Add default request from namespace annotation about k8s-sidecar-injector

[atorrescogollo]

Hi @domruf , In think Kyverno should work for this. The approach mentioned is similar to this clusterpolicy.

[domruf]

@atorrescogollo thank you very much. I think this will be very helpful.

[domruf]

@atorrescogollo I have the same use case. Have you found a way to make it work? Or maybe a different project that is able to do this?

[atorrescogollo]

I think something like this would work:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: inject-certs
  annotations:
    policies.kyverno.io/title: Autoinject custom CA to pods
    policies.kyverno.io/category: Certificates
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      Automount custom CA certificates when an annotation `inject-certs=enabled` is found
spec:
  background: false
  rules:
  - name: add-volume
    match:
      resources:
        kinds:
        - Pod
    preconditions:
      all:
        - key: "{{request.object.metadata.annotations.\"inject-certs\"}}"
          operator: Equals
          value: "enabled"
        - key: "{{request.operation}}"
          operator: In
          value:
          - CREATE
          - UPDATE
    mutate:
      foreach:
        - list: "request.object.spec.containers"
          patchStrategicMerge:
            spec:
              containers:
              - name: "{{ element.name }}"
                volumeMounts:
                  - name: "etc-ssl-certs"
                    mountPath: "/etc/ssl/certs"
              volumes:
              - name: etc-ssl-certs
                configMap:
                  name: ca-pemstore