description:A kubernetes admission controller for validating and mutating webhooks that operates against Anchore Engine to make access decisions and annotations
This chart deploys an admission controller for kubernetes that makes admission decisions based on policy-based evaluation of image content.
The controller's code is at: https://github.com/anchore/kubernetes-admission-controller , with more details on the implementation and config there.
This chart is a simple wrapper to wire up credentials, configuration, and setup rbac, tls, and api service config for the controller.
## Running the chart
1. The chart does not deploy an anchore engine service, if you don't already have anchore running, you can use the anchore chart
to deploy one with:
```
helm install --name anchore stable/anchore-engine
```
Setup of policies and users is covered in the anchore documentation, for this readme we'll use admin user credentials, but it
is *strongly* suggested that you use a non-admin user for the controller credential.
1. Create a secret for the anchore credentials that the controller will use to make api calls to Anchore. This must be done out-of-band of the chart creation and should be in the
same namespace you will deploy the chart to. The file must be a json file with the format:
```
{
"users": [
{ "username": "user1", "password": "password"},
{ "uesrname": "user2", "password": "password2"},
...
]
}
```
The file *must* be named `credentials.json` in the secret so that it mounts properly in the pod.
Not all users in the anchore engine need to be specified, only those that will be referenced in the controller configuration.
