-
Notifications
You must be signed in to change notification settings - Fork 7
AO-91 Add ClusterAgentInjectors to helm chart #338
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
…entInjectors by default
69a5300
to
37e0c63
Compare
{{- range $injector := .Values.agentInjectors.injectors }} | ||
--- | ||
apiVersion: agents.contrastsecurity.com/v1beta1 | ||
kind: ClusterAgentInjector |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When you do a helm upgrade
this will fail because the CRD is not present.
Maybe we could check if it exists and print some guidance at that point?
That would likely bring back a call to lookup
and that doesn't work in every tool though, maybe it's just some migration docs, presuming this will be a new major version?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I tried to move the CRDs into the templates directory but this doesn't work because helm templates/validates before helm hooks are called so even if the CRDs are labeled with pre-install/pre-upgrade the template step fails with "ensure CRDs are installed first". We have https://docs.contrastsecurity.com/en/helm-upgrades.html for upgrade instructions (kubectl replace should be kubectl apply though). There is a proposal to handle this better in helm 4, another option is possibly having the CRDs as a subchart but that has its own issues.
namespaceLabelSelector
for support ClusterAgentInjectors in helm chartlookupNamespaces
, replaced bynamespaces: '*'
when usinguseClusterAgentInjectors: true
Example template output