add configurable sigstore volume (#6211)

Signed-off-by: André Bauer <andre.bauer@staffbase.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

charts/kyverno/Chart.yaml

@@ -26,7 +26,5 @@ annotations:
       url: https://kyverno.io/docs
   # valid kinds are: added, changed, deprecated, removed, fixed and security
   artifacthub.io/changes: |
-    - kind: changed
-      description: Syntax change for webhooksCleanup switch to match with the rest of the file
-    - kind: fixed
-      description: Handle multiple extraArgs in init container
+    - kind: added
+      description: make sigstore volume configurable

charts/kyverno/README.md

@@ -242,6 +242,7 @@ The command removes all the Kubernetes components associated with the chart and
 | webhooksCleanup.enabled | bool | `false` | Create a helm pre-delete hook to cleanup webhooks. |
 | webhooksCleanup.image | string | `"bitnami/kubectl:latest"` | `kubectl` image to run commands for deleting webhooks. |
 | tufRootMountPath | string | `"/.sigstore"` | A writable volume to use for the TUF root initialization. |
+| sigstoreVolume | object | `{"emptyDir":{}}` | Volume to be mounted in pods for TUF/cosign work. |
 | grafana.enabled | bool | `false` | Enable grafana dashboard creation. |
 | grafana.configMapName | string | `"{{ include \"kyverno.fullname\" . }}-grafana"` | Configmap name template. |
 | grafana.namespace | string | `nil` | Namespace to create the grafana dashboard configmap. If not set, it will be created in the same namespace where the chart is deployed. |

charts/kyverno/templates/admission-controller/deployment.yaml

@@ -177,7 +177,7 @@ spec:
               name: api-token
       volumes:
       - name: sigstore
-        emptyDir: {}
+        {{- toYaml (required "A valid .Values.sigstoreVolume entry is required" .Values.sigstoreVolume) | nindent 8 }}
       - name: api-token
         projected:
           sources:

charts/kyverno/values.yaml

@@ -493,6 +493,10 @@ webhooksCleanup:
 # -- A writable volume to use for the TUF root initialization.
 tufRootMountPath: /.sigstore
 
+# -- Volume to be mounted in pods for TUF/cosign work.
+sigstoreVolume:
+  emptyDir: {}
+
 grafana:
   # -- Enable grafana dashboard creation.
   enabled: false