failurePolicy Ignore vs enforcing policies

[rubroboletus]

All webhooks have failurePolicy=ignore, but that can cause problems when you wanna to enforce policies on your cluster. Also updateStrategy for Deployment is not ideal. Consider using maxSurge: 1;maxUnavailable: 40%. Then with 1 running Pod, new one will be created first and old one Terminated on success. Also for enforcing rules, maybe better solution is to set failurePolicy=Fail, setting up proper timeout and namespaceSelector.matchExpressions: with good expression and label to kyverno namespace.

[JimBugwadia]

@rubroboletus thanks! I agree with your suggestions on the webhook defaults and deployment strategy. However, can you please elaborate on this?

Also for enforcing rules, maybe better solution is to set failurePolicy=Fail, setting up proper timeout and namespaceSelector.matchExpressions: with good expression and label to kyverno namespace.

What namespace selector are you referring to?

[rubroboletus]

@JimBugwadia namespace selector for webhook, from K8s documentation:

apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
...
webhooks:

• name: my-webhook.example.com
  namespaceSelector:
  matchExpressions:
  • key: namespace
    operator: NotIn
    values: ["kyverno"]
    rules:
  • operations: ["CREATE"]
    apiGroups: [""]
    apiVersions: [""]
    resources: ["*"]
    scope: "Namespaced"
    ...

but there is a risk, when someone labels another namespace with "namespace=kyverno". So this must be done with RBAC rule disallowing K8s operators to modify / add namespace labels, or kyverno rule disallowing to modify / add labels with name "namespace".

[JimBugwadia]

Release 1.4 will introduce HA options. We can then revisit the default webhook configuration.

[realshuting]

Hi @rubroboletus - namespaceSelector is supported now, please see https://kyverno.io/docs/installation/#webhooks for details.

For all other configurations, please track via #1981, #1995.