enable https access

integrity-shield-operator/config/samples/apis_v1_integrityshield.yaml

@@ -299,7 +299,7 @@ spec:
         "raw_body": postdata,
         "timeout": "2500ms",
         "raise_error": false,
-        "tls_insecure_skip_verify": true
+        "tls_ca_cert": REPLACE_WITH_CA_CERT
       })
     }
 

integrity-shield-operator/config/samples/apis_v1_integrityshield_local.yaml

@@ -297,7 +297,7 @@ spec:
         "raw_body": postdata,
         "timeout": "2500ms",
         "raise_error": false,
-        "tls_insecure_skip_verify": true
+        "tls_ca_cert": REPLACE_WITH_CA_CERT
       })
     }
 

integrity-shield-operator/controllers/integrityshield.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"fmt"
 	"reflect"
+	"strings"
 	"time"
 
 	apiv1 "github.com/open-cluster-management/integrity-shield/integrity-shield-operator/api/v1"
@@ -1103,6 +1104,21 @@ func (r *IntegrityShieldReconciler) createOrUpdateConstraintTemplate(instance *a
 
 	if err != nil && errors.IsNotFound(err) {
 		reqLogger.Info("Creating a new resource")
+		// load ca cert
+		secret := &corev1.Secret{}
+		err = r.Get(ctx, types.NamespacedName{Name: instance.Spec.APITlsSecretName, Namespace: instance.Namespace}, secret)
+		if err != nil {
+			reqLogger.Error(err, "Fail to load CA Cert from Secret")
+		}
+		cabundle, ok := secret.Data["ca.crt"]
+		rego := expected.Spec.Targets[0].Rego
+		if ok {
+			ca_str := fmt.Sprintf("%#v\n", string(cabundle))
+			rego = strings.Replace(rego, "REPLACE_WITH_CA_CERT", ca_str, 1)
+
+		}
+		expected.Spec.Targets[0].Rego = rego
+
 		err = r.Create(ctx, expected)
 		if err != nil && errors.IsAlreadyExists(err) {
 			// Already exists from previous reconcile, requeue.

webhook/gatekeeper-constraint/example/constraint-configmap.yaml

@@ -13,10 +13,7 @@ spec:
   parameters:
     constraintName: configmap-constraint
     action:
-      admissionControl:
-        enforce: false
-      audit:
-        inform: true
+      mode: detect
     objectSelector:
     - name: sample-cm
     signers:

webhook/gatekeeper-constraint/example/constraint-deplyoment.yaml

@@ -13,10 +13,7 @@ spec:
   parameters:
     constraintName: deployment-constraint
     action:
-      admissionControl:
-        enforce: false
-      audit:
-        inform: true
+      mode: detect
     objectSelector:
     - name: sample-deploy
     signers:

webhook/gatekeeper-constraint/template-manifestintegrityconstraint.yaml → webhook/gatekeeper-constraint/example/template-manifestintegrityconstraint.yaml

@@ -1,3 +1,5 @@
+# This is an example of constraint template.
+# This constraint template is installed by Integrity Shield Operator.
 apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
@@ -40,7 +42,8 @@ spec:
             "raw_body": postdata,
             "timeout": "2500ms",
             "raise_error": false,
-            "tls_insecure_skip_verify": true
+             "tls_ca_cert": "-----BEGIN CERTIFICATE-----\nMIIDITCCAgmgA.......\n-----END CERTIFICATE-----"
+
           })
         }