fix: scope of webhook configurations

cmd/build/helmify/replacements.go

@@ -173,6 +173,7 @@ var replacements = map[string]string{
     - services/proxy
     - nodes/proxy
     - services/status
+    scope: 'Namespaced'
   {{- end }}`,
 
 	"HELMSUBST_MUTATING_WEBHOOK_CLIENT_CONFIG: \"\"": `{{- if .Values.mutatingWebhookURL }}
@@ -258,6 +259,7 @@ var replacements = map[string]string{
     - 'nodes/proxy'
     # For constraints that mitigate CVE-2020-8554
     - 'services/status'
+    scope: 'Namespaced'
   {{- end }}`,
 
 	"HELMSUBST_MUTATING_WEBHOOK_MATCH_CONDITIONS": `{{ toYaml .Values.mutatingWebhookMatchConditions | nindent 4 }}`,

config/crd/bases/gvkmanifest.gatekeeper.sh_gvkmanifests.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  name: gvkmanifests.gvkmanifest.gatekeeper.sh
+spec:
+  group: gvkmanifest.gatekeeper.sh
+  names:
+    kind: GVKManifest
+    listKind: GVKManifestList
+    plural: gvkmanifests
+    singular: gvkmanifest
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: GVKManifest is the Schema for the GVKManifest API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              groups:
+                additionalProperties:
+                  additionalProperties:
+                    items:
+                      type: string
+                    type: array
+                  type: object
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true

manifest_staging/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml

@@ -79,6 +79,7 @@ webhooks:
     - services/proxy
     - nodes/proxy
     - services/status
+    scope: 'Namespaced'
   {{- end }}
   sideEffects: None
   timeoutSeconds: {{ .Values.mutatingWebhookTimeoutSeconds }}

manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml

@@ -87,6 +87,7 @@ webhooks:
     - 'nodes/proxy'
     # For constraints that mitigate CVE-2020-8554
     - 'services/status'
+    scope: 'Namespaced'
   {{- end }}
   sideEffects: None
   timeoutSeconds: {{ .Values.validatingWebhookTimeoutSeconds }}