This is unreleased documentation for Admission Controller 1.37-dev.

Managing Kubewarden Admission Controller with Rancher Fleet

You can manage Kubewarden Admission Controller Helm chart, like other Helm charts, with Rancher Fleet. Rancher Fleet uses Kubernetes CRDs to define a GitOps approach to managing Kubernetes clusters. It does this by defining Fleet Bundles.

Installing

The Admission Controller chart is a standard chart. See the Quickstart docs for more information.

Removing

Removing the Admission Controller chart will leave around the user-managed custom resources and CRDs. See the Quickstart docs for more information.

Admission Controller Kubewarden uses a pre-delete helm hook job in admission-controller chart that deletes the controller, webhooks, resources that enable PolicyServers to process policies, default PolicyServer and recommended policies.

Uninstalling CRDs automatically isn’t normally supported by any tooling, and Rancher Fleet is no exception.

To manually remove the CRDs and any remaining user-managed custom resources after removing the Fleet Bundle:

  • Remove the Admission Controller Bundle from your Fleet Git repository, or delete it directly with kubectl delete bundle, and let Fleet reconcile the removal of the Helm release from the target clusters.

  • Confirm the Helm release is uninstalled and the pre-delete hook completed, by checking that the kubewarden-controller Deployment and webhooks are gone from the targeted clusters.

  • Manually delete the remaining CRDs, which will also remove the user-managed custom resources on each targeted cluster:

    kubectl delete crd policyservers.policies.kubewarden.io
kubectl delete crd clusteradmissionpolicies.policies.kubewarden.io
kubectl delete crd admissionpolicies.policies.kubewarden.io
kubectl delete crd clusteradmissionpolicygroups.policies.kubewarden.io
kubectl delete crd admissionpolicygroups.policies.kubewarden.io

    Because Fleet’s GitRepo/Bundle resources target multiple clusters, you need to repeat this manual CRD cleanup on every downstream cluster where the Bundle deployed Admission Controller.

Example

For an example of Fleet bundle definitions see github.com/kubewarden/fleet-example.