certificate_webhook-conf.yaml

{{- $k8sMinor := (include "k8s-version-minor" .) -}}
{{- $altNames := list -}}
{{- $altNames = append $altNames (printf "%s-svc" .Chart.Name) -}}
{{- $altNames = append $altNames (printf "%s-svc.%s" .Chart.Name .Release.Namespace) -}}
{{- $altNames = append $altNames (printf "%s-svc.%s.svc" .Chart.Name .Release.Namespace) -}}
{{- $altNames = append $altNames (printf "%s-svc.%s.svc.cluster.local" .Chart.Name .Release.Namespace) -}}
{{- $certs := genSelfSignedCert (printf "%s-svc.%s.svc" .Chart.Name .Release.Namespace) nil $altNames 36500 -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Chart.Name }}-tls
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "helm.labels" . | nindent 4 }}
type: Opaque
data:
  tls.crt: {{ default ($certs.Cert | b64enc) (include "getInstalledTLSCert" .) }}
  tls.key: {{ default ($certs.Key | b64enc) (include "getInstalledTLSKey" .) }}
---
{{ if lt ($k8sMinor | int) 17 }}
apiVersion: admissionregistration.k8s.io/v1beta1
{{ else }}
apiVersion: admissionregistration.k8s.io/v1
{{ end }}
kind: MutatingWebhookConfiguration
metadata:
  name: {{ .Chart.Name }}-webhook
  labels:
    {{- include "helm.labels" . | nindent 4 }}
  annotations:
    {{- if .Values.deployment.isArgoCD }}
    "argocd.argoproj.io/hook": PreSync
    "argocd.argoproj.io/hook-delete-policy": BeforeHookCreation, HookSucceeded, HookFailed
    {{- else }}
    "helm.sh/hook": post-delete
    "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
    {{- end }}
webhooks:
  - name: {{ .Chart.Name }}-svc.{{ .Release.Namespace }}.svc
    failurePolicy: Ignore
    reinvocationPolicy: {{ .Values.deployment.reinvocationPolicy | default "Never" }}
    clientConfig:
      service:
        name: {{ .Chart.Name }}-svc
        namespace: {{ .Release.Namespace }}
        path: /mutate
      caBundle: {{ default ($certs.Cert | b64enc) (include "getInstalledTLSCert" .) }}
    rules: []
    sideEffects: None
    {{- if lt ($k8sMinor | int) 17 }}
    admissionReviewVersions: ["v1beta1"]
    {{- else }}
    admissionReviewVersions: ["v1"]
    {{- end }}
---
{{ if lt ($k8sMinor | int) 17 -}}
apiVersion: admissionregistration.k8s.io/v1beta1
{{ else -}}
apiVersion: admissionregistration.k8s.io/v1
{{ end -}}
kind: MutatingWebhookConfiguration
metadata:
  name: {{ .Chart.Name }}-webhook
  labels:
    {{- include "helm.labels" . | nindent 4 }}
  annotations:
    {{- if .Values.deployment.isArgoCD }}
    "argocd.argoproj.io/hook": PostSync
    {{- else }}
    "helm.sh/hook": post-install, post-upgrade, post-rollback
    {{- end }}
webhooks:
  - name: {{ .Chart.Name }}-svc.{{ .Release.Namespace }}.svc
    failurePolicy: {{ .Values.deployment.failurePolicy | default "Fail" }}
    reinvocationPolicy: {{ .Values.deployment.reinvocationPolicy | default "Never" }}
    clientConfig:
      service:
        name: {{ .Chart.Name }}-svc
        namespace: {{ .Release.Namespace }}
        path: /mutate
      caBundle: {{ default ($certs.Cert | b64enc) (include "getInstalledTLSCert" .) }}
    rules:
      - operations: ["CREATE", "UPDATE"]
        apiGroups: ["*"]
        apiVersions: ["*"]
        {{- if .Values.automaticChildApproval }}
        {{- if .Values.automaticChildApproval.enabled }}
        resources: ["pods", "deployments", "replicationcontrollers", "replicasets", "daemonsets", "statefulsets", "jobs", "cronjobs"]
        {{- else }}
        resources: ["pods"]
        {{- end }}
        {{- else }}
        resources: ["pods", "deployments", "replicationcontrollers", "replicasets", "daemonsets", "statefulsets", "jobs", "cronjobs"]
        {{- end }}
    sideEffects: None
    {{- if gt ($k8sMinor | int) 13 }}
    timeoutSeconds: 30
    {{- end }}
    {{- if lt ($k8sMinor | int) 17 }}
    admissionReviewVersions: ["v1beta1"]
    {{- else }}
    admissionReviewVersions: ["v1"]
    {{- end }}
    {{- if .Values.namespacedValidation }}
    {{- if .Values.namespacedValidation.enabled }}
    namespaceSelector:
      matchExpressions:
      - key: securesystemsengineering.connaisseur/webhook
    {{- if not .Values.namespacedValidation.mode}}
        operator: NotIn
        values:
          - ignore
    {{- else if eq .Values.namespacedValidation.mode "ignore"}}
        operator: NotIn
        values:
          - ignore
    {{- else if eq .Values.namespacedValidation.mode "validate"}}
        operator: In
        values:
          - validate
   {{- end }}
   {{- end }}
   {{- end }}