feat: add reinvocationPolicy config to the MutatingWebhookConfigurati…

…on Chart Config (#1844) * add reinvocationPolicy config to the MutatingWebhookConfiguration. Leaves the default as Never which is the Kubernetes default set today Signed-off-by: Mitchell Maler <mitchell.maler@live.com> * revert change Signed-off-by: Mitchell Maler <mitchell.maler@live.com> * run make manifests Signed-off-by: Mitchell Maler <mitchell.maler@live.com> Co-authored-by: Rita Zhang <rita.z.zhang@gmail.com>
open-policy-agent · Feb 24, 2022 · 6efe4af · 6efe4af
1 parent b8bf07f
commit 6efe4af
Show file tree

Hide file tree

Showing 7 changed files with 8 additions and 0 deletions.
diff --git a/cmd/build/helmify/kustomize-for-helm.yaml b/cmd/build/helmify/kustomize-for-helm.yaml
@@ -198,6 +198,7 @@ webhooks:
       namespace: gatekeeper-system
       path: /v1/mutate
   failurePolicy: HELMSUBST_MUTATING_WEBHOOK_FAILURE_POLICY
+  reinvocationPolicy: HELMSUBST_MUTATING_WEBHOOK_REINVOCATION_POLICY
   rules:
   - HELMSUBST_MUTATING_WEBHOOK_OPERATION_RULES
   matchPolicy: Exact

diff --git a/cmd/build/helmify/replacements.go b/cmd/build/helmify/replacements.go
@@ -57,6 +57,8 @@ var replacements = map[string]string{
 
 	"HELMSUBST_MUTATING_WEBHOOK_FAILURE_POLICY": `{{ .Values.mutatingWebhookFailurePolicy }}`,
 
+	"HELMSUBST_MUTATING_WEBHOOK_REINVOCATION_POLICY": `{{ .Values.mutatingWebhookReinvocationPolicy }}`,
+
 	"- HELMSUBST_MUTATING_WEBHOOK_EXEMPT_NAMESPACE_LABELS": `
     {{- range $key, $value := .Values.mutatingWebhookExemptNamespacesLabels}}
     - key: {{ $key }}

diff --git a/cmd/build/helmify/static/README.md b/cmd/build/helmify/static/README.md
@@ -92,6 +92,7 @@ _See [Exempting Namespaces](https://open-policy-agent.github.io/gatekeeper/websi
 | enableExternalData                            | Enable external data (alpha feature)                                                                                                                                                                                                                | `false`                                                                   |
 | enableTLSHealthcheck                          | Enable probing webhook API with certificate stored in certDir                                                                                                                                                                                       | `false`                                                                   |
 | mutatingWebhookFailurePolicy                  | The failurePolicy for the mutating webhook                                                                                                                                                                                                          | `Ignore`                                                                  |
+| mutatingWebhookReinvocationPolicy             | The reinvocationPolicy for the mutating webhook                                                                                                                                                                                                     | `Never`                                                                   |
 | mutatingWebhookExemptNamespacesLabels         | Additional namespace labels that will be exempt from the mutating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.   | `{}`                                                                      |
 | mutatingWebhookTimeoutSeconds                 | The timeout for the mutating webhook in seconds                                                                                                                                                                                                     | `3`                                                                       |
 | mutatingWebhookCustomRules                    | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                                 | `{}`                                                                      |

diff --git a/cmd/build/helmify/static/values.yaml b/cmd/build/helmify/static/values.yaml
@@ -14,6 +14,7 @@ enableDeleteOperations: false
 enableExternalData: false
 enableTLSHealthcheck: false
 mutatingWebhookFailurePolicy: Ignore
+mutatingWebhookReinvocationPolicy: Never
 mutatingWebhookExemptNamespacesLabels: {}
 mutatingWebhookTimeoutSeconds: 3
 mutatingWebhookCustomRules: {}

diff --git a/manifest_staging/charts/gatekeeper/README.md b/manifest_staging/charts/gatekeeper/README.md
@@ -92,6 +92,7 @@ _See [Exempting Namespaces](https://open-policy-agent.github.io/gatekeeper/websi
 | enableExternalData                            | Enable external data (alpha feature)                                                                                                                                                                                                                | `false`                                                                   |
 | enableTLSHealthcheck                          | Enable probing webhook API with certificate stored in certDir                                                                                                                                                                                       | `false`                                                                   |
 | mutatingWebhookFailurePolicy                  | The failurePolicy for the mutating webhook                                                                                                                                                                                                          | `Ignore`                                                                  |
+| mutatingWebhookReinvocationPolicy             | The reinvocationPolicy for the mutating webhook                                                                                                                                                                                                     | `Never`                                                                   |
 | mutatingWebhookExemptNamespacesLabels         | Additional namespace labels that will be exempt from the mutating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.   | `{}`                                                                      |
 | mutatingWebhookTimeoutSeconds                 | The timeout for the mutating webhook in seconds                                                                                                                                                                                                     | `3`                                                                       |
 | mutatingWebhookCustomRules                    | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                                 | `{}`                                                                      |

diff --git a/...per/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml b/...per/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml
@@ -31,6 +31,7 @@ webhooks:
       operator: NotIn
       value: {{ $value }}
     {{- end }}
+  reinvocationPolicy: {{ .Values.mutatingWebhookReinvocationPolicy }}
   rules:
   {{- if .Values.mutatingWebhookCustomRules }}
   {{- toYaml .Values.mutatingWebhookCustomRules | nindent 2 }}

diff --git a/manifest_staging/charts/gatekeeper/values.yaml b/manifest_staging/charts/gatekeeper/values.yaml
@@ -14,6 +14,7 @@ enableDeleteOperations: false
 enableExternalData: false
 enableTLSHealthcheck: false
 mutatingWebhookFailurePolicy: Ignore
+mutatingWebhookReinvocationPolicy: Never
 mutatingWebhookExemptNamespacesLabels: {}
 mutatingWebhookTimeoutSeconds: 3
 mutatingWebhookCustomRules: {}