Could we create a ConstraintTemplate for blocking ValidatingWebhookConfiguration with scope '*'

[atulsmakkar]

• Need to create a ConstraintTemplate for blocking ValidatingWebhookConfiguration with scope '*' and allowing only webhooks with "Namescaped" scope.

• Need to have test case as well that blocks.

• In my current scenario OPA Gatekeeper fails to block creation of ValidatingWebhookConfiguration with any scope, it simply creates ValidatingWebhookConfiguration.

• Using this rego for Constraint template:

    package blockvalidatingwebhook
    violation[{"msg": msg}] {
      input.request.object.kind == "ValidatingWebhookConfiguration"
      input.request.object.spec.scope == "*"
      input.request.operation == "CREATE"
      msg := "Users are not allowed to create ValidatingWebhookConfiguration with scope: '*'."
   }
  

• Constraints:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: BlockValidatingWebhook
metadata:
  name: block-validating-webhook
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["ValidatingWebhookConfiguration"]

[anderseknert]

The API group would be admissionregistration.k8s.io, no?

[atulsmakkar]

I have tried that, but it does not work.

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: BlockValidatingWebhook
metadata:
  name: block-validating-webhook
spec:
  enforcementAction: deny
  match:
    kinds:
    - apiGroups:
      - admissionregistration.k8s.io
      kinds:
      - ValidatingWebhookConfiguration