apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:07:52Z" generateName: kyverno-admission-controller-6c47f7875- labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 6c47f7875 name: kyverno-admission-controller-6c47f7875-k5h6s namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-admission-controller-6c47f7875 uid: d24a552c-74ac-4b3c-aabd-c75c0c93aea9 resourceVersion: "1131" uid: 441a9438-ca22-41f9-87fb-b92888d884a7 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - admission-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller - --reportsServiceAccountName=system:serviceaccount:kyverno:kyverno-reports-controller - --servicePort=443 - --webhookServerPort=9443 - --resyncPeriod=15m - --crdWatcher=false - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --dumpPayload=false - --forceFailurePolicyIgnore=false - --generateValidatingAdmissionPolicy=true - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --protectManagedResources=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: KYVERNO_SVC value: kyverno-svc - name: TUF_ROOT value: /.sigstore - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: kyverno ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics-port protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 384Mi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-mdb4n readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true initContainers: - args: - --loggingFormat=text - --v=2 - --openreportsEnabled=false env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller - name: KYVERNO_SVC value: kyverno-svc image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imagePullPolicy: IfNotPresent name: kyverno-pre resources: limits: cpu: 100m memory: 256Mi requests: cpu: 10m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-mdb4n readOnly: true nodeName: chart-test-swarm-run-77-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-admission-controller serviceAccountName: kyverno-admission-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-mdb4n projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:53Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:08:07Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:08:12Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:08:12Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:52Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://62cf4772130eb2dff370a01ecf21638e31f7627250ca5fc982a7c6ac2fcd7192 image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imageID: reg.kyverno.io/kyverno/kyverno@sha256:dcd8cf6de2158cd8334fc728f9c4eb521e2c006320a59d69a9b91af87ac8f41c lastState: {} name: kyverno ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:08:07Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 initContainerStatuses: - containerID: containerd://86f785b669cee4a2adbd62c2148047a2ffc5c8235db5081e5e60646cda1c4c6a image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imageID: reg.kyverno.io/kyverno/kyvernopre@sha256:e72b2309cde1d77de494c17e519dfe1dff9c1ee4d64327e80298a018bb612628 lastState: {} name: kyverno-pre ready: true restartCount: 0 started: false state: terminated: containerID: containerd://86f785b669cee4a2adbd62c2148047a2ffc5c8235db5081e5e60646cda1c4c6a exitCode: 0 finishedAt: "2026-06-09T14:08:06Z" reason: Completed startedAt: "2026-06-09T14:07:53Z" phase: Running podIP: 10.244.0.10 podIPs: - ip: 10.244.0.10 qosClass: Burstable startTime: "2026-06-09T14:07:52Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:06:51Z" generateName: kyverno-background-controller-546f9479c7- labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 546f9479c7 name: kyverno-background-controller-546f9479c7-srqhz namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-background-controller-546f9479c7 uid: d9180aa0-6712-474c-8a00-8f91f91bd9d3 resourceVersion: "704" uid: 6e09cf6f-d667-403c-ad96-0459eed7c893 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - background-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-background-controller - name: KYVERNO_DEPLOYMENT value: kyverno-background-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-524mj readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-77-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-background-controller serviceAccountName: kyverno-background-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-524mj projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:54Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:51Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:54Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:54Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:51Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://ab565f9cf9e4f3f96200df96d28ba039f3d8c146b30b463c16168dc84c61bb65 image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imageID: reg.kyverno.io/kyverno/background-controller@sha256:33a19d2ae18ee0b8e650172f65985f35acd8909d6eeca4032465cca1ba022831 lastState: {} name: controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:06:54Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.5 podIPs: - ip: 10.244.0.5 qosClass: Burstable startTime: "2026-06-09T14:06:51Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:06:51Z" generateName: kyverno-cleanup-controller-5787967fcd- labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 5787967fcd name: kyverno-cleanup-controller-5787967fcd-vs2jl namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-cleanup-controller-5787967fcd uid: 8f8a2f37-0e66-4c9f-9ba8-2e1a5d607383 resourceVersion: "805" uid: a8f9eaaa-82b6-470d-a512-2a154aff6da8 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - cleanup-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --servicePort=443 - --resyncPeriod=15m - --cleanupServerPort=9443 - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --protectManagedResources=false - --ttlReconciliationInterval=1m env: - name: KYVERNO_DEPLOYMENT value: kyverno-cleanup-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-cleanup-controller - name: KYVERNO_ROLE_NAME value: kyverno:cleanup-controller - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_SVC value: kyverno-cleanup-controller image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-7zdnr readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-77-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-cleanup-controller serviceAccountName: kyverno-cleanup-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-7zdnr projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:17Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:51Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:22Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:22Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:51Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://6d91b8f08afca2654920ad74fb0876d74e9bdb7877ab9b73e8063caf724be93a image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imageID: reg.kyverno.io/kyverno/cleanup-controller@sha256:e9b3342264c82ae35f4fe3abd0e563e613bb54eae6ca493134f0fd4cbacfc0d1 lastState: {} name: controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:07:17Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.7 podIPs: - ip: 10.244.0.7 qosClass: Burstable startTime: "2026-06-09T14:06:51Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:06:51Z" generateName: kyverno-reports-controller-669cbff555- labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 669cbff555 name: kyverno-reports-controller-669cbff555-wtgbg namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: kyverno-reports-controller-669cbff555 uid: c03f5b74-f934-4f4f-b59e-fa8e6f337ae3 resourceVersion: "746" uid: d45b0e34-6a32-43de-baee-f31bf70280e8 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - reports-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --openreportsEnabled=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --admissionReports=true - --aggregateReports=true - --policyReports=true - --validatingAdmissionPolicyReports=true - --mutatingAdmissionPolicyReports=false - --backgroundScan=true - --backgroundScanWorkers=2 - --backgroundScanInterval=1h - --skipResourceFilters=true - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-reports-controller - name: KYVERNO_DEPLOYMENT value: kyverno-reports-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: TUF_ROOT value: /.sigstore image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-qwzvg readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-77-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 0 restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-reports-controller serviceAccountName: kyverno-reports-controller terminationGracePeriodSeconds: 30 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token - name: kube-api-access-qwzvg projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:11Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:51Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:11Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:07:11Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:06:51Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://0ca531fcf120066db96f6b2dd1884ea9a91d45429cb1d200825083bc8451e0bc image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imageID: reg.kyverno.io/kyverno/reports-controller@sha256:4972c80bccbafecc65406ec938abf029f0a428c56ea86f4e5cd11f63d951aad9 lastState: {} name: controller ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:07:11Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.8 podIPs: - ip: 10.244.0.8 qosClass: Burstable startTime: "2026-06-09T14:06:51Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-background-controller-metrics namespace: kyverno resourceVersion: "611" uid: 229e69eb-5be6-45c7-891e-46b2d09228e4 spec: clusterIP: 10.96.78.48 clusterIPs: - 10.96.78.48 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-cleanup-controller namespace: kyverno resourceVersion: "622" uid: db647762-7ea7-4cef-9ecd-bc47f2a23aae spec: clusterIP: 10.96.111.233 clusterIPs: - 10.96.111.233 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - appProtocol: https name: https port: 443 protocol: TCP targetPort: https selector: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-cleanup-controller-metrics namespace: kyverno resourceVersion: "614" uid: e4106839-7756-405b-93cc-fc2100cc7db6 spec: clusterIP: 10.96.197.119 clusterIPs: - 10.96.197.119 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-reports-controller-metrics namespace: kyverno resourceVersion: "602" uid: 9b07e553-121e-4b5b-a335-d470344bb307 spec: clusterIP: 10.96.189.255 clusterIPs: - 10.96.189.255 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-svc namespace: kyverno resourceVersion: "604" uid: d1ba9f15-370c-4acb-9f65-ef108e805667 spec: clusterIP: 10.96.78.139 clusterIPs: - 10.96.78.139 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - appProtocol: https name: https port: 443 protocol: TCP targetPort: https selector: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-svc-metrics namespace: kyverno resourceVersion: "620" uid: 8dc7d0a1-9eda-4889-a24c-2be9d700c6ad spec: clusterIP: 10.96.199.49 clusterIPs: - 10.96.199.49 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: metrics-port port: 8000 protocol: TCP targetPort: 8000 selector: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 3 labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-admission-controller namespace: kyverno resourceVersion: "1137" uid: 07a0fd7e-264e-42f9-bd23-3656a7d53ca8 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - admission-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller - --reportsServiceAccountName=system:serviceaccount:kyverno:kyverno-reports-controller - --servicePort=443 - --webhookServerPort=9443 - --resyncPeriod=15m - --crdWatcher=false - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --dumpPayload=false - --forceFailurePolicyIgnore=false - --generateValidatingAdmissionPolicy=true - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --protectManagedResources=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: KYVERNO_SVC value: kyverno-svc - name: TUF_ROOT value: /.sigstore - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: kyverno ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics-port protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 384Mi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --loggingFormat=text - --v=2 - --openreportsEnabled=false env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller - name: KYVERNO_SVC value: kyverno-svc image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imagePullPolicy: IfNotPresent name: kyverno-pre resources: limits: cpu: 100m memory: 256Mi requests: cpu: 10m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-admission-controller serviceAccountName: kyverno-admission-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:06:51Z" lastUpdateTime: "2026-06-09T14:07:33Z" message: ReplicaSet "kyverno-admission-controller-6c47f7875" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing - lastTransitionTime: "2026-06-09T14:08:12Z" lastUpdateTime: "2026-06-09T14:08:12Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available observedGeneration: 3 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 1 labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-background-controller namespace: kyverno resourceVersion: "708" uid: c32c2414-b4b8-427f-9950-ffb93167c858 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - background-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-background-controller - name: KYVERNO_DEPLOYMENT value: kyverno-background-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-background-controller serviceAccountName: kyverno-background-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:06:54Z" lastUpdateTime: "2026-06-09T14:06:54Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:06:51Z" lastUpdateTime: "2026-06-09T14:06:54Z" message: ReplicaSet "kyverno-background-controller-546f9479c7" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 1 labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-cleanup-controller namespace: kyverno resourceVersion: "811" uid: 26596fc7-a835-4e3c-913b-fee8bd0f195b spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - cleanup-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --servicePort=443 - --resyncPeriod=15m - --cleanupServerPort=9443 - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --protectManagedResources=false - --ttlReconciliationInterval=1m env: - name: KYVERNO_DEPLOYMENT value: kyverno-cleanup-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-cleanup-controller - name: KYVERNO_ROLE_NAME value: kyverno:cleanup-controller - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_SVC value: kyverno-cleanup-controller image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-cleanup-controller serviceAccountName: kyverno-cleanup-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:07:22Z" lastUpdateTime: "2026-06-09T14:07:22Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:06:51Z" lastUpdateTime: "2026-06-09T14:07:22Z" message: ReplicaSet "kyverno-cleanup-controller-5787967fcd" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 1 labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 name: kyverno-reports-controller namespace: kyverno resourceVersion: "750" uid: d721cca0-a9ff-4d06-99d5-95e80206f3cb spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno strategy: rollingUpdate: maxSurge: 1 maxUnavailable: 40% type: RollingUpdate template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - reports-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --openreportsEnabled=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --admissionReports=true - --aggregateReports=true - --policyReports=true - --validatingAdmissionPolicyReports=true - --mutatingAdmissionPolicyReports=false - --backgroundScan=true - --backgroundScanWorkers=2 - --backgroundScanInterval=1h - --skipResourceFilters=true - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-reports-controller - name: KYVERNO_DEPLOYMENT value: kyverno-reports-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: TUF_ROOT value: /.sigstore image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-reports-controller serviceAccountName: kyverno-reports-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:07:11Z" lastUpdateTime: "2026-06-09T14:07:11Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:06:51Z" lastUpdateTime: "2026-06-09T14:07:11Z" message: ReplicaSet "kyverno-reports-controller-669cbff555" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 3 labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 6c47f7875 name: kyverno-admission-controller-6c47f7875 namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-admission-controller uid: 07a0fd7e-264e-42f9-bd23-3656a7d53ca8 resourceVersion: "1136" uid: d24a552c-74ac-4b3c-aabd-c75c0c93aea9 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 6c47f7875 template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: admission-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-admission-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 6c47f7875 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - admission-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller - --reportsServiceAccountName=system:serviceaccount:kyverno:kyverno-reports-controller - --servicePort=443 - --webhookServerPort=9443 - --resyncPeriod=15m - --crdWatcher=false - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --admissionReports=true - --maxAdmissionReports=1000 - --autoUpdateWebhooks=true - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --dumpPayload=false - --forceFailurePolicyIgnore=false - --generateValidatingAdmissionPolicy=true - --generateMutatingAdmissionPolicy=false - --dumpPatches=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --protectManagedResources=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: KYVERNO_SVC value: kyverno-svc - name: TUF_ROOT value: /.sigstore - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller image: reg.kyverno.io/kyverno/kyverno:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: kyverno ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics-port protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 384Mi requests: cpu: 100m memory: 128Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst initContainers: - args: - --loggingFormat=text - --v=2 - --openreportsEnabled=false env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-admission-controller - name: KYVERNO_ROLE_NAME value: kyverno:admission-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_DEPLOYMENT value: kyverno-admission-controller - name: KYVERNO_SVC value: kyverno-svc image: reg.kyverno.io/kyverno/kyvernopre:v1.18.1 imagePullPolicy: IfNotPresent name: kyverno-pre resources: limits: cpu: 100m memory: 256Mi requests: cpu: 10m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-admission-controller serviceAccountName: kyverno-admission-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 3 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 1 labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 546f9479c7 name: kyverno-background-controller-546f9479c7 namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-background-controller uid: c32c2414-b4b8-427f-9950-ffb93167c858 resourceVersion: "707" uid: d9180aa0-6712-474c-8a00-8f91f91bd9d3 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 546f9479c7 template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: background-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-background-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 546f9479c7 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - background-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --enableConfigMapCaching=true - --controllerRuntimeMetricsAddress=:8080 - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-background-controller - name: KYVERNO_DEPLOYMENT value: kyverno-background-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace image: reg.kyverno.io/kyverno/background-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-background-controller serviceAccountName: kyverno-background-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 1 labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 5787967fcd name: kyverno-cleanup-controller-5787967fcd namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-cleanup-controller uid: 26596fc7-a835-4e3c-913b-fee8bd0f195b resourceVersion: "810" uid: 8f8a2f37-0e66-4c9f-9ba8-2e1a5d607383 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 5787967fcd template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: cleanup-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-cleanup-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 5787967fcd spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - cleanup-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --caSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca - --tlsSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair - --tlsKeyAlgorithm=RSA - --servicePort=443 - --resyncPeriod=15m - --cleanupServerPort=9443 - --disableMetrics=false - --otelConfig=prometheus - --metricsPort=8000 - --enableDeferredLoading=true - --dumpPayload=false - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --protectManagedResources=false - --ttlReconciliationInterval=1m env: - name: KYVERNO_DEPLOYMENT value: kyverno-cleanup-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-cleanup-controller - name: KYVERNO_ROLE_NAME value: kyverno:cleanup-controller - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: KYVERNO_SVC value: kyverno-cleanup-controller image: reg.kyverno.io/kyverno/cleanup-controller:v1.18.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 2 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 15 periodSeconds: 30 successThreshold: 1 timeoutSeconds: 5 name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP readinessProbe: failureThreshold: 6 httpGet: path: /health/readiness port: 9443 scheme: HTTPS initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault startupProbe: failureThreshold: 20 httpGet: path: /health/liveness port: 9443 scheme: HTTPS initialDelaySeconds: 2 periodSeconds: 6 successThreshold: 1 timeoutSeconds: 1 terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-cleanup-controller serviceAccountName: kyverno-cleanup-controller terminationGracePeriodSeconds: 30 volumes: - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: kyverno meta.helm.sh/release-namespace: kyverno creationTimestamp: "2026-06-09T14:06:51Z" generation: 1 labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 669cbff555 name: kyverno-reports-controller-669cbff555 namespace: kyverno ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: kyverno-reports-controller uid: d721cca0-a9ff-4d06-99d5-95e80206f3cb resourceVersion: "749" uid: c03f5b74-f934-4f4f-b59e-fa8e6f337ae3 spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/part-of: kyverno pod-template-hash: 669cbff555 template: metadata: creationTimestamp: null labels: app.kubernetes.io/component: reports-controller app.kubernetes.io/instance: kyverno app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: kyverno-reports-controller app.kubernetes.io/part-of: kyverno app.kubernetes.io/version: 3.8.1 helm.sh/chart: kyverno-3.8.1 pod-template-hash: 669cbff555 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: app.kubernetes.io/component operator: In values: - reports-controller topologyKey: kubernetes.io/hostname weight: 1 automountServiceAccountToken: true containers: - args: - --disableMetrics=false - --openreportsEnabled=false - --otelConfig=prometheus - --metricsPort=8000 - --resyncPeriod=15m - --admissionReports=true - --aggregateReports=true - --policyReports=true - --validatingAdmissionPolicyReports=true - --mutatingAdmissionPolicyReports=false - --backgroundScan=true - --backgroundScanWorkers=2 - --backgroundScanInterval=1h - --skipResourceFilters=true - --enableConfigMapCaching=true - --enableDeferredLoading=true - --maxAPICallResponseLength=2000000 - --apiCallTimeout=30s - --loggingFormat=text - --v=2 - --omitEvents=PolicyApplied,PolicySkipped - --enablePolicyException=false - --allowInsecureRegistry=false - --registryCredentialHelpers=default,google,amazon,azure,github - --enableReporting=validate,mutate,mutateExisting,imageVerify,generate env: - name: KYVERNO_SERVICEACCOUNT_NAME value: kyverno-reports-controller - name: KYVERNO_DEPLOYMENT value: kyverno-reports-controller - name: INIT_CONFIG value: kyverno - name: METRICS_CONFIG value: kyverno-metrics - name: KYVERNO_POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: KYVERNO_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: TUF_ROOT value: /.sigstore image: reg.kyverno.io/kyverno/reports-controller:v1.18.1 imagePullPolicy: IfNotPresent name: controller ports: - containerPort: 9443 name: https protocol: TCP - containerPort: 8000 name: metrics protocol: TCP resources: limits: memory: 128Mi requests: cpu: 100m memory: 64Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL privileged: false readOnlyRootFilesystem: true runAsGroup: 65534 runAsNonRoot: true runAsUser: 65534 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /.sigstore name: sigstore - mountPath: /var/run/secrets/kyverno/apicall name: apicall-token readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux restartPolicy: Always schedulerName: default-scheduler securityContext: {} serviceAccount: kyverno-reports-controller serviceAccountName: kyverno-reports-controller terminationGracePeriodSeconds: 30 volumes: - emptyDir: {} name: sigstore - name: apicall-token projected: defaultMode: 292 sources: - serviceAccountToken: audience: kyverno-svc.kyverno.io expirationSeconds: 3600 path: token status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 kind: List metadata: resourceVersion: ""