Skip to content

Commit e63a583

Browse files
DorB-Pmaxsmythesozercan
authored
feat: add disableAudit helm option (#3270)
Signed-off-by: zapdor2000@gmail.com <zapdor2000@gmail.com> Co-authored-by: Max Smythe <smythe@google.com> Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com>
1 parent 0e48a01 commit e63a583

File tree

6 files changed

+17
-13
lines changed

6 files changed

+17
-13
lines changed

‎cmd/build/helmify/main.go

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -129,10 +129,8 @@ func (ks *kindSet) Write() error {
129129
}
130130

131131
if name == "gatekeeper-audit" && kind == DeploymentKind {
132+
obj = "{{- if not .Values.disableAudit }}\n" + obj + "{{- end }}\n"
132133
obj = strings.Replace(obj, " priorityClassName: system-cluster-critical", " {{- if .Values.audit.priorityClassName }}\n priorityClassName: {{ .Values.audit.priorityClassName }}\n {{- end }}", 1)
133-
}
134-
135-
if name == "gatekeeper-audit" && kind == DeploymentKind {
136134
obj = strings.Replace(obj, " - emptyDir: {}", " {{- if .Values.audit.writeToRAMDisk }}\n - emptyDir:\n medium: Memory\n {{ else }}\n - emptyDir: {}\n {{- end }}", 1)
137135
}
138136

‎cmd/build/helmify/static/README.md

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ information._
120120
| preUninstall.nodeSelector | The node selector to use for pod scheduling in preUninstall hook jobs | `kubernetes.io/os: linux` |
121121
| preUninstall.resources | The resource request/limits for the container image in preUninstall hook jobs | `{}` |
122122
| preUninstall.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` |
123-
| psp.enabled | Enabled PodSecurityPolicy | `false` |
123+
| psp.enabled | Enabled PodSecurityPolicy | `false` |
124124
| upgradeCRDs.enabled | Upgrade CRDs using pre-install/pre-upgrade hooks | `true` |
125125
| upgradeCRDs.extraRules | Extra rules for the gatekeeper-admin-upgrade-crds ClusterRole | `[]` |
126126
| upgradeCRDs.priorityClassName | Priority class name for gatekeeper-update-crds-hook Job | `` |
@@ -134,8 +134,9 @@ information._
134134
| auditFromCache | Take the roster of resources to audit from the audit cache | `false` |
135135
| auditChunkSize | Chunk size for listing cluster resources for audit (alpha feature) | `500` |
136136
| auditMatchKindOnly | Only check resources of the kinds specified in all constraints defined in the cluster. | `false` |
137-
| disableValidatingWebhook | Disable the validating webhook | `false` |
137+
| disableAudit | Disable audit controller | `false` |
138138
| disableMutation | Disable mutation | `false` |
139+
| disableValidatingWebhook | Disable the validating webhook | `false` |
139140
| validatingWebhookName | The name of the `ValidatingWebhookConfiguration` | `gatekeeper-validating-webhook-configuration` |
140141
| validatingWebhookTimeoutSeconds | The timeout for the validating webhook in seconds | `3` |
141142
| validatingWebhookFailurePolicy | The failurePolicy for the validating webhook | `Ignore` |
@@ -147,10 +148,10 @@ information._
147148
| validatingWebhookURL | Custom URL for Kubernetes API server to use to reach the validating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used. | `null` |
148149
| enableDeleteOperations | Enable validating webhook for delete operations. Does not work with `validatingWebhookCustomRules` | `false` |
149150
| enableExternalData | Enable external data | `true` |
150-
| enableGeneratorResourceExpansion | Enable generator resource expansion (beta feature) | `true` |
151+
| enableGeneratorResourceExpansion | Enable generator resource expansion (beta feature) | `true` |
151152
| enableTLSHealthcheck | Enable probing webhook API with certificate stored in certDir | `false` |
152153
| maxServingThreads | Limit the number of concurrent calls the validation backend made by the validation webhook. -1 limits this value to GOMAXPROCS. Configuring this value may lower max RAM usage and limit CPU throttling, Tuning it can optimize serving capacity. | `-1` |
153-
| metricsBackends | Metrics exporters to use. Valid exporters are: `prometheus`, `stackdriver`, and `opentelemetry` starting from Gatekeeper 3.15 | `["prometheus"]` |
154+
| metricsBackends | Metrics exporters to use. Valid exporters are: `prometheus`, `stackdriver`, and `opentelemetry` starting from Gatekeeper 3.15 | `["prometheus"]` |
154155
| mutatingWebhookName | The name of the `MutatingWebhookConfiguration` | `gatekeeper-mutating-webhook-configuration` |
155156
| mutatingWebhookFailurePolicy | The failurePolicy for the mutating webhook | `Ignore` |
156157
| mutatingWebhookReinvocationPolicy | The reinvocationPolicy for the mutating webhook | `Never` |
@@ -218,7 +219,7 @@ information._
218219
| rbac.create | Enable the creation of RBAC resources | `true` |
219220
| externalCertInjection.enabled | Enable the injection of an external certificate. This disables automatic certificate generation and rotation | `false` |
220221
| externalCertInjection.secretName | Name of secret for injected certificate | `gatekeeper-webhook-server-cert` |
221-
| externaldataProviderResponseCacheTTL | TTL for the external data provider response cache. Specify the duration in 'h', 'm', or 's' for hours, minutes, or seconds respectively. | `3m` |
222+
| externaldataProviderResponseCacheTTL | TTL for the external data provider response cache. Specify the duration in 'h', 'm', or 's' for hours, minutes, or seconds respectively. | `3m` |
222223

223224
## Contributing Changes
224225

‎cmd/build/helmify/static/values.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ metricsBackends: ["prometheus"]
55
auditMatchKindOnly: false
66
constraintViolationsLimit: 20
77
auditFromCache: false
8+
disableAudit: false
89
disableMutation: false
910
disableValidatingWebhook: false
1011
validatingWebhookName: gatekeeper-validating-webhook-configuration

0 commit comments

Comments
 (0)