fix: scope of webhook configurations #3676
Conversation
Signed-off-by: plavy <[email protected]>
Signed-off-by: plavy <[email protected]>
Signed-off-by: tin.plavec <[email protected]>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #3676 +/- ##
==========================================
- Coverage 54.49% 47.74% -6.76%
==========================================
Files 134 234 +100
Lines 12329 19858 +7529
==========================================
+ Hits 6719 9481 +2762
- Misses 5116 9487 +4371
- Partials 494 890 +396
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
@maxsmythe PTAL. |
|
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions. |
|
@plavy is there still interest for this PR? |
|
@JaydipGabani The MR got two approvals, so I am not sure where the problem is. |
...er/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml
Show resolved
Hide resolved
There was a problem hiding this comment.
@plavy apologies for the delay. Please add newly added variables to https://github.com/open-policy-agent/gatekeeper/blob/master/cmd/build/helmify/static/README.md. Really close on closing this.
Signed-off-by: plavy <[email protected]>
Signed-off-by: plavy <[email protected]>
Signed-off-by: plavy <[email protected]>
Signed-off-by: plavy <[email protected]>
Signed-off-by: plavy <[email protected]>
|
@JaydipGabani I've implemented all the scopes and added entries to README. |
| @@ -144,9 +144,11 @@ information._ | |||
| | validatingWebhookObjectSelector | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's validation webhook unless measures are taken to control how exemption labels can be set. | `{}` | | |||
| | validatingWebhookMatchConditions | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called | `[]` | | |||
| | validatingWebhookCheckIgnoreFailurePolicy | The failurePolicy for the check-ignore-label validating webhook | `Fail` | | |||
| | validatingWebhookCheckIgnoreScope | The scope for the check-ignore-label validating webhook | `*` | | |||
There was a problem hiding this comment.
Appologies on going back and forth on this, but allowing users to set the scope for this might not be a good idea. Since the scope of the check-ignore-label validating webhook should not be set to Namespaced, as this scope applies only to rules for Namespace resources. Setting it to Namespaced will prevent the rejection of invalid Namespaces with the admission.gatekeeper.sh/ignore label. Namespaces with this label, along with all resources within them, are exempt from Gatekeeper validation. We should revert this back to remove the variable.
|
@plavy PTAL. Moving this to 3.20 for now since I do think there is more in this PR that needs to happen to address the original concerns. In order to make the webhooks complaint we can modify the scope of |
What this PR does / why we need it:
As described in the issue, scope of the webhooks is not set, defaulting to unrestricted scope.
namespaceSelectoris therefore not fully enforced.Which issue(s) this PR fixes:
Fixes #3675