make all kyverno policies optional and disabled by default

platform-apps/charts/kyverno/templates/crb-kubevirt-rolebinding.yaml

@@ -1,3 +1,4 @@
+{{ if has "policy-kubevirt-rolebinding" .Values.kyvernoPolicies }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -9,4 +10,5 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: kyverno-background-controller
-  namespace: kyverno
+  namespace: kyverno
+{{- end }}

platform-apps/charts/kyverno/templates/policy-add-label-velero.yaml

@@ -1,3 +1,4 @@
+{{ if has "add-labels-to-cm-velero" .Values.kyvernoPolicies }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
@@ -31,3 +32,4 @@ spec:
           labels:
             velero.io/exclude-from-backup: "true"
     skipBackgroundRequests: true
+{{- end }}

platform-apps/charts/kyverno/templates/policy-kubevirt-rolebinding.yaml

@@ -1,3 +1,4 @@
+{{ if has "policy-kubevirt-rolebinding" .Values.kyvernoPolicies }}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
@@ -39,4 +40,5 @@ spec:
             kind: ClusterRole
             name: kubevirt-datavolume-permission
             apiGroup: rbac.authorization.k8s.io
+{{- end }}
 

platform-apps/charts/kyverno/values.yaml

@@ -1,6 +1,8 @@
-kyvernoPolicies:
-  - add-ns-quota
-  - kargo-project-name-validation-apps-in-any-ns
+# per default no kyvernoPolicies get applied, add them in the list in your values files to enable them
+kyvernoPolicies: []
+#  - add-ns-quota
+#  - kargo-project-name-validation-apps-in-any-ns
+#  - policy-kubevirt-rolebinding
 
 kyverno:
   admissionController: