merge poc

charts/external-data-provider/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-description: A Helm chart for a template external data provider
-name: external-data-provider
-version: 0.0.2
-home: https://github.com/open-policy-agent/gatekeeper-external-data-provider
+description: A Helm chart for attest external data provider
+name: attest-provider
+version: 0.0.1
+home: https://github.com/docker/attest-external-data-provider
 sources:
-  - https://github.com/open-policy-agent/gatekeeper-external-data-provider.git
-appVersion: 0.0.2
+  - https://github.com/docker/attest-external-data-provider.git
+appVersion: 0.0.1

charts/external-data-provider/templates/external-data-provider-deployment.yaml

@@ -1,33 +1,24 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: external-data-provider
+  name: attest-provider
   namespace: {{ .Release.Namespace }}
 spec:
   replicas: 1
   selector:
     matchLabels:
-      run: external-data-provider
+      run: attest-provider
   template:
     metadata:
       labels:
-        run: external-data-provider
+        run: attest-provider
     spec:
       containers:
-      - image: openpolicyagent/gatekeeper-external-data-provider:dev
+      - image: docker/attest-external-data-provider:dev
         imagePullPolicy: IfNotPresent
-        name: external-data-provider
+        name: attest-provider
         securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-          runAsGroup: 65532
-          runAsNonRoot: true
-          runAsUser: 65532
-          seccompProfile:
-            type: RuntimeDefault
+          {{- toYaml .Values.securityContext | nindent 12 }}
         args:
         - --cert-dir={{ .Values.certDir }}
         {{- if .Values.clientCAFile }}
@@ -37,8 +28,10 @@ spec:
         ports:
         - containerPort: {{ .Values.port }}
           protocol: TCP
-        {{- if .Values.clientCAFile }}
         volumeMounts:
+        - name: tuf-temp
+          mountPath: /tuf_temp
+        {{- if .Values.clientCAFile }}
         - name: gatekeeper-ca-cert
           mountPath: /tmp/gatekeeper
           readOnly: true
@@ -46,8 +39,10 @@ spec:
       restartPolicy: Always
       nodeSelector:
         kubernetes.io/os: linux
-      {{- if .Values.clientCAFile }}
       volumes:
+      - name: tuf-temp
+        emptyDir: {}
+      {{- if .Values.clientCAFile }}
       - name: gatekeeper-ca-cert
         secret:
           secretName: gatekeeper-webhook-server-cert

charts/external-data-provider/templates/external-data-provider-service.yaml

@@ -1,13 +1,13 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: external-data-provider
+  name: attest-provider
   namespace: {{ .Release.Namespace }}
 spec:
   ports:
-  - port: {{ .Values.port }}
-    protocol: TCP
-    targetPort: {{ .Values.port }}
+    - port: {{ .Values.port }}
+      protocol: TCP
+      targetPort: {{ .Values.port }}
   selector:
-    run: external-data-provider
+    run: attest-provider
   sessionAffinity: None

charts/external-data-provider/templates/external-data-provider.yaml

@@ -1,8 +1,8 @@
 apiVersion: externaldata.gatekeeper.sh/v1beta1
 kind: Provider
 metadata:
-  name: external-data-provider
+  name: attest-provider
 spec:
-  url: https://external-data-provider.{{ .Release.Namespace }}:{{ .Values.port }}
+  url: https://attest-provider.{{ .Release.Namespace }}:{{ .Values.port }}
   timeout: {{ .Values.provider.timeout }}
   caBundle: {{ required "You must provide .Values.provider.tls.caBundle" .Values.provider.tls.caBundle }}

charts/external-data-provider/values.yaml

@@ -2,6 +2,17 @@ certDir: /certs
 clientCAFile: /tmp/gatekeeper/ca.crt
 port: 8090
 provider:
-  timeout: 1
+  timeout: 30
   tls:
     caBundle: ""
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: false # need to fix go-tuf temp dir
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  seccompProfile:
+    type: RuntimeDefault