# hw-kyverno

![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.13](https://img.shields.io/badge/AppVersion-1.13-informational?style=flat-square)

## Requirements

| Repository | Name | Version |
|------------|------|---------|
| file://../hopsworkslib | hopsworkslib | 0.1.0 |

## Values

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| hopsworkslib | object | `{}` | override hopsworkslib values |
| policies | object | `{"addCertificatesVolume":{"autogenControllers":"DaemonSet,Deployment,Job,StatefulSet","cacertsConfigMap":"ca-pemstore","enabled":false,"envs":[],"extraAnnotations":[],"hopsworksProjectLabelKey":"hopsworks.ai/project","labels":[{"key":"job-type","value":"check-image-exist"},{"key":"job-type","value":"tag"},{"key":"job-type","value":"list-tags"},{"key":"job-type","value":"docker-build"},{"key":"job-type","value":"delete"},{"key":"job-type","value":"git-command"}],"mountPath":""},"prohibitHostPath":{"enabled":false}}` | Configuration for Hopsworks Kyverno policies and exceptions |
| policies.addCertificatesVolume | object | `{"autogenControllers":"DaemonSet,Deployment,Job,StatefulSet","cacertsConfigMap":"ca-pemstore","enabled":false,"envs":[],"extraAnnotations":[],"hopsworksProjectLabelKey":"hopsworks.ai/project","labels":[{"key":"job-type","value":"check-image-exist"},{"key":"job-type","value":"tag"},{"key":"job-type","value":"list-tags"},{"key":"job-type","value":"docker-build"},{"key":"job-type","value":"delete"},{"key":"job-type","value":"git-command"}],"mountPath":""}` | Configuration to add custom certificates to pods as a mounted volume |
| policies.addCertificatesVolume.autogenControllers | string | `"DaemonSet,Deployment,Job,StatefulSet"` | the list of controllers separated by comma to generate the policy for |
| policies.addCertificatesVolume.cacertsConfigMap | string | `"ca-pemstore"` | The name of the configmap containing the certificates. The configmap should contains the ca-certificates.crt trusted by the user to replace the whole /etc/ssl/certs. It should also include the root certificate(s) if any defined for OAUTH or LDAP identity providers. Also, if using a hosted object storage with a custom CA, it should includes the java/cacerts to trust that object storage host and that require updating the hopsfs.namenode.jvmOpts = "-Djavax.net.ssl.trustStore=/etc/ssl/certs/my-cacerts -Djavax.net.ssl.trustStorePassword=changeit" and similarly for the hopsfs.datanode.jvmOpts. |
| policies.addCertificatesVolume.enabled | bool | `false` | Enable add certificates volume |
| policies.addCertificatesVolume.envs | list | `[]` | The array of environment variables with their values that you would like to inject to the pods along side the certificates volume. |
| policies.addCertificatesVolume.extraAnnotations | list | `[]` | The array of extra annotations to use when filtering which pods to inject the certificates volume into. |
| policies.addCertificatesVolume.hopsworksProjectLabelKey | string | `"hopsworks.ai/project"` | the name of the label key to identify hopsworks user project namespaces |
| policies.addCertificatesVolume.labels | list | `[{"key":"job-type","value":"check-image-exist"},{"key":"job-type","value":"tag"},{"key":"job-type","value":"list-tags"},{"key":"job-type","value":"docker-build"},{"key":"job-type","value":"delete"},{"key":"job-type","value":"git-command"}]` | The array of labels to use when filtering which pods to inject the certificates volume into. The default list includes job-type=check-image-exist, job-type=tag, job-type=list-tags, job-type=docker-build, job-type=delete for docker operations, that is needed if using a registry with custom CA. The default list also includes job-type=git-command for git operations, that is needed if using a git host with custom CA. |
| policies.addCertificatesVolume.mountPath | string | `""` | Path to mount the certificates volume |
| policies.prohibitHostPath | object | `{"enabled":false}` | Configuration for disabling hostPath volumes in Pods |
| policies.prohibitHostPath.enabled | bool | `false` | Enable hostPath policy and relevant exceptions |