Initial commit

charts/external-data-provider/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/external-data-provider/Chart.yaml

@@ -0,0 +1,8 @@
+apiVersion: v2
+description: A Helm chart for a template external data provider
+name: external-data-provider
+version: 0.0.2
+home: https://github.com/open-policy-agent/gatekeeper-external-data-provider
+sources:
+  - https://github.com/open-policy-agent/gatekeeper-external-data-provider.git
+appVersion: 0.0.2

charts/external-data-provider/templates/external-data-provider-deployment.yaml

@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: external-data-provider
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: external-data-provider
+  template:
+    metadata:
+      labels:
+        run: external-data-provider
+    spec:
+      containers:
+      - image: openpolicyagent/gatekeeper-external-data-provider:dev
+        imagePullPolicy: IfNotPresent
+        name: external-data-provider
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsGroup: 65532
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
+        args:
+        - --cert-dir={{ .Values.certDir }}
+        {{- if .Values.clientCAFile }}
+        - --client-ca-file={{ .Values.clientCAFile }}
+        {{- end }}
+        - --port={{ .Values.port }}
+        ports:
+        - containerPort: {{ .Values.port }}
+          protocol: TCP
+        {{- if .Values.clientCAFile }}
+        volumeMounts:
+        - name: gatekeeper-ca-cert
+          mountPath: /tmp/gatekeeper
+          readOnly: true
+        {{- end }}
+      restartPolicy: Always
+      nodeSelector:
+        kubernetes.io/os: linux
+      {{- if .Values.clientCAFile }}
+      volumes:
+      - name: gatekeeper-ca-cert
+        secret:
+          secretName: gatekeeper-webhook-server-cert
+          items:
+          - key: ca.crt
+            path: ca.crt
+      {{- end }}

charts/external-data-provider/templates/external-data-provider-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: external-data-provider
+  namespace: {{ .Release.Namespace }}
+spec:
+  ports:
+  - port: {{ .Values.port }}
+    protocol: TCP
+    targetPort: {{ .Values.port }}
+  selector:
+    run: external-data-provider
+  sessionAffinity: None

charts/external-data-provider/templates/external-data-provider.yaml

@@ -0,0 +1,8 @@
+apiVersion: externaldata.gatekeeper.sh/v1beta1
+kind: Provider
+metadata:
+  name: external-data-provider
+spec:
+  url: https://external-data-provider.{{ .Release.Namespace }}:{{ .Values.port }}
+  timeout: {{ .Values.provider.timeout }}
+  caBundle: {{ required "You must provide .Values.provider.tls.caBundle" .Values.provider.tls.caBundle }}

charts/external-data-provider/values.yaml

@@ -0,0 +1,7 @@
+certDir: /certs
+clientCAFile: /tmp/gatekeeper/ca.crt
+port: 8090
+provider:
+  timeout: 1
+  tls:
+    caBundle: ""