panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add hooks to set failurepolicy to ignore on webhook (#128)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Faisal Memon
2023-04-04 09:46:49 +02:00
committed by GitHub
co-authored by Marco Franssen
parent d5dc706592
commit 456075f843
6 changed files with 267 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+4
View File
@@ -49,6 +49,10 @@ A Helm chart to install the SPIRE server.
| controllerManager.service.port | int | `443` | |
| controllerManager.service.type | string | `"ClusterIP"` | |
| controllerManager.validatingWebhookConfiguration.failurePolicy | string | `"Fail"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy | string | `"IfNotPresent"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | |
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | |
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
| dataStorage.enabled | bool | `true` | |
| dataStorage.size | string | `"1Gi"` | |
charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml
+2 -2
View File
@@ -10,7 +10,7 @@ webhooks:
name: {{ include "spire-controller-manager.fullname" . }}-webhook
namespace: {{ include "spire-server.namespace" . }}
path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks
name: vclusterfederatedtrustdomain.kb.io
rules:
- apiGroups: ["spire.spiffe.io"]
@@ -24,7 +24,7 @@ webhooks:
name: {{ include "spire-controller-manager.fullname" . }}-webhook
namespace: {{ include "spire-server.namespace" . }}
path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
failurePolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}
failurePolicy: Ignore # Actual value to be set by post install/upgrade hooks
name: vclusterspiffeid.kb.io
rules:
- apiGroups: ["spire.spiffe.io"]
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+85
View File
@@ -0,0 +1,85 @@
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "spire-server.serviceAccountName" . }}-post-install
namespace: {{ include "spire-server.namespace" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-install
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "spire-server.fullname" . }}-post-install
annotations:
"helm.sh/hook": post-install
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
rules:
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
verbs: ["get", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-server.fullname" . }}-post-install
annotations:
"helm.sh/hook": post-install
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
subjects:
- kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }}-post-install
namespace: {{ include "spire-server.namespace" . }}
roleRef:
kind: ClusterRole
name: {{ include "spire-server.fullname" . }}-post-install
apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ include "spire-server.fullname" . }}-post-install
namespace: {{ include "spire-server.namespace" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-install
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
spec:
template:
metadata:
name: {{ include "spire-server.fullname" . }}-post-install
spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-install
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
command:
- /bin/sh
- -c
- |-
kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
}'
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+85
View File
@@ -0,0 +1,85 @@
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
namespace: {{ include "spire-server.namespace" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "spire-server.fullname" . }}-post-upgrade
annotations:
"helm.sh/hook": post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
rules:
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
verbs: ["get", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-server.fullname" . }}-post-upgrade
annotations:
"helm.sh/hook": post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
subjects:
- kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
namespace: {{ include "spire-server.namespace" . }}
roleRef:
kind: ClusterRole
name: {{ include "spire-server.fullname" . }}-post-upgrade
apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ include "spire-server.fullname" . }}-post-upgrade
namespace: {{ include "spire-server.namespace" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
spec:
template:
metadata:
name: {{ include "spire-server.fullname" . }}-post-upgrade
spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-post-upgrade
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: post-upgrade-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
command:
- /bin/sh
- -c
- |-
kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"{{ .Values.controllerManager.validatingWebhookConfiguration.failurePolicy }}"
}
]
}'
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+85
View File
@@ -0,0 +1,85 @@
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
{{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
namespace: {{ include "spire-server.namespace" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "spire-server.fullname" . }}-pre-upgrade
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
rules:
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}]
verbs: ["get", "patch"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-server.fullname" . }}-pre-upgrade
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
subjects:
- kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
namespace: {{ include "spire-server.namespace" . }}
roleRef:
kind: ClusterRole
name: {{ include "spire-server.fullname" . }}-pre-upgrade
apiGroup: rbac.authorization.k8s.io
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ include "spire-server.fullname" . }}-pre-upgrade
namespace: {{ include "spire-server.namespace" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": pre-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, hook-failed
spec:
template:
metadata:
name: {{ include "spire-server.fullname" . }}-pre-upgrade
spec:
restartPolicy: Never
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}-pre-upgrade
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
command:
- /bin/sh
- -c
- |-
kubectl patch validatingwebhookconfiguration {{ include "spire-controller-manager.fullname" . }}-webhook --type='strategic' -p '
{
"webhooks":[
{
"name":"vclusterspiffeid.kb.io",
"failurePolicy":"Ignore"
},
{
"name":"vclusterfederatedtrustdomain.kb.io",
"failurePolicy":"Ignore"
}
]
}'
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+6
View File
@@ -185,6 +185,12 @@ controllerManager:
validatingWebhookConfiguration:
failurePolicy: Fail
upgradeHook:
image:
registry: cgr.dev
repository: chainguard/kubectl
pullPolicy: IfNotPresent
version: latest
telemetry:
prometheus: