Skip to content

Commit 9159806

Browse files
slimm609slimm609
committed
rebase and update gotemplate for readme
Signed-off-by: slimm609 <dbrian@vmware.com>
1 parent 563d5b6 commit 9159806

2 files changed

Lines changed: 57 additions & 22 deletions

File tree

‎charts/policy-controller/README.md‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
![Version: 0.3.1](https://img.shields.io/badge/Version-0.3.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.4.0](https://img.shields.io/badge/AppVersion-0.4.0-informational?style=flat-square)
44

5-
The Helm chart for Policy Controller
5+
The Helm chart for Policy Controller
66

77
**Homepage:** <https://github.com/sigstore/policy-controller>
88

@@ -30,12 +30,8 @@ The Helm chart for Policy Controller
3030
| policywebhook.extraArgs | object | `{}` | |
3131
| policywebhook.image.pullPolicy | string | `"IfNotPresent"` | |
3232
| policywebhook.image.repository | string | `"ghcr.io/sigstore/policy-controller/policy-webhook"` | |
33-
<<<<<<< HEAD
34-
| policywebhook.image.version | string | `"sha256:03f6b9807103c988439741fdc2ec4410a85c13ba62fbad58448a070ac07bb5bc"` | `"v0.4.0"` |
35-
=======
36-
| policywebhook.image.version | string | `"sha256:2d8ec2534e903a722a89efd6fe04a52a8a420ca3f8be1703aa697bf5faf418eb"` | |
33+
| policywebhook.image.version | string | `"sha256:03f6b9807103c988439741fdc2ec4410a85c13ba62fbad58448a070ac07bb5bc"` | |
3734
| policywebhook.namespaceOptIn | bool | `true` | |
38-
>>>>>>> c616289 (Add ability to disable opt-in)
3935
| policywebhook.podSecurityContext.allowPrivilegeEscalation | bool | `false` | |
4036
| policywebhook.podSecurityContext.capabilities.drop[0] | string | `"all"` | |
4137
| policywebhook.podSecurityContext.enabled | bool | `true` | |
@@ -59,7 +55,7 @@ The Helm chart for Policy Controller
5955
| webhook.extraArgs | object | `{}` | |
6056
| webhook.image.pullPolicy | string | `"IfNotPresent"` | |
6157
| webhook.image.repository | string | `"ghcr.io/sigstore/policy-controller/policy-controller"` | |
62-
| webhook.image.version | string | `"sha256:2b1c017535f6a0f672ec38279f3792ca1181555342a2deae53605e202afb9764"` | `"v0.4.0"` |
58+
| webhook.image.version | string | `"sha256:2b1c017535f6a0f672ec38279f3792ca1181555342a2deae53605e202afb9764"` | |
6359
| webhook.name | string | `"webhook"` | |
6460
| webhook.podSecurityContext.allowPrivilegeEscalation | bool | `false` | |
6561
| webhook.podSecurityContext.capabilities.drop[0] | string | `"all"` | |
@@ -164,7 +160,9 @@ Creating a deployment referencing images that are not signed will yield the foll
164160
pod/pod1-signed created
165161
```
166162

167-
168163
## More info
169164

170165
You can find more information about the policy-controller in [here](https://docs.sigstore.dev/policy-controller/overview/).
166+
167+
----------------------------------------------
168+
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

‎charts/policy-controller/README.md.gotmpl‎

Lines changed: 51 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,22 @@
11
{{ template "chart.header" . }}
2-
{{ template "chart.description" . }}
32

43
{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
54

6-
## Requirements
7-
* Kubernetes cluster with rights to install admission webhooks
8-
* Helm
5+
{{ template "chart.description" . }}
6+
7+
**Homepage:** <https://github.com/sigstore/policy-controller>
8+
99

10-
The following table lists the configurable parameters of the policy-controller chart and their default values.
10+
## Maintainers
11+
12+
| Name | Email | Url |
13+
| ---- | ------ | --- |
14+
| dlorenc | | |
15+
| hectorj2f | | |
16+
17+
## Source Code
18+
19+
* <https://github.com/sigstore/policy-controller>
1120

1221

1322
{{ template "chart.requirementsSection" . }}
@@ -16,28 +25,52 @@ The following table lists the configurable parameters of the policy-controller c
1625

1726
### Deploy `policy-controller` Helm Chart
1827

28+
Install `policy-controller` using Helm:
29+
30+
```shell
31+
helm repo add sigstore https://sigstore.github.io/helm-charts
32+
33+
helm repo update
34+
35+
kubectl create namespace cosign-system
36+
37+
helm install policy-controller -n cosign-system sigstore/policy-controller --devel
38+
```
39+
40+
The `policy-controller` enforce images matching the defined list of `ClusterImagePolicy` for the labeled namespaces.
41+
42+
Note that, by default, the `policy-controller` offers a configurable behavior defining whether to allow, deny or warn whenever an image does not match a policy in a specific namespace. This behavior can be configured using the `config-policy-controller` ConfigMap created under the release namespace, and by adding an entry with the property `no-match-policy` and its value `warn|allow|deny`.
43+
By default, any image that does not match a policy is rejected whenever `no-match-policy` is not configured in the ConfigMap.
44+
45+
As supported in previous versions, you could create your own key pair:
46+
1947
```shell
2048
export COSIGN_PASSWORD=<my_cosign_password>
2149
cosign generate-key-pair
2250
```
2351

24-
The previous command generates two key files `cosign.key` and `cosign.pub`. Next, create a secret to validate the signatures:
52+
This command generates two key files `cosign.key` and `cosign.pub`. Next, create a secret to validate the signatures:
2553

2654
```shell
27-
kubectl create namespace cosign-system
28-
2955
kubectl create secret generic mysecret -n \
3056
cosign-system --from-file=cosign.pub=./cosign.pub
3157
```
3258

33-
Install `policy-controller` using Helm and setting the value of the secret key reference to `mysecret` that you created above:
59+
**IMPORTANT:** The `cosign.secretKeyRef` flag is not supported anymore. Finally, you could reuse your secret `mysecret` by creating a `ClusterImagePolicy` that sets it as listed authorities, as shown below.
3460

35-
```shell
36-
helm repo add sigstore https://sigstore.github.io/helm-charts
37-
38-
helm repo update
61+
```yaml
62+
apiVersion: policy.sigstore.dev/v1alpha1
63+
kind: ClusterImagePolicy
64+
metadata:
65+
name: cip-key-secret
66+
spec:
67+
images:
68+
- glob: "**your-desired-value**"
69+
authorities:
70+
- key:
71+
secretRef:
72+
name: mysecret
3973
40-
helm install policy-controller -n cosign-system sigstore/policy-controller --devel --set cosign.secretKeyRef.name=mysecret
4174
```
4275

4376
### Enabling Admission control
@@ -76,4 +109,8 @@ Creating a deployment referencing images that are not signed will yield the foll
76109
pod/pod1-signed created
77110
```
78111

112+
113+
## More info
114+
115+
You can find more information about the policy-controller in [here](https://docs.sigstore.dev/policy-controller/overview/).
79116
{{ template "helm-docs.versionFooter" . }}

0 commit comments

Comments
 (0)