apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:05:33Z" generateName: kyverno-admission-controller-6c47f7875- labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 6c47f7875 name: kyverno-admission-controller-6c47f7875-gwqtn namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-admission-controller-6c47f7875 uid: 142dcf4d-55ad-454c-aba8-0c7fa391fa23 resourceVersion: "806" uid: d6f2c540-fbb1-4313-b071-05f12118a383 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - admission-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller - --reportsServiceAccountName=system:serviceaccount:kyverno:kyverno-reports-controller - --servicePort=443 - --webhookServerPort=9443 - --resyncPeriod=15m - --crdWatcher=false - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --dumpPayload=false - --forceFailurePolicyIgnore=false - --generateValidatingAdmissionPolicy=true - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --protectManagedResources=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: KYVERNO_SVC value: kyverno-svc - name: TUF_ROOT value: /.sigstore - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: kyverno ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics-port protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 384Mi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-l95f4 readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true initContainers: - args: - --loggingFormat=text - --v=2 - --openreportsEnabled=false env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller - name: KYVERNO_SVC value: kyverno-svc image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imagePullPolicy: IfNotPresent name: kyverno-pre resources: limits: cpu: 100m memory: 256Mi requests: cpu: 10m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-l95f4 readOnly: true nodeName: chart-test-swarm-run-76-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-admission-controller serviceAccountName: kyverno-admission-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-l95f4 projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:52Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:53Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:10Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:10Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:33Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://7ffc1832bdf69048c1eb2176441b78f033250f4d8f28c84845870ea0ca40886e image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imageID: reg.kyverno.io/kyverno/kyverno@sha256:dcd8cf6de2158cd8334fc728f9c4eb521e2c006320a59d69a9b91af87ac8f41c lastState: {} name: kyverno ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:06:02Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 initContainerStatuses: - containerID: containerd://1f6062518a1a441fa16a971aabe9971c8e1f76b844b75b1e9f6cbb844cfb6d53 image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imageID: reg.kyverno.io/kyverno/kyvernopre@sha256:e72b2309cde1d77de494c17e519dfe1dff9c1ee4d64327e80298a018bb612628 lastState: {} name: kyverno-pre ready: true restartCount: 0 started: false state: terminated: containerID: containerd://1f6062518a1a441fa16a971aabe9971c8e1f76b844b75b1e9f6cbb844cfb6d53 exitCode: 0 finishedAt: "2026-06-09T14:05:52Z" reason: Completed startedAt: "2026-06-09T14:05:52Z" phase: Running podIP: 10.244.0.8 podIPs: - ip: 10.244.0.8 qosClass: Burstable startTime: "2026-06-09T14:05:33Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:05:33Z" generateName: kyverno-background-controller-546f9479c7- labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 546f9479c7 name: kyverno-background-controller-546f9479c7-jck9w namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-background-controller-546f9479c7 uid: 92045a0d-1fc0-451d-bbbc-a75d58f391e5 resourceVersion: "703" uid: ef6c0bad-3966-4b29-ba49-de8267bf77f5 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - background-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-background-controller - name: KYVERNO_DEPLOYMENT value: kyverno-background-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-596xm readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-76-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-background-controller serviceAccountName: kyverno-background-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-596xm projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:49Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:33Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:49Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:49Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:33Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://01d1f321790bcc1b47e20a1acc24969870c5e18bb2f419a182e6cda60d521e81 image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imageID: reg.kyverno.io/kyverno/background-controller@sha256:33a19d2ae18ee0b8e650172f65985f35acd8909d6eeca4032465cca1ba022831 lastState: {} name: controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:05:49Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.7 podIPs: - ip: 10.244.0.7 qosClass: Burstable startTime: "2026-06-09T14:05:33Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:05:33Z" generateName: kyverno-cleanup-controller-5787967fcd- labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 5787967fcd name: kyverno-cleanup-controller-5787967fcd-5wxt7 namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-cleanup-controller-5787967fcd uid: 10e2f609-82e5-4611-84e9-efd485f318eb resourceVersion: "733" uid: 6b0b1aa4-2373-43e3-9c30-b3c4f8420ff9 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - cleanup-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --servicePort=443 - --resyncPeriod=15m - --cleanupServerPort=9443 - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --protectManagedResources=false - --ttlReconciliationInterval=1m env: - name: KYVERNO_DEPLOYMENT value: kyverno-cleanup-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-cleanup-controller - name: KYVERNO_ROLE_NAME value: kyverno:cleanup-controller - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_SVC value: kyverno-cleanup-controller image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-hgsdd readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-76-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-cleanup-controller serviceAccountName: kyverno-cleanup-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-hgsdd projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:42Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:33Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:54Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:54Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:33Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://c989524ec3a8984fba35d994a7ee6370bbdac34c1789d2733ac83041e2e45253 image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imageID: reg.kyverno.io/kyverno/cleanup-controller@sha256:e9b3342264c82ae35f4fe3abd0e563e613bb54eae6ca493134f0fd4cbacfc0d1 lastState: {} name: controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:05:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: Burstable startTime: "2026-06-09T14:05:33Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:05:33Z" generateName: kyverno-reports-controller-669cbff555- labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 669cbff555 name: kyverno-reports-controller-669cbff555-6fmrh namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-reports-controller-669cbff555 uid: 02e80736-9b98-4243-be23-19d183098ce6 resourceVersion: "688" uid: ee4e3b93-49d2-4c67-ab71-cfdf02c191cb spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - reports-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --openreportsEnabled=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --admissionReports=true - --aggregateReports=true - --policyReports=true - --validatingAdmissionPolicyReports=true - --mutatingAdmissionPolicyReports=false - --backgroundScan=true - --backgroundScanWorkers=2 - --backgroundScanInterval=1h - --skipResourceFilters=true - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-reports-controller - name: KYVERNO_DEPLOYMENT value: kyverno-reports-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: TUF_ROOT value: /.sigstore image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-qrvlc readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-76-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-reports-controller serviceAccountName: kyverno-reports-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-qrvlc projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:46Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:33Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:46Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:46Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:05:33Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://123d1acb399d2584a0d5ab0f56a82209ee115ca8a824177b227c0ca14344c1bf image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imageID: reg.kyverno.io/kyverno/reports-controller@sha256:4972c80bccbafecc65406ec938abf029f0a428c56ea86f4e5cd11f63d951aad9 lastState: {} name: controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:05:45Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.5 podIPs: - ip: 10.244.0.5 qosClass: Burstable startTime: "2026-06-09T14:05:33Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-background-controller-metrics namespace: kyverno resourceVersion: "571" uid: a917ad1a-dc18-452f-af5a-e92c96b999fa spec: clusterIP: 10.96.81.167 clusterIPs: - 10.96.81.167 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-cleanup-controller namespace: kyverno resourceVersion: "562" uid: 0394d483-7464-4253-9f63-5557a3b9c159 spec: clusterIP: 10.96.235.127 clusterIPs: - 10.96.235.127 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - appProtocol: https name: https port: 443 protocol: TCP targetPort: https selector: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-cleanup-controller-metrics namespace: kyverno resourceVersion: "580" uid: aad98117-b89d-4197-b4fa-d26b7d03c131 spec: clusterIP: 10.96.75.141 clusterIPs: - 10.96.75.141 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-reports-controller-metrics namespace: kyverno resourceVersion: "576" uid: b589e2a4-2a95-4a1b-98c9-37218137dcfd spec: clusterIP: 10.96.2.144 clusterIPs: - 10.96.2.144 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-svc namespace: kyverno resourceVersion: "559" uid: 842fef07-de44-4a3c-a224-396f84c2e6ab spec: clusterIP: 10.96.251.227 clusterIPs: - 10.96.251.227 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - appProtocol: https name: https port: 443 protocol: TCP targetPort: https selector: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-svc-metrics namespace: kyverno resourceVersion: "565" uid: 901e4b65-4e57-4427-837d-64bfd4c7518f spec: clusterIP: 10.96.99.164 clusterIPs: - 10.96.99.164 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-admission-controller namespace: kyverno resourceVersion: "812" uid: 84bfb15a-e70c-4d77-ad3f-91b7ac0cab9a spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - admission-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller - --reportsServiceAccountName=system:serviceaccount:kyverno:kyverno-reports-controller - --servicePort=443 - --webhookServerPort=9443 - --resyncPeriod=15m - --crdWatcher=false - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --dumpPayload=false - --forceFailurePolicyIgnore=false - --generateValidatingAdmissionPolicy=true - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --protectManagedResources=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: KYVERNO_SVC value: kyverno-svc - name: TUF_ROOT value: /.sigstore - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: kyverno ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics-port protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 384Mi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --loggingFormat=text - --v=2 - --openreportsEnabled=false env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller - name: KYVERNO_SVC value: kyverno-svc image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imagePullPolicy: IfNotPresent name: kyverno-pre resources: limits: cpu: 100m memory: 256Mi requests: cpu: 10m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-admission-controller serviceAccountName: kyverno-admission-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:06:10Z" lastUpdateTime: "2026-06-09T14:06:10Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:05:33Z" lastUpdateTime: "2026-06-09T14:06:10Z" message: ReplicaSet "kyverno-admission-controller-6c47f7875" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-background-controller namespace: kyverno resourceVersion: "707" uid: d792495b-41ac-45f6-83bf-8e57d78e41dd spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - background-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-background-controller - name: KYVERNO_DEPLOYMENT value: kyverno-background-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-background-controller serviceAccountName: kyverno-background-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:05:49Z" lastUpdateTime: "2026-06-09T14:05:49Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:05:33Z" lastUpdateTime: "2026-06-09T14:05:49Z" message: ReplicaSet "kyverno-background-controller-546f9479c7" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-cleanup-controller namespace: kyverno resourceVersion: "739" uid: 1ebc3c87-8aef-4dec-961c-72b07c67be6f spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - cleanup-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --servicePort=443 - --resyncPeriod=15m - --cleanupServerPort=9443 - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --protectManagedResources=false - --ttlReconciliationInterval=1m env: - name: KYVERNO_DEPLOYMENT value: kyverno-cleanup-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-cleanup-controller - name: KYVERNO_ROLE_NAME value: kyverno:cleanup-controller - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_SVC value: kyverno-cleanup-controller image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-cleanup-controller serviceAccountName: kyverno-cleanup-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:05:54Z" lastUpdateTime: "2026-06-09T14:05:54Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:05:33Z" lastUpdateTime: "2026-06-09T14:05:54Z" message: ReplicaSet "kyverno-cleanup-controller-5787967fcd" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-reports-controller namespace: kyverno resourceVersion: "692" uid: 91e7554a-4010-4dc1-8a5e-e037945e8d8e spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - reports-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --openreportsEnabled=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --admissionReports=true - --aggregateReports=true - --policyReports=true - --validatingAdmissionPolicyReports=true - --mutatingAdmissionPolicyReports=false - --backgroundScan=true - --backgroundScanWorkers=2 - --backgroundScanInterval=1h - --skipResourceFilters=true - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-reports-controller - name: KYVERNO_DEPLOYMENT value: kyverno-reports-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: TUF_ROOT value: /.sigstore image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-reports-controller serviceAccountName: kyverno-reports-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:05:46Z" lastUpdateTime: "2026-06-09T14:05:46Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:05:33Z" lastUpdateTime: "2026-06-09T14:05:46Z" message: ReplicaSet "kyverno-reports-controller-669cbff555" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 6c47f7875 name: kyverno-admission-controller-6c47f7875 namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-admission-controller uid: 84bfb15a-e70c-4d77-ad3f-91b7ac0cab9a resourceVersion: "811" uid: 142dcf4d-55ad-454c-aba8-0c7fa391fa23 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 6c47f7875 template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 6c47f7875 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - admission-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller - --reportsServiceAccountName=system:serviceaccount:kyverno:kyverno-reports-controller - --servicePort=443 - --webhookServerPort=9443 - --resyncPeriod=15m - --crdWatcher=false - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --dumpPayload=false - --forceFailurePolicyIgnore=false - --generateValidatingAdmissionPolicy=true - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --protectManagedResources=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: KYVERNO_SVC value: kyverno-svc - name: TUF_ROOT value: /.sigstore - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: kyverno ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics-port protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 384Mi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --loggingFormat=text - --v=2 - --openreportsEnabled=false env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller - name: KYVERNO_SVC value: kyverno-svc image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imagePullPolicy: IfNotPresent name: kyverno-pre resources: limits: cpu: 100m memory: 256Mi requests: cpu: 10m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-admission-controller serviceAccountName: kyverno-admission-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 546f9479c7 name: kyverno-background-controller-546f9479c7 namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-background-controller uid: d792495b-41ac-45f6-83bf-8e57d78e41dd resourceVersion: "706" uid: 92045a0d-1fc0-451d-bbbc-a75d58f391e5 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 546f9479c7 template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 546f9479c7 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - background-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-background-controller - name: KYVERNO_DEPLOYMENT value: kyverno-background-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-background-controller serviceAccountName: kyverno-background-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 5787967fcd name: kyverno-cleanup-controller-5787967fcd namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-cleanup-controller uid: 1ebc3c87-8aef-4dec-961c-72b07c67be6f resourceVersion: "737" uid: 10e2f609-82e5-4611-84e9-efd485f318eb spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 5787967fcd template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 5787967fcd spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - cleanup-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --servicePort=443 - --resyncPeriod=15m - --cleanupServerPort=9443 - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --protectManagedResources=false - --ttlReconciliationInterval=1m env: - name: KYVERNO_DEPLOYMENT value: kyverno-cleanup-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-cleanup-controller - name: KYVERNO_ROLE_NAME value: kyverno:cleanup-controller - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_SVC value: kyverno-cleanup-controller image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-cleanup-controller serviceAccountName: kyverno-cleanup-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:05:33Z" generation: 1 labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 669cbff555 name: kyverno-reports-controller-669cbff555 namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-reports-controller uid: 91e7554a-4010-4dc1-8a5e-e037945e8d8e resourceVersion: "691" uid: 02e80736-9b98-4243-be23-19d183098ce6 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 669cbff555 template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 669cbff555 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - reports-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --openreportsEnabled=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --admissionReports=true - --aggregateReports=true - --policyReports=true - --validatingAdmissionPolicyReports=true - --mutatingAdmissionPolicyReports=false - --backgroundScan=true - --backgroundScanWorkers=2 - --backgroundScanInterval=1h - --skipResourceFilters=true - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-reports-controller - name: KYVERNO_DEPLOYMENT value: kyverno-reports-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: TUF_ROOT value: /.sigstore image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-reports-controller serviceAccountName: kyverno-reports-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 kind: List metadata: resourceVersion: ""