new(shield): add configuration to disable audit validatingwebhook

Signed-off-by: Gianmatteo Palmieri <[email protected]>

Author: mrgian

charts/shield/README.md

@@ -105,6 +105,7 @@ The following table lists the configurable parameters of the `shield` chart and
 | features.detections.malware_control.enabled                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                  | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | features.detections.ml_policies.enabled                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                                                  | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | features.detections.kubernetes_audit.enabled                                                                                           | Enable the Kubernetes Audit feature on cluster shield                                                                                                                                                                                                                                                                                                                                                            | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| features.detections.kubernetes_audit.method                                                                                            | Method to use: validating_webhook (emulated) or audit_backend (real audit logs)                                                                                                                                                                                                                                                                                                                                  | <code>validating_webhook</code>                                                                                                                                                                                                                                                                                                                                                                                                              |
 | features.detections.kubernetes_audit.timeout                                                                                           | The timeout for the audit feature                                                                                                                                                                                                                                                                                                                                                                                | <code>10</code>                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | features.detections.kubernetes_audit.http_port                                                                                         | The port that will be used to expose the audit endpoints                                                                                                                                                                                                                                                                                                                                                         | <code>6443</code>                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | features.detections.kubernetes_audit.excluded_namespaces                                                                               | The list of namespaces that will be excluded from the audit feature                                                                                                                                                                                                                                                                                                                                              | <code>[]</code>                                                                                                                                                                                                                                                                                                                                                                                                                              |

charts/shield/templates/cluster/tls-certificates-admissionregistration.yaml

@@ -35,7 +35,7 @@ data:
   {{ include "cluster.tls_certificates.ca_cert_file_name" . }}: {{ $cert.CACert }}
 {{- end }}
 {{- end -}}
-{{- if and .Values.cluster.validatingwebhookconfiguration.create (include "cluster.audit_enabled" .) }}
+{{- if and .Values.cluster.validatingwebhookconfiguration.create (eq .Values.features.detections.kubernetes_audit.method "validating_webhook") (include "cluster.audit_enabled" .) }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration

charts/shield/tests/cluster/configmap_test.yaml

@@ -55,6 +55,7 @@ tests:
                 enabled: false
                 excluded_namespaces: \[\]
                 http_port: 6443
+                method: validating_webhook
                 timeout: 10
                 webhook_rules:
                 - apiGroups:
@@ -152,6 +153,7 @@ tests:
                 enabled: false
                 excluded_namespaces: \[\]
                 http_port: 6443
+                method: validating_webhook
                 timeout: 10
                 webhook_rules:
                 - apiGroups:
@@ -231,6 +233,7 @@ tests:
                 enabled: false
                 excluded_namespaces: \[\]
                 http_port: 6443
+                method: validating_webhook
                 timeout: 10
                 webhook_rules:
                 - apiGroups:
@@ -341,6 +344,7 @@ tests:
                 enabled: false
                 excluded_namespaces: \[\]
                 http_port: 6443
+                method: validating_webhook
                 timeout: 10
                 webhook_rules:
                 - apiGroups:
@@ -481,6 +485,7 @@ tests:
                 enabled: false
                 excluded_namespaces: \[\]
                 http_port: 6443
+                method: validating_webhook
                 timeout: 10
                 webhook_rules:
                 - apiGroups:
@@ -841,6 +846,7 @@ tests:
                 enabled: false
                 excluded_namespaces: \[\]
                 http_port: 6443
+                method: validating_webhook
                 timeout: 10
                 webhook_rules:
                 - apiGroups:
@@ -926,6 +932,7 @@ tests:
                 enabled: false
                 excluded_namespaces: \[\]
                 http_port: 6443
+                method: validating_webhook
                 timeout: 10
                 webhook_rules:
                 - apiGroups:

charts/shield/tests/cluster/tls-certificates-admissionregistration_test.yaml

@@ -258,6 +258,23 @@ tests:
           value: 1234
         documentIndex: 1
 
+  - it: Audit AdmissionRegistration not created (audit_backend method)
+    set:
+      features:
+        detections:
+          kubernetes_audit:
+            enabled: true
+            method: audit_backend
+    asserts:
+      - hasDocuments:
+          count: 1
+      - containsDocument:
+          kind: Secret
+          apiVersion: v1
+          name: shield-release-cluster-tls-certificates
+          namespace: shield-namespace
+        documentIndex: 0
+
   - it: Admission Control AdmissionRegistration (Generate TLS)
     set:
       features:

charts/shield/values.yaml

@@ -120,6 +120,8 @@ features:
     kubernetes_audit:
       # Enable the Kubernetes Audit feature on cluster shield
       enabled: false
+      # Method to use: validating_webhook (emulated) or audit_backend (real audit logs)
+      method: validating_webhook
       # The timeout for the audit feature
       timeout: 10
       # The port that will be used to expose the audit endpoints