Support utilizing imageData with private registries

In order to support utilizing the imageData variable in kyverno policies such as https://kyverno.io/policies/other/block_images_with_volumes/block-images-with-volumes/ we need to:

• Add --imagePullSecrets to .Values.extraArgs

extraArgs:
  - --clientRateLimitQPS=25
  - --clientRateLimitBurst=50
  - --autogenInternals=false
  - --imagePullSecrets=private-registry

• Ensure NetworkPolicy includes an exception to allow network traffic to query the registry.

added kyverno label

@rob.ferguson thanks i added that to my kyverno build is this in this sprint if so i can knock it out...

We will likely want to discuss tomorrow, adding the imagePullSecret seems straightforward but I am assuming there will be some conversation around how something like this would have to work with our existing network policies.

@rob.ferguson and @micah.nagel ....I'm assuming kyverno policy would hit kube-dns and egress out from there...Which we already have network policies for such behavior.

The pod should indeed be able to resolve DNS for the container registry but the subsequent request would be blocked.

I believe you would need a policy that would target TCP traffic and a CIDR range (0.0.0.0/0).

@ronwebb you may not see the issue if you aren't setting the controlPlaneCidr value - https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blob/master/chart/values.yaml#L103-106

If you don't set that, the API egress policy would allow 0.0.0.0/0 (all egress) which would hide the issue.

changed milestone to %1.45.0

changed iteration to Big Bang Iterations Oct 4, 2022 - Oct 17, 2022

added teamcore/security label

set weight to 2

assigned to @ronwebb

added statusdoing label

mentioned in merge request !33 (merged)

marked this issue as related to kyverno-policies#22 (closed)

removed iteration Big Bang Iterations Oct 4, 2022 - Oct 17, 2022

changed iteration to Big Bang Iterations Oct 18, 2022 - Oct 31, 2022

changed milestone to %1.46.0

added kindfeature priority5 labels

added statusreview label and removed statusdoing label

removed iteration Big Bang Iterations Oct 18, 2022 - Oct 31, 2022

changed iteration to Big Bang Iterations Nov 1, 2022 - Nov 14, 2022

changed milestone to %1.47.0

removed iteration Big Bang Iterations Nov 1, 2022 - Nov 14, 2022

changed iteration to Big Bang Iterations Nov 15, 2022 - Nov 28, 2022

closed with merge request big-bang/bigbang!2253 (merged)

removed iteration Big Bang Iterations Nov 15, 2022 - Nov 28, 2022