kyverno-background-controller-fips

Key Features

Core capabilities and strengths of this container

• FIPS 140-2 compliant background processing
• Automated policy report generation
• Resource cleanup and optimization
• Secure background scan operations

Common Use Cases

Typical scenarios where this container excels

• Regulated environment policy enforcement
• Kubernetes cluster security compliance
• Automated security posture management
• Continuous policy validation

Pull Latest Image

Download the container image from the registry

Basic Run

Run the container with basic configuration

docker run -it --name kyverno-background-controller-fips clnstrt-images.cleanstart.com/$ORGANIZATION/kyverno-background-controller-fips:latest

Production Deployment

Deploy with production security settings

docker run -d --name kyverno-background-controller-fips \
  --read-only \
  --security-opt=no-new-privileges \
  --user 1000:1000 \
  clnstrt-images.cleanstart.com/$ORGANIZATION/kyverno-background-controller-fips:latest

Volume Mount

Mount local directory for persistent data

docker run -v $(pwd)/policies:/policies clnstrt-images.cleanstart.com/$ORGANIZATION/kyverno-background-controller-fips:latest

Port Forwarding

Run with custom port mappings

docker run -p 9443:9443 clnstrt-images.cleanstart.com/$ORGANIZATION/kyverno-background-controller-fips:latest

Environment Variables

Configuration options available through environment variables

KYVERNO_NAMESPACE

Namespace where Kyverno is installed

kyverno

METRICS_PORT

Port for metrics endpoint

9443

LOG_LEVEL

Logging level configuration

info

FIPS_MODE

FIPS mode configuration

enabled

Security Best Practices

Recommended security configurations and practices

• Enable FIPS mode in production environments
• Configure proper RBAC permissions
• Use secure communication channels
• Implement resource quotas and limits
• Regular security scanning and updates
• Monitor policy enforcement metrics

Kubernetes Security Context

Recommended security context for Kubernetes deployments

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
  seccompProfile:
    type: RuntimeDefault

Documentation Resources

Essential links and resources for further information

• Container Registry: https://clnstrt-images.cleanstart.com/$ORGANIZATION
• Kyverno Documentation: https://kyverno.io/docs/
• FIPS Compliance Guide: https://clnstrt-images.cleanstart.com/$ORGANIZATION/docs/fips-compliance