Celes Renata
390cb0b4bf
SSL filtering is off on the proxy. The proxy env vars were causing Docker login failures (proxy intercepting Harbor auth) and pip hash mismatches (proxy caching stale packages). Keep only the CA cert mount for any remaining TLS needs.
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: woodpecker-proxy-ca
|
|
annotations:
|
|
policies.kyverno.io/title: "Woodpecker Proxy CA Injection"
|
|
policies.kyverno.io/category: "Networking"
|
|
policies.kyverno.io/subject: "Pod"
|
|
spec:
|
|
rules:
|
|
- name: inject-ca-cert
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Pod
|
|
namespaces:
|
|
- woodpecker
|
|
exclude:
|
|
any:
|
|
- resources:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: server
|
|
- resources:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: agent
|
|
mutate:
|
|
patchStrategicMerge:
|
|
spec:
|
|
containers:
|
|
- (name): "*"
|
|
env:
|
|
- name: SSL_CERT_FILE
|
|
value: "/etc/ssl/certs/proxy-ca.crt"
|
|
volumeMounts:
|
|
- name: proxy-ca
|
|
mountPath: /etc/ssl/certs/proxy-ca.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
volumes:
|
|
- name: proxy-ca
|
|
configMap:
|
|
name: proxy-ca-cert
|