forked from open-policy-agent/gatekeeper
-
Notifications
You must be signed in to change notification settings - Fork 0
/
gatekeeper.yaml
166 lines (166 loc) · 4.31 KB
/
gatekeeper.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
# Grant OPA/kube-mgmt read-only access to resources. This let's kube-mgmt
# replicate resources into OPA so they can be used in policies.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: opa-viewer
roleRef:
kind: ClusterRole
name: view
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: default
namespace: system
---
# Define role for OPA/kube-mgmt to update webhook configurations and watch secrets and services.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: gatekeeper-cluster-role
rules:
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["*"]
resources: ["*"]
verbs: ["get", "list", "watch"]
---
# Grant OPA/kube-mgmt role defined above.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: gatekeeper-cluster-role
roleRef:
kind: ClusterRole
name: gatekeeper-cluster-role
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: default
namespace: gatekeeper-system
---
# Define role for OPA/kube-mgmt to update configmaps and manage services and secrets
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: gatekeeper-system
name: gatekeeper-namespace-role
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: [""]
resources: ["secrets", "services"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
# Grant OPA/kube-mgmt role defined above.
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
namespace: gatekeeper-system
name: gatekeeper-namespace-role
roleRef:
kind: Role
name: gatekeeper-namespace-role
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: default
namespace: gatekeeper-system
---
apiVersion: v1
kind: Service
metadata:
labels:
control-plane: controller-manager
controller-tools.k8s.io: "1.0"
name: gatekeeper-controller-manager-service
namespace: gatekeeper-system
spec:
selector:
control-plane: controller-manager
controller-tools.k8s.io: "1.0"
ports:
- port: 443
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
control-plane: controller-manager
controller-tools.k8s.io: "1.0"
name: gatekeeper-controller-manager
namespace: gatekeeper-system
spec:
selector:
matchLabels:
control-plane: controller-manager
controller-tools.k8s.io: "1.0"
serviceName: gatekeeper-controller-manager-service
template:
metadata:
labels:
control-plane: controller-manager
controller-tools.k8s.io: "1.0"
spec:
containers:
- name: manager
args:
- --stderrthreshold=INFO
command:
- /root/manager
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
- name: SECRET_NAME
value: gatekeeper-webhook-server-secret
image: docker.io/nikhilbh/gatekeeper:latest
imagePullPolicy: Always
ports:
- containerPort: 443
name: webhook-server
protocol: TCP
resources:
limits:
cpu: 100m
memory: 30Mi
requests:
cpu: 100m
memory: 20Mi
volumeMounts:
- mountPath: /certs
name: cert
readOnly: true
- name: opa
args:
- run
- --server
- --addr=http://127.0.0.1:8181
image: openpolicyagent/opa:0.10.1
imagePullPolicy: Always
resources: {}
- name: kube-mgmt
args:
- --replicate-cluster=v1/namespaces
- --replicate=extensions/v1beta1/ingresses
- --replicate=v1/pods
- --policies=gatekeeper-system
image: openpolicyagent/kube-mgmt:0.6
imagePullPolicy: Always
resources: {}
terminationGracePeriodSeconds: 10
volumes:
- name: cert
secret:
defaultMode: 420
secretName: gatekeeper-webhook-server-secret
---
apiVersion: v1
kind: Secret
metadata:
name: gatekeeper-webhook-server-secret
namespace: gatekeeper-system