values.yaml

cosign:
  # add the values in base64 encoded
  cosignPub: ""
  webhookName: "policy.sigstore.dev"

installCRDs: true

imagePullSecrets: []

policywebhook:
  configData: {}
  replicaCount: 1
  image:
    repository: ghcr.io/sigstore/policy-controller/policy-webhook
    # crane digest ghcr.io/sigstore/policy-controller/policy-webhook:v0.4.2
    version: sha256:7ed0b012751d9941cb7b969ab2c37f5633d4dba2b2b445a6e6e23a91de554d6b
    pullPolicy: IfNotPresent
  env: {}
  extraArgs: {}
  resources:
    limits:
      cpu: 100m
      memory: 256Mi
    requests:
      cpu: 100m
      memory: 128Mi
  serviceAccount:
    annotations: {}
  securityContext:
    enabled: false
    runAsUser: 65532
  podSecurityContext:
    enabled: true
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    capabilities:
      drop:
        - ALL
  service:
    annotations: {}
    type: ClusterIP
    port: 443
  webhookNames:
    defaulting: "defaulting.clusterimagepolicy.sigstore.dev"
    validating: "validating.clusterimagepolicy.sigstore.dev"

webhook:
  replicaCount: 1
  name: webhook
  image:
    repository: ghcr.io/sigstore/policy-controller/policy-controller
    # crane digest ghcr.io/sigstore/policy-controller/policy-controller:v0.4.2
    version: sha256:435373b2bde7ed3fe133ff0d59bb4a23a0e15762320c9547fe6d1d042ab50c6c
    pullPolicy: IfNotPresent
  env: {}
  extraArgs: {}
  resources:
    limits:
      cpu: 100m
      memory: 256Mi
    requests:
      cpu: 100m
      memory: 128Mi
  securityContext:
    enabled: false
    runAsUser: 65532
  podSecurityContext:
    enabled: true
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    runAsUser: 1000
    capabilities:
      drop:
        - ALL
  serviceAccount:
    annotations: {}
  service:
    annotations: {}
    type: ClusterIP
    port: 443
    # For nodeport, specify the following:
    #   type: NodePort
    #   nodePort: <port-number>
  volumeMounts: []
  volumes: []
  namespaceSelector:
    matchExpressions:
      - key: policy.sigstore.dev/include
        operator: In
        values: ["true"]

## common node selector for all the pods
commonNodeSelector: {}
#  key1: value1
#  key2: value2

## common tolerations for all the pods
commonTolerations: []
# - key: "key"
#   operator: "Equal"
#   value: "value"
#   effect: "NoSchedule"

## serviceMonitor makes policy controller metrics discoverable to prometheus
serviceMonitor:
  enabled: false