allow setting matchConditions for the injector webhook

hashicorp · Dec 11, 2024 · ba97e72 · ba97e72
1 parent 272d04e
commit ba97e72
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 0 deletions.
diff --git a/templates/injector-mutating-webhook.yaml b/templates/injector-mutating-webhook.yaml
@@ -41,5 +41,9 @@ webhooks:
     namespaceSelector:
 {{ toYaml (((.Values.injector.webhook)).namespaceSelector | default .Values.injector.namespaceSelector) | indent 6}}
 {{ end }}
+{{- if (((.Values.injector.webhook)).matchConditions) }}
+    matchConditions:
+{{ toYaml ((.Values.injector.webhook)).matchConditions | indent 6}}
+{{ end }}
 {{- template "injector.objectSelector" . -}}
 {{ end }}
diff --git a/values.schema.json b/values.schema.json
@@ -584,6 +584,12 @@
                         "failurePolicy": {
                             "type": "string"
                         },
+                        "matchConditions": {
+                            "type": "array",
+                            "items": {
+                                "type": "object"
+                            }
+                        },
                         "matchPolicy": {
                             "type": "string"
                         },

diff --git a/values.yaml b/values.yaml
@@ -171,6 +171,15 @@ injector:
     #
     timeoutSeconds: 30
 
+    # matchConditions is the selector for restricting the webhook fine-grained request filtering.
+    # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions
+    # for more details.
+    # Example:
+    # matchConditions:
+    # - name: include-vault-pods
+    #   expression: "has(object.metadata.annotations) && 'vault.hashicorp.com/agent-inject' in object.metadata.annotations"
+    matchConditions: []
+
     # namespaceSelector is the selector for restricting the webhook to only
     # specific namespaces.
     # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector