From 299e4a0829ca19e09a75995881799a32d331629c Mon Sep 17 00:00:00 2001
From: Chip Zoller <chipzoller@gmail.com>
Date: Wed, 27 Mar 2024 09:49:36 -0400
Subject: [PATCH] Default exclusions in webhooks (#9948)
---
charts/kyverno/README.md | 4 ++--
charts/kyverno/templates/NOTES.txt | 2 --
charts/kyverno/values.yaml | 19 +++++++++----------
config/install-latest-testing.yaml | 3 ++-
4 files changed, 13 insertions(+), 15 deletions(-)
diff --git a/charts/kyverno/README.md b/charts/kyverno/README.md
index 152f8013d8..17de78e464 100644
--- a/charts/kyverno/README.md
+++ b/charts/kyverno/README.md
@@ -293,8 +293,8 @@ The chart values are organised per component.
| config.excludeClusterRoles | list | `[]` | Exclude roles |
| config.generateSuccessEvents | bool | `false` | Generate success events. |
| config.resourceFilters | list | See [values.yaml](values.yaml) | Resource types to be skipped by the Kyverno policy engine. Make sure to surround each entry in quotes so that it doesn't get parsed as a nested YAML list. These are joined together without spaces, run through `tpl`, and the result is set in the config map. |
-| config.webhooks | list | `[]` | Defines the `namespaceSelector` in the webhook configurations. Note that it takes a list of `namespaceSelector` and/or `objectSelector` in the JSON format, and only the first element will be forwarded to the webhook configurations. The Kyverno namespace is excluded if `excludeKyvernoNamespace` is `true` (default) |
-| config.webhookAnnotations | object | `{}` | Defines annotations to set on webhook configurations. |
+| config.webhooks | list | `[{"namespaceSelector":{"matchExpressions":[{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kube-system"]}]}}]` | Defines the `namespaceSelector` in the webhook configurations. Note that it takes a list of `namespaceSelector` and/or `objectSelector` in the JSON format, and only the first element will be forwarded to the webhook configurations. The Kyverno namespace is excluded if `excludeKyvernoNamespace` is `true` (default) |
+| config.webhookAnnotations | object | `{"admissions.enforcer/disabled":"true"}` | Defines annotations to set on webhook configurations. |
| config.webhookLabels | object | `{}` | Defines labels to set on webhook configurations. |
| config.matchConditions | list | `[]` | Defines match conditions to set on webhook configurations (requires Kubernetes 1.27+). |
| config.excludeKyvernoNamespace | bool | `true` | Exclude Kyverno namespace Determines if default Kyverno namespace exclusion is enabled for webhooks and resourceFilters |
diff --git a/charts/kyverno/templates/NOTES.txt b/charts/kyverno/templates/NOTES.txt
index 30f3a13e20..c282d5865c 100644
--- a/charts/kyverno/templates/NOTES.txt
+++ b/charts/kyverno/templates/NOTES.txt
@@ -43,6 +43,4 @@ The following components have been installed in your cluster:
⚠️ WARNING: Generating reports from ValidatingAdmissionPolicies requires a Kubernetes 1.27+ cluster with `ValidatingAdmissionPolicy` feature gate and `admissionregistration.k8s.io` API group enabled.
{{- end }}
-💡 Note: If Kyverno has been installed on AKS, it is likely you will need to disable the Admission Enforcer. Please see the Kyverno documentation at https://kyverno.io/docs/installation/platform-notes/#notes-for-aks-users for more details.
-
💡 Note: There is a trade-off when deciding which approach to take regarding Namespace exclusions. Please see the documentation at https://kyverno.io/docs/installation/#security-vs-operability to understand the risks.
diff --git a/charts/kyverno/values.yaml b/charts/kyverno/values.yaml
index 448a570b69..e93168e450 100644
--- a/charts/kyverno/values.yaml
+++ b/charts/kyverno/values.yaml
@@ -320,15 +320,14 @@ config:
# Note that it takes a list of `namespaceSelector` and/or `objectSelector` in the JSON format, and only the first element
# will be forwarded to the webhook configurations.
# The Kyverno namespace is excluded if `excludeKyvernoNamespace` is `true` (default)
- webhooks: []
+ webhooks:
# Exclude namespaces
- # - namespaceSelector:
- # matchExpressions:
- # - key: kubernetes.io/metadata.name
- # operator: NotIn
- # values:
- # - kube-system
- # - kyverno
+ - namespaceSelector:
+ matchExpressions:
+ - key: kubernetes.io/metadata.name
+ operator: NotIn
+ values:
+ - kube-system
# Exclude objects
# - objectSelector:
# matchExpressions:
@@ -336,9 +335,9 @@ config:
# operator: DoesNotExist
# -- Defines annotations to set on webhook configurations.
- webhookAnnotations: {}
+ webhookAnnotations:
# Example to disable admission enforcer on AKS:
- # 'admissions.enforcer/disabled': 'true'
+ 'admissions.enforcer/disabled': 'true'
# -- Defines labels to set on webhook configurations.
webhookLabels: {}
diff --git a/config/install-latest-testing.yaml b/config/install-latest-testing.yaml
index 9a0378a64f..9206ba1fa3 100644
--- a/config/install-latest-testing.yaml
+++ b/config/install-latest-testing.yaml
@@ -188,7 +188,8 @@ data:
[ServiceMonitor,kyverno,kyverno-reports-controller]
[Secret,kyverno,kyverno-svc.kyverno.svc.*]
[Secret,kyverno,kyverno-cleanup-controller.kyverno.svc.*]
- webhooks: '[{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kyverno"]}]}}]'
+ webhooks: "[{\"namespaceSelector\":{\"matchExpressions\":[{\"key\":\"kubernetes.io/metadata.name\",\"operator\":\"NotIn\",\"values\":[\"kube-system\"]},{\"key\":\"kubernetes.io/metadata.name\",\"operator\":\"NotIn\",\"values\":[\"kyverno\"]}],\"matchLabels\":null}}]"
+ webhookAnnotations: "{\"admissions.enforcer/disabled\":\"true\"}"
---
apiVersion: v1
kind: ConfigMap