[stable/opa] Added a namespace selector config to admission controller (#14518)

Making the namespace selector configurable allows for more flexibility.
e.g. we want to enable it for only 1 namespace.

Signed-off-by: Ali Rizwan <ari@hellofresh.com>

stable/opa/Chart.yaml

@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.4.5
+version: 1.5.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:

stable/opa/README.md

@@ -61,6 +61,7 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `admissionControllerKind` | Type of admission controller to install. | `ValidatingWebhookConfiguration` |
 | `admissionControllerFailurePolicy` | Fail-open (`Ignore`) or fail-closed (`Fail`)? | `Ignore` |
 | `admissionControllerRules` | Types of operations resources to check. | `*` |
+| `admissionControllerNamespaceSelector` | Namespace selector for the admission controller | See [values.yaml](values.yaml) |
 | `generateAdmissionControllerCerts` | Auto-generate TLS certificates for admission controller. | `true` |
 | `admissionControllerCA` | Manually set admission controller certificate CA. | Unset |
 | `admissionControllerCert` | Manually set admission controller certificate. | Unset |
@@ -82,4 +83,4 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `opa` | OPA configuration. | See [values.yaml](values.yaml) |
 | `mgmt.resources` | CPU and memory limits for the kube-mgmt container. | `{}` |
 | `sar.resources` | CPU and memory limits for the sar container. | `{}` |
-| `priorityClassName` | The name of the priorityClass for the pods. | Unset |
+| `priorityClassName` | The name of the priorityClass for the pods. | Unset |

stable/opa/templates/webhookconfiguration.yaml

@@ -13,9 +13,10 @@ metadata:
 {{ include "opa.labels.standard" . | indent 4 }}
 webhooks:
   - name: webhook.openpolicyagent.org
+{{- with .Values.admissionControllerNamespaceSelector }}
     namespaceSelector:
-      matchExpressions:
-        - {key: openpolicyagent.org/webhook, operator: NotIn, values: [ignore]}
+{{ toYaml . | indent 6 }}
+{{ end }}
     failurePolicy: {{ .Values.admissionControllerFailurePolicy }}
     rules:
 {{ toYaml .Values.admissionControllerRules | indent 6 }}

stable/opa/values.yaml

@@ -24,6 +24,11 @@ admissionControllerKind: ValidatingWebhookConfiguration
 # recommend leaving the failure policy as Ignore.
 admissionControllerFailurePolicy: Ignore
 
+# Adds a namespace selector to the admission controller webhook
+admissionControllerNamespaceSelector:
+  matchExpressions:
+    - {key: openpolicyagent.org/webhook, operator: NotIn, values: [ignore]}
+
 # SideEffectClass for the webhook, setting to None enables dry-run
 admissionControllerSideEffect: Unknown