diff --git a/cluster-resources/policies/auth-sidecar-injector.yaml b/cluster-resources/policies/auth-sidecar-injector.yaml index daa7e2f..7c5faa7 100644 --- a/cluster-resources/policies/auth-sidecar-injector.yaml +++ b/cluster-resources/policies/auth-sidecar-injector.yaml @@ -10,13 +10,7 @@ metadata: policies.kyverno.io/severity: medium policies.kyverno.io/subject: Pod policies.kyverno.io/description: >- - Injects an auth sidecar container into Pods annotated with - policies.forteapps.io/auth: "true". The sidecar proxies requests through - a token-based auth layer. If the auth-tokens Secret does not exist in the - namespace, an empty one is created to prevent volume mount failures. - Upstream URL and image can be overridden via - policies.forteapps.io/auth-upstream-url and - policies.forteapps.io/auth-image annotations. + Injects an auth sidecar container into Pods annotated with policies.forteapps.io/auth: "true". The sidecar proxies requests through a token-based auth layer. If the auth-tokens Secret does not exist in the namespace, an empty one is created to prevent volume mount failures. Upstream URL and image can be overridden via policies.forteapps.io/auth-upstream-url and policies.forteapps.io/auth-image annotations. spec: background: false rules: @@ -112,6 +106,7 @@ spec: context: - name: secretCount apiCall: + method: GET urlPath: /api/v1/namespaces/{{request.namespace}}/secrets jmesPath: "items[?metadata.name == 'auth-tokens'] | length(@)" preconditions: