feat(helm): matchConditions added in Validating & MutatingWebhookConfiguration

cmd/build/helmify/kustomize-for-helm.yaml

@@ -253,6 +253,7 @@ webhooks:
   objectSelector: HELMSUBST_MUTATING_WEBHOOK_OBJECT_SELECTOR
   sideEffects: None
   timeoutSeconds: HELMSUBST_MUTATING_WEBHOOK_TIMEOUT
+  matchConditions: HELMSUBST_MUTATING_WEBHOOK_MATCH_CONDITIONS
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
@@ -279,6 +280,7 @@ webhooks:
   failurePolicy: HELMSUBST_VALIDATING_WEBHOOK_FAILURE_POLICY
   rules:
   - HELMSUBST_VALIDATING_WEBHOOK_OPERATION_RULES
+  matchConditions: HELMSUBST_VALIDATING_WEBHOOK_MATCH_CONDITIONS
 - clientConfig:
     service:
       name: gatekeeper-webhook-service

cmd/build/helmify/main.go

@@ -105,12 +105,16 @@ func (ks *kindSet) Write() error {
 			fileName := fmt.Sprintf("%s-%s.yaml", strings.ToLower(name), strings.ToLower(kind))
 
 			if name == "validation.gatekeeper.sh" {
-				obj = "{{- if not .Values.disableValidatingWebhook }}\n" + obj + "{{- end }}\n"
+				matchConditions := "  matchConditions: " + replacements["HELMSUBST_VALIDATING_WEBHOOK_MATCH_CONDITIONS"]
+				replace := fmt.Sprintf("  {{- if ge (int .Capabilities.KubeVersion.Minor) 28 }}\n%s\n  {{- end }}", matchConditions)
+				obj = "{{- if not .Values.disableValidatingWebhook }}\n" + strings.Replace(obj, matchConditions, replace, 1) + "{{- end }}\n"
 				fileName = fmt.Sprintf("gatekeeper-validating-webhook-configuration-%s.yaml", strings.ToLower(kind))
 			}
 
 			if name == "mutation.gatekeeper.sh" {
-				obj = "{{- if not .Values.disableMutation }}\n" + obj + "{{- end }}\n"
+				matchConditions := "  matchConditions: " + replacements["HELMSUBST_MUTATING_WEBHOOK_MATCH_CONDITIONS"]
+				replace := fmt.Sprintf("  {{- if ge (int .Capabilities.KubeVersion.Minor) 28 }}\n%s\n  {{- end }}", matchConditions)
+				obj = "{{- if not .Values.disableMutation }}\n" + strings.Replace(obj, matchConditions, replace, 1) + "{{- end }}\n"
 				fileName = fmt.Sprintf("gatekeeper-mutating-webhook-configuration-%s.yaml", strings.ToLower(kind))
 			}
 

cmd/build/helmify/replacements.go

@@ -146,6 +146,8 @@ var replacements = map[string]string{
       path: /v1/mutate
     {{- end }}`,
 
+	"HELMSUBST_VALIDATING_WEBHOOK_MATCH_CONDITIONS": `{{ toYaml .Values.validatingWebhookMatchConditions | nindent 4 }}`,
+
 	"HELMSUBST_VALIDATING_WEBHOOK_TIMEOUT": `{{ .Values.validatingWebhookTimeoutSeconds }}`,
 
 	"HELMSUBST_VALIDATING_WEBHOOK_FAILURE_POLICY": `{{ .Values.validatingWebhookFailurePolicy }}`,
@@ -217,6 +219,8 @@ var replacements = map[string]string{
     - 'services/status'
   {{- end }}`,
 
+	"HELMSUBST_MUTATING_WEBHOOK_MATCH_CONDITIONS": `{{ toYaml .Values.mutatingWebhookMatchConditions | nindent 4 }}`,
+
 	"HELMSUBST_PDB_CONTROLLER_MANAGER_MINAVAILABLE": `{{ .Values.pdb.controllerManager.minAvailable }}`,
 
 	`HELMSUBST_AUDIT_CONTROLLER_MANAGER_DEPLOYMENT_IMAGE_RELEASE: ""`: `{{- if .Values.image.release }}

cmd/build/helmify/static/README.md

@@ -141,6 +141,7 @@ information._
 | validatingWebhookFailurePolicy                             | The failurePolicy for the validating webhook                                                                                                                                                                                                                                                   | `Ignore`                                                                                                                                                              |
 | validatingWebhookAnnotations                               | The annotations to add to the ValidatingWebhookConfiguration                                                                                                                                                                                                                                   | `{}`                                                                                                                                                                  |
 | validatingWebhookObjectSelector                            | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's validation webhook unless measures are taken to control how exemption labels can be set.                          | `{}`                                                                                                                                                                  |
+| validatingWebhookMatchConditions                           | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called                                                                                                                 | `{}`                                                                                                                                                                  |
 | validatingWebhookCheckIgnoreFailurePolicy                  | The failurePolicy for the check-ignore-label validating webhook                                                                                                                                                                                                                                | `Fail`                                                                                                                                                                |
 | validatingWebhookExemptNamespacesLabels                    | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.                                            | `{}`                                                                                                                                                                  |
 | validatingWebhookCustomRules                               | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                          | `{}`                                                                                                                                                                  |
@@ -157,6 +158,7 @@ information._
 | mutatingWebhookAnnotations                                 | The annotations to add to the MutatingWebhookConfiguration                                                                                                                                                                                                                                     | `{}`                                                                                                                                                                  |
 | mutatingWebhookExemptNamespacesLabels                      | Additional namespace labels that will be exempt from the mutating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.                                              | `{}`                                                                                                                                                                  |
 | mutatingWebhookObjectSelector                              | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's mutation webhook unless measures are taken to control how exemption labels can be set.                            | `{}`                                                                                                                                                                  |
+| mutatingWebhookMatchConditions                             | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called                                                                                                                 | `{}`                                                                                                                                                                  |
 | mutatingWebhookTimeoutSeconds                              | The timeout for the mutating webhook in seconds                                                                                                                                                                                                                                                | `3`                                                                                                                                                                   |
 | mutatingWebhookCustomRules                                 | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                                                                            | `{}`                                                                                                                                                                  |
 | mutatingWebhookURL                                         | Custom URL for Kubernetes API server to use to reach the mutating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used.                                                                                                                              | `null`                                                                                                                                                                |

cmd/build/helmify/static/values.yaml

@@ -13,6 +13,7 @@ validatingWebhookFailurePolicy: Ignore
 validatingWebhookAnnotations: {}
 validatingWebhookExemptNamespacesLabels: {}
 validatingWebhookObjectSelector: {}
+validatingWebhookMatchConditions: {}
 validatingWebhookCheckIgnoreFailurePolicy: Fail
 validatingWebhookCustomRules: {}
 validatingWebhookURL: null
@@ -27,6 +28,7 @@ mutatingWebhookReinvocationPolicy: Never
 mutatingWebhookAnnotations: {}
 mutatingWebhookExemptNamespacesLabels: {}
 mutatingWebhookObjectSelector: {}
+mutatingWebhookMatchConditions: {}
 mutatingWebhookTimeoutSeconds: 1
 mutatingWebhookCustomRules: {}
 mutatingWebhookURL: null

manifest_staging/charts/gatekeeper/README.md

@@ -141,6 +141,7 @@ information._
 | validatingWebhookFailurePolicy                             | The failurePolicy for the validating webhook                                                                                                                                                                                                                                                   | `Ignore`                                                                                                                                                              |
 | validatingWebhookAnnotations                               | The annotations to add to the ValidatingWebhookConfiguration                                                                                                                                                                                                                                   | `{}`                                                                                                                                                                  |
 | validatingWebhookObjectSelector                            | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's validation webhook unless measures are taken to control how exemption labels can be set.                          | `{}`                                                                                                                                                                  |
+| validatingWebhookMatchConditions                           | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called                                                                                                                 | `{}`                                                                                                                                                                  |
 | validatingWebhookCheckIgnoreFailurePolicy                  | The failurePolicy for the check-ignore-label validating webhook                                                                                                                                                                                                                                | `Fail`                                                                                                                                                                |
 | validatingWebhookExemptNamespacesLabels                    | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.                                            | `{}`                                                                                                                                                                  |
 | validatingWebhookCustomRules                               | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                          | `{}`                                                                                                                                                                  |
@@ -157,6 +158,7 @@ information._
 | mutatingWebhookAnnotations                                 | The annotations to add to the MutatingWebhookConfiguration                                                                                                                                                                                                                                     | `{}`                                                                                                                                                                  |
 | mutatingWebhookExemptNamespacesLabels                      | Additional namespace labels that will be exempt from the mutating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.                                              | `{}`                                                                                                                                                                  |
 | mutatingWebhookObjectSelector                              | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's mutation webhook unless measures are taken to control how exemption labels can be set.                            | `{}`                                                                                                                                                                  |
+| mutatingWebhookMatchConditions                             | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called                                                                                                                 | `{}`                                                                                                                                                                  |
 | mutatingWebhookTimeoutSeconds                              | The timeout for the mutating webhook in seconds                                                                                                                                                                                                                                                | `3`                                                                                                                                                                   |
 | mutatingWebhookCustomRules                                 | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                                                                            | `{}`                                                                                                                                                                  |
 | mutatingWebhookURL                                         | Custom URL for Kubernetes API server to use to reach the mutating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used.                                                                                                                              | `null`                                                                                                                                                                |

manifest_staging/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml

@@ -24,6 +24,9 @@ webhooks:
       path: /v1/mutate
     {{- end }}
   failurePolicy: {{ .Values.mutatingWebhookFailurePolicy }}
+  {{- if ge (int .Capabilities.KubeVersion.Minor) 28 }}
+  matchConditions: {{ toYaml .Values.mutatingWebhookMatchConditions | nindent 4 }}
+  {{- end }}
   matchPolicy: Exact
   name: mutation.gatekeeper.sh
   namespaceSelector:

manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml

@@ -24,6 +24,9 @@ webhooks:
       path: /v1/admit
     {{- end }}
   failurePolicy: {{ .Values.validatingWebhookFailurePolicy }}
+  {{- if ge (int .Capabilities.KubeVersion.Minor) 28 }}
+  matchConditions: {{ toYaml .Values.validatingWebhookMatchConditions | nindent 4 }}
+  {{- end }}
   matchPolicy: Exact
   name: validation.gatekeeper.sh
   namespaceSelector:

manifest_staging/charts/gatekeeper/values.yaml

@@ -13,6 +13,7 @@ validatingWebhookFailurePolicy: Ignore
 validatingWebhookAnnotations: {}
 validatingWebhookExemptNamespacesLabels: {}
 validatingWebhookObjectSelector: {}
+validatingWebhookMatchConditions: {}
 validatingWebhookCheckIgnoreFailurePolicy: Fail
 validatingWebhookCustomRules: {}
 validatingWebhookURL: null
@@ -27,6 +28,7 @@ mutatingWebhookReinvocationPolicy: Never
 mutatingWebhookAnnotations: {}
 mutatingWebhookExemptNamespacesLabels: {}
 mutatingWebhookObjectSelector: {}
+mutatingWebhookMatchConditions: {}
 mutatingWebhookTimeoutSeconds: 1
 mutatingWebhookCustomRules: {}
 mutatingWebhookURL: null