From d38ffd4f1f2a92f264c5bbfdf66fc8febab3c1bc Mon Sep 17 00:00:00 2001
From: Ali Rizwan <aleerizw@gmail.com>
Date: Wed, 5 Jun 2019 17:39:55 +0200
Subject: [PATCH] [stable/opa] Added a namespace selector config to admission
 controller (#14518)

Making the namespace selector configurable allows for more flexibility.
e.g. we want to enable it for only 1 namespace.

Signed-off-by: Ali Rizwan <ari@hellofresh.com>
---
 stable/opa/Chart.yaml                          | 2 +-
 stable/opa/README.md                           | 3 ++-
 stable/opa/templates/webhookconfiguration.yaml | 5 +++--
 stable/opa/values.yaml                         | 5 +++++
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/stable/opa/Chart.yaml b/stable/opa/Chart.yaml
index 058d0539f4..2e84bddc4e 100644
--- a/stable/opa/Chart.yaml
+++ b/stable/opa/Chart.yaml
@@ -6,7 +6,7 @@ keywords:
 - opa
 - admission control
 - policy
-version: 1.4.5
+version: 1.5.0
 home: https://www.openpolicyagent.org
 icon: https://raw.githubusercontent.com/open-policy-agent/opa/master/logo/logo.png
 sources:
diff --git a/stable/opa/README.md b/stable/opa/README.md
index 586a31bff6..4951a5ba53 100644
--- a/stable/opa/README.md
+++ b/stable/opa/README.md
@@ -61,6 +61,7 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `admissionControllerKind` | Type of admission controller to install. | `ValidatingWebhookConfiguration` |
 | `admissionControllerFailurePolicy` | Fail-open (`Ignore`) or fail-closed (`Fail`)? | `Ignore` |
 | `admissionControllerRules` | Types of operations resources to check. | `*` |
+| `admissionControllerNamespaceSelector` | Namespace selector for the admission controller | See [values.yaml](values.yaml) |
 | `generateAdmissionControllerCerts` | Auto-generate TLS certificates for admission controller. | `true` |
 | `admissionControllerCA` | Manually set admission controller certificate CA. | Unset |
 | `admissionControllerCert` | Manually set admission controller certificate. | Unset |
@@ -82,4 +83,4 @@ Reference](https://www.openpolicyagent.org/docs/configuration.html).
 | `opa` | OPA configuration. | See [values.yaml](values.yaml) |
 | `mgmt.resources` | CPU and memory limits for the kube-mgmt container. | `{}` |
 | `sar.resources` | CPU and memory limits for the sar container. | `{}` |
-| `priorityClassName` | The name of the priorityClass for the pods. | Unset |
\ No newline at end of file
+| `priorityClassName` | The name of the priorityClass for the pods. | Unset |
diff --git a/stable/opa/templates/webhookconfiguration.yaml b/stable/opa/templates/webhookconfiguration.yaml
index a2a1aa3084..ac91d0ae1e 100644
--- a/stable/opa/templates/webhookconfiguration.yaml
+++ b/stable/opa/templates/webhookconfiguration.yaml
@@ -13,9 +13,10 @@ metadata:
 {{ include "opa.labels.standard" . | indent 4 }}
 webhooks:
   - name: webhook.openpolicyagent.org
+{{- with .Values.admissionControllerNamespaceSelector }}
     namespaceSelector:
-      matchExpressions:
-        - {key: openpolicyagent.org/webhook, operator: NotIn, values: [ignore]}
+{{ toYaml . | indent 6 }}
+{{ end }}
     failurePolicy: {{ .Values.admissionControllerFailurePolicy }}
     rules:
 {{ toYaml .Values.admissionControllerRules | indent 6 }}
diff --git a/stable/opa/values.yaml b/stable/opa/values.yaml
index d1c40e81a1..976bfc6133 100644
--- a/stable/opa/values.yaml
+++ b/stable/opa/values.yaml
@@ -24,6 +24,11 @@ admissionControllerKind: ValidatingWebhookConfiguration
 # recommend leaving the failure policy as Ignore.
 admissionControllerFailurePolicy: Ignore
 
+# Adds a namespace selector to the admission controller webhook
+admissionControllerNamespaceSelector:
+  matchExpressions:
+    - {key: openpolicyagent.org/webhook, operator: NotIn, values: [ignore]}
+
 # SideEffectClass for the webhook, setting to None enables dry-run
 admissionControllerSideEffect: Unknown