diff --git a/content/en/docs/Installation/customization.md b/content/en/docs/Installation/customization.md index 21b1d95c9..e3dbfa78c 100644 --- a/content/en/docs/Installation/customization.md +++ b/content/en/docs/Installation/customization.md @@ -302,6 +302,7 @@ The following flags can be used to control the advanced behavior of the various |`backgroundScanInterval` (R) | 1h | Sets the time interval when periodic background scans for reporting take place. Supports minute durations as well (e.g., `10m`).| | `backgroundScanWorkers` (R) | 2 | Defines the number of internal worker threads to use when processing background scan reports. More workers means faster report processing at the cost of more resources consumed. Since the reports controller uses leader election, all reports processing will only be done by a single replica at a time. | | `caSecretName` (AC) | | overwrites the default secret name of the RootCA certificate. See also the related flag `tlsSecretName`.| +| `cleanupServerPort` (C) | 9443 | Defines the port used by the cleanup server. Usually changed in tandem with `webhookServerPort`.| | `clientRateLimitBurst` (ABCR) | 300 | Configures the maximum burst for throttling. Uses the client default if zero. | | `clientRateLimitQPS` (ABCR) | 300 | Configures the maximum QPS to the API server from Kyverno. Uses the client default if zero. | | `eventsRateLimitBurst` (ABCR) | 300 | Configures the maximum burst for throttling for events. Uses the client default if zero. | diff --git a/content/en/docs/Installation/platform-notes.md b/content/en/docs/Installation/platform-notes.md index b1cdb56e2..d5248938b 100644 --- a/content/en/docs/Installation/platform-notes.md +++ b/content/en/docs/Installation/platform-notes.md @@ -35,7 +35,7 @@ spec: source: chart: kyverno repoURL: https://kyverno.github.io/kyverno - targetRevision: 2.6.0 + targetRevision: syncPolicy: automated: prune: true @@ -59,8 +59,8 @@ Red Hat OpenShift contains a feature called [Security Context Constraints](https ### Notes for EKS Users -For EKS clusters built with the VPC CNI plug-in, if you wish to opt for the operability strategy as defined in the [Security vs Operability section](/docs/installation/#security-vs-operability), during the installation of Kyverno you should exclude the `kube-system` Namespace from webhooks as this is the Namespace where the plug-in runs. In situations where all the cluster Nodes are "deleted" (ex., only one node group in the cluster which is scaled to zero), which also impacts where the Kyverno replicas run, if `kube-system` is not excluded and where at least one policy in `Fail` mode matches on Pods, the VPC CNI plug-in's DaemonSet Pods may not be able to come online to finish the Node bootstrapping process. If this situation occurs, because the underlying cluster network cannot return to a healthy state, Kyverno will be unable to service webhook requests. +For EKS clusters built with the VPC CNI plug-in, if you wish to opt for the operability strategy as defined in the [Security vs Operability section](/docs/installation/#security-vs-operability), during the installation of Kyverno you should exclude the `kube-system` Namespace from webhooks as this is the Namespace where the plug-in runs. In situations where all the cluster Nodes are "deleted" (ex., only one node group in the cluster which is scaled to zero), which also impacts where the Kyverno replicas run, if `kube-system` is not excluded and where at least one policy in `Fail` mode matches on Pods, the VPC CNI plug-in's DaemonSet Pods may not be able to come online to finish the Node bootstrapping process. If this situation occurs, because the underlying cluster network cannot return to a healthy state, Kyverno will be unable to service webhook requests. As of Kyverno 1.12, `kube-system` is excluded by default in webhooks. ### Notes for AKS Users -AKS uses an Admission Enforcer control the webhooks in an AKS cluster and will remove those that may impact system Namespaces. Since Kyverno registers as a webhook, this Admission Enforcer may remove Kyverno's webhook causing the two to fight over webhook reconciliation. See [this Microsoft Azure FAQ](https://learn.microsoft.com/en-us/azure/aks/faq#can-admission-controller-webhooks-impact-kube-system-and-internal-aks-namespaces) for further information. When deploying Kyverno on an AKS cluster, set the Helm option `config.webhookAnnotations` to include the necessary annotation to disable the Admission Enforcer. Kyverno will configure its webhooks with this annotation to prevent their removal by AKS. The annotation that should be used is `"admissions.enforcer/disabled": true`. See the chart [README](https://github.com/kyverno/kyverno/blob/release-1.11/charts/kyverno/README.md) for more information. +AKS uses an Admission Enforcer control the webhooks in an AKS cluster and will remove those that may impact system Namespaces. Since Kyverno registers as a webhook, this Admission Enforcer may remove Kyverno's webhook causing the two to fight over webhook reconciliation. See [this Microsoft Azure FAQ](https://learn.microsoft.com/en-us/azure/aks/faq#can-admission-controller-webhooks-impact-kube-system-and-internal-aks-namespaces) for further information. When deploying Kyverno on an AKS cluster, set the Helm option `config.webhookAnnotations` to include the necessary annotation to disable the Admission Enforcer. Kyverno will configure its webhooks with this annotation to prevent their removal by AKS. The annotation that should be used is `"admissions.enforcer/disabled": true`. See the chart [README](https://github.com/kyverno/kyverno/blob/release-1.11/charts/kyverno/README.md) for more information. As of Kyverno 1.12, this annotation has already been set for you. diff --git a/content/en/docs/Introduction/_index.md b/content/en/docs/Introduction/_index.md index 4baa1bb18..750d6e48a 100644 --- a/content/en/docs/Introduction/_index.md +++ b/content/en/docs/Introduction/_index.md @@ -53,7 +53,7 @@ These guides are intended for proof-of-concept or lab demonstrations only and no First, install Kyverno from the latest release manifest. ```sh -kubectl create -f https://github.com/kyverno/kyverno/releases/download/v1.11.1/install.yaml +kubectl create -f https://github.com/kyverno/kyverno/releases/download/v1.12.0/install.yaml ``` Next, select the quick start guide in which you are interested. Alternatively, start at the top and work your way down.