Add ability to disable namespace opt-in

charts/policy-controller/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-description: The Helm chart for Policy  Controller
+description: The Helm chart for Policy Controller
 home: https://github.com/sigstore/policy-controller
 
 sources:

charts/policy-controller/README.md

@@ -2,7 +2,7 @@
 
 ![Version: 0.3.1](https://img.shields.io/badge/Version-0.3.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.4.0](https://img.shields.io/badge/AppVersion-0.4.0-informational?style=flat-square)
 
-The Helm chart for Policy  Controller
+The Helm chart for Policy Controller
 
 **Homepage:** <https://github.com/sigstore/policy-controller>
 
@@ -30,7 +30,8 @@ The Helm chart for Policy  Controller
 | policywebhook.extraArgs | object | `{}` |  |
 | policywebhook.image.pullPolicy | string | `"IfNotPresent"` |  |
 | policywebhook.image.repository | string | `"ghcr.io/sigstore/policy-controller/policy-webhook"` |  |
-| policywebhook.image.version | string | `"sha256:03f6b9807103c988439741fdc2ec4410a85c13ba62fbad58448a070ac07bb5bc"` | `"v0.4.0"` |
+| policywebhook.image.version | string | `"sha256:03f6b9807103c988439741fdc2ec4410a85c13ba62fbad58448a070ac07bb5bc"` |  |
+| policywebhook.namespaceOptIn | bool | `true` |  |
 | policywebhook.podSecurityContext.allowPrivilegeEscalation | bool | `false` |  |
 | policywebhook.podSecurityContext.capabilities.drop[0] | string | `"all"` |  |
 | policywebhook.podSecurityContext.enabled | bool | `true` |  |
@@ -54,7 +55,7 @@ The Helm chart for Policy  Controller
 | webhook.extraArgs | object | `{}` |  |
 | webhook.image.pullPolicy | string | `"IfNotPresent"` |  |
 | webhook.image.repository | string | `"ghcr.io/sigstore/policy-controller/policy-controller"` |  |
-| webhook.image.version | string | `"sha256:2b1c017535f6a0f672ec38279f3792ca1181555342a2deae53605e202afb9764"` | `"v0.4.0"` |
+| webhook.image.version | string | `"sha256:2b1c017535f6a0f672ec38279f3792ca1181555342a2deae53605e202afb9764"` |  |
 | webhook.name | string | `"webhook"` |  |
 | webhook.podSecurityContext.allowPrivilegeEscalation | bool | `false` |  |
 | webhook.podSecurityContext.capabilities.drop[0] | string | `"all"` |  |
@@ -159,7 +160,9 @@ Creating a deployment referencing images that are not signed will yield the foll
    pod/pod1-signed created
    ```
 
-
 ## More info
 
 You can find more information about the policy-controller in [here](https://docs.sigstore.dev/policy-controller/overview/).
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

charts/policy-controller/README.md.gotmpl

@@ -0,0 +1,115 @@
+{{ template "chart.header" . }}
+
+{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
+
+{{ template "chart.description" . }}
+
+**Homepage:** <https://github.com/sigstore/policy-controller>
+
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| dlorenc |  |  |
+| hectorj2f |  |  |
+
+## Source Code
+
+* <https://github.com/sigstore/policy-controller>
+
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}
+
+### Deploy `policy-controller` Helm Chart
+
+Install `policy-controller` using Helm:
+
+```shell
+helm repo add sigstore https://sigstore.github.io/helm-charts
+
+helm repo update
+
+kubectl create namespace cosign-system
+
+helm install policy-controller -n cosign-system sigstore/policy-controller --devel
+```
+
+The `policy-controller` enforce images matching the defined list of `ClusterImagePolicy` for the labeled namespaces.
+
+Note that, by default, the `policy-controller` offers a configurable behavior defining whether to allow, deny or warn whenever an image does not match a policy in a specific namespace. This behavior can be configured using the `config-policy-controller` ConfigMap created under the release namespace, and by adding an entry with the property `no-match-policy` and its value `warn|allow|deny`.
+By default, any image that does not match a policy is rejected whenever `no-match-policy` is not configured in the ConfigMap.
+
+As supported in previous versions, you could create your own key pair:
+
+```shell
+export COSIGN_PASSWORD=<my_cosign_password>
+cosign generate-key-pair
+```
+
+This command generates two key files `cosign.key` and `cosign.pub`. Next, create a secret to validate the signatures:
+
+```shell
+kubectl create secret generic mysecret -n \
+cosign-system --from-file=cosign.pub=./cosign.pub
+```
+
+**IMPORTANT:** The `cosign.secretKeyRef` flag is not supported anymore. Finally, you could reuse your secret `mysecret` by creating a `ClusterImagePolicy` that sets it as listed authorities, as shown below.
+
+```yaml
+apiVersion: policy.sigstore.dev/v1alpha1
+kind: ClusterImagePolicy
+metadata:
+  name: cip-key-secret
+spec:
+  images:
+  - glob: "**your-desired-value**"
+  authorities:
+  - key:
+      secretRef:
+        name: mysecret
+
+```
+
+### Enabling Admission control
+
+To enable the `policy admission webhook` to check for signed images, you will need to add the following label in each namespace that you would want the webhook triggered:
+
+Label: `policy.sigstore.dev/include: "true"`
+
+```yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    policy.sigstore.dev/include: "true"
+    kubernetes.io/metadata.name: my-namespace
+  name: my-namespace
+spec:
+  finalizers:
+  - kubernetes
+```
+
+### Testing the webhook
+
+1. Using Unsigned Images:
+Creating a deployment referencing images that are not signed will yield the following error and no resources will be created:
+
+    ```shell
+    kubectl apply -f my-deployment.yaml
+    Error from server (BadRequest): error when creating "my-deployment.yaml": admission webhook "policy.sigstore.dev" denied the request: validation failed: invalid image signature: spec.template.spec.containers[0].image
+    ```
+
+2. Using Signed Images: Assuming a signed `nginx` image with a tag `signed` exists on a registry, the resource will be successfully created.
+
+   ```shell
+   kubectl run pod1-signed  --image=< REGISTRY_USER >/nginx:signed -n testns
+   pod/pod1-signed created
+   ```
+
+## More info
+
+You can find more information about the policy-controller in [here](https://docs.sigstore.dev/policy-controller/overview/).
+{{ template "helm-docs.versionFooter" . }}

charts/policy-controller/templates/webhook/webhook_mutating.yaml

@@ -4,12 +4,14 @@ metadata:
   name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
 webhooks:
 - name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
+  {{- if .Values.policywebhook.namespaceOptIn }}
   namespaceSelector:
     # The webhook should only apply to things that opt-in
     matchExpressions:
     - key: policy.sigstore.dev/include
       operator: In
       values: ["true"]
+  {{- end }}
   admissionReviewVersions: [v1]
   clientConfig:
     service:

charts/policy-controller/templates/webhook/webhook_validating.yaml

@@ -4,12 +4,14 @@ metadata:
   name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
 webhooks:
 - name: {{ required "A valid cosign.webhookName is required" .Values.cosign.webhookName }}
+  {{- if .Values.policywebhook.namespaceOptIn }}
   namespaceSelector:
     # The webhook should only apply to things that opt-in
     matchExpressions:
     - key: policy.sigstore.dev/include
       operator: In
       values: ["true"]
+  {{- end }}
   admissionReviewVersions: [v1]
   clientConfig:
     service:

charts/policy-controller/values.schema.json

@@ -136,6 +136,9 @@
                         }
                     }
                 },
+                "namespaceOptIn": {
+                    "type": "boolean"
+                },
                 "webhookNames": {
                     "type": "object",
                     "properties": {

charts/policy-controller/values.yaml

@@ -38,6 +38,8 @@ policywebhook:
     annotations: {}
     type: ClusterIP
     port: 443
+  # opt-in to validation with namespace annotation
+  namespaceOptIn: true
   webhookNames:
     defaulting: "defaulting.clusterimagepolicy.sigstore.dev"
     validating: "validating.clusterimagepolicy.sigstore.dev"