feat: add helm chart

Signed-off-by: Charles-Edouard Brétéché <[email protected]>

.gitignore

@@ -1,3 +1,3 @@
 .tools/
 website/site/
-kyverno-envoy-plugin
+/kyverno-envoy-plugin

charts/kyverno-envoy-plugin/.helmignore

@@ -0,0 +1,3 @@
+.helmignore
+ci/
+README.md.gotmpl

charts/kyverno-envoy-plugin/Chart.yaml

@@ -0,0 +1,22 @@
+apiVersion: v2
+type: application
+name: kyverno-envoy-plugin
+version: v0.0.0
+appVersion: latest
+icon: https://github.com/kyverno/kyverno/raw/main/img/logo.png
+description: Kyverno policies based authorization plugin for Envoy ❤️
+keywords:
+  - kubernetes
+  - kyverno
+  - authz
+  - policy
+  - envoy
+  - istio
+  - security
+home: https://kyverno.github.io/kyverno-envoy-plugin
+sources:
+  - https://github.com/kyverno/kyverno-envoy-plugin
+maintainers:
+  - name: Kyverno
+    url: https://kyverno.io/
+kubeVersion: ">=1.25.0-0"

charts/kyverno-envoy-plugin/templates/NOTES.txt

@@ -0,0 +1 @@
+Chart version: {{ .Chart.Version }}

charts/kyverno-envoy-plugin/templates/_helpers/_chart.tpl

@@ -0,0 +1,9 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{- define "kyverno.chart.name" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "kyverno.chart.version" -}}
+  {{- .Chart.Version | replace "+" "_" -}}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/_helpers/_labels.tpl

@@ -0,0 +1,43 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{- define "kyverno.labels.merge" -}}
+{{- $labels := dict -}}
+{{- range . -}}
+  {{- $labels = merge $labels (fromYaml .) -}}
+{{- end -}}
+{{- with $labels -}}
+  {{- toYaml $labels -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.labels.helm" -}}
+{{- if not .Values.templating.enabled -}}
+helm.sh/chart: {{ template "kyverno.chart.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.labels.version" -}}
+app.kubernetes.io/version: {{ template "kyverno.chart.version" . }}
+{{- end -}}
+
+{{- define "kyverno.labels.common" -}}
+{{- template "kyverno.labels.merge" (list
+  (include "kyverno.labels.helm" .)
+  (include "kyverno.labels.version" .)
+  (toYaml .Values.customLabels)
+) -}}
+{{- end -}}
+
+{{- define "kyverno.labels.component" -}}
+app.kubernetes.io/component: {{ . }}
+{{- end -}}
+
+{{- define "kyverno.labels.name" -}}
+app.kubernetes.io/name: {{ . }}
+{{- end -}}
+
+{{- define "kyverno.labels.match.common" -}}
+app.kubernetes.io/part-of: {{ template "kyverno.names.fullname" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/_helpers/_names.tpl

@@ -0,0 +1,22 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{- define "kyverno.names.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "kyverno.names.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+  {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+  {{- $name := default .Chart.Name .Values.nameOverride -}}
+  {{- if contains $name .Release.Name -}}
+    {{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+  {{- else -}}
+    {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+  {{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.namespace" -}}
+{{ default .Release.Namespace .Values.namespaceOverride }}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/sidecar-injector/_helpers.tpl

@@ -0,0 +1,39 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{- define "kyverno.sidecar-injector.name" -}}
+{{ template "kyverno.names.name" . }}-sidecar-injector
+{{- end -}}
+
+{{- define "kyverno.sidecar-injector.labels" -}}
+{{- template "kyverno.labels.merge" (list
+  (include "kyverno.labels.common" .)
+  (include "kyverno.sidecar-injector.labels.match" .)
+) -}}
+{{- end -}}
+
+{{- define "kyverno.sidecar-injector.labels.match" -}}
+{{- template "kyverno.labels.merge" (list
+  (include "kyverno.labels.match.common" .)
+  (include "kyverno.labels.component" "sidecar-injector")
+) -}}
+{{- end -}}
+
+{{- define "kyverno.sidecar-injector.role.name" -}}
+{{ include "kyverno.names.fullname" . }}:sidecar-injector
+{{- end -}}
+
+{{- define "kyverno.sidecar-injector.service-account.name" -}}
+{{- if .Values.sidecarInjector.rbac.create -}}
+    {{ default (include "kyverno.sidecar-injector.name" .) .Values.sidecarInjector.rbac.serviceAccount.name }}
+{{- else -}}
+    {{ required "A service account name is required when `rbac.create` is set to `false`" .Values.sidecarInjector.rbac.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{- define "kyverno.sidecar-injector.serviceName" -}}
+{{- printf "%s-svc" (include "kyverno.names.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "kyverno.sidecar-injector.caCertificatesConfigMapName" -}}
+{{ printf "%s-ca-certificates" (include "kyverno.sidecar-injector.name" .) }}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/sidecar-injector/cluster-role-binding.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.sidecarInjector.enabled -}}
+{{- if .Values.sidecarInjector.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "kyverno.sidecar-injector.role.name" . }}
+  labels:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "kyverno.sidecar-injector.role.name" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "kyverno.sidecar-injector.service-account.name" . }}
+    namespace: {{ template "kyverno.namespace" . }}
+{{- end -}}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/sidecar-injector/cluster-role.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.sidecarInjector.enabled -}}
+{{- if .Values.sidecarInjector.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "kyverno.sidecar-injector.role.name" . }}
+  labels:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+{{- end -}}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/sidecar-injector/mutating-webhook-configuration.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.sidecarInjector.enabled -}}
+apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ template "kyverno.sidecar-injector.name" . }}
+  labels:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+webhooks:
+  - name: kyverno-envoy-sidecar.kyverno-envoy-sidecar-injector.svc
+    clientConfig:
+      service:
+        name: {{ template "kyverno.sidecar-injector.name" . }}
+        namespace: {{ template "kyverno.namespace" . }}
+        path: "/mutate"
+    failurePolicy: Fail
+    sideEffects: None
+    admissionReviewVersions:
+    - v1
+    rules:
+      - apiGroups:
+          - ''
+        apiVersions:
+          - v1
+        resources:
+          - pods
+        operations:
+          - CREATE
+        scope: '*'  
+    objectSelector:
+      matchExpressions:
+        - key: kyverno-envoy-sidecar/injection
+          operator: In
+          values:
+          - enabled
+{{- end -}}

charts/kyverno-envoy-plugin/templates/sidecar-injector/secret.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.sidecarInjector.enabled -}}
+{{- if .Values.sidecarInjector.createSelfSignedCert -}}
+{{- $ca := genCA (printf "*.%s.svc" (include "kyverno.namespace" .)) 1024 -}}
+{{- $svcName := (printf "%s.%s.svc" (include "kyverno.sidecar-injector.name" .) (include "kyverno.namespace" .)) -}}
+{{- $cert := genSignedCert $svcName nil (list $svcName) 1024 $ca -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "kyverno.sidecar-injector.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-ca
+  namespace: {{ template "kyverno.namespace" . }}
+  labels:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+type: kubernetes.io/tls
+data:
+  tls.key: {{ $ca.Key | b64enc }}
+  tls.crt: {{ $ca.Cert | b64enc }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "kyverno.sidecar-injector.name" . }}.{{ template "kyverno.namespace" . }}.svc.kyverno-tls-pair
+  namespace: {{ template "kyverno.namespace" . }}
+  labels:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+  annotations:
+    self-signed-cert: "true"
+type: kubernetes.io/tls
+data:
+  tls.key: {{ $cert.Key | b64enc }}
+  tls.crt: {{ $cert.Cert | b64enc }}
+{{- end -}}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/sidecar-injector/service-account.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.sidecarInjector.enabled -}}
+{{- if .Values.sidecarInjector.rbac.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "kyverno.sidecar-injector.service-account.name" . }}
+  namespace: {{ template "kyverno.namespace" . }}
+  labels:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+{{- end -}}
+{{- end -}}

charts/kyverno-envoy-plugin/templates/sidecar-injector/service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.sidecarInjector.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "kyverno.sidecar-injector.service-account.name" . }}
+  namespace: {{ template "kyverno.namespace" . }}
+  labels:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: https
+    protocol: TCP
+    port: 443
+    targetPort: 8443
+  selector:
+    {{- include "kyverno.sidecar-injector.labels" . | nindent 4 }}
+{{- end -}}