Skip to content

feat(KSPM admission controller): SSPROD-35354 - Make Dry Run mode configurable to a user in Chart Values. #1560

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 17 commits into from
Jan 25, 2024
Merged

feat(KSPM admission controller): SSPROD-35354 - Make Dry Run mode configurable to a user in Chart Values. #1560

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
e5a54d0
SSPROD-35354 - configure dry-run and denyOnError
dimar-apolicy Jan 7, 2024
606f359
use `timeoutSeconds` as default timeout
dimar-apolicy Jan 7, 2024
cad37fa
set defaults for DRY_RUN and DENY_ON_ERROR
dimar-apolicy Jan 8, 2024
8bf16e5
Merge branch 'master' into SSPROD-35354-dryrun-from-chart
dimar-apolicy Jan 11, 2024
4cb3e9a
update image and chart versions
dimar-apolicy Jan 14, 2024
90d883c
Merge branch 'master' into SSPROD-35354-dryrun-from-chart
dimar-apolicy Jan 14, 2024
9050244
remove `rc` from image tag
dimar-apolicy Jan 14, 2024
06eaf79
add `rc` to image tag
dimar-apolicy Jan 14, 2024
464560f
attempt to pass pre-commit check
dimar-apolicy Jan 14, 2024
a5a5941
attempt to pass pre-commit check II
dimar-apolicy Jan 15, 2024
fde8426
update version in README.md
dimar-apolicy Jan 15, 2024
d060fdb
fix DEFAULT_TIMEOUT env in deployment.yaml
dimar-apolicy Jan 24, 2024
703d96f
remove rc tag from image
dimar-apolicy Jan 25, 2024
b3a3ead
Merge branch 'main' into SSPROD-35354-dryrun-from-chart
dimar-apolicy Jan 25, 2024
d0e062f
versions fixes after merge with main
dimar-apolicy Jan 25, 2024
f0c58a5
version bump
dimar-apolicy Jan 25, 2024
7544fd7
Merge branch 'main' into SSPROD-35354-dryrun-from-chart
dimar-apolicy Jan 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/admission-controller/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: admission-controller
description: Sysdig Admission Controller using Sysdig Secure inline image scanner
type: application
version: 0.14.19
version: 0.14.20
appVersion: 3.9.36
home: https://sysdiglabs.github.io/admission-controller/
icon: https://avatars.githubusercontent.com/u/5068817?s=200&v=4
Expand Down
6 changes: 3 additions & 3 deletions charts/admission-controller/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ For example:

```bash
helm upgrade --install admission-controller sysdig/admission-controller \
--create-namespace -n sysdig-admission-controller --version=0.14.19 \
--create-namespace -n sysdig-admission-controller --version=0.14.20 \
--set sysdig.secureAPIToken=YOUR-KEY-HERE,clusterName=YOUR-CLUSTER-NAME
```

Expand All @@ -80,7 +80,7 @@ For example:

```bash
helm upgrade --install admission-controller sysdig/admission-controller \
--create-namespace -n sysdig-admission-controller --version=0.14.19 \
--create-namespace -n sysdig-admission-controller --version=0.14.20 \
--values values.yaml

```
Expand Down Expand Up @@ -142,7 +142,7 @@ The following table lists the configurable parameters of the `admission-controll
| webhook.v2.http.port | HTTP serve port where the requests will be served from | <code>6443</code> |
| webhook.v2.image.registry | The KSPM Admission Controller image registry | <code>quay.io</code> |
| webhook.v2.image.repository | The KSPM Admission Controller image repository | <code>sysdig/secure-admission-controller</code> |
| webhook.v2.image.tag | The KSPM Admission Controller image tag | <code>1.0.1</code> |
| webhook.v2.image.tag | The KSPM Admission Controller image tag | <code>1.27.0</code> |
| webhook.v2.image.digest | Specifies the image digest value. If set, this value is used instead of the tag value | <code></code> |
| webhook.v2.image.pullPolicy | The PullPolicy for KSPM Admission Controller image | <code></code> |
| webhook.name | The service name for Webhook deployment | <code>webhook</code> |
Expand Down
6 changes: 5 additions & 1 deletion charts/admission-controller/templates/webhook/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,8 +54,12 @@ spec:
image: {{ include "admissionController.kspm.image" . }}
imagePullPolicy: {{ .Values.webhook.v2.image.pullPolicy | default .Values.global.image.pullPolicy }}
env:
- name: DEFAULT_TIMEOUT
value: {{ .Values.webhook.timeoutSeconds | quote }}
- name: DENY_ON_ERROR
Copy link
Contributor

@AlbertoBarba AlbertoBarba Jan 15, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we configure the failurePolicy accordingly?

EG: heres what happens with the webhook right now https://github.com/sysdiglabs/charts/blob/master/charts/admission-controller/templates/_helpers.tpl#L453

Copy link
Contributor Author

@dimar-apolicy dimar-apolicy Jan 15, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AlbertoBarba there is no change in existing logic, just using the value in another container.

value: {{ .Values.webhook.denyOnError | default "false" | quote }}
- name: DRY_RUN
value: "true"
value: {{ .Values.webhook.dryRun | default "true" | quote }}
{{- if (or (include "webhook.httpProxy" .) (include "webhook.httpsProxy" .) (include "webhook.noProxy" .) )}}
- name: HTTP_PROXY
value: {{ include "webhook.httpProxy" . }}
Expand Down
2 changes: 1 addition & 1 deletion charts/admission-controller/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ webhook:
# The KSPM Admission Controller image repository
repository: sysdig/secure-admission-controller
# The KSPM Admission Controller image tag
tag: 1.0.1
tag: 1.27.0
# Specifies the image digest value. If set, this value is used instead of the tag value
digest:
# The PullPolicy for KSPM Admission Controller image
Expand Down
4 changes: 2 additions & 2 deletions charts/sysdig-deploy/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: sysdig-deploy
description: A chart with various Sysdig components for Kubernetes
type: application
version: 1.37.6
version: 1.37.7
maintainers:
- name: AlbertoBarba
email: alberto.barba@sysdig.com
Expand All @@ -20,7 +20,7 @@ dependencies:
- name: admission-controller
# repository: https://charts.sysdig.com
repository: file://../admission-controller
version: ~0.14.19
version: ~0.14.20
alias: admissionController
condition: admissionController.enabled
- name: agent
Expand Down