Merge pull request #113 from iits-consulting/bugfix/cert-manager

Bugfix: cert manager PolicyException

charts/cert-manager/Chart.yaml

@@ -9,4 +9,4 @@ dependencies:
     condition: clusterIssuers.otcDNS.enabled
 name: cert-manager
 description: Wrapper chart for cert-manager. Deploys a ClusterIssuer resource to bootstrap Let's encrypt cert generation
-version: 1.14.4
+version: 1.14.5

charts/cert-manager/images.txt

@@ -1,6 +1,6 @@
-quay.io/jetstack/cert-manager-acmesolver:v1.14.4
-quay.io/jetstack/cert-manager-cainjector:v1.14.4
-quay.io/jetstack/cert-manager-controller:v1.14.4
-quay.io/jetstack/cert-manager-ctl:v1.14.4
-quay.io/jetstack/cert-manager-webhook:v1.14.4
-quay.io/jetstack/cert-manager-startupapicheck:v1.14.4
+quay.io/jetstack/cert-manager-acmesolver:v1.14.5
+quay.io/jetstack/cert-manager-cainjector:v1.14.5
+quay.io/jetstack/cert-manager-controller:v1.14.5
+quay.io/jetstack/cert-manager-ctl:v1.14.5
+quay.io/jetstack/cert-manager-webhook:v1.14.5
+quay.io/jetstack/cert-manager-startupapicheck:v1.14.5

charts/cert-manager/templates/policy-exclusion.yaml

@@ -0,0 +1,32 @@
+{{ with .Values.policyException }}
+{{ if tpl .enabled $ | toString | eq "true" }}
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: cert-manager-webhook
+spec:
+  exceptions:
+    - policyName: restrict-seccomp-strict
+      ruleNames:
+        - check-seccomp-strict
+        - autogen-check-seccomp-strict
+    - policyName: restrict-seccomp
+      ruleNames:
+        - check-seccomp
+        - autogen-check-seccomp
+    - policyName: enforce-security-context
+      ruleNames:
+        - add-pod-security-context
+  match:
+    any:
+      - resources:
+          kinds:
+            - Deployment
+            - ReplicaSet
+            - Pod
+          names:
+            - '*cert-manager-webhook-opentelekomcloud*'
+          namespaces:
+            - cert-manager
+{{- end }}
+{{- end }}

charts/cert-manager/values.yaml

@@ -24,4 +24,9 @@ clusterIssuers:
     server: https://acme-v02.api.letsencrypt.org/directory
     region: eu-de
     accessKey: ""
-    secretKey: ""
+    secretKey: ""
+
+
+policyException:
+  # Only enabled if clusterIssuers.otcDNS.enabled is also true
+  enabled: "{{ .Values.clusterIssuers.otcDNS.enabled }}"