}
diff --git a/chart/values.yaml b/chart/values.yaml
index c8065d76eeefef31f177bb19dfdf094d3fe2f2b7..4843888613ef495d589b0c1526d428c73a5fbe28 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -407,6 +407,23 @@ kyvernopolicies:
# -- Post Renderers. See docs/postrenders.md
postRenderers: []
+kyvernoreporter:
+ # -- Toggle deployment of Kyverno Reporter
+ enabled: false
+ git:
+ repo: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/kyverno-reporter
+ path: ./chart
+ tag: "2.13.0-bb.0"
+
+ # -- Flux reconciliation overrides specifically for the Kyverno Reporter Package
+ flux: {}
+
+ # -- Values to passthrough to the kyverno reporter chart: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/kyverno-reporter.git
+ values: {}
+
+ # -- Post Renderers. See docs/postrenders.md
+ postRenderers: []
+
# ----------------------------------------------------------------------------------------------------------------------
# ----------------------------------------------------------------------------------------------------------------------
diff --git a/docs/packages.md b/docs/packages.md
index 911bd782ee359ecef355b33a8f338c2250769188..18b9186c0b04f1f2bfc3743bc954d55c49cffeac 100644
--- a/docs/packages.md
+++ b/docs/packages.md
@@ -26,6 +26,7 @@ Columns:
| [Cluster Auditor](https://repo1.dso.mil/platform-one/big-bang/apps/core/cluster-auditor) |  | No | No | No | [Yes](https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/565) | [Yes (STRICT)](https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/1370) | No |
| [Kyverno](https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/kyverno) |  | No | No | No | Yes | No | No |
| [Kyverno Policies](https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/kyverno-policies)  |  | No | No | No | Yes | No | No |
+| [Kyverno Reporter](https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/kyverno-reporter) |  | No | No | No | Yes | Yes (STRICT) | No |
| [Promtail](https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/promtail)  |  | No | No | No | Yes | [Yes (STRICT)](https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/1516) | No |
| [Loki](https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/loki)  |  | No | No | No | Yes | [Yes (STRICT)](https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/1516) | No |
| [Tempo](https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/tempo)  |  | No | Yes | Yes | [Yes](https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/1253) | [Yes (STRICT)](https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/1762) | No |
diff --git a/docs/understanding-bigbang/package-architecture/kyverno.md b/docs/understanding-bigbang/package-architecture/kyverno.md
index 1f3f74c2690086fcb504f53712a4ef5d849de6ab..345cddb6eb78bff49a0e886c70f0af3089ddbd3c 100644
--- a/docs/understanding-bigbang/package-architecture/kyverno.md
+++ b/docs/understanding-bigbang/package-architecture/kyverno.md
@@ -40,6 +40,37 @@ kyverno:
replicaCount: 3
```
+## Kyverno Reporter
+
+Kyverno Reporter is an optional component providing two main reporting functions:
+* Providing a metrics endpoint which can be used to observe in monitoring tools like Grafana.
+* Reporting Kyverno policy violations to various configurable `targets`, including Grafana Loki, Elasticsearch, Slack, Discord or MS Teams.
+
+
+```yaml
+kyvernoreporter:
+ enabled: true
+```
+
+### Kyverno Reporter UI
+While not yet officially supported by BigBang the Kyverno Reporter can be useful for inspecting policy results when other tools like Grafana are not available or in debugging scenarios.
+```yaml
+kyvernoreporter:
+ enabled: true
+
+ values:
+ global:
+ plugins:
+ kyverno:
+ enabled: true
+
+ ui:
+ enabled: true
+
+ kyvernoPlugin:
+ enabled: true
+```
+
## Single Sign on (SSO)
None. This service doesn't have a web interface.
diff --git a/tests/test-values.yaml b/tests/test-values.yaml
index 469b5a55034d4491ad62adfc3be26dd357eba497..649bce6f894a2c48ff9bbf1b1b364defec095bf8 100644
--- a/tests/test-values.yaml
+++ b/tests/test-values.yaml
@@ -293,6 +293,15 @@ kyverno:
bbtests:
enabled: true
+kyvernoreporter:
+ enabled: false
+ values:
+ bbtests:
+ cypress:
+ envs:
+ cypress_grafana_url: https://grafana.bigbang.dev
+ cypress_prometheus_url: https://prometheus.bigbang.dev
+
kyvernopolicies:
enabled: false
values: