[stable/opa] add timeout for a webhook call in seconds (#17960)

* add timeout for a webhook call in seconds

Signed-off-by: Ondrej Kuchar <ondrej.kuchar@pan-net.eu>

* syntax fix

Signed-off-by: Ondrej Kuchar <ondrej.kuchar@pan-net.eu>

stable/opa/Chart.yaml

@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.9.0
+version: 1.9.1
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:

stable/opa/README.md

@@ -86,4 +86,5 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `priorityClassName` | The name of the priorityClass for the pods. | Unset |
 | `prometheus.enabled` | Flag to expose the `/metrics` endpoint to be scraped. | `false` | 
 | `annotations` | Annotations to be added to the deployment template. | `{}` |
-| `bootstrapPolicies` | Bootstrap policies to be loaded during OPA startup. | `{}` |
+| `bootstrapPolicies` | Bootstrap policies to be loaded during OPA startup. | `{}` |
+| `timeoutSeconds` | Timeout for a webhook call in seconds. | `` |

stable/opa/templates/webhookconfiguration.yaml

@@ -32,6 +32,9 @@ webhooks:
         name: {{ template "opa.fullname" . }}
         namespace: {{ .Release.Namespace }}
     sideEffects: {{ .Values.admissionControllerSideEffect }}
+{{ if .Values.timeoutSeconds }}
+    timeoutSeconds: {{ .Values.timeoutSeconds }}
+{{ end }}
 
 {{ if .Values.certManager.enabled }}
 ---

stable/opa/values.yaml

@@ -194,3 +194,9 @@ livenessProbe:
 
 # Set a priorityClass using priorityClassName
 # priorityClassName:
+
+# Timeout for a webhook call in seconds.
+# Starting in kubernetes 1.14 you can set the timeout and it is
+# encouraged to use a small timeout for webhooks. If the webhook call times out, the request
+# the request is handled according to the webhook'sfailure policy.
+# timeoutSeconds: 20