pepr 0.1.20 → 0.1.22

package/dist/pepr-cli.js

@@ -21,7 +21,7 @@ var uuid = require('uuid');
 var commander = require('commander');
 var chokidar = require('chokidar');
 
-var version = "0.1.20";
+var version = "0.1.22";
 
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Pepr Authors
@@ -91,47 +91,71 @@ const banner = `    [38;5;
                                                                                                                                                 
     `;
 
-// SPDX-License-Identifier: Apache-2.0
+const caName = "Pepr Ephemeral CA";
+/**
+ * Generates a self-signed CA and server certificate with Subject Alternative Names (SANs) for the K8s webhook.
+ *
+ * @param {string} name - The name to use for the server certificate's Common Name and SAN DNS entry.
+ * @returns {TLSOut} - An object containing the Base64-encoded CA, server certificate, and server private key.
+ */
 function genTLS(name) {
-    // Generate a new CA key pair
+    // Generate a new CA key pair and create a self-signed CA certificate
     const caKeys = forge.pki.rsa.generateKeyPair(2048);
-    const caCert = forge.pki.createCertificate();
-    caCert.publicKey = caKeys.publicKey;
-    caCert.serialNumber = "01";
-    caCert.validity.notBefore = new Date();
-    caCert.validity.notAfter = new Date();
-    caCert.validity.notAfter.setFullYear(caCert.validity.notBefore.getFullYear() + 1);
-    const caAttrs = [
+    const caCert = genCert(caKeys, caName, [{ name: "commonName", value: caName }]);
+    caCert.setExtensions([
         {
-            name: "commonName",
-            value: "Pepr Ephemeral CA",
+            name: "basicConstraints",
+            cA: true,
         },
-    ];
-    caCert.setSubject(caAttrs);
-    caCert.setIssuer(caAttrs);
-    caCert.sign(caKeys.privateKey, forge.md.sha256.create());
-    // Generate a new key pair
-    const keys = forge.pki.rsa.generateKeyPair(2048);
-    const cert = forge.pki.createCertificate();
-    cert.publicKey = keys.publicKey;
-    cert.serialNumber = "01";
-    cert.validity.notBefore = new Date();
-    cert.validity.notAfter = new Date();
-    cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
-    const attrs = [
         {
-            name: "commonName",
-            value: `${name}.pepr-system.svc`,
+            name: "keyUsage",
+            keyCertSign: true,
+            digitalSignature: true,
+            nonRepudiation: true,
+            keyEncipherment: true,
+            dataEncipherment: true,
         },
-    ];
-    cert.setSubject(attrs);
-    cert.setIssuer(caCert.subject.attributes);
-    cert.sign(caKeys.privateKey, forge.md.sha256.create());
+    ]);
+    // Generate a new server key pair and create a server certificate signed by the CA
+    const serverKeys = forge.pki.rsa.generateKeyPair(2048);
+    const serverCert = genCert(serverKeys, name, caCert.subject.attributes);
+    // Sign both certificates with the CA private key
+    caCert.sign(caKeys.privateKey, forge.md.sha256.create());
+    serverCert.sign(caKeys.privateKey, forge.md.sha256.create());
     // Convert the keys and certificates to PEM format
-    const ca = Buffer.from(forge.pki.certificateToPem(caCert)).toString("base64");
-    const key = Buffer.from(forge.pki.privateKeyToPem(keys.privateKey)).toString("base64");
-    const crt = Buffer.from(forge.pki.certificateToPem(cert)).toString("base64");
-    return { ca, key, crt };
+    const pem = {
+        ca: forge.pki.certificateToPem(caCert),
+        crt: forge.pki.certificateToPem(serverCert),
+        key: forge.pki.privateKeyToPem(serverKeys.privateKey),
+    };
+    // Base64-encode the PEM strings
+    const ca = Buffer.from(pem.ca).toString("base64");
+    const key = Buffer.from(pem.key).toString("base64");
+    const crt = Buffer.from(pem.crt).toString("base64");
+    return { ca, key, crt, pem };
+}
+function genCert(key, name, issuer) {
+    const crt = forge.pki.createCertificate();
+    crt.publicKey = key.publicKey;
+    crt.serialNumber = "01";
+    crt.validity.notBefore = new Date();
+    crt.validity.notAfter = new Date();
+    crt.validity.notAfter.setFullYear(crt.validity.notBefore.getFullYear() + 1);
+    // Add SANs to the server certificate
+    crt.setExtensions([
+        {
+            name: "subjectAltName",
+            altNames: [
+                {
+                    type: 2,
+                    value: name,
+                },
+            ],
+        },
+    ]);
+    // Set the server certificate's issuer to the CA
+    crt.setIssuer(issuer);
+    return crt;
 }
 
 // SPDX-License-Identifier: Apache-2.0
@@ -141,12 +165,16 @@ const peprIgnore = {
     values: ["ignore"],
 };
 class Webhook {
-    constructor(config) {
+    get tls() {
+        return this._tls;
+    }
+    constructor(config, host) {
         this.config = config;
+        this.host = host;
         this.name = `pepr-${config.uuid}`;
         this.image = `ghcr.io/defenseunicorns/pepr/controller:${config.version}`;
         // Generate the ephemeral tls things
-        this.tls = genTLS(this.name);
+        this._tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
     }
     /** Generate the pepr-system namespace */
     namespace() {
@@ -217,8 +245,8 @@ class Webhook {
             },
             type: "kubernetes.io/tls",
             data: {
-                "tls.crt": this.tls.crt,
-                "tls.key": this.tls.key,
+                "tls.crt": this._tls.crt,
+                "tls.key": this._tls.key,
             },
         };
     }
@@ -233,6 +261,21 @@ class Webhook {
                 values: this.config.alwaysIgnore.namespaces,
             });
         }
+        const clientConfig = {
+            caBundle: this._tls.ca,
+        };
+        // If a host is specified, use that with a port of 3000
+        if (this.host) {
+            clientConfig.url = `https://${this.host}:3000/mutate`;
+        }
+        else {
+            // Otherwise, use the service
+            clientConfig.service = {
+                name: this.name,
+                namespace: "pepr-system",
+                path: "/mutate",
+            };
+        }
         return {
             apiVersion: "admissionregistration.k8s.io/v1",
             kind: "MutatingWebhookConfiguration",
@@ -241,14 +284,7 @@ class Webhook {
                 {
                     name: `${name}.pepr.dev`,
                     admissionReviewVersions: ["v1", "v1beta1"],
-                    clientConfig: {
-                        caBundle: this.tls.ca,
-                        service: {
-                            name: this.name,
-                            namespace: "pepr-system",
-                            path: "/mutate",
-                        },
-                    },
+                    clientConfig,
                     failurePolicy: "Ignore",
                     matchPolicy: "Equivalent",
                     timeoutSeconds: 15,
@@ -264,7 +300,7 @@ class Webhook {
                             apiGroups: ["*"],
                             apiVersions: ["*"],
                             operations: ["CREATE", "UPDATE", "DELETE"],
-                            resources: ["*"],
+                            resources: ["*/*"],
                         },
                     ],
                     // @todo: track side effects state
@@ -285,7 +321,7 @@ class Webhook {
                 },
             },
             spec: {
-                replicas: 1,
+                replicas: 2,
                 selector: {
                     matchLabels: {
                         app: this.name,
@@ -333,6 +369,11 @@ class Webhook {
                                         mountPath: "/etc/certs",
                                         readOnly: true,
                                     },
+                                    {
+                                        name: "module",
+                                        mountPath: "/app/module.js.gz",
+                                        readOnly: true,
+                                    },
                                 ],
                             },
                         ],
@@ -343,12 +384,56 @@ class Webhook {
                                     secretName: `${this.name}-tls`,
                                 },
                             },
+                            {
+                                name: "module",
+                                secret: {
+                                    secretName: `${this.name}-module`,
+                                },
+                            },
                         ],
                     },
                 },
             },
         };
     }
+    /** Only permit the  */
+    networkPolicy() {
+        return {
+            apiVersion: "networking.k8s.io/v1",
+            kind: "NetworkPolicy",
+            metadata: {
+                name: this.name,
+                namespace: "pepr-system",
+            },
+            spec: {
+                podSelector: {
+                    matchLabels: {
+                        app: this.name,
+                    },
+                },
+                policyTypes: ["Ingress"],
+                ingress: [
+                    {
+                        from: [
+                            {
+                                namespaceSelector: {
+                                    matchLabels: {
+                                        "kubernetes.io/metadata.name": "kube-system",
+                                    },
+                                },
+                            },
+                        ],
+                        ports: [
+                            {
+                                protocol: "TCP",
+                                port: 443,
+                            },
+                        ],
+                    },
+                ],
+            },
+        };
+    }
     service() {
         return {
             apiVersion: "v1",
@@ -415,6 +500,7 @@ class Webhook {
     allYaml(code) {
         const resources = [
             this.namespace(),
+            this.networkPolicy(),
             this.clusterRole(),
             this.clusterRoleBinding(),
             this.serviceAccount(),
@@ -437,6 +523,7 @@ class Webhook {
         const rbacApi = kubeConfig.makeApiClient(clientNode.RbacAuthorizationV1Api);
         const appsApi = kubeConfig.makeApiClient(clientNode.AppsV1Api);
         const admissionApi = kubeConfig.makeApiClient(clientNode.AdmissionregistrationV1Api);
+        const networkApi = kubeConfig.makeApiClient(clientNode.NetworkingV1Api);
         const ns = this.namespace();
         try {
             types.Log.info("Checking for namespace");
@@ -447,6 +534,16 @@ class Webhook {
             types.Log.info("Creating namespace");
             await coreV1Api.createNamespace(ns);
         }
+        const netpol = this.networkPolicy();
+        try {
+            types.Log.info("Checking for network policy");
+            await networkApi.readNamespacedNetworkPolicy(netpol.metadata.name, namespace);
+        }
+        catch (e) {
+            types.Log.debug(e.body);
+            types.Log.info("Creating network policy");
+            await networkApi.createNamespacedNetworkPolicy(namespace, netpol);
+        }
         const wh = this.mutatingWebhook();
         try {
             types.Log.info("Creating mutating webhook");
@@ -496,6 +593,10 @@ class Webhook {
             await coreV1Api.deleteNamespacedServiceAccount(sa.metadata.name, namespace);
             await coreV1Api.createNamespacedServiceAccount(namespace, sa);
         }
+        // If a host is specified, we don't need to deploy the rest of the resources
+        if (this.host) {
+            return;
+        }
         const mod = this.moduleSecret(code);
         try {
             types.Log.info("Creating module secret");
@@ -689,6 +790,47 @@ function deploy (program) {
     });
 }
 
+// SPDX-License-Identifier: Apache-2.0
+function dev (program) {
+    program
+        .command("dev")
+        .description("Setup a local webhook development environment")
+        .option("-d, --dir [directory]", "Pepr module directory", ".")
+        .option("-h, --host [host]", "Host to listen on", "host.docker.internal")
+        .action(async (opts) => {
+        // Prompt the user to confirm
+        const confirm = await prompt.prompt({
+            type: "confirm",
+            name: "confirm",
+            message: "This will remove and redeploy the module. Continue?",
+        });
+        // Exit if the user doesn't confirm
+        if (!confirm.confirm) {
+            process.exit(0);
+        }
+        // Build the module
+        const { cfg, path } = await buildModule(opts.dir);
+        // Read the compiled module code
+        const code = await fs.promises.readFile(path, { encoding: "utf-8" });
+        // Generate a secret for the module
+        const webhook = new Webhook({
+            ...cfg.pepr,
+            description: cfg.description,
+        }, opts.host);
+        // Write the TLS cert and key to disk
+        await fs.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+        await fs.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+        try {
+            await webhook.deploy(code);
+            types.Log.info(`Module deployed successfully`);
+        }
+        catch (e) {
+            types.Log.error(`Error deploying module: ${e}`);
+            process.exit(1);
+        }
+    });
+}
+
 // SPDX-License-Identifier: Apache-2.0
 /**
  * Sanitize a user input name to be used as a pepr module directory name
@@ -1009,11 +1151,7 @@ function walkthrough() {
             },
         ],
     };
-    return prompt([
-        askName,
-        askDescription,
-        askErrorBehavior,
-    ]);
+    return prompt([askName, askDescription, askErrorBehavior]);
 }
 async function confirm(dirName, packageJSON, peprTSPath) {
     console.log(`
@@ -1147,4 +1285,5 @@ build(program);
 capability(program);
 test(program);
 deploy(program);
+dev(program);
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pepr",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Kubernetes application engine",
   "author": "Defense Unicorns",
   "homepage": "https://github.com/defenseunicorns/pepr",
@@ -29,7 +29,10 @@
     "prettier": "npx prettier src --check",
     "prettier:fix": "npm run prettier -- --write",
     "prepublishOnly": "rm -fr dist/* && npm run lint:fix && npm run prettier:fix && npm run test && npm run build",
-    "e2e-dev": "npm run build && docker buildx build --tag pepr:dev . && k3d image import pepr:dev && node dist/pepr-cli.js deploy -f -i pepr:dev"
+    "e2e-dev-setup": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev",
+    "e2e-dev": "npm run build && docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev && node dist/pepr-cli.js deploy -f -i pepr:dev",
+    "prestart": "ts-node src/cli dev",
+    "start": "chokidar 'src/**/*.ts' -c 'SSL_KEY_PATH=insecure-tls.key SSL_CERT_PATH=insecure-tls.crt ts-node src/controller/index.ts' --initial --silent"
   },
   "dependencies": {
     "@kubernetes/client-node": "^0.18.1",
@@ -59,6 +62,7 @@
     "@typescript-eslint/eslint-plugin": "^5.57.0",
     "@typescript-eslint/parser": "^5.57.0",
     "ava": "^5.2.0",
+    "chokidar-cli": "^3.0.0",
     "eslint": "^8.37.0",
     "ts-node": "^10.9.1",
     "tsconfig-paths": "^4.1.2"

package/src/lib/k8s/tls.ts

@@ -1,57 +1,90 @@
-// SPDX-License-Identifier: Apache-2.0
-// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
-
-// @todo: quick and dirty temp tls chain for testing, to be replaced at runtime
-// Don't freak out, this is a self-signed cert for testing purposes only.
 import forge from "node-forge";
 
+const caName = "Pepr Ephemeral CA";
+
 export interface TLSOut {
   ca: string;
   crt: string;
   key: string;
+  pem: {
+    ca: string;
+    crt: string;
+    key: string;
+  };
 }
 
+/**
+ * Generates a self-signed CA and server certificate with Subject Alternative Names (SANs) for the K8s webhook.
+ *
+ * @param {string} name - The name to use for the server certificate's Common Name and SAN DNS entry.
+ * @returns {TLSOut} - An object containing the Base64-encoded CA, server certificate, and server private key.
+ */
 export function genTLS(name: string): TLSOut {
-  // Generate a new CA key pair
+  // Generate a new CA key pair and create a self-signed CA certificate
   const caKeys = forge.pki.rsa.generateKeyPair(2048);
-  const caCert = forge.pki.createCertificate();
-  caCert.publicKey = caKeys.publicKey;
-  caCert.serialNumber = "01";
-  caCert.validity.notBefore = new Date();
-  caCert.validity.notAfter = new Date();
-  caCert.validity.notAfter.setFullYear(caCert.validity.notBefore.getFullYear() + 1);
-  const caAttrs = [
+  const caCert = genCert(caKeys, caName, [{ name: "commonName", value: caName }]);
+
+  caCert.setExtensions([
     {
-      name: "commonName",
-      value: "Pepr Ephemeral CA",
+      name: "basicConstraints",
+      cA: true,
     },
-  ];
-  caCert.setSubject(caAttrs);
-  caCert.setIssuer(caAttrs);
+    {
+      name: "keyUsage",
+      keyCertSign: true,
+      digitalSignature: true,
+      nonRepudiation: true,
+      keyEncipherment: true,
+      dataEncipherment: true,
+    },
+  ]);
+
+  // Generate a new server key pair and create a server certificate signed by the CA
+  const serverKeys = forge.pki.rsa.generateKeyPair(2048);
+  const serverCert = genCert(serverKeys, name, caCert.subject.attributes);
+
+  // Sign both certificates with the CA private key
   caCert.sign(caKeys.privateKey, forge.md.sha256.create());
+  serverCert.sign(caKeys.privateKey, forge.md.sha256.create());
 
-  // Generate a new key pair
-  const keys = forge.pki.rsa.generateKeyPair(2048);
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = "01";
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 1);
-  const attrs = [
+  // Convert the keys and certificates to PEM format
+  const pem = {
+    ca: forge.pki.certificateToPem(caCert),
+    crt: forge.pki.certificateToPem(serverCert),
+    key: forge.pki.privateKeyToPem(serverKeys.privateKey),
+  };
+
+  // Base64-encode the PEM strings
+  const ca = Buffer.from(pem.ca).toString("base64");
+  const key = Buffer.from(pem.key).toString("base64");
+  const crt = Buffer.from(pem.crt).toString("base64");
+
+  return { ca, key, crt, pem };
+}
+
+function genCert(key: forge.pki.rsa.KeyPair, name: string, issuer: forge.pki.CertificateField[]) {
+  const crt = forge.pki.createCertificate();
+  crt.publicKey = key.publicKey;
+  crt.serialNumber = "01";
+  crt.validity.notBefore = new Date();
+  crt.validity.notAfter = new Date();
+  crt.validity.notAfter.setFullYear(crt.validity.notBefore.getFullYear() + 1);
+
+  // Add SANs to the server certificate
+  crt.setExtensions([
     {
-      name: "commonName",
-      value: `${name}.pepr-system.svc`,
+      name: "subjectAltName",
+      altNames: [
+        {
+          type: 2, // DNS
+          value: name,
+        },
+      ],
     },
-  ];
-  cert.setSubject(attrs);
-  cert.setIssuer(caCert.subject.attributes);
-  cert.sign(caKeys.privateKey, forge.md.sha256.create());
+  ]);
 
-  // Convert the keys and certificates to PEM format
-  const ca = Buffer.from(forge.pki.certificateToPem(caCert)).toString("base64");
-  const key = Buffer.from(forge.pki.privateKeyToPem(keys.privateKey)).toString("base64");
-  const crt = Buffer.from(forge.pki.certificateToPem(cert)).toString("base64");
+  // Set the server certificate's issuer to the CA
+  crt.setIssuer(issuer);
 
-  return { ca, key, crt };
+  return crt;
 }

package/src/lib/k8s/webhook.ts

@@ -3,9 +3,11 @@
 
 import {
   AdmissionregistrationV1Api,
+  AdmissionregistrationV1WebhookClientConfig,
   AppsV1Api,
   CoreV1Api,
   KubeConfig,
+  NetworkingV1Api,
   RbacAuthorizationV1Api,
   V1ClusterRole,
   V1ClusterRoleBinding,
@@ -13,6 +15,7 @@ import {
   V1LabelSelectorRequirement,
   V1MutatingWebhookConfiguration,
   V1Namespace,
+  V1NetworkPolicy,
   V1Secret,
   V1Service,
   V1ServiceAccount,
@@ -31,17 +34,21 @@ const peprIgnore: V1LabelSelectorRequirement = {
 
 export class Webhook {
   private name: string;
-  private tls: TLSOut;
+  private _tls: TLSOut;
 
   public image: string;
 
-  constructor(private readonly config: ModuleConfig) {
+  public get tls(): TLSOut {
+    return this._tls;
+  }
+
+  constructor(private readonly config: ModuleConfig, private readonly host?: string) {
     this.name = `pepr-${config.uuid}`;
 
     this.image = `ghcr.io/defenseunicorns/pepr/controller:${config.version}`;
 
     // Generate the ephemeral tls things
-    this.tls = genTLS(this.name);
+    this._tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
   }
 
   /** Generate the pepr-system namespace */
@@ -117,8 +124,8 @@ export class Webhook {
       },
       type: "kubernetes.io/tls",
       data: {
-        "tls.crt": this.tls.crt,
-        "tls.key": this.tls.key,
+        "tls.crt": this._tls.crt,
+        "tls.key": this._tls.key,
       },
     };
   }
@@ -136,6 +143,22 @@ export class Webhook {
       });
     }
 
+    const clientConfig: AdmissionregistrationV1WebhookClientConfig = {
+      caBundle: this._tls.ca,
+    };
+
+    // If a host is specified, use that with a port of 3000
+    if (this.host) {
+      clientConfig.url = `https://${this.host}:3000/mutate`;
+    } else {
+      // Otherwise, use the service
+      clientConfig.service = {
+        name: this.name,
+        namespace: "pepr-system",
+        path: "/mutate",
+      };
+    }
+
     return {
       apiVersion: "admissionregistration.k8s.io/v1",
       kind: "MutatingWebhookConfiguration",
@@ -144,14 +167,7 @@ export class Webhook {
         {
           name: `${name}.pepr.dev`,
           admissionReviewVersions: ["v1", "v1beta1"],
-          clientConfig: {
-            caBundle: this.tls.ca,
-            service: {
-              name: this.name,
-              namespace: "pepr-system",
-              path: "/mutate",
-            },
-          },
+          clientConfig,
           failurePolicy: "Ignore",
           matchPolicy: "Equivalent",
           timeoutSeconds: 15,
@@ -167,7 +183,7 @@ export class Webhook {
               apiGroups: ["*"],
               apiVersions: ["*"],
               operations: ["CREATE", "UPDATE", "DELETE"],
-              resources: ["*"],
+              resources: ["*/*"],
             },
           ],
           // @todo: track side effects state
@@ -189,7 +205,7 @@ export class Webhook {
         },
       },
       spec: {
-        replicas: 1,
+        replicas: 2,
         selector: {
           matchLabels: {
             app: this.name,
@@ -237,6 +253,11 @@ export class Webhook {
                     mountPath: "/etc/certs",
                     readOnly: true,
                   },
+                  {
+                    name: "module",
+                    mountPath: "/app/module.js.gz",
+                    readOnly: true,
+                  },
                 ],
               },
             ],
@@ -247,6 +268,12 @@ export class Webhook {
                   secretName: `${this.name}-tls`,
                 },
               },
+              {
+                name: "module",
+                secret: {
+                  secretName: `${this.name}-module`,
+                },
+              },
             ],
           },
         },
@@ -254,6 +281,45 @@ export class Webhook {
     };
   }
 
+  /** Only permit the  */
+  networkPolicy(): V1NetworkPolicy {
+    return {
+      apiVersion: "networking.k8s.io/v1",
+      kind: "NetworkPolicy",
+      metadata: {
+        name: this.name,
+        namespace: "pepr-system",
+      },
+      spec: {
+        podSelector: {
+          matchLabels: {
+            app: this.name,
+          },
+        },
+        policyTypes: ["Ingress"],
+        ingress: [
+          {
+            from: [
+              {
+                namespaceSelector: {
+                  matchLabels: {
+                    "kubernetes.io/metadata.name": "kube-system",
+                  },
+                },
+              },
+            ],
+            ports: [
+              {
+                protocol: "TCP",
+                port: 443,
+              },
+            ],
+          },
+        ],
+      },
+    };
+  }
+
   service(): V1Service {
     return {
       apiVersion: "v1",
@@ -324,6 +390,7 @@ export class Webhook {
   allYaml(code: string) {
     const resources = [
       this.namespace(),
+      this.networkPolicy(),
       this.clusterRole(),
       this.clusterRoleBinding(),
       this.serviceAccount(),
@@ -351,6 +418,7 @@ export class Webhook {
     const rbacApi = kubeConfig.makeApiClient(RbacAuthorizationV1Api);
     const appsApi = kubeConfig.makeApiClient(AppsV1Api);
     const admissionApi = kubeConfig.makeApiClient(AdmissionregistrationV1Api);
+    const networkApi = kubeConfig.makeApiClient(NetworkingV1Api);
 
     const ns = this.namespace();
     try {
@@ -362,6 +430,16 @@ export class Webhook {
       await coreV1Api.createNamespace(ns);
     }
 
+    const netpol = this.networkPolicy();
+    try {
+      logger.info("Checking for network policy");
+      await networkApi.readNamespacedNetworkPolicy(netpol.metadata.name, namespace);
+    } catch (e) {
+      logger.debug(e.body);
+      logger.info("Creating network policy");
+      await networkApi.createNamespacedNetworkPolicy(namespace, netpol);
+    }
+
     const wh = this.mutatingWebhook();
     try {
       logger.info("Creating mutating webhook");
@@ -410,6 +488,11 @@ export class Webhook {
       await coreV1Api.createNamespacedServiceAccount(namespace, sa);
     }
 
+    // If a host is specified, we don't need to deploy the rest of the resources
+    if (this.host) {
+      return;
+    }
+
     const mod = this.moduleSecret(code);
     try {
       logger.info("Creating module secret");