From b0860ba17779975763e21651204636349a48b4c7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Charles-Edouard=20Br=C3=A9t=C3=A9ch=C3=A9?= Date: Thu, 17 Mar 2022 08:51:08 +0100 Subject: [PATCH] fix: filter resources names with helm custom release name (#3361) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix: configmap resource filters generated by helm does not account for namespace Signed-off-by: Charles-Edouard Brétéché * fix: ignore resources by helm chart Signed-off-by: Charles-Edouard Brétéché Co-authored-by: shuting --- charts/kyverno/README.md | 28 ++++++++++++++++++++++++++++ charts/kyverno/README.md.gotmpl | 28 ++++++++++++++++++++++++++++ charts/kyverno/values.yaml | 19 ++++++++++++++++++- 3 files changed, 74 insertions(+), 1 deletion(-) diff --git a/charts/kyverno/README.md b/charts/kyverno/README.md index a9aa0e8be4..705d6f63d8 100644 --- a/charts/kyverno/README.md +++ b/charts/kyverno/README.md @@ -143,6 +143,34 @@ If `createSelfSignedCert` is `true`, Helm will take care of the steps of creatin If `createSelfSignedCert` is `false`, Kyverno will generate a self-signed CA and a certificate, or you can provide your own TLS CA and signed-key pair and create the secret yourself as described in the [documentation](https://kyverno.io/docs/installation/#customize-the-installation-of-kyverno). +## Default resource filters + +[Kyverno resource filters](https://kyverno.io/docs/installation/#resource-filters) are a used to exclude resources from the Kyverno engine rules processing. + +This chart comes with default resource filters that apply exclusions on a couple of namespaces and resource kinds: +- all resources in `kube-system`, `kube-public` and `kube-node-lease` namespaces +- all resources in all namespaces for the following resource kinds: + - `Event` + - `Node` + - `APIService` + - `TokenReview` + - `SubjectAccessReview` + - `SelfSubjectAccessReview` + - `Binding` + - `ReplicaSet` + - `ReportChangeRequest` + - `ClusterReportChangeRequest` +- all resources created by this chart itself + +Those default exclusions are there to prevent disruptions as much as possible. +Under the hood, Kyverno installs an admission controller for critical cluster resources. +A cluster can become unresponsive if Kyverno is not up and running, ultimately preventing pods to be scheduled in the cluster. + +You can however override the default resource filters by setting the `config.resourceFilters` stanza. +It contains an array of string templates that are passed through the `tpl` Helm function and joined together to produce the final `resourceFilters` written in the Kyverno config map. + +Please consult the [values.yaml](./values.yaml) file before overriding `config.resourceFilters` and use the apropriate templates to build your desired exclusions list. + ## Source Code * diff --git a/charts/kyverno/README.md.gotmpl b/charts/kyverno/README.md.gotmpl index 76daafebbb..a2ca4b5240 100644 --- a/charts/kyverno/README.md.gotmpl +++ b/charts/kyverno/README.md.gotmpl @@ -64,6 +64,34 @@ If `createSelfSignedCert` is `true`, Helm will take care of the steps of creatin If `createSelfSignedCert` is `false`, Kyverno will generate a self-signed CA and a certificate, or you can provide your own TLS CA and signed-key pair and create the secret yourself as described in the [documentation](https://kyverno.io/docs/installation/#customize-the-installation-of-kyverno). +## Default resource filters + +[Kyverno resource filters](https://kyverno.io/docs/installation/#resource-filters) are a used to exclude resources from the Kyverno engine rules processing. + +This chart comes with default resource filters that apply exclusions on a couple of namespaces and resource kinds: +- all resources in `kube-system`, `kube-public` and `kube-node-lease` namespaces +- all resources in all namespaces for the following resource kinds: + - `Event` + - `Node` + - `APIService` + - `TokenReview` + - `SubjectAccessReview` + - `SelfSubjectAccessReview` + - `Binding` + - `ReplicaSet` + - `ReportChangeRequest` + - `ClusterReportChangeRequest` +- all resources created by this chart itself + +Those default exclusions are there to prevent disruptions as much as possible. +Under the hood, Kyverno installs an admission controller for critical cluster resources. +A cluster can become unresponsive if Kyverno is not up and running, ultimately preventing pods to be scheduled in the cluster. + +You can however override the default resource filters by setting the `config.resourceFilters` stanza. +It contains an array of string templates that are passed through the `tpl` Helm function and joined together to produce the final `resourceFilters` written in the Kyverno config map. + +Please consult the [values.yaml](./values.yaml) file before overriding `config.resourceFilters` and use the apropriate templates to build your desired exclusions list. + {{ template "chart.sourcesSection" . }} {{ template "chart.requirementsSection" . }} diff --git a/charts/kyverno/values.yaml b/charts/kyverno/values.yaml index 7f3b6e00b5..b587f7eb84 100644 --- a/charts/kyverno/values.yaml +++ b/charts/kyverno/values.yaml @@ -216,11 +216,28 @@ config: - '[TokenReview,*,*]' - '[SubjectAccessReview,*,*]' - '[SelfSubjectAccessReview,*,*]' - - '[*,{{ include "kyverno.namespace" . }},kyverno*]' - '[Binding,*,*]' - '[ReplicaSet,*,*]' - '[ReportChangeRequest,*,*]' - '[ClusterReportChangeRequest,*,*]' + # exclude resources from the chart + - '[ClusterRole,*,{{ template "kyverno.fullname" . }}:*]' + - '[ClusterRoleBinding,*,{{ template "kyverno.fullname" . }}:*]' + - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.serviceAccountName" . }}]' + - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.configMapName" . }}]' + - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.metricsConfigMapName" . }}]' + - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}]' + - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' + - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}]' + - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}]' + - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}:*]' + - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}:*]' + - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.serviceName" . }}]' + - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.serviceName" . }}-metrics]' + - '[ServiceMonitor,{{ if .Values.serviceMonitor.namespace }}{{ .Values.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.serviceName" . }}-service-monitor]' + - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-test]' + # -- Name of an existing config map (ignores default/provided resourceFilters) existingConfig: '' # -- Exclude group role