Skip to content

Commit f4c66ce

Browse files
slimm609slimm609
committed
Add ability to disable opt-in
- add the ability to disable opt-in support for namespace validation and enforce on across the entire cluster Signed-off-by: Brian Davis <[email protected]> Signed-off-by: slimm609 <[email protected]>
1 parent a1158d7 commit f4c66ce

File tree

7 files changed

+107
-14
lines changed

7 files changed

+107
-14
lines changed

‎charts/policy-controller/Chart.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
apiVersion: v2
2-
description: The Helm chart for Policy Controller
2+
description: The Helm chart for Policy Controller
33
home: https://github.com/sigstore/policy-controller
44

55
sources:
@@ -8,8 +8,8 @@ sources:
88
type: application
99

1010
name: policy-controller
11-
version: 0.2.1
12-
appVersion: 0.2.1
11+
version: 0.2.2
12+
appVersion: 0.2.2
1313

1414
maintainers:
1515
- name: dlorenc

‎charts/policy-controller/README.md‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,37 @@
1-
# Policy Controller
1+
# policy-controller
22

3-
## Requirements
3+
The Helm chart for Policy Controller
4+
5+
![Version: 0.2.2](https://img.shields.io/badge/Version-0.2.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.2](https://img.shields.io/badge/AppVersion-0.2.2-informational?style=flat-square)
46

7+
## Requirements
58
* Kubernetes cluster with rights to install admission webhooks
69
* Helm
710

8-
## Parameters
9-
1011
The following table lists the configurable parameters of the policy-controller chart and their default values.
1112

13+
## Values
14+
1215
| Key | Type | Default | Description |
1316
|-----|------|---------|-------------|
1417
| commonNodeSelector | object | `{}` | |
1518
| commonTolerations | list | `[]` | |
16-
| imagePullSecrets | string | `nil` | |
1719
| cosign.cosignPub | string | `""` | |
1820
| cosign.secretKeyRef.name | string | `""` | |
1921
| cosign.webhookName | string | `"policy.sigstore.dev"` | |
22+
| imagePullSecrets | list | `[]` | |
2023
| policywebhook.env | object | `{}` | |
2124
| policywebhook.extraArgs | object | `{}` | |
2225
| policywebhook.image.pullPolicy | string | `"IfNotPresent"` | |
2326
| policywebhook.image.repository | string | `"ghcr.io/sigstore/policy-controller/policy-webhook"` | |
24-
| policywebhook.image.version | string | `"sha256:63cd54b877bcd8b3d6d6b7110955e3f773bd8ad5b16d1b6133d4009c26c6da18"` | |
25-
| policywebhook.replicaCount | int | `1` | |
27+
| policywebhook.image.version | string | `"sha256:2d8ec2534e903a722a89efd6fe04a52a8a420ca3f8be1703aa697bf5faf418eb"` | |
28+
| policywebhook.namespaceOptIn | bool | `true` | |
2629
| policywebhook.podSecurityContext.allowPrivilegeEscalation | bool | `false` | |
2730
| policywebhook.podSecurityContext.capabilities.drop[0] | string | `"all"` | |
2831
| policywebhook.podSecurityContext.enabled | bool | `true` | |
2932
| policywebhook.podSecurityContext.readOnlyRootFilesystem | bool | `true` | |
3033
| policywebhook.podSecurityContext.runAsNonRoot | bool | `true` | |
34+
| policywebhook.replicaCount | int | `1` | |
3135
| policywebhook.resources.limits.cpu | string | `"100m"` | |
3236
| policywebhook.resources.limits.memory | string | `"256Mi"` | |
3337
| policywebhook.resources.requests.cpu | string | `"100m"` | |
@@ -43,16 +47,16 @@ The following table lists the configurable parameters of the policy-controller c
4347
| serviceMonitor.enabled | bool | `false` | |
4448
| webhook.env | object | `{}` | |
4549
| webhook.extraArgs | object | `{}` | |
46-
| webhook.replicaCount | int | `1` | |
4750
| webhook.image.pullPolicy | string | `"IfNotPresent"` | |
4851
| webhook.image.repository | string | `"ghcr.io/sigstore/policy-controller/policy-controller"` | |
49-
| webhook.image.version | string | `"sha256:63cd54b877bcd8b3d6d6b7110955e3f773bd8ad5b16d1b6133d4009c26c6da18"` | |
52+
| webhook.image.version | string | `"sha256:9b8fe4bcc058de060294f7ccb375c288010cd5e36cc3938393baef3c893d0106"` | |
5053
| webhook.name | string | `"webhook"` | |
5154
| webhook.podSecurityContext.allowPrivilegeEscalation | bool | `false` | |
5255
| webhook.podSecurityContext.capabilities.drop[0] | string | `"all"` | |
5356
| webhook.podSecurityContext.enabled | bool | `true` | |
5457
| webhook.podSecurityContext.readOnlyRootFilesystem | bool | `true` | |
5558
| webhook.podSecurityContext.runAsUser | int | `1000` | |
59+
| webhook.replicaCount | int | `1` | |
5660
| webhook.resources.limits.cpu | string | `"100m"` | |
5761
| webhook.resources.limits.memory | string | `"256Mi"` | |
5862
| webhook.resources.requests.cpu | string | `"100m"` | |
@@ -64,8 +68,6 @@ The following table lists the configurable parameters of the policy-controller c
6468
| webhook.service.type | string | `"ClusterIP"` | |
6569
| webhook.serviceAccount.annotations | object | `{}` | |
6670

67-
----------------------------------------------
68-
6971
### Deploy `policy-controller` Helm Chart
7072

7173
```shell
@@ -127,3 +129,6 @@ Creating a deployment referencing images that are not signed will yield the foll
127129
kubectl run pod1-signed --image=< REGISTRY_USER >/nginx:signed -n testns
128130
pod/pod1-signed created
129131
```
132+
133+
----------------------------------------------
134+
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

‎charts/policy-controller/README.md.gotmpl‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
{{ template "chart.header" . }}
2+
{{ template "chart.description" . }}
3+
4+
{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
5+
6+
## Requirements
7+
* Kubernetes cluster with rights to install admission webhooks
8+
* Helm
9+
10+
The following table lists the configurable parameters of the policy-controller chart and their default values.
11+
12+
13+
{{ template "chart.requirementsSection" . }}
14+
15+
{{ template "chart.valuesSection" . }}
16+
17+
### Deploy `policy-controller` Helm Chart
18+
19+
```shell
20+
export COSIGN_PASSWORD=<my_cosign_password>
21+
cosign generate-key-pair
22+
```
23+
24+
The previous command generates two key files `cosign.key` and `cosign.pub`. Next, create a secret to validate the signatures:
25+
26+
```shell
27+
kubectl create namespace cosign-system
28+
29+
kubectl create secret generic mysecret -n \
30+
cosign-system --from-file=cosign.pub=./cosign.pub
31+
```
32+
33+
Install `policy-controller` using Helm and setting the value of the secret key reference to `mysecret` that you created above:
34+
35+
```shell
36+
helm repo add sigstore https://sigstore.github.io/helm-charts
37+
38+
helm repo update
39+
40+
helm install policy-controller -n cosign-system sigstore/policy-controller --devel --set cosign.secretKeyRef.name=mysecret
41+
```
42+
43+
### Enabling Admission control
44+
45+
To enable the `policy admission webhook` to check for signed images, you will need to add the following label in each namespace that you would want the webhook triggered:
46+
47+
Label: `policy.sigstore.dev/include: "true"`
48+
49+
```yaml
50+
apiVersion: v1
51+
kind: Namespace
52+
metadata:
53+
labels:
54+
policy.sigstore.dev/include: "true"
55+
kubernetes.io/metadata.name: my-namespace
56+
name: my-namespace
57+
spec:
58+
finalizers:
59+
- kubernetes
60+
```
61+
62+
### Testing the webhook
63+
64+
1. Using Unsigned Images:
65+
Creating a deployment referencing images that are not signed will yield the following error and no resources will be created:
66+
67+
```shell
68+
kubectl apply -f my-deployment.yaml
69+
Error from server (BadRequest): error when creating "my-deployment.yaml": admission webhook "policy.sigstore.dev" denied the request: validation failed: invalid image signature: spec.template.spec.containers[0].image
70+
```
71+
72+
2. Using Signed Images: Assuming a signed `nginx` image with a tag `signed` exists on a registry, the resource will be successfully created.
73+
74+
```shell
75+
kubectl run pod1-signed --image=< REGISTRY_USER >/nginx:signed -n testns
76+
pod/pod1-signed created
77+
```
78+
79+
{{ template "helm-docs.versionFooter" . }}

‎charts/policy-controller/templates/webhook/webhook_mutating.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ metadata:
44
name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
55
webhooks:
66
- name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
7+
{{- if .Values.policywebhook.namespaceOptIn }}
78
namespaceSelector:
89
# The webhook should only apply to things that opt-in
910
matchExpressions:
1011
- key: policy.sigstore.dev/include
1112
operator: In
1213
values: ["true"]
14+
{{- end }}
1315
admissionReviewVersions: [v1]
1416
clientConfig:
1517
service:

‎charts/policy-controller/templates/webhook/webhook_validating.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ metadata:
44
name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
55
webhooks:
66
- name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
7+
{{- if .Values.policywebhook.namespaceOptIn }}
78
namespaceSelector:
89
# The webhook should only apply to things that opt-in
910
matchExpressions:
1011
- key: policy.sigstore.dev/include
1112
operator: In
1213
values: ["true"]
14+
{{- end }}
1315
admissionReviewVersions: [v1]
1416
clientConfig:
1517
service:

‎charts/policy-controller/values.schema.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,9 @@
144144
}
145145
}
146146
},
147+
"namespaceOptIn": {
148+
"type": "boolean"
149+
},
147150
"webhookNames": {
148151
"type": "object",
149152
"properties": {

‎charts/policy-controller/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ policywebhook:
4040
annotations: {}
4141
type: ClusterIP
4242
port: 443
43+
# opt-in to validation with namespace annotation
44+
namespaceOptIn: true
4345
webhookNames:
4446
defaulting: "defaulting.clusterimagepolicy.sigstore.dev"
4547
validating: "validating.clusterimagepolicy.sigstore.dev"

0 commit comments

Comments
 (0)