feat(admission) enable the webhook by default and release 2.16 (#727)

* feat(admission) enable the webhook by default * chore(*) release 2.16
Kong · Feb 2, 2023 · 1c5242f · 1c5242f
1 parent 69f9534
commit 1c5242f
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 6 deletions.
diff --git a/charts/kong/CHANGELOG.md b/charts/kong/CHANGELOG.md
@@ -2,10 +2,19 @@
 
 ## Unreleased
 
+Nothing yet.
+
+## 2.16.0
+
 ### Improvements
 
-* Enable users to specify their own labels and annotations to generated PodSecurityPolicy
+* Let users specify their own labels and annotations for generated PodSecurityPolicy.
   [#721](https://github.com/Kong/charts/pull/721)
+* Enable the admission webhook by default. This can reject configuration, but
+  is not expected to be a meaningfully breaking change. Existing configuration
+  is not affected, and any new changes that the webhook would reject would also
+  be rejected by Kong.
+  [#727](https://github.com/Kong/charts/pull/727)
 * Replaced static secret with projected volume in deployment.
   [#722](https://github.com/Kong/charts/pull/722)
 * Reject invalid log config values.

diff --git a/charts/kong/Chart.yaml b/charts/kong/Chart.yaml
@@ -11,7 +11,7 @@ maintainers:
 name: kong
 sources:
 - https://github.com/Kong/charts/tree/main/charts/kong
-version: 2.15.3
+version: 2.16.0
 appVersion: "3.1"
 dependencies:
 - name: postgresql

diff --git a/charts/kong/README.md b/charts/kong/README.md
@@ -716,10 +716,10 @@ section of `values.yaml` file:
 | ingressClassAnnotations                 | The ingress-class value for controller                                                                                                                   | kong                               |
 | args                                    | List of ingress-controller cli arguments                                                                                                                 | []                                 |
 | watchNamespaces                         | List of namespaces to watch. Watches all namespaces if empty                                                                                             | []                                 |
-| admissionWebhook.enabled                | Whether to enable the validating admission webhook                                                                                                       | false                              |
-| admissionWebhook.failurePolicy          | How unrecognized errors from the admission endpoint are handled (Ignore or Fail)                                                                         | Fail                               |
+| admissionWebhook.enabled                | Whether to enable the validating admission webhook                                                                                                       | true                              |
+| admissionWebhook.failurePolicy          | How unrecognized errors from the admission endpoint are handled (Ignore or Fail)                                                                         | Ignore                               |
 | admissionWebhook.port                   | The port the ingress controller will listen on for admission webhooks                                                                                    | 8080                               |
-| admissionWebhook.certificate.provided   | Whether to generate the admission webhook certificate if not provided                                                                                    | false                              |
+| admissionWebhook.certificate.provided   | Use a provided certificate. When set to false, the chart will automatically generate a certificate.                                                      | false                              |
 | admissionWebhook.certificate.secretName | Name of the TLS secret for the provided webhook certificate                                                                                              |                                    |
 | admissionWebhook.certificate.caBundle   | PEM encoded CA bundle which will be used to validate the provided webhook certificate                                                                    |                                    |
 | deployment.userDefinedVolumes           | Create volumes. Please go to Kubernetes doc for the spec of the volumes                                                                                  |                                    |

diff --git a/charts/kong/values.yaml b/charts/kong/values.yaml
@@ -508,7 +508,7 @@ ingressController:
   #   TZ: "Europe/Berlin"
 
   admissionWebhook:
-    enabled: false
+    enabled: true
     failurePolicy: Ignore
     port: 8080
     certificate: