From c6b96642f7c0bec1d7b2f5b195906bf02f231ee1 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Fri, 5 Sep 2025 13:49:18 -0500
Subject: [PATCH] Auto-install kyverno chart

---
 manifests/apply.sh                |  2 --
 manifests/helm/kustomization.yaml |  2 --
 manifests/helm/kyverno.yaml       | 40 -------------------------------
 modules/nixos/kubernetes.nix      | 17 +++++++++++++
 4 files changed, 17 insertions(+), 44 deletions(-)
 delete mode 100644 manifests/helm/kyverno.yaml

diff --git a/manifests/apply.sh b/manifests/apply.sh
index 7ffe584..6d0514d 100755
--- a/manifests/apply.sh
+++ b/manifests/apply.sh
@@ -6,8 +6,6 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 # Change to the script directory
 cd "$SCRIPT_DIR"
 
-kubectl apply -f helm/kyverno.yaml
-sleep 15
 kubectl apply -k helm
 sleep 5
 # https://cloudnative-pg.io
diff --git a/manifests/helm/kustomization.yaml b/manifests/helm/kustomization.yaml
index 531baaf..fa4d303 100644
--- a/manifests/helm/kustomization.yaml
+++ b/manifests/helm/kustomization.yaml
@@ -1,6 +1,4 @@
 resources:
-  - flux.yaml
-  - kyverno.yaml  # Needed to configure Longhorn
   - longhorn.yaml  # Needed for storage
   - traefik.yaml
   - external-secrets.yaml
diff --git a/manifests/helm/kyverno.yaml b/manifests/helm/kyverno.yaml
deleted file mode 100644
index bce3318..0000000
--- a/manifests/helm/kyverno.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kyverno-system
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: kyverno
-  namespace: kyverno-system
-spec:
-  interval: "24h"
-  url: "https://kyverno.github.io/kyverno/"
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kyverno
-  namespace: kyverno-system
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: kyverno
-      version: "3.4.4"
-      sourceRef:
-        kind: HelmRepository
-        name: kyverno
-      interval: "1h"
-  values:
-    admissionController:
-      replicas: 3
-    backgroundController:
-      replicas: 3
-    cleanupController:
-      replicas: 2
-    reportsController:
-      replicas: 2
-    crds:
-      install: true
diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix
index 06cad2e..43d1527 100644
--- a/modules/nixos/kubernetes.nix
+++ b/modules/nixos/kubernetes.nix
@@ -78,6 +78,23 @@ in
     services = {
       k3s = {
         enable = true;
+        autoDeployCharts = {
+          kyverno = {
+            enable = true;
+            createNamespace = true;
+            name = "kyverno";
+            repo = "https://kyverno.github.io/kyverno/";
+            targetNamespace = "kyverno-system";
+            values = {
+              admissionController.replicas =  3;
+              backgroundController.replicas =  3;
+              cleanupController.replicas =  2;
+              reportsController.replicas =  2;
+              crds.install =  true;
+            };
+            version = "3.4.4";
+          };
+        };
         extraFlags = [
           "--cluster-cidr=10.211.0.0/16"
           "--service-cidr=10.221.0.0/16"