stackrox · clickboo · Aug 1, 2025 · Jul 23, 2025
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -19,6 +19,11 @@ Changes should still be described appropriately in JIRA/doc input pages, for inc
 - ROX-30100: Incorrect defaults for admission controller related configuration options in "roxctl sensor generate" have been fixed. The admission controller will be deployed and configured
 for policy evaluation and enforcement as well as image scanning, out of the box - without requiring a user to specify command line
 options to "roxctl sensor generate".
+- ROX-30034,ROX-29995,ROX-29996: Support for two new admission controller configuration related options in roxctl sensor generate
+  - `--admission-controller-enforcement` defaults to true. If set to false, admission controller webhook will be 
+  configured to not enforce policies on any admission review request.
+  - `--admission-controller-fail-on-error` defaults to false, which means admission controller webhook will fail open.
+  If set to true, the admission controller webhook will fail closed i.e. the review request will be blocked in case of timeouts or errors.

 ### Removed Features


diff --git a/central/cluster/datastore/datastore_impl.go b/central/cluster/datastore/datastore_impl.go
@@ -1052,6 +1052,10 @@ func configureFromHelmConfig(cluster *storage.Cluster, helmConfig *storage.Compl
 	cluster.AdmissionControllerEvents = staticConfig.GetAdmissionControllerEvents()
 	cluster.TolerationsConfig = staticConfig.GetTolerationsConfig().CloneVT()
 	cluster.SlimCollector = staticConfig.GetSlimCollector()
+	cluster.AdmissionControllerFailOnError = false
+	if features.AdmissionControllerConfig.Enabled() {
+		cluster.AdmissionControllerFailOnError = staticConfig.GetAdmissionControllerFailureOnError()
+	}
 }

 func (ds *datastoreImpl) collectClusters(ctx context.Context) ([]*storage.Cluster, error) {

diff --git a/central/clusters/deployer.go b/central/clusters/deployer.go
@@ -169,6 +169,7 @@ func getBaseMetaValues(c *storage.Cluster, versions version.Versions, scannerSli
 		ScanInline:                       c.GetDynamicConfig().GetAdmissionControllerConfig().GetScanInline(),
 		AdmissionControllerEnabled:       c.GetDynamicConfig().GetAdmissionControllerConfig().GetEnabled(),
 		AdmissionControlEnforceOnUpdates: c.GetDynamicConfig().GetAdmissionControllerConfig().GetEnforceOnUpdates(),
+		AdmissionControllerFailOnError:   c.AdmissionControllerFailOnError,
 		ReleaseBuild:                     buildinfo.ReleaseBuild,

 		EnablePodSecurityPolicies: false,

diff --git a/central/graphql/resolvers/generated.go b/central/graphql/resolvers/generated.go
diff --git a/generated/api/v1/cluster_service.swagger.json b/generated/api/v1/cluster_service.swagger.json
diff --git a/generated/storage/cluster.pb.go b/generated/storage/cluster.pb.go