Skip to content

Commit

Permalink
add ValidatingWebhookConfiguration
Browse files Browse the repository at this point in the history
Signed-off-by: Carlos Panato <[email protected]>
  • Loading branch information
cpanato committed Nov 10, 2021
1 parent 0d550f6 commit ee32cd4
Show file tree
Hide file tree
Showing 3 changed files with 22 additions and 3 deletions.
4 changes: 2 additions & 2 deletions charts/cosigned/templates/webhook/clusterrole_webhook.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -11,11 +11,11 @@ rules:
verbs: ["create"]
# Allow the reconciliation of exactly our validating webhook.
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
verbs: ["list", "watch"]

- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations"]
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
verbs: ["get", "update"]
resourceNames: ["cosigned.sigstore.dev"]

Expand Down
19 changes: 19 additions & 0 deletions charts/cosigned/templates/webhook/webhook_mutating.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
name: cosigned.sigstore.dev
webhooks:
- name: cosigned.sigstore.dev
namespaceSelector:
# The webhook should only apply to things that opt-in
matchExpressions:
- key: cosigned.sigstore.dev/include
operator: In
values: ["true"]
admissionReviewVersions: [v1]
clientConfig:
service:
name: webhook
namespace: {{ .Release.Namespace }}
failurePolicy: Fail
sideEffects: None
2 changes: 1 addition & 1 deletion charts/cosigned/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ webhook:
podSecurityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
capabilities:
drop:
- all
Expand Down

0 comments on commit ee32cd4

Please sign in to comment.