| mode | Operating mode: 'monitor' (log only) or 'trace' (enforce/block) | no | monitor |
| kntrl_version | kntrl release version to install (e.g. 'v0.5.0'). Defaults to 'latest'. | no | v0.2.2 |
| api_url | kntrl Cloud API URL for centralized reporting | no | "" |
| api_key | kntrl Cloud API key for authentication | no | "" |
| enable_default_network_rules | Enable built-in network allowlist (npm, PyPI, GitHub, CDN hosts) | no | true |
| enable_default_process_rules | Enable built-in process blocking (blocked chains and executables) | no | true |
| enable_default_dns_rules | Enable built-in DNS server allowlist (Google, Cloudflare) | no | true |
| enable_default_file_rules | Enable built-in file monitoring (secrets, credentials, SSH keys) | no | true |
| enable_default_supply_chain_rego | Enable built-in OPA supply chain protection rules (exfil domain blocklist, metadata blocking, registry lockdown) | no | true |
| allowed_hosts | Additional allowed hostnames (comma-separated, e.g. '.example.com,api.myservice.io') | no | "" |
| allowed_ips | Additional allowed IP addresses or CIDRs (comma-separated, e.g. '10.0.0.0/8,203.0.113.5') | no | "" |
| allow_local_ranges | Allow RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) | no | true |
| allow_github_meta | Dynamically allow GitHub Actions infrastructure IPs from api.github.com/meta | no | true |
| allow_metadata | Allow cloud metadata endpoints (169.254.169.254, 168.63.129.16) | no | false |
| extra_blocked_executables | Additional executables to block (comma-separated, e.g. 'nmap,masscan') | no | "" |
| extra_monitored_paths | Additional file paths to monitor (comma-separated, e.g. '/app/secrets/,/.env') | no | "" |
| extra_protected_paths | Additional file paths to protect from writes (comma-separated) | no | "" |
| extra_monitored_env_vars | Additional environment variables to monitor (comma-separated, e.g. 'MY_SECRET,DB_PASSWORD') | no | "" |
| custom_rules_file | Path to a custom YAML rules file (merged with defaults) | no | "" |
| custom_rules_dir | Path to a directory containing custom .yaml and/or .rego files (merged with defaults) | no | "" |
| custom_rego_file | Path to a custom .rego file to include alongside defaults | no | "" |
| network_profiles | JSON array of per-process network profiles. Example:
[{"process":"maven","allowed_hosts":["repo1.maven.org",".maven.org"]}]
| no | "" |
| extra_blocked_chains | JSON array of additional process blocked chains. Example:
[{"process":"curl","ancestors":["maven"]},{"process":"wget","ancestors":["gradle"]}]
| no | "" |