Brigade: Admission Controller when creating projects manually

[rmb938]

When creating brigade projects manually (i.e creating the secret manually) via terraform, ect... it would be nice to have some sort of validation against the secret to make sure it's setup correctly. This probably could be done via an admission controller. https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/

[radu-matei]

And I think we can re-use the logic from brig project create for it.

[dgkanatsios]

Writing an admission webhook can be quite tricky, we could also examine something like OpenPolicyAgent https://github.com/open-policy-agent/gatekeeper? Maybe it can be customized to suit our purposes.

[rmb938]

@dgkanatsios How so? An admission controller is just an http server that accepts an input object and outputs true or false, with the client-go library it is very straight forward and can be about 200 lines of code. The only difficult part is generating certificates because they only can be https.

As an example: https://github.com/caesarxuchao/example-webhook-admission-controller/blob/master/main.go. This is a year old so it's a bit out of date but it's very simple.

[dgkanatsios]

@dgkanatsios The only difficult part is generating certificates because they only can be https.

Exactly this. I've written one here and the most difficult task was to get the https working. I didn't even attempt to let the user generate them :) It's been some time since then, so things might be easier now (regarding the CA and the https part).

[rmb938]

Sure I see how that could be a difficult task for the user if they are not familiar with how to do it and how things are deployed.

This is somewhat of an advanced feature so I guess just having documentation about using gatekeeper and having a sample policy may be good enough? :man_shrugging:

[dgkanatsios]

probably... I haven't taken a deep look at the gatekeeper TBH, not sure if it does support our scenario. But it would be definitely be a good idea to validate those non-brig-created Projects.