Updates to installation docs for policy changes

Author: kcarmichael08

modules/roxctl-sensor-generate.adoc

@@ -22,23 +22,29 @@ $ roxctl sensor generate [flags]
 |`--admission-controller-disable-bypass`
 |Disable the bypass annotations for the admission controller. The default value is `false`.
 
+|`--admission-controller-enforcement`
+|Valid values are `true` and `false`. The default value is `true`. When set to `true`, the admission controller enforces a policy and rejects the deployment or update attempt. When set to `false`, the admission controller does not enforce a policy and allows a deployment or update to the cluster that violates the policy conditions.
+
 |`--admission-controller-enforce-on-creates`
-|Dynamic enable for enforcing on object creation in the admission controller. The default value is `false`.
+|This field is deprecated.
 
 |`--admission-controller-enforce-on-updates`
-|Enable dynamic enforcement of object updates in the admission controller. The default value is `false`.
+|This field is deprecated.
+
+|`--admission-controller-fail-on-error`
+| Valid values are `true` and `false`. The default value is `false`. Determines the action that should occur when an error or timeout happens in the admission controller. When set to `true`, the admission controller does not allow a request to reach the API server, or fails closed. When set to `false`, the admission controller allows the request to reach the server, or fails open.
 
 |`--admission-controller-listen-on-creates`
-|Configure the admission controller webhook to listen to deployment creation. The default value is `false`.
+|This field is deprecated.
 
 |`--admission-controller-listen-on-updates`
-|Configure the admission controller webhook to listen to deployment updates. The default value is `false`.
+|This field is deprecated.
 
 |`--admission-controller-scan-inline`
-|Get scans inline when using the admission controller. The default value is `false`.
+|This field is deprecated.
 
 |`--admission-controller-timeout int32`
-|Set the timeout in seconds for the admission controller. The default value is `3`.
+|This field is deprecated.
 
 |`--central string`
 |Set the endpoint to which you want to connect Sensor. The default value is `central.stackrox:443`.

modules/secured-cluster-configuration-options-operator.adoc

@@ -33,19 +33,17 @@ To change the name, you must delete and re-create the object.
 |===
 | Parameter | Description
 
+|`admissionControl.enforce`
+| This parameter determines if admission controller enforcement is enabled on a cluster. For a new installation, the default value is `true.` For an update to an existing installation, the system checks the previous values for the admission controller parameters. If one of the `admissionControl.dynamic.enforceOnCreates` or `admissionControl.dynamic.enforceOnUpdates` parameters was set to `true` before the update, the value of this parameter is set to `true` with the update. If one of these parameters was set to `false`, the value is `false`. 
+
 | `admissionControl.listenOnCreates`
-| Specify `true` to enable preventive policy enforcement for object creations.
-The default value is `true`.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.listenOnEvents`
-| Specify `true` to enable monitoring and enforcement for Kubernetes events, such as `port-forward` and `exec` events.
-It is used to control access to resources through the Kubernetes API.
-The default value is `true`.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.listenOnUpdates`
-| Specify `true` to enable preventive policy enforcement for object updates.
-It will not have any effect unless `Listen On Creates` is set to `true` as well.
-The default value is `true`.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.nodeSelector`
 | If you want this component to only run on specific nodes, you can configure a node selector using this parameter.
@@ -69,17 +67,16 @@ a| Use one of the following values to configure the bypassing of admission contr
     * `Disabled` to disable the ability to bypass admission controller enforcement for the secured cluster.
 
 The default value is `BreakGlassAnnotation`.
+//Changes needed? 
 
 | `admissionControl.contactImageScanners`
-a| Use one of the following values to specify if the admission controller must connect to the image scanner:
-
-    * `ScanIfMissing` if the scan results for the image are missing.
-    * `DoNotScanInline` to skip scanning the image when processing the admission request.
+| This field is deprecated.
 
-The default value is `DoNotScanInline`.
+|`admissionControl.failurePolicy`
+| Determines the action that should occur when an error or timeout happens in the admission controller. You can configure if the admission controller should allow a request to reach the API server, or fail open; or to stop the request, or fail closed. The default value is `Ignore`, or fail open, and allows the request to reach the server. Setting the value to `closed` does not allow the request to reach the server.
 
 | `admissionControl.timeoutSeconds`
-| Use this parameter to specify the maximum number of seconds {product-title-short} must wait for an admission review before marking it as fail open. If the admission webhook does not receive information that it is requesting before the end of the timeout period, it fails, but in fail open status, it still allows the operation to succeed. For example, the admission controller would allow a deployment to be created even if a scan had timed out and {product-title-short} could not determine if the deployment violated a policy. Beginning in release 4.5, Red{nbsp}Hat reduced the default timeout setting for the {product-title-short} admission controller webhooks from 20 seconds to 10 seconds, resulting in an effective timeout of 12 seconds within the `ValidatingWebhookConfiguration`. This change does not negatively affect {ocp} users because {ocp} caps the timeout at 13 seconds.
+| The maximum number of seconds {product-title-short} must wait for an admission review before marking it as failed. This option is not configurable and is set to 10 seconds. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 |===
 
 [id="scanner-configuration-settings_{context}"]

modules/secured-cluster-services-config.adoc

@@ -24,6 +24,7 @@ ifeval::["{context}" == "install-secured-cluster-other"]
 :kube:
 endif::[]
 
+//Helm parameters
 
 |===
 | Parameter | Description
@@ -146,42 +147,36 @@ If you specify it as `true`, no tolerations are applied, and the collector pods
 | `collector.serviceTLS.key`
 | The internal service-to-service TLS certificate key that Collector uses.
 
+|`admissionControl.enforce`
+| This parameter determines if admission controller enforcement is enabled when checking policies. For a new installation, the default value is `true.` For an update to an existing installation, the system checks the previous values for the admission controller parameters. If one of the `admissionControl.dynamic.enforceOnCreates` or `admissionControl.dynamic.enforceOnUpdates` parameters was set to `true` before the update, the value of this parameter is set to `true` with the update. If one of these parameters was set to `false`, the value is `false`.
+
+|`admissionControl.failurePolicy`
+| Determines the action that should occur when an error or timeout happens in the admission controller. You can configure if the admission controller should allow the request to reach the API server, or fail open; or to stop the request, or fail closed. The default value is `Ignore`, or fail open, and allows the request to reach the server. Setting the value to `closed` does not allow the request to reach the server. 
+
 | `admissionControl.listenOnCreates`
-| This setting controls whether Kubernetes is configured to contact {product-title} with `AdmissionReview` requests for workload creation events.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.listenOnUpdates`
-| When you set this parameter as `false`, {product-title} creates the `ValidatingWebhookConfiguration` in a way that causes the Kubernetes API server not to send object update events.
-Since the volume of object updates is usually higher than the object creates, leaving this as `false` limits the load on the admission control service and decreases the chances of a malfunctioning admission control service.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.listenOnEvents`
-| This setting controls whether the cluster is configured to contact {product-title} with `AdmissionReview` requests for Kubernetes `exec` and `portforward` events.
-{product-title-short} does not support this feature on {ocp} 3.11.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.dynamic.enforceOnCreates`
-| This setting controls whether {product-title} evaluates policies;
-if it is disabled, all AdmissionReview requests are automatically accepted.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.dynamic.enforceOnUpdates`
-| This setting controls the behavior of the admission control service.
-You must specify `listenOnUpdates` as `true` for this to work.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.dynamic.scanInline`
-| If you set this option to `true`, the admission control service requests an image scan before making an admission decision.
-Since image scans take several seconds, enable this option only if you can ensure that all images used in your cluster are scanned before deployment (for example, by a CI integration during image build).
-This option corresponds to the *Contact image scanners* option in the {product-title-short} portal.
+| This parameter is deprecated. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.dynamic.disableBypass`
-| Set it to `true` to disable bypassing the Admission controller.
+| Set it to `true` to disable bypassing the Admission controller. The default value is `false`.
 //TODO: Link to admission controller docs
 
 | `admissionControl.dynamic.timeout`
-| Use this parameter to specify the maximum number of seconds {product-title-short} must wait for an admission review before marking it as fail open. If the admission webhook does not receive information that it is requesting before the end of the timeout period, it fails, but in fail open status, it still allows the operation to succeed. For example, the admission controller would allow a deployment to be created even if a scan had timed out and {product-title-short} could not determine if the deployment violated a policy. Beginning in release 4.5, Red{nbsp}Hat reduced the default timeout setting for the {product-title-short} admission controller webhooks from 20 seconds to 10 seconds, resulting in an effective timeout of 12 seconds within the `ValidatingWebhookConfiguration`.
-ifndef::kube[]
-This change does not negatively affect {ocp} users because {ocp} caps the timeout at 13 seconds.
-endif::kube[]
-ifndef::openshift[]
-For Kubernetes clusters, image scanning and pulling that are done as part of the webhook execution might require you to configure a longer timeout value.
-endif::openshift[]
+| The maximum number of seconds {product-title-short} must wait for an admission review before marking it as failed. This option is not configurable and is set to 10 seconds. Do not edit this parameter. If you edit this parameter, policy evaluation will not work as expected.
 
 | `admissionControl.resources.requests.memory`
 | The memory request for the Admission Control container. Use this parameter to override the default value.