Managing SUSE Security Admission Controller with Rancher Fleet

You can manage SUSE Security Admission Controller Helm chart, like other Helm charts, with SUSE Rancher Prime: Continuous Delivery (Rancher Fleet). Rancher Fleet uses Kubernetes CRDs to define a GitOps approach to managing Kubernetes clusters. It does this by defining Fleet Bundles.

Installing

The Admission Controller chart is a standard chart. See the Quickstart docs for more information.

The Admission Controller Helm chart and its container images are distributed through the SUSE Application Collection. To install Admission Controller with Fleet, Fleet needs credentials to pull the chart, and the target clusters need credentials to pull the container images. See the Application Collection authentication documentation for how to obtain them.

  1. On each target cluster, create the suse-sec-adm-controller namespace and an image pull secret, so the cluster can pull the Admission Controller container images:

    kubectl create namespace suse-sec-adm-controller

kubectl create secret docker-registry application-collection \
  --namespace suse-sec-adm-controller \
  --docker-server=dp.apps.rancher.io \
  --docker-username=<your-username> \
  --docker-password=<your-token>

  2. On the Fleet management cluster, create a Secret with the Application Collection credentials in the namespace of the GitRepo. Fleet uses it to pull the Helm chart. This example uses the fleet-local namespace, which targets the local cluster; use fleet-default to target downstream clusters:

    kubectl create secret generic application-collection-helm \
  --namespace fleet-local \
  --from-literal=username=<your-username> \
  --from-literal=password=<your-token>

  3. In your Git repository, add a fleet.yaml file that deploys the suse-security-admission-controller chart from the Application Collection, in a directory such as admission-controller:

    defaultNamespace: suse-sec-adm-controller
helm:
  releaseName: suse-sec-adm-controller
  repo: oci://dp.apps.rancher.io/charts/suse-security-admission-controller
  version: 1.1.0
  values:
    global:
      imagePullSecrets:
        - application-collection

    Add your own chart values under helm.values.

  4. Create a GitRepo that watches that directory. The helmSecretName field references the Secret with the Application Collection credentials. Fleet forwards those credentials only to the Helm repositories that match helmRepoURLRegex:

    kubectl apply -f - <<EOF
apiVersion: fleet.cattle.io/v1alpha1
kind: GitRepo
metadata:
  name: suse-sec-adm-controller
  namespace: fleet-local
spec:
  repo: <your-git-repository-url>
  branch: main
  paths:
    - admission-controller
  helmSecretName: application-collection-helm
  helmRepoURLRegex: "^oci://dp.apps.rancher.io/"
EOF

  5. Check that Fleet deployed the bundle:

    kubectl get gitrepo -n fleet-local suse-sec-adm-controller
kubectl get pods -n suse-sec-adm-controller

Fleet deploys the chart with Helm against the target cluster, so the certificates that the chart creates on installation are reused on later deployments. Unlike with ArgoCD, no configuration is needed to ignore differences in the certificate Secrets or the webhook configurations.

See the Continuous Delivery documentation for more information about GitRepo resources and credentials.

Removing

Removing the Admission Controller chart will leave around the user-managed custom resources and CRDs. See the Quickstart docs for more information.

Admission Controller Kubewarden uses a pre-delete helm hook job in suse-security-admission-controller chart that deletes the controller, webhooks, resources that enable PolicyServers to process policies, default PolicyServer and recommended policies.

Uninstalling CRDs automatically isn’t normally supported by any tooling, and Rancher Fleet is no exception.

To manually remove the CRDs and any remaining user-managed custom resources after removing the Fleet Bundle:

  • Remove the Admission Controller Bundle from your Fleet Git repository, or delete it directly with kubectl delete bundle, and let Fleet reconcile the removal of the Helm release from the target clusters.

  • Confirm the Helm release is uninstalled and the pre-delete hook completed, by checking that the suse-sec-adm-controller-ssac Deployment and webhooks are gone from the targeted clusters.

  • Manually delete the remaining CRDs, which will also remove the user-managed custom resources on each targeted cluster:

    kubectl delete crd policyservers.policies.kubewarden.io
kubectl delete crd clusteradmissionpolicies.policies.kubewarden.io
kubectl delete crd admissionpolicies.policies.kubewarden.io
kubectl delete crd clusteradmissionpolicygroups.policies.kubewarden.io
kubectl delete crd admissionpolicygroups.policies.kubewarden.io

    If no other tool in the cluster uses the OpenReports CRDs, also delete the ones installed by the chart:

    kubectl delete crd reports.openreports.io
kubectl delete crd clusterreports.openreports.io

    Because Fleet’s GitRepo/Bundle resources target multiple clusters, you need to repeat this manual CRD cleanup on every downstream cluster where the Bundle deployed Admission Controller.

Example

The Installing section contains a complete example of a fleet.yaml file and a GitRepo for the suse-security-admission-controller chart.

For more examples of Fleet bundle definitions, based on the community chart, see github.com/kubewarden/fleet-example.