diff --git a/charts/mcp-operator/templates/deployment.yaml b/charts/mcp-operator/templates/deployment.yaml
index 0e70ce0..55d9d40 100644
--- a/charts/mcp-operator/templates/deployment.yaml
+++ b/charts/mcp-operator/templates/deployment.yaml
@@ -91,6 +91,10 @@ spec:
         {{- if .Values.apiserver.worker.intervalTime }}
         - --apiserver-worker-interval={{ .Values.apiserver.worker.intervalTime }}
         {{- end }}
+        env:
+        {{- with .Values.managedcontrolplane.extraEnv }}
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
         ports:
         {{- if not .Values.webhooks.disabled }}
           - name: webhooks-https
diff --git a/charts/mcp-operator/values.yaml b/charts/mcp-operator/values.yaml
index c016334..8b33d7c 100644
--- a/charts/mcp-operator/values.yaml
+++ b/charts/mcp-operator/values.yaml
@@ -54,6 +54,9 @@ webhooks:
 managedcontrolplane:
   disabled: false
 
+  # Extra environment variables to add to the init container.
+  extraEnv: [ ]
+
 apiserver:
   disabled: false
   # architecture:
diff --git a/internal/controller/core/cloudorchestrator/controller.go b/internal/controller/core/cloudorchestrator/controller.go
index 7b01414..2456864 100644
--- a/internal/controller/core/cloudorchestrator/controller.go
+++ b/internal/controller/core/cloudorchestrator/controller.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"strings"
 	"time"
 
@@ -42,6 +43,43 @@ import (
 const (
 	defaultNamespace string = "openmcp-system" // TODO make this configurable
 	ControllerName   string = "CloudOrchestrator"
+
+	envEnableKyvernoDefaultValues string = "ENABLE_KYVERNO_DEFAULT_VALUES"
+	kyvernoDefaultValues          string = `{
+  "config": {
+    "excludeGroups": [
+      "system:nodes"
+    ],
+    "preserve": false,
+    "resourceFilters": [
+      "[*/*,kyverno,*]",
+      "[*/*,istio-system,*]",
+      "[*/*,kyma-system,*]",
+      "[*/*,kube-system,*]",
+      "[*/*,kube-public,*]",
+      
+    ],
+    "updateRequestThreshold": 5000,
+    "webhooks": {
+      "namespaceSelector": {
+        "matchExpressions": [
+          {
+            "key": "kubernetes.io/metadata.name",
+            "operator": "NotIn",
+            "values": [
+              "kube-system",
+              "kyverno",
+              "istio-system",
+              "kube-public",
+              "kyma-system",
+              
+            ]
+          }
+        ]
+      }
+    }
+  }
+}`
 )
 
 var (
@@ -367,8 +405,14 @@ func convertToControlPlaneSpec(coSpec *openmcpv1alpha1.CloudOrchestratorSpec, ap
 	}
 
 	if coSpec.Kyverno != nil {
+		var values *apiextensionsv1.JSON
+		if os.Getenv(envEnableKyvernoDefaultValues) == "true" {
+			values = &apiextensionsv1.JSON{Raw: []byte(kyvernoDefaultValues)}
+		}
+
 		controlPlaneSpec.Kyverno = &corev1beta1.KyvernoConfig{
 			Version: coSpec.Kyverno.Version,
+			Values:  values,
 		}
 	}