Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Enable toggling of deferring to VAP #3335

Merged
merged 5 commits into from
Mar 28, 2024
Merged

feat: Enable toggling of deferring to VAP #3335

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
627eda2
Enable toggling of deferring to VAP
maxsmythe Mar 26, 2024
bb3a7a8
Update main.go
maxsmythe Mar 27, 2024
f029840
Update main.go
maxsmythe Mar 28, 2024
d944f62
Merge branch 'master' into incorporate-cf-vap-toggle
maxsmythe Mar 28, 2024
6e1aa67
Merge branch 'master' into incorporate-cf-vap-toggle
sozercan Mar 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,7 @@ var (
disabledBuiltins = util.NewFlagSet()
enableK8sCel = flag.Bool("experimental-enable-k8s-native-validation", false, "Alpha: enable the validating admission policy driver")
externaldataProviderResponseCacheTTL = flag.Duration("external-data-provider-response-cache-ttl", 3*time.Minute, "TTL for the external data provider response cache. Specify the duration in 'h', 'm', or 's' for hours, minutes, or seconds respectively. Defaults to 3 minutes if unspecified. Setting the TTL to 0 disables the cache.")
deferAdmissionToVAP = flag.Bool("defer-admission-to-vap", false, "When set to false, Gatekeeper webhook can act as a fallback in case K8s' Validating Admission Policy fails. When set to true, Gatekeeper validating webhook will not evaluate a policy for an admission request it expects vap to enforce. May improve resource usage at the cost of race conditions detecting whether VAP enforcement is in effect. This does not impact audit results. Defaults to false.")
)

func init() {
Expand Down Expand Up @@ -414,7 +415,16 @@ func setupControllers(ctx context.Context, mgr ctrl.Manager, sw *watch.Controlle

if *enableK8sCel {
// initialize K8sValidation
k8sDriver, err := k8scel.New()
var k8scelArgs []k8scel.Arg
if *deferAdmissionToVAP && constraint.VapEnforcement != constraint.VapFlagNone {
switch constraint.VapEnforcement {
case constraint.VapFlagGatekeeperDefault:
k8scelArgs = append(k8scelArgs, k8scel.VAPGenerationDefault(k8scel.VAPDefaultNo))
case constraint.VapFlagVapDefault:
k8scelArgs = append(k8scelArgs, k8scel.VAPGenerationDefault(k8scel.VAPDefaultYes))
}
}
k8sDriver, err := k8scel.New(k8scelArgs...)
if err != nil {
setupLog.Error(err, "unable to set up K8s native driver")
return err
Expand Down
Loading