chore: adding helm variable for mutating subresources (#3916)

JaydipGabani · web-flow · commit 990586a2247a · 2025-04-21T15:21:39.000-07:00
Signed-off-by: Jaydip Gabani &lt;gabanijaydip@gmail.com&gt;
diff --git a/cmd/build/helmify/replacements.go b/cmd/build/helmify/replacements.go
@@ -162,24 +162,11 @@ var replacements = map[string]string{
     operations:
     - CREATE
     - UPDATE
-    resources:
+    resources: 
     - '*'
-    - pods/ephemeralcontainers
-    - pods/exec
-    - pods/log
-    - pods/eviction
-    - pods/portforward
-    - pods/proxy
-    - pods/attach
-    - pods/binding
-    - pods/resize
-    - deployments/scale
-    - replicasets/scale
-    - statefulsets/scale
-    - replicationcontrollers/scale
-    - services/proxy
-    - nodes/proxy
-    - services/status
+    {{- range .Values.mutatingWebhookSubResources }}
+    - {{ . }}
+    {{- end }}
   {{- end }}`,
 
 	"HELMSUBST_MUTATING_WEBHOOK_CLIENT_CONFIG: \"\"": `{{- if .Values.mutatingWebhookURL }}
@@ -249,23 +236,9 @@ var replacements = map[string]string{
     - '*'
     # Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper).
     # You can find a rough list of subresources by doing a case-sensitive search in the Kubernetes codebase for 'Subresource("'
-    - 'pods/ephemeralcontainers'
-    - 'pods/exec'
-    - 'pods/log'
-    - 'pods/eviction'
-    - 'pods/portforward'
-    - 'pods/proxy'
-    - 'pods/attach'
-    - 'pods/binding'
-    - 'pods/resize'
-    - 'deployments/scale'
-    - 'replicasets/scale'
-    - 'statefulsets/scale'
-    - 'replicationcontrollers/scale'
-    - 'services/proxy'
-    - 'nodes/proxy'
-    # For constraints that mitigate CVE-2020-8554
-    - 'services/status'
+    {{- range .Values.validatingWebhookSubResources }}
+    - {{ . }}
+    {{- end }}
   {{- end }}`,
 
 	"HELMSUBST_MUTATING_WEBHOOK_MATCH_CONDITIONS": `{{ toYaml .Values.mutatingWebhookMatchConditions | nindent 4 }}`,
diff --git a/cmd/build/helmify/static/README.md b/cmd/build/helmify/static/README.md
@@ -146,6 +146,7 @@ information._
 | validatingWebhookCheckIgnoreFailurePolicy                  | The failurePolicy for the check-ignore-label validating webhook                                                                                                                                                                                                                                | `Fail`                                                                                                                                                                |
 | validatingWebhookExemptNamespacesLabels                    | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.                                            | `{}`                                                                                                                                                                  |
 | validatingWebhookCustomRules                               | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                          | `{}`                                                                                                                                                                  |
+| validatingWebhookSubResources                                        | Rule for selecting which API subresources trigger the webhook.                                                                                                                                                                                             | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']`                                                                                                                           |
 | validatingWebhookURL                                       | Custom URL for Kubernetes API server to use to reach the validating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used.                                                                                                                            | `null`                                                                                                                                                                |
 | enableDeleteOperations                                     | Enable validating webhook for delete operations. Does not work with `validatingWebhookCustomRules`                                                                                                                                                                                             | `false`                                                                                                                                                               |
 | enableConnectOperations                                    | Enable validating webhook for connect operations.                                                                                                                                                                                                                                              | `false`                                                                                                                                                               |
@@ -163,6 +164,7 @@ information._
 | mutatingWebhookMatchConditions                             | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called                                                                                                                 | `[]`                                                                                                                                                                  |
 | mutatingWebhookTimeoutSeconds                              | The timeout for the mutating webhook in seconds                                                                                                                                                                                                                                                | `3`                                                                                                                                                                   |
 | mutatingWebhookCustomRules                                 | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                                                                            | `{}`                                                                                                                                                                  |
+| mutatingWebhookSubResources                                        | Rule for selecting which API subresources trigger the webhook.                                                                                                                                                                                             | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']`                                                                                                                           |
 | mutatingWebhookURL                                         | Custom URL for Kubernetes API server to use to reach the mutating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used.                                                                                                                              | `null`                                                                                                                                                                |
 | emitAdmissionEvents                                        | (alpha) Emit K8s events in configurable namespace for admission violations                                                                                                                                                                                                              | `false`                                                                                                                                                               |
 | emitAuditEvents                                            | (alpha) Emit K8s events in configurable namespace for audit violations                                                                                                                                                                                                                  | `false`                                                                                                                                                               |
diff --git a/cmd/build/helmify/static/values.yaml b/cmd/build/helmify/static/values.yaml
@@ -17,6 +17,7 @@ validatingWebhookObjectSelector: {}
 validatingWebhookMatchConditions: []
 validatingWebhookCheckIgnoreFailurePolicy: Fail
 validatingWebhookCustomRules: {}
+validatingWebhookSubResources: ['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']
 validatingWebhookURL: null
 enableDeleteOperations: false
 enableConnectOperations: false
@@ -33,6 +34,7 @@ mutatingWebhookObjectSelector: {}
 mutatingWebhookMatchConditions: []
 mutatingWebhookTimeoutSeconds: 1
 mutatingWebhookCustomRules: {}
+mutatingWebhookSubResources: ['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']
 mutatingWebhookURL: null
 mutationAnnotations: false
 auditChunkSize: 500
diff --git a/manifest_staging/charts/gatekeeper/README.md b/manifest_staging/charts/gatekeeper/README.md
@@ -146,6 +146,7 @@ information._
 | validatingWebhookCheckIgnoreFailurePolicy                  | The failurePolicy for the check-ignore-label validating webhook                                                                                                                                                                                                                                | `Fail`                                                                                                                                                                |
 | validatingWebhookExemptNamespacesLabels                    | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace.                                            | `{}`                                                                                                                                                                  |
 | validatingWebhookCustomRules                               | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                          | `{}`                                                                                                                                                                  |
+| validatingWebhookSubResources                                        | Rule for selecting which API subresources trigger the webhook.                                                                                                                                                                                             | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']`                                                                                                                           |
 | validatingWebhookURL                                       | Custom URL for Kubernetes API server to use to reach the validating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used.                                                                                                                            | `null`                                                                                                                                                                |
 | enableDeleteOperations                                     | Enable validating webhook for delete operations. Does not work with `validatingWebhookCustomRules`                                                                                                                                                                                             | `false`                                                                                                                                                               |
 | enableConnectOperations                                    | Enable validating webhook for connect operations.                                                                                                                                                                                                                                              | `false`                                                                                                                                                               |
@@ -163,6 +164,7 @@ information._
 | mutatingWebhookMatchConditions                             | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called                                                                                                                 | `[]`                                                                                                                                                                  |
 | mutatingWebhookTimeoutSeconds                              | The timeout for the mutating webhook in seconds                                                                                                                                                                                                                                                | `3`                                                                                                                                                                   |
 | mutatingWebhookCustomRules                                 | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced.                                                                                                                                            | `{}`                                                                                                                                                                  |
+| mutatingWebhookSubResources                                        | Rule for selecting which API subresources trigger the webhook.                                                                                                                                                                                             | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']`                                                                                                                           |
 | mutatingWebhookURL                                         | Custom URL for Kubernetes API server to use to reach the mutating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used.                                                                                                                              | `null`                                                                                                                                                                |
 | emitAdmissionEvents                                        | (alpha) Emit K8s events in configurable namespace for admission violations                                                                                                                                                                                                              | `false`                                                                                                                                                               |
 | emitAuditEvents                                            | (alpha) Emit K8s events in configurable namespace for audit violations                                                                                                                                                                                                                  | `false`                                                                                                                                                               |
diff --git a/manifest_staging/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml b/manifest_staging/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml
@@ -62,24 +62,11 @@ webhooks:
     operations:
     - CREATE
     - UPDATE
-    resources:
+    resources: 
     - '*'
-    - pods/ephemeralcontainers
-    - pods/exec
-    - pods/log
-    - pods/eviction
-    - pods/portforward
-    - pods/proxy
-    - pods/attach
-    - pods/binding
-    - pods/resize
-    - deployments/scale
-    - replicasets/scale
-    - statefulsets/scale
-    - replicationcontrollers/scale
-    - services/proxy
-    - nodes/proxy
-    - services/status
+    {{- range .Values.mutatingWebhookSubResources }}
+    - {{ . }}
+    {{- end }}
   {{- end }}
   sideEffects: None
   timeoutSeconds: {{ .Values.mutatingWebhookTimeoutSeconds }}
diff --git a/manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml b/manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml
@@ -71,23 +71,9 @@ webhooks:
     - '*'
     # Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper).
     # You can find a rough list of subresources by doing a case-sensitive search in the Kubernetes codebase for 'Subresource("'
-    - 'pods/ephemeralcontainers'
-    - 'pods/exec'
-    - 'pods/log'
-    - 'pods/eviction'
-    - 'pods/portforward'
-    - 'pods/proxy'
-    - 'pods/attach'
-    - 'pods/binding'
-    - 'pods/resize'
-    - 'deployments/scale'
-    - 'replicasets/scale'
-    - 'statefulsets/scale'
-    - 'replicationcontrollers/scale'
-    - 'services/proxy'
-    - 'nodes/proxy'
-    # For constraints that mitigate CVE-2020-8554
-    - 'services/status'
+    {{- range .Values.validatingWebhookSubResources }}
+    - {{ . }}
+    {{- end }}
   {{- end }}
   sideEffects: None
   timeoutSeconds: {{ .Values.validatingWebhookTimeoutSeconds }}
diff --git a/manifest_staging/charts/gatekeeper/values.yaml b/manifest_staging/charts/gatekeeper/values.yaml
