diff --git a/helm/portieris/templates/webhooks.yaml b/helm/portieris/templates/webhooks.yaml index ace0bbbf..915a1d9f 100644 --- a/helm/portieris/templates/webhooks.yaml +++ b/helm/portieris/templates/webhooks.yaml @@ -67,15 +67,21 @@ webhooks: failurePolicy: {{ .Values.webHooks.failurePolicy }} sideEffects: None admissionReviewVersions: ["v1"] - {{ if .Values.AllowAdmissionSkip }} + {{- if or (.Values.AllowAdmissionSkip) (.Values.NamespaceSelectorAdmissionSkip) }} namespaceSelector: matchExpressions: + {{- if .Values.AllowAdmissionSkip}} - key: securityenforcement.admission.cloud.ibm.com/namespace operator: NotIn values: - skip - {{ end }} + {{- end }} + + {{- with .Values.NamespaceSelectorAdmissionSkip }} +{{ toYaml . | indent 6 }} + {{- end }} + {{- end }} {{ if .Values.ObjectSelectorAdmissionSkip }} objectSelector: {{ toYaml .Values.ObjectSelectorAdmissionSkip | indent 6 }} - {{ end }} \ No newline at end of file + {{ end }} diff --git a/helm/portieris/values.yaml b/helm/portieris/values.yaml index 3e6ee620..e4791662 100644 --- a/helm/portieris/values.yaml +++ b/helm/portieris/values.yaml @@ -109,6 +109,12 @@ ObjectSelectorAdmissionSkip: # values: # - xxxx +NamespaceSelectorAdmissionSkip: + #- key: kubernetes.io/metadata.name + # operator: NotIn + # values: + # - kube-system + clusterPolicy: allowedRepositories: # This permissive policy allows all images in namespaces which do not have an ImagePolicy.