values.yaml

cosign:
  # add the values in base64 encoded
  cosignPub: ""
  webhookName: "policy.sigstore.dev"

installCRDs: true

imagePullSecrets: []

loglevel: info

webhook:
  customLabels: {}
  configData: {}
  replicaCount: 1
  name: webhook
  image:
    repository: ghcr.io/sigstore/policy-controller/policy-controller
    # crane digest ghcr.io/sigstore/policy-controller/policy-controller:v0.8.2
    version: sha256:f291fce5b9c1a69ba54990eda7e0fe4114043b1afefb0f4ee3e6f84ec9ef1605
    pullPolicy: IfNotPresent
  env: {}
  extraArgs: {}
  resources:
    limits:
      cpu: 200m
      memory: 512Mi
    requests:
      cpu: 100m
      memory: 128Mi
  securityContext:
    enabled: false
    runAsUser: 65532
  failurePolicy: Fail
  podSecurityContext:
    enabled: true
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    runAsUser: 1000
    capabilities:
      drop:
        - ALL
  podDisruptionBudget:
    enabled: true
    minAvailable: 1
    # maxUnavailable: 3
  serviceAccount:
    annotations: {}
    create: true
    name: ""
  service:
    annotations: {}
    type: ClusterIP
    port: 443
    # For nodeport, specify the following:
    #   type: NodePort
    #   nodePort: <port-number>
  volumeMounts: []
  volumes: []
  namespaceSelector:
    matchExpressions:
      - key: policy.sigstore.dev/include
        operator: In
        values: ["true"]
  registryCaBundle: {}
  webhookNames:
    defaulting: "defaulting.clusterimagepolicy.sigstore.dev"
    validating: "validating.clusterimagepolicy.sigstore.dev"

leasescleanup:
  image:
    repository: cgr.dev/chainguard/kubectl
    version: latest-dev
    pullPolicy: IfNotPresent

## common node selector for all the pods
commonNodeSelector: {}
#  key1: value1
#  key2: value2

## common tolerations for all the pods
commonTolerations: []
# - key: "key"
#   operator: "Equal"
#   value: "value"
#   effect: "NoSchedule"

## This will set some annotations in config maps and secrets. Use case: Disable versioning to deploy helm chart using spinnaker
commonAnnotations: {}
#  strategy.spinnaker.io/versioned: "false"
#  key2: value2

## serviceMonitor makes policy controller metrics discoverable to prometheus
serviceMonitor:
  enabled: false