From 419de461a92d5b09c6976ac5451388c5ca543e73 Mon Sep 17 00:00:00 2001 From: qizhicheng Date: Tue, 29 Oct 2024 12:36:50 +0800 Subject: [PATCH 1/3] sync official chart --- charts/gatekeeper/Chart.yaml | 14 +- charts/gatekeeper/README.md | 337 +++++------ .../crds/assign-customresourcedefinition.yaml | 525 ++++++++++++++---- .../assignimage-customresourcedefinition.yaml | 173 ++++-- ...signmetadata-customresourcedefinition.yaml | 456 ++++++++++++--- .../crds/config-customresourcedefinition.yaml | 23 +- ...intpodstatus-customresourcedefinition.yaml | 23 +- ...ainttemplate-customresourcedefinition.yaml | 66 ++- ...atepodstatus-customresourcedefinition.yaml | 21 +- ...siontemplate-customresourcedefinition.yaml | 196 ++++++- ...atepodstatus-customresourcedefinition.yaml | 75 +++ .../modifyset-customresourcedefinition.yaml | 513 +++++++++++++---- ...torpodstatus-customresourcedefinition.yaml | 25 +- .../provider-customresourcedefinition.yaml | 37 +- .../syncset-customresourcedefinition.yaml | 62 +++ charts/gatekeeper/templates/_helpers.tpl | 56 +- .../gatekeeper-admin-podsecuritypolicy.yaml | 7 +- .../gatekeeper-admin-serviceaccount.yaml | 3 + .../gatekeeper-audit-deployment.yaml | 30 +- ...ekeeper-controller-manager-deployment.yaml | 28 +- ...per-controller-manager-network-policy.yaml | 14 +- ...ontroller-manager-poddisruptionbudget.yaml | 5 +- ...atekeeper-critical-pods-resourcequota.yaml | 1 + .../gatekeeper-manager-role-clusterrole.yaml | 27 +- .../gatekeeper-manager-role-role.yaml | 2 +- ...anager-rolebinding-clusterrolebinding.yaml | 1 + ...eeper-manager-rolebinding-rolebinding.yaml | 1 + ...guration-mutatingwebhookconfiguration.yaml | 27 +- ...ration-validatingwebhookconfiguration.yaml | 15 +- ...gatekeeper-webhook-server-cert-secret.yaml | 1 + .../gatekeeper-webhook-service-service.yaml | 1 + .../templates/namespace-post-install.yaml | 30 +- .../templates/namespace-post-upgrade.yaml | 30 +- .../templates/probe-webhook-post-install.yaml | 20 +- .../templates/upgrade-crds-hook.yaml | 32 +- .../templates/webhook-configs-pre-delete.yaml | 34 +- charts/gatekeeper/values.yaml | 85 ++- 37 files changed, 2346 insertions(+), 650 deletions(-) create mode 100644 charts/gatekeeper/crds/expansiontemplatepodstatus-customresourcedefinition.yaml create mode 100644 charts/gatekeeper/crds/syncset-customresourcedefinition.yaml diff --git a/charts/gatekeeper/Chart.yaml b/charts/gatekeeper/Chart.yaml index 65a4326..97ce48c 100644 --- a/charts/gatekeeper/Chart.yaml +++ b/charts/gatekeeper/Chart.yaml @@ -1,13 +1,11 @@ apiVersion: v2 -appVersion: v3.12.0 description: A Helm chart for Gatekeeper -home: https://github.com/open-policy-agent/gatekeeper +name: gatekeeper icon: https://open-policy-agent.github.io/gatekeeper/website/img/logo.svg keywords: -- open policy agent -name: gatekeeper + - open policy agent +version: 3.17.1 +home: https://github.com/open-policy-agent/gatekeeper sources: -- https://github.com/open-policy-agent/gatekeeper.git -version: 3.12.0 -maintainers: -- name: LeoQuote + - https://github.com/open-policy-agent/gatekeeper.git +appVersion: v3.17.1 diff --git a/charts/gatekeeper/README.md b/charts/gatekeeper/README.md index 3d082ef..eb2470d 100644 --- a/charts/gatekeeper/README.md +++ b/charts/gatekeeper/README.md @@ -1,8 +1,8 @@ # Gatekeeper Helm Chart - This chart was forked form offical helm chart, adding podmonitor which is essential for monitoring See official chart at: https://github.com/open-policy-agent/gatekeeper/tree/master/charts/gatekeeper + ## Get Repo Info ```console @@ -16,10 +16,10 @@ _See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation ```console # Helm install with gatekeeper-system namespace already created -$ helm install -n gatekeeper-system [RELEASE_NAME] douban/gatekeeper +$ helm install -n gatekeeper-system [RELEASE_NAME] gatekeeper/gatekeeper # Helm install and create namespace -$ helm install -n gatekeeper-system [RELEASE_NAME] douban/gatekeeper --create-namespace +$ helm install -n gatekeeper-system [RELEASE_NAME] gatekeeper/gatekeeper --create-namespace ``` @@ -30,186 +30,211 @@ _See [helm install](https://helm.sh/docs/helm/helm_install/) for command documen ## Upgrade Chart **Upgrading from < v3.4.0** -Chart 3.4.0 deprecates support for Helm 2 and also removes the creation of the `gatekeeper-system` Namespace from within the chart. This follows Helm 3 Best Practices. +Chart 3.4.0 deprecates support for Helm 2 and also removes the creation of the `gatekeeper-system` Namespace from within +the chart. This follows Helm 3 Best Practices. Option 1: A simple way to upgrade is to uninstall first and re-install with 3.4.0 or greater. ```console $ helm uninstall gatekeeper -$ helm install -n gatekeeper-system [RELEASE_NAME] douban/gatekeeper --create-namespace +$ helm install -n gatekeeper-system [RELEASE_NAME] gatekeeper/gatekeeper --create-namespace ``` Option 2: -Run the `helm_migrate.sh` script before installing the 3.4.0 or greater chart. This will remove the Helm secret for the original release, while keeping all of the resources. It then updates the annotations of the resources so that the new chart can import and manage them. +Run the `helm_migrate.sh` script before installing the 3.4.0 or greater chart. This will remove the Helm secret for the +original release, while keeping all of the resources. It then updates the annotations of the resources so that the new +chart can import and manage them. ```console $ helm_migrate.sh -$ helm install -n gatekeeper-system gatekeeper douban/gatekeeper +$ helm install -n gatekeeper-system gatekeeper gatekeeper/gatekeeper ``` **Upgrading from >= v3.4.0** + ```console -$ helm upgrade -n gatekeeper-system [RELEASE_NAME] douban/gatekeeper +$ helm upgrade -n gatekeeper-system [RELEASE_NAME] gatekeeper/gatekeeper ``` _See [helm 2 to 3](https://helm.sh/docs/topics/v2_v3_migration/) for Helm 2 migration documentation._ - ## Exempting Namespace -The Helm chart automatically sets the Gatekeeper flag `--exempt-namespace={{ .Release.Namespace }}` in order to exempt the namespace where the chart is installed, and adds the `admission.gatekeeper.sh/ignore` label to the namespace during a post-install hook. +The Helm chart automatically sets the Gatekeeper flag `--exempt-namespace={{ .Release.Namespace }}` in order to exempt +the namespace where the chart is installed, and adds the `admission.gatekeeper.sh/ignore` label to the namespace during +a post-install hook. -_See [Exempting Namespaces](https://open-policy-agent.github.io/gatekeeper/website/docs/exempt-namespaces) for more information._ +_See [Exempting Namespaces](https://open-policy-agent.github.io/gatekeeper/website/docs/exempt-namespaces) for more +information._ ## Parameters -| Parameter | Description | Default | -| :-------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------ | -| postInstall.labelNamespace.enabled | Add labels to the namespace during post install hooks | `true` | -| postInstall.labelNamespace.extraNamespaces | The extra namespaces that need to have the label during post install hooks | `[]` | -| postInstall.labelNamespace.extraAnnotations | Extra annotations added to the post install Job | `{}` | -| postInstall.labelNamespace.image.repository | Image with kubectl to label the namespace | `openpolicyagent/gatekeeper-crds` | -| postInstall.labelNamespace.image.tag | Image tag | Current release version: `v3.12.0` | -| postInstall.labelNamespace.image.pullPolicy | Image pullPolicy | `IfNotPresent` | -| postInstall.labelNamespace.image.pullSecrets | Image pullSecrets | `[]` | -| postInstall.labelNamespace.extraRules | Extra rules for the gatekeeper-update-namespace-label Role | `[]` | -| postInstall.probeWebhook.enabled | Probe webhook API post install. When enabled along with `postInstall.labelNamespace.enabled`, this probe will run as part of `postInstall.labelNamespace` Job as an initContainer | `true` | -| postInstall.probeWebhook.image.repository | Image with curl to probe the webhook API | `curlimages/curl` | -| postInstall.probeWebhook.image.tag | Image tag | `7.83.1` | -| postInstall.probeWebhook.image.pullPolicy | Image pullPolicy | `IfNotPresent` | -| postInstall.probeWebhook.image.pullSecrets | Image pullSecrets | `[]` | -| postInstall.probeWebhook.waitTimeout | Total time to wait for the webhook API to become available | `60` | -| postInstall.probeWebhook.httpTimeout | HTTP client timeout | `2` | -| postInstall.probeWebhook.insecureHTTPS | Ignore server SSL certificate | `false` | -| postInstall.affinity | The affinity to use for pod scheduling in postInstall hook jobs | `{}` | -| postInstall.tolerations | The tolerations to use for pod scheduling in postInstall hook jobs | `[]` | -| postInstall.nodeSelector | The node selector to use for pod scheduling in postInstall hook jobs | `kubernetes.io/os: linux` | -| postInstall.resources | The resource request/limits for the container image in postInstall hook jobs | `{}` | -| postInstall.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | -| postUpgrade.labelNamespace.enabled | Add labels to the namespace during post upgrade hooks | `false` | -| postUpgrade.labelNamespace.extraNamespaces | The extra namespaces that need to have the label during post upgrade hooks | `[]` | -| postUpgrade.labelNamespace.extraAnnotations | Extra annotations added to the post upgrade Job | `{}` | -| postUpgrade.labelNamespace.image.repository | Image with kubectl to label the namespace | `openpolicyagent/gatekeeper-crds` | -| postUpgrade.labelNamespace.image.tag | Image tag | Current release version: `v3.12.0` | -| postUpgrade.labelNamespace.image.pullPolicy | Image pullPolicy | `IfNotPresent` | -| postUpgrade.labelNamespace.image.pullSecrets | Image pullSecrets | `[]` -| postUpgrade.affinity | The affinity to use for pod scheduling in postUpgrade hook jobs | `{}` | -| postUpgrade.tolerations | The tolerations to use for pod scheduling in postUpgrade hook jobs | `[]` | -| postUpgrade.nodeSelector | The node selector to use for pod scheduling in postUpgrade hook jobs | `kubernetes.io/os: linux` | -| postUpgrade.resources | The resource request/limits for the container image in postUpgrade hook jobs | `{}` | -| postUpgrade.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | -| preInstall.crdRepository.image.repository | Image with kubectl to update the CRDs. If not set, the `image.crdRepository` is used instead. | `null` | -| preInstall.crdRepository.image.tag | Image tag | Current release version: `v3.12.0` | -| preUninstall.deleteWebhooks.enabled | Delete webhooks before gatekeeper itself is uninstalled | `false` | -| preUninstall.deleteWebhooks.image.repository | Image with kubectl to delete the webhooks | `openpolicyagent/gatekeeper-crds` | -| preUninstall.deleteWebhooks.image.tag | Image tag | Current release version: `v3.12.0` | -| preUninstall.deleteWebhooks.image.pullPolicy | Image pullPolicy | `IfNotPresent` | -| preUninstall.deleteWebhooks.image.pullSecrets | Image pullSecrets | `[]` | -| preUninstall.deleteWebhooks.extraRules | Extra rules for the gatekeeper-delete-webhook-configs Role | `[]` | -| preUninstall.affinity | The affinity to use for pod scheduling in preUninstall hook jobs | `{}` | -| preUninstall.tolerations | The tolerations to use for pod scheduling in preUninstall hook jobs | `[]` | -| preUninstall.nodeSelector | The node selector to use for pod scheduling in preUninstall hook jobs | `kubernetes.io/os: linux` | -| preUninstall.resources | The resource request/limits for the container image in preUninstall hook jobs | `{}` | -| preUninstall.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | -| psp.enabled | Enabled PodSecurityPolicy | `true` | -| upgradeCRDs.enabled | Upgrade CRDs using pre-install/pre-upgrade hooks | `true` | -| upgradeCRDs.extraRules | Extra rules for the gatekeeper-admin-upgrade-crds ClusterRole | `[]` | -| crds.affinity | The affinity to use for pod scheduling in crds hook jobs | `{}` | -| crds.tolerations | The tolerations to use for pod scheduling in crds hook jobs | `[]` | -| crds.nodeSelector | The node selector to use for pod scheduling in crds hook jobs | `kubernetes.io/os: linux` | -| crds.resources | The resource request/limits for the container image in crds hook jobs | `{}` | -| crds.securityContext | Security context applied to the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 65532, "runAsNonRoot": true, "runAsUser": 65532 }` | -| auditInterval | The frequency with which audit is run | `60` | -| constraintViolationsLimit | The maximum # of audit violations reported on a constraint | `20` | -| auditFromCache | Take the roster of resources to audit from the audit cache | `false` | -| auditChunkSize | Chunk size for listing cluster resources for audit (alpha feature) | `500` | -| auditMatchKindOnly | Only check resources of the kinds specified in all constraints defined in the cluster. | `false` | -| disableValidatingWebhook | Disable the validating webhook | `false` | -| disableMutation | Disable mutation | `false` | -| validatingWebhookName | The name of the `ValidatingWebhookConfiguration` | `gatekeeper-validating-webhook-configuration` | -| validatingWebhookTimeoutSeconds | The timeout for the validating webhook in seconds | `3` | -| validatingWebhookFailurePolicy | The failurePolicy for the validating webhook | `Ignore` | -| validatingWebhookAnnotations | The annotations to add to the ValidatingWebhookConfiguration | `{}` | -| validatingWebhookObjectSelector | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's validation webhook unless measures are taken to control how exemption labels can be set. | `{}` | -| validatingWebhookCheckIgnoreFailurePolicy | The failurePolicy for the check-ignore-label validating webhook | `Fail` | -| validatingWebhookExemptNamespacesLabels | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace. | `{}` | -| validatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | -| enableDeleteOperations | Enable validating webhook for delete operations. Does not work with `validatingWebhookCustomRules` | `false` | -| enableExternalData | Enable external data | `true` | -| enableGeneratorResourceExpansion | Enable generator resource expansion (alpha feature) | `false` | -| enableTLSHealthcheck | Enable probing webhook API with certificate stored in certDir | `false` | -| maxServingThreads | Limit the number of concurrent calls the validation backend made by the validation webhook. -1 limits this value to GOMAXPROCS. Configuring this value may lower max RAM usage and limit CPU throttling, Tuning it can optimize serving capacity. | `-1` | -| metricsBackends | Metrics exporters to use. Valid exporters are: `prometheus`, `stackdriver`, and `opencensus` | `["prometheus"]` | -| mutatingWebhookName | The name of the `MutatingWebhookConfiguration` | `gatekeeper-mutating-webhook-configuration` | -| mutatingWebhookFailurePolicy | The failurePolicy for the mutating webhook | `Ignore` | -| mutatingWebhookReinvocationPolicy | The reinvocationPolicy for the mutating webhook | `Never` | -| mutatingWebhookAnnotations | The annotations to add to the MutatingWebhookConfiguration | `{}` | -| mutatingWebhookExemptNamespacesLabels | Additional namespace labels that will be exempt from the mutating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace. | `{}` | -| mutatingWebhookObjectSelector | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's mutation webhook unless measures are taken to control how exemption labels can be set. | `{}` | -| mutatingWebhookTimeoutSeconds | The timeout for the mutating webhook in seconds | `3` | -| mutatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | -| emitAdmissionEvents | Emit K8s events in configurable namespace for admission violations (alpha feature) | `false` | -| emitAuditEvents | Emit K8s events in configurable namespace for audit violations (alpha feature) | `false` | -| auditEventsInvolvedNamespace | Emit audit events for each violation in the involved objects namespace, the default (false) generates events in the namespace Gatekeeper is installed in. Audit events from cluster-scoped resources will continue to generate events in the namespace that Gatekeeper is installed in | `false` | -| admissionEventsInvolvedNamespace | Emit admission events for each violation in the involved objects namespace, the default (false) generates events in the namespace Gatekeeper is installed in. Admission events from cluster-scoped resources will continue to generate events in the namespace that Gatekeeper is installed in | `false` | -| logDenies | Log detailed info on each deny | `false` | -| logLevel | Minimum log level | `INFO` | -| image.pullPolicy | The image pull policy | `IfNotPresent` | -| image.repository | Image repository | `openpolicyagent/gatekeeper` | -| image.release | The image release tag to use | Current release version: `v3.12.0` | -| image.pullSecrets | Specify an array of imagePullSecrets | `[]` | -| resources | The resource request/limits for the container image | limits: 1 CPU, 512Mi, requests: 100mCPU, 256Mi | -| nodeSelector | The node selector to use for pod scheduling | `kubernetes.io/os: linux` | -| controllerManager.affinity | The node affinity to use for controller manager pod scheduling | `{}` | -| controllerManager.topologySpreadConstraints | The topology spread constraints to use for controller manager pod scheduling | `[]` | -| controllerManager.tolerations | The tolerations to use for controller manager pod scheduling | `[]` | -| controllerManager.healthPort | Health port for controller manager | `9090` | -| controllerManager.port | Webhook-server port for controller manager | `8443` | -| controllerManager.metricsPort | Metrics port for controller manager | `8888` | -| controllerManager.readinessTimeout | Timeout in seconds for the controller manager's readiness probe | `1` | -| controllerManager.livenessTimeout | Timeout in seconds for the controller manager's liveness probe | `1` | -| controllerManager.logLevel | The minimum log level for the controller manager, takes precedence over `logLevel` when specified | `null` -| controllerManager.priorityClassName | Priority class name for controller manager | `system-cluster-critical` | -| controllerManager.podSecurityContext | Security context on pod level for controller manager | {fsGroup: 999, suplementalGroups: [999]} | -| controllerManager.exemptNamespaces | The exact namespaces to exempt by the admission webhook | `[]` | -| controllerManager.exemptNamespacePrefixes | The namespace prefixes to exempt by the admission webhook | `[]` | -| controllerManager.hostNetwork | Enables controllerManager to be deployed on hostNetwork | `false` | -| controllerManager.dnsPolicy | Set the dnsPolicy for controllerManager pods | `ClusterFirst` | -| controllerManager.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | -| controllerManager.tlsMinVersion | Set the minimum supported TLS version for validating and mutating webhook servers | `1.3` | -| controllerManager.extraRules | Extra rules for the gatekeeper-manager-role Role | `[]` | -| controllerManager.networkPolicy.enabled | Should a network policy for the controller manager be created | `false` | -| controllerManager.networkPolicy.ingress | Additional ingress rules to be added to the controller manager network policy | `{}` | -| audit.affinity | The node affinity to use for audit pod scheduling | `{}` | -| audit.topologySpreadConstraints | The topology spread constraints to use for audit pod scheduling | `[]` | -| audit.tolerations | The tolerations to use for audit pod scheduling | `[]` | -| audit.priorityClassName | Priority class name for audit controller | `system-cluster-critical` | -| audit.podSecurityContext | Security context for audit on pod level | {fsGroup: 999, suplementalGroups: [999]} | -| audit.hostNetwork | Enables audit to be deployed on hostNetwork | `false` | -| audit.dnsPolicy | Set the dnsPolicy for audit pods | `ClusterFirst` | -| audit.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | -| audit.healthPort | Health port for audit | `9090` | -| audit.metricsPort | Metrics port for audit | `8888` | -| audit.readinessTimeout | Timeout in seconds for audit's readiness probe | `1` | -| audit.livenessTimeout | Timeout in seconds for the audit's liveness probe | `1` | -| audit.logLevel | The minimum log level for audit, takes precedence over `logLevel` when specified | `null` -| replicas | The number of Gatekeeper replicas to deploy for the webhook | `3` | -| podAnnotations | The annotations to add to the Gatekeeper pods | `container.seccomp.security.alpha.kubernetes.io/manager: runtime/default` | -| podLabels | The labels to add to the Gatekeeper pods | `{}` | -| podCountLimit | The maximum number of Gatekeeper pods to run | `100` | -| secretAnnotations | The annotations to add to the Gatekeeper secrets | `{}` | -| pdb.controllerManager.minAvailable | The number of controller manager pods that must still be available after an eviction | `1` | -| service.type | Service type | `ClusterIP` | -| service.loadBalancerIP | The IP address of LoadBalancer service | `` | -| service.healthzPort | Service port to gatekeeper Webhook health port | `9090` | -| rbac.create | Enable the creation of RBAC resources | `true` | -| externalCertInjection.enabled | Enable the injection of an external certificate. This disables automatic certificate generation and rotation | `false` | -| externalCertInjection.secretName | Name of secret for injected certificate | `gatekeeper-webhook-server-cert` | -| podMonitor.enabled | Whether to install `PodMonitor` resources or not | `false` | -| podMonitor.extraLabels | Extra labels for `PodMonitor` resources | `{}` | +| Parameter | Description | Default | +|:-----------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| postInstall.labelNamespace.enabled | Add labels to the namespace during post install hooks | `true` | +| postInstall.labelNamespace.extraNamespaces | The extra namespaces that need to have the label during post install hooks | `[]` | +| postInstall.labelNamespace.extraAnnotations | Extra annotations added to the post install Job | `{}` | +| postInstall.labelNamespace.image.repository | Image with kubectl to label the namespace | `openpolicyagent/gatekeeper-crds` | +| postInstall.labelNamespace.image.tag | Image tag | Current release version: `v3.17.1` | +| postInstall.labelNamespace.image.pullPolicy | Image pullPolicy | `IfNotPresent` | +| postInstall.labelNamespace.image.pullSecrets | Image pullSecrets | `[]` | +| postInstall.labelNamespace.extraRules | Extra rules for the gatekeeper-update-namespace-label Role | `[]` | +| postInstall.labelNamespace.priorityClassName | Priority class name for gatekeeper-update-namespace-label Job | `` | +| postInstall.probeWebhook.enabled | Probe webhook API post install. When enabled along with `postInstall.labelNamespace.enabled`, this probe will run as part of `postInstall.labelNamespace` Job as an initContainer | `true` | +| postInstall.probeWebhook.image.repository | Image with curl to probe the webhook API | `curlimages/curl` | +| postInstall.probeWebhook.image.tag | Image tag | `7.83.1` | +| postInstall.probeWebhook.image.pullPolicy | Image pullPolicy | `IfNotPresent` | +| postInstall.probeWebhook.image.pullSecrets | Image pullSecrets | `[]` | +| postInstall.probeWebhook.waitTimeout | Total time to wait for the webhook API to become available | `60` | +| postInstall.probeWebhook.httpTimeout | HTTP client timeout | `2` | +| postInstall.probeWebhook.insecureHTTPS | Ignore server SSL certificate | `false` | +| postInstall.probeWebhook.priorityClassName | Priority class name for gatekeeper-probe-webhook-post-install Job | `` | +| postInstall.affinity | The affinity to use for pod scheduling in postInstall hook jobs | `{}` | +| postInstall.tolerations | The tolerations to use for pod scheduling in postInstall hook jobs | `[]` | +| postInstall.nodeSelector | The node selector to use for pod scheduling in postInstall hook jobs | `kubernetes.io/os: linux` | +| postInstall.resources | The resource request/limits for the container image in postInstall hook jobs | `{}` | +| postInstall.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | +| postUpgrade.labelNamespace.enabled | Add labels to the namespace during post upgrade hooks | `false` | +| postUpgrade.labelNamespace.extraNamespaces | The extra namespaces that need to have the label during post upgrade hooks | `[]` | +| postUpgrade.labelNamespace.extraAnnotations | Extra annotations added to the post upgrade Job | `{}` | +| postUpgrade.labelNamespace.image.repository | Image with kubectl to label the namespace | `openpolicyagent/gatekeeper-crds` | +| postUpgrade.labelNamespace.image.tag | Image tag | Current release version: `v3.17.1` | +| postUpgrade.labelNamespace.image.pullPolicy | Image pullPolicy | `IfNotPresent` | +| postUpgrade.labelNamespace.image.pullSecrets | Image pullSecrets | `[]` | +| postUpgrade.labelNamespace.priorityClassName | Priority class name for gatekeeper-update-namespace-label-post-upgrade Job | `` | +| postUpgrade.affinity | The affinity to use for pod scheduling in postUpgrade hook jobs | `{}` | +| postUpgrade.tolerations | The tolerations to use for pod scheduling in postUpgrade hook jobs | `[]` | +| postUpgrade.nodeSelector | The node selector to use for pod scheduling in postUpgrade hook jobs | `kubernetes.io/os: linux` | +| postUpgrade.resources | The resource request/limits for the container image in postUpgrade hook jobs | `{}` | +| postUpgrade.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | +| preInstall.crdRepository.image.repository | Image with kubectl to update the CRDs. If not set, the `image.crdRepository` is used instead. | `null` | +| preInstall.crdRepository.image.tag | Image tag | Current release version: `v3.17.1` | +| preUninstall.deleteWebhookConfigurations.enabled | Delete webhooks before gatekeeper itself is uninstalled | `false` | +| preUninstall.deleteWebhookConfigurations.image.repository | Image with kubectl to delete the webhooks | `openpolicyagent/gatekeeper-crds` | +| preUninstall.deleteWebhookConfigurations.image.tag | Image tag | Current release version: `v3.17.1` | +| preUninstall.deleteWebhookConfigurations.image.pullPolicy | Image pullPolicy | `IfNotPresent` | +| preUninstall.deleteWebhookConfigurations.image.pullSecrets | Image pullSecrets | `[]` | +| preUninstall.deleteWebhookConfigurations.extraRules | Extra rules for the gatekeeper-delete-webhook-configs Role | `[]` | +| preUninstall.deleteWebhookConfigurations.priorityClassName | Priority class name for gatekeeper-delete-webhook-configs Job | `` | +| preUninstall.affinity | The affinity to use for pod scheduling in preUninstall hook jobs | `{}` | +| preUninstall.tolerations | The tolerations to use for pod scheduling in preUninstall hook jobs | `[]` | +| preUninstall.nodeSelector | The node selector to use for pod scheduling in preUninstall hook jobs | `kubernetes.io/os: linux` | +| preUninstall.resources | The resource request/limits for the container image in preUninstall hook jobs | `{}` | +| preUninstall.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | +| psp.enabled | Enabled PodSecurityPolicy | `false` | +| upgradeCRDs.enabled | Upgrade CRDs using pre-install/pre-upgrade hooks | `true` | +| upgradeCRDs.extraRules | Extra rules for the gatekeeper-admin-upgrade-crds ClusterRole | `[]` | +| upgradeCRDs.priorityClassName | Priority class name for gatekeeper-update-crds-hook Job | `` | +| crds.affinity | The affinity to use for pod scheduling in crds hook jobs | `{}` | +| crds.tolerations | The tolerations to use for pod scheduling in crds hook jobs | `[]` | +| crds.nodeSelector | The node selector to use for pod scheduling in crds hook jobs | `kubernetes.io/os: linux` | +| crds.resources | The resource request/limits for the container image in crds hook jobs | `{}` | +| crds.securityContext | Security context applied to the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 65532, "runAsNonRoot": true, "runAsUser": 65532 }` | +| auditInterval | The frequency with which audit is run | `60` | +| constraintViolationsLimit | The maximum # of audit violations reported on a constraint | `20` | +| auditFromCache | Take the roster of resources to audit from the audit cache | `false` | +| auditChunkSize | Chunk size for listing cluster resources for audit (alpha feature) | `500` | +| auditMatchKindOnly | Only check resources of the kinds specified in all constraints defined in the cluster. | `false` | +| disableAudit | Disable audit controller | `false` | +| disableMutation | Disable mutation | `false` | +| disableValidatingWebhook | Disable the validating webhook | `false` | +| validatingWebhookName | The name of the `ValidatingWebhookConfiguration` | `gatekeeper-validating-webhook-configuration` | +| validatingWebhookTimeoutSeconds | The timeout for the validating webhook in seconds | `3` | +| validatingWebhookFailurePolicy | The failurePolicy for the validating webhook | `Ignore` | +| validatingWebhookAnnotations | The annotations to add to the ValidatingWebhookConfiguration | `{}` | +| validatingWebhookObjectSelector | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's validation webhook unless measures are taken to control how exemption labels can be set. | `{}` | +| validatingWebhookMatchConditions | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called | `[]` | +| validatingWebhookCheckIgnoreFailurePolicy | The failurePolicy for the check-ignore-label validating webhook | `Fail` | +| validatingWebhookExemptNamespacesLabels | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace. | `{}` | +| validatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | +| validatingWebhookURL | Custom URL for Kubernetes API server to use to reach the validating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used. | `null` | +| enableDeleteOperations | Enable validating webhook for delete operations. Does not work with `validatingWebhookCustomRules` | `false` | +| enableConnectOperations | Enable validating webhook for connect operations. | `false` | +| enableExternalData | Enable external data | `true` | +| enableGeneratorResourceExpansion | Enable generator resource expansion (beta feature) | `true` | +| enableTLSHealthcheck | Enable probing webhook API with certificate stored in certDir | `false` | +| maxServingThreads | Limit the number of concurrent calls the validation backend made by the validation webhook. -1 limits this value to GOMAXPROCS. Configuring this value may lower max RAM usage and limit CPU throttling, Tuning it can optimize serving capacity. | `-1` | +| metricsBackends | Metrics exporters to use. Valid exporters are: `prometheus`, `stackdriver`, and `opentelemetry` starting from Gatekeeper 3.15 | `["prometheus"]` | +| mutatingWebhookName | The name of the `MutatingWebhookConfiguration` | `gatekeeper-mutating-webhook-configuration` | +| mutatingWebhookFailurePolicy | The failurePolicy for the mutating webhook | `Ignore` | +| mutatingWebhookReinvocationPolicy | The reinvocationPolicy for the mutating webhook | `Never` | +| mutatingWebhookAnnotations | The annotations to add to the MutatingWebhookConfiguration | `{}` | +| mutatingWebhookExemptNamespacesLabels | Additional namespace labels that will be exempt from the mutating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace. | `{}` | +| mutatingWebhookObjectSelector | The label selector to further refine which namespaced resources will be selected by the webhook. Please note that an exemption label means users can circumvent Gatekeeper's mutation webhook unless measures are taken to control how exemption labels can be set. | `{}` | +| mutatingWebhookMatchConditions | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called | `[]` | +| mutatingWebhookTimeoutSeconds | The timeout for the mutating webhook in seconds | `3` | +| mutatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | +| mutatingWebhookURL | Custom URL for Kubernetes API server to use to reach the mutating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used. | `null` | +| emitAdmissionEvents | Emit K8s events in configurable namespace for admission violations (alpha feature) | `false` | +| emitAuditEvents | Emit K8s events in configurable namespace for audit violations (alpha feature) | `false` | +| enableK8sNativeValidation | Enable the K8s Native Validating driver to allow constraint templates to use rules written in VAP-style CEL (beta feature) | `true` | +| defaultCreateVAPForTemplates | Create VAP resource for template containing VAP-style CEL source. Allowed values are false: do not create Validating Admission Policy unless generateVAP: true is set on constraint template explicitly, true: create Validating Admission Policy unless generateVAP: false is set on constraint template explicitly. (alpha feature) | `false` | +| defaultCreateVAPBindingForConstraints | Create VAPBinding resource for constraint of the template containing VAP-style CEL source. Allowed values are false: do not create Validating Admission Policy Binding, true: create Validating Admission Policy Binding. (alpha feature) | `false` | +| auditEventsInvolvedNamespace | Emit audit events for each violation in the involved objects namespace, the default (false) generates events in the namespace Gatekeeper is installed in. Audit events from cluster-scoped resources will continue to generate events in the namespace that Gatekeeper is installed in | `false` | +| admissionEventsInvolvedNamespace | Emit admission events for each violation in the involved objects namespace, the default (false) generates events in the namespace Gatekeeper is installed in. Admission events from cluster-scoped resources will continue to generate events in the namespace that Gatekeeper is installed in | `false` | +| logDenies | Log detailed info on each deny | `false` | +| logLevel | Minimum log level | `INFO` | +| image.pullPolicy | The image pull policy | `IfNotPresent` | +| image.repository | Image repository | `openpolicyagent/gatekeeper` | +| image.release | The image release tag to use | Current release version: `v3.17.1` | +| image.pullSecrets | Specify an array of imagePullSecrets | `[]` | +| resources | The resource request/limits for the container image | limits: 1 CPU, 512Mi, requests: 100mCPU, 256Mi | +| nodeSelector | The node selector to use for pod scheduling | `kubernetes.io/os: linux` | +| controllerManager.podLabels | The labels to add to the controller manager pod | `{}` | +| controllerManager.affinity | The node affinity to use for controller manager pod scheduling | `{}` | +| controllerManager.topologySpreadConstraints | The topology spread constraints to use for controller manager pod scheduling | `[]` | +| controllerManager.tolerations | The tolerations to use for controller manager pod scheduling | `[]` | +| controllerManager.healthPort | Health port for controller manager | `9090` | +| controllerManager.port | Webhook-server port for controller manager | `8443` | +| controllerManager.metricsPort | Metrics port for controller manager | `8888` | +| controllerManager.readinessTimeout | Timeout in seconds for the controller manager's readiness probe | `1` | +| controllerManager.livenessTimeout | Timeout in seconds for the controller manager's liveness probe | `1` | +| controllerManager.logLevel | The minimum log level for the controller manager, takes precedence over `logLevel` when specified | `null` | +| controllerManager.priorityClassName | Priority class name for controller manager | `system-cluster-critical` | +| controllerManager.podSecurityContext | Security context on pod level for controller manager | {fsGroup: 999, suplementalGroups: [999]} | +| controllerManager.exemptNamespaces | The exact namespaces to exempt by the admission webhook | `[]` | +| controllerManager.exemptNamespacePrefixes | The namespace prefixes to exempt by the admission webhook | `[]` | +| controllerManager.hostNetwork | Enables controllerManager to be deployed on hostNetwork | `false` | +| controllerManager.dnsPolicy | Set the dnsPolicy for controllerManager pods | `ClusterFirst` | +| controllerManager.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | +| controllerManager.tlsMinVersion | Set the minimum supported TLS version for validating and mutating webhook servers | `1.3` | +| controllerManager.extraRules | Extra rules for the gatekeeper-manager-role Role | `[]` | +| controllerManager.networkPolicy.enabled | Should a network policy for the controller manager be created | `false` | +| controllerManager.networkPolicy.ingress | Additional ingress rules to be added to the controller manager network policy | `{}` | +| controllerManager.strategyType | The strategy type to use for Controller Manager deployment | `RollingUpdate` | +| controllerManager.strategyRollingUpdate | [RollingUpdate](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#rolling-update-deployment) configuration for Controller Manager deployment | `{}` | +| audit.podLabels | The labels to add to the audit pod | `{}` | +| audit.affinity | The node affinity to use for audit pod scheduling | `{}` | +| audit.topologySpreadConstraints | The topology spread constraints to use for audit pod scheduling | `[]` | +| audit.tolerations | The tolerations to use for audit pod scheduling | `[]` | +| audit.priorityClassName | Priority class name for audit controller | `system-cluster-critical` | +| audit.podSecurityContext | Security context for audit on pod level | {fsGroup: 999, suplementalGroups: [999]} | +| audit.hostNetwork | Enables audit to be deployed on hostNetwork | `false` | +| audit.dnsPolicy | Set the dnsPolicy for audit pods | `ClusterFirst` | +| audit.securityContext | Security context applied on the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 999, "runAsNonRoot": true, "runAsUser": 1000 }` | +| audit.healthPort | Health port for audit | `9090` | +| audit.metricsPort | Metrics port for audit | `8888` | +| audit.readinessTimeout | Timeout in seconds for audit's readiness probe | `1` | +| audit.livenessTimeout | Timeout in seconds for the audit's liveness probe | `1` | +| audit.logLevel | The minimum log level for audit, takes precedence over `logLevel` when specified | `null` | +| replicas | The number of Gatekeeper replicas to deploy for the webhook | `3` | +| podAnnotations | The annotations to add to the Gatekeeper pods | `container.seccomp.security.alpha.kubernetes.io/manager: runtime/default` | +| podLabels | The labels to add to the Gatekeeper pods | `{}` | +| podCountLimit | The maximum number of Gatekeeper pods to run | `100` | +| secretAnnotations | The annotations to add to the Gatekeeper secrets | `{}` | +| pdb.controllerManager.minAvailable | The number of controller manager pods that must still be available after an eviction | `1` | +| service.type | Service type | `ClusterIP` | +| service.loadBalancerIP | The IP address of LoadBalancer service | `` | +| service.healthzPort | Service port to gatekeeper Webhook health port | `9090` | +| rbac.create | Enable the creation of RBAC resources | `true` | +| externalCertInjection.enabled | Enable the injection of an external certificate. This disables automatic certificate generation and rotation | `false` | +| externalCertInjection.secretName | Name of secret for injected certificate | `gatekeeper-webhook-server-cert` | +| externaldataProviderResponseCacheTTL | TTL for the external data provider response cache. Specify the duration in 'h', 'm', or 's' for hours, minutes, or seconds respectively. | `3m` | ## Contributing Changes -Please refer to [Contributing to Helm Chart](https://open-policy-agent.github.io/gatekeeper/website/docs/help#contributing-to-helm-chart) for modifying the Helm chart. +Please refer +to [Contributing to Helm Chart](https://open-policy-agent.github.io/gatekeeper/website/docs/help#contributing-to-helm-chart) +for modifying the Helm chart. diff --git a/charts/gatekeeper/crds/assign-customresourcedefinition.yaml b/charts/gatekeeper/crds/assign-customresourcedefinition.yaml index ce98648..1b8bc53 100644 --- a/charts/gatekeeper/crds/assign-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/assign-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: assign.mutations.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: Assign is the Schema for the assign API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: @@ -37,9 +47,14 @@ spec: description: AssignSpec defines the desired state of Assign. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + description: |- + ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + This is necessary because every mutation implies part of an object schema and object + schemas are associated with specific GVKs. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -59,21 +74,40 @@ spec: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' type: string match: - description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + description: |- + Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined + match criteria matches everything. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -84,81 +118,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -176,17 +263,23 @@ spec: properties: dataSource: default: ValueAtLocation - description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + description: |- + DataSource specifies where to extract the data that will be sent + to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: - description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + description: |- + Default specifies the default value to use when the external data + provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail - description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + description: |- + FailurePolicy specifies the policy to apply when the external data + provider returns an error. enum: - UseDefault - Ignore @@ -209,7 +302,18 @@ spec: type: object pathTests: items: - description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + description: |- + PathTest allows the user to customize how the mutation works if parent + paths are missing. It traverses the list in order. All sub paths are + tested against the provided condition, if the test fails, the mutation is + not applied. All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. + + + Available Tests: + * MustExist - the path must exist or do not mutate + * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object @@ -239,7 +343,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -248,7 +354,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 @@ -271,10 +380,19 @@ spec: description: Assign is the Schema for the assign API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -282,9 +400,14 @@ spec: description: AssignSpec defines the desired state of Assign. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + description: |- + ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + This is necessary because every mutation implies part of an object schema and object + schemas are associated with specific GVKs. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -304,21 +427,40 @@ spec: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' type: string match: - description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + description: |- + Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined + match criteria matches everything. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -329,81 +471,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -421,17 +616,23 @@ spec: properties: dataSource: default: ValueAtLocation - description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + description: |- + DataSource specifies where to extract the data that will be sent + to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: - description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + description: |- + Default specifies the default value to use when the external data + provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail - description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + description: |- + FailurePolicy specifies the policy to apply when the external data + provider returns an error. enum: - UseDefault - Ignore @@ -454,7 +655,18 @@ spec: type: object pathTests: items: - description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + description: |- + PathTest allows the user to customize how the mutation works if parent + paths are missing. It traverses the list in order. All sub paths are + tested against the provided condition, if the test fails, the mutation is + not applied. All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. + + + Available Tests: + * MustExist - the path must exist or do not mutate + * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object @@ -484,7 +696,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -493,7 +707,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 @@ -516,10 +733,19 @@ spec: description: Assign is the Schema for the assign API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -527,9 +753,14 @@ spec: description: AssignSpec defines the desired state of Assign. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + description: |- + ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + This is necessary because every mutation implies part of an object schema and object + schemas are associated with specific GVKs. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -549,21 +780,40 @@ spec: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' type: string match: - description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + description: |- + Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined + match criteria matches everything. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -574,81 +824,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -666,17 +969,23 @@ spec: properties: dataSource: default: ValueAtLocation - description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + description: |- + DataSource specifies where to extract the data that will be sent + to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: - description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + description: |- + Default specifies the default value to use when the external data + provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail - description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + description: |- + FailurePolicy specifies the policy to apply when the external data + provider returns an error. enum: - UseDefault - Ignore @@ -699,7 +1008,18 @@ spec: type: object pathTests: items: - description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + description: |- + PathTest allows the user to customize how the mutation works if parent + paths are missing. It traverses the list in order. All sub paths are + tested against the provided condition, if the test fails, the mutation is + not applied. All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. + + + Available Tests: + * MustExist - the path must exist or do not mutate + * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object @@ -729,7 +1049,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -738,7 +1060,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 diff --git a/charts/gatekeeper/crds/assignimage-customresourcedefinition.yaml b/charts/gatekeeper/crds/assignimage-customresourcedefinition.yaml index bab8016..ab9177a 100644 --- a/charts/gatekeeper/crds/assignimage-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/assignimage-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: assignimage.mutations.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: AssignImage is the Schema for the assignimage API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: @@ -37,9 +47,14 @@ spec: description: AssignImageSpec defines the desired state of AssignImage. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + description: |- + ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + This is necessary because every mutation implies part of an object schema and object + schemas are associated with specific GVKs. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -59,21 +74,40 @@ spec: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].image`.' type: string match: - description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + description: |- + Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined + match criteria matches everything. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -84,81 +118,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -169,17 +256,32 @@ spec: description: Parameters define the behavior of the mutator. properties: assignDomain: - description: AssignDomain sets the domain component on an image string. The trailing slash should not be included. + description: |- + AssignDomain sets the domain component on an image string. The trailing + slash should not be included. type: string assignPath: description: AssignPath sets the domain component on an image string. type: string assignTag: - description: AssignImage sets the image component on an image string. It must start with a `:` or `@`. + description: |- + AssignImage sets the image component on an image string. It must start + with a `:` or `@`. type: string pathTests: items: - description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + description: |- + PathTest allows the user to customize how the mutation works if parent + paths are missing. It traverses the list in order. All sub paths are + tested against the provided condition, if the test fails, the mutation is + not applied. All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. + + + Available Tests: + * MustExist - the path must exist or do not mutate + * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object @@ -209,7 +311,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -218,7 +322,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 diff --git a/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml b/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml index 468b01f..719b0cd 100644 --- a/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: assignmetadata.mutations.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: AssignMetadata is the Schema for the assignmetadata API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: @@ -42,18 +52,34 @@ spec: description: Match selects which objects are in scope. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -64,81 +90,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -155,17 +234,23 @@ spec: properties: dataSource: default: ValueAtLocation - description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + description: |- + DataSource specifies where to extract the data that will be sent + to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: - description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + description: |- + Default specifies the default value to use when the external data + provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail - description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + description: |- + FailurePolicy specifies the policy to apply when the external data + provider returns an error. enum: - UseDefault - Ignore @@ -192,7 +277,9 @@ spec: description: AssignMetadataStatus defines the observed state of AssignMetadata. properties: byPod: - description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file' + description: |- + INSERT ADDITIONAL STATUS FIELD - define observed state of cluster + Important: Run "make" to regenerate code after modifying this file items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: @@ -205,7 +292,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -214,7 +303,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 @@ -237,10 +329,19 @@ spec: description: AssignMetadata is the Schema for the assignmetadata API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -253,18 +354,34 @@ spec: description: Match selects which objects are in scope. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -275,81 +392,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -366,17 +536,23 @@ spec: properties: dataSource: default: ValueAtLocation - description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + description: |- + DataSource specifies where to extract the data that will be sent + to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: - description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + description: |- + Default specifies the default value to use when the external data + provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail - description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + description: |- + FailurePolicy specifies the policy to apply when the external data + provider returns an error. enum: - UseDefault - Ignore @@ -403,7 +579,9 @@ spec: description: AssignMetadataStatus defines the observed state of AssignMetadata. properties: byPod: - description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file' + description: |- + INSERT ADDITIONAL STATUS FIELD - define observed state of cluster + Important: Run "make" to regenerate code after modifying this file items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: @@ -416,7 +594,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -425,7 +605,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 @@ -448,10 +631,19 @@ spec: description: AssignMetadata is the Schema for the assignmetadata API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -464,18 +656,34 @@ spec: description: Match selects which objects are in scope. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -486,81 +694,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -577,17 +838,23 @@ spec: properties: dataSource: default: ValueAtLocation - description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + description: |- + DataSource specifies where to extract the data that will be sent + to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: - description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + description: |- + Default specifies the default value to use when the external data + provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail - description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + description: |- + FailurePolicy specifies the policy to apply when the external data + provider returns an error. enum: - UseDefault - Ignore @@ -614,7 +881,9 @@ spec: description: AssignMetadataStatus defines the observed state of AssignMetadata. properties: byPod: - description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file' + description: |- + INSERT ADDITIONAL STATUS FIELD - define observed state of cluster + Important: Run "make" to regenerate code after modifying this file items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: @@ -627,7 +896,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -636,7 +907,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 diff --git a/charts/gatekeeper/crds/config-customresourcedefinition.yaml b/charts/gatekeeper/crds/config-customresourcedefinition.yaml index 57826ac..11a5d92 100644 --- a/charts/gatekeeper/crds/config-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/config-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: configs.config.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: Config is the Schema for the configs API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -38,8 +48,11 @@ spec: properties: excludedNamespaces: items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array processes: diff --git a/charts/gatekeeper/crds/constraintpodstatus-customresourcedefinition.yaml b/charts/gatekeeper/crds/constraintpodstatus-customresourcedefinition.yaml index 230a541..85942c0 100644 --- a/charts/gatekeeper/crds/constraintpodstatus-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/constraintpodstatus-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: constraintpodstatuses.status.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: ConstraintPodStatus is the Schema for the constraintpodstatuses API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -33,13 +43,16 @@ spec: description: ConstraintPodStatusStatus defines the observed state of ConstraintPodStatus. properties: constraintUID: - description: Storing the constraint UID allows us to detect drift, such as when a constraint has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the constraint UID allows us to detect drift, such as + when a constraint has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string enforced: type: boolean errors: items: - description: Error represents a single error caught while adding a constraint to OPA. + description: Error represents a single error caught while adding a constraint to engine. properties: code: type: string diff --git a/charts/gatekeeper/crds/constrainttemplate-customresourcedefinition.yaml b/charts/gatekeeper/crds/constrainttemplate-customresourcedefinition.yaml index 737e3af..2507c15 100644 --- a/charts/gatekeeper/crds/constrainttemplate-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/constrainttemplate-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.3 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: constrainttemplates.templates.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: ConstraintTemplate is the Schema for the constrainttemplates API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -62,7 +72,9 @@ spec: items: properties: code: - description: The source code options for the constraint template. "Rego" can only be specified in one place (either here or in the "rego" field) + description: |- + The source code options for the constraint template. "Rego" can only + be specified in one place (either here or in the "rego" field) items: properties: engine: @@ -95,7 +107,9 @@ spec: properties: byPod: items: - description: ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller + description: |- + ByPodStatus defines the observed state of ConstraintTemplate as seen by + an individual controller properties: errors: items: @@ -135,10 +149,19 @@ spec: description: ConstraintTemplate is the Schema for the constrainttemplates API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -175,7 +198,9 @@ spec: items: properties: code: - description: The source code options for the constraint template. "Rego" can only be specified in one place (either here or in the "rego" field) + description: |- + The source code options for the constraint template. "Rego" can only + be specified in one place (either here or in the "rego" field) items: properties: engine: @@ -208,7 +233,9 @@ spec: properties: byPod: items: - description: ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller + description: |- + ByPodStatus defines the observed state of ConstraintTemplate as seen by + an individual controller properties: errors: items: @@ -248,10 +275,19 @@ spec: description: ConstraintTemplate is the Schema for the constrainttemplates API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -288,7 +324,9 @@ spec: items: properties: code: - description: The source code options for the constraint template. "Rego" can only be specified in one place (either here or in the "rego" field) + description: |- + The source code options for the constraint template. "Rego" can only + be specified in one place (either here or in the "rego" field) items: properties: engine: @@ -321,7 +359,9 @@ spec: properties: byPod: items: - description: ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller + description: |- + ByPodStatus defines the observed state of ConstraintTemplate as seen by + an individual controller properties: errors: items: diff --git a/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml b/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml index 271572b..2d4bd1c 100644 --- a/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: constrainttemplatepodstatuses.status.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: ConstraintTemplatePodStatus is the Schema for the constrainttemplatepodstatuses API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -58,7 +68,10 @@ spec: type: string type: array templateUID: - description: UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. + description: |- + UID is a type that holds unique ID values, including UUIDs. Because we + don't ONLY use UUIDs, this is an alias to string. Being a type captures + intent and helps make sure that UIDs and names do not get conflated. type: string type: object type: object diff --git a/charts/gatekeeper/crds/expansiontemplate-customresourcedefinition.yaml b/charts/gatekeeper/crds/expansiontemplate-customresourcedefinition.yaml index 042249c..8e84974 100644 --- a/charts/gatekeeper/crds/expansiontemplate-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/expansiontemplate-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: expansiontemplate.expansion.gatekeeper.sh @@ -22,20 +23,37 @@ spec: description: ExpansionTemplate is the Schema for the ExpansionTemplate API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: + properties: + name: + maxLength: 63 + type: string type: object spec: description: ExpansionTemplateSpec defines the desired state of ExpansionTemplate. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds of generator resources which will be expanded. + description: |- + ApplyTo lists the specific groups, versions and kinds of generator resources + which will be expanded. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -52,10 +70,15 @@ spec: type: object type: array enforcementAction: - description: EnforcementAction specifies the enforcement action to be used for resources matching the ExpansionTemplate. Specifying an empty value will use the enforcement action specified by the Constraint in violation. + description: |- + EnforcementAction specifies the enforcement action to be used for resources + matching the ExpansionTemplate. Specifying an empty value will use the + enforcement action specified by the Constraint in violation. type: string generatedGVK: - description: GeneratedGVK specifies the GVK of the resources which the generator resource creates. + description: |- + GeneratedGVK specifies the GVK of the resources which the generator + resource creates. properties: group: type: string @@ -65,9 +88,166 @@ spec: type: string type: object templateSource: - description: TemplateSource specifies the source field on the generator resource to use as the base for expanded resource. For Pod-creating generators, this is usually spec.template + description: |- + TemplateSource specifies the source field on the generator resource to + use as the base for expanded resource. For Pod-creating generators, this + is usually spec.template type: string type: object + status: + description: ExpansionTemplateStatus defines the observed state of ExpansionTemplate. + properties: + byPod: + items: + description: ExpansionTemplatePodStatusStatus defines the observed state of ExpansionTemplatePodStatus. + properties: + errors: + items: + properties: + message: + type: string + type: + type: string + required: + - message + type: object + type: array + id: + description: 'Important: Run "make" to regenerate code after modifying this file' + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + templateUID: + description: |- + UID is a type that holds unique ID values, including UUIDs. Because we + don't ONLY use UUIDs, this is an alias to string. Being a type captures + intent and helps make sure that UIDs and names do not get conflated. + type: string + type: object + type: array + type: object type: object served: true storage: true + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: ExpansionTemplate is the Schema for the ExpansionTemplate API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ExpansionTemplateSpec defines the desired state of ExpansionTemplate. + properties: + applyTo: + description: |- + ApplyTo lists the specific groups, versions and kinds of generator resources + which will be expanded. + items: + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. + properties: + groups: + items: + type: string + type: array + kinds: + items: + type: string + type: array + versions: + items: + type: string + type: array + type: object + type: array + enforcementAction: + description: |- + EnforcementAction specifies the enforcement action to be used for resources + matching the ExpansionTemplate. Specifying an empty value will use the + enforcement action specified by the Constraint in violation. + type: string + generatedGVK: + description: |- + GeneratedGVK specifies the GVK of the resources which the generator + resource creates. + properties: + group: + type: string + kind: + type: string + version: + type: string + type: object + templateSource: + description: |- + TemplateSource specifies the source field on the generator resource to + use as the base for expanded resource. For Pod-creating generators, this + is usually spec.template + type: string + type: object + status: + description: ExpansionTemplateStatus defines the observed state of ExpansionTemplate. + properties: + byPod: + items: + description: ExpansionTemplatePodStatusStatus defines the observed state of ExpansionTemplatePodStatus. + properties: + errors: + items: + properties: + message: + type: string + type: + type: string + required: + - message + type: object + type: array + id: + description: 'Important: Run "make" to regenerate code after modifying this file' + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + templateUID: + description: |- + UID is a type that holds unique ID values, including UUIDs. Because we + don't ONLY use UUIDs, this is an alias to string. Being a type captures + intent and helps make sure that UIDs and names do not get conflated. + type: string + type: object + type: array + type: object + type: object + served: true + storage: false + subresources: + status: {} diff --git a/charts/gatekeeper/crds/expansiontemplatepodstatus-customresourcedefinition.yaml b/charts/gatekeeper/crds/expansiontemplatepodstatus-customresourcedefinition.yaml new file mode 100644 index 0000000..54d9d5d --- /dev/null +++ b/charts/gatekeeper/crds/expansiontemplatepodstatus-customresourcedefinition.yaml @@ -0,0 +1,75 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + labels: + gatekeeper.sh/system: "yes" + name: expansiontemplatepodstatuses.status.gatekeeper.sh +spec: + group: status.gatekeeper.sh + names: + kind: ExpansionTemplatePodStatus + listKind: ExpansionTemplatePodStatusList + plural: expansiontemplatepodstatuses + singular: expansiontemplatepodstatus + preserveUnknownFields: false + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: ExpansionTemplatePodStatus is the Schema for the expansiontemplatepodstatuses API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + status: + description: ExpansionTemplatePodStatusStatus defines the observed state of ExpansionTemplatePodStatus. + properties: + errors: + items: + properties: + message: + type: string + type: + type: string + required: + - message + type: object + type: array + id: + description: 'Important: Run "make" to regenerate code after modifying this file' + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + templateUID: + description: |- + UID is a type that holds unique ID values, including UUIDs. Because we + don't ONLY use UUIDs, this is an alias to string. Being a type captures + intent and helps make sure that UIDs and names do not get conflated. + type: string + type: object + type: object + served: true + storage: true diff --git a/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml b/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml index 1bb1933..24c86d4 100644 --- a/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: modifyset.mutations.gatekeeper.sh @@ -19,13 +20,24 @@ spec: - name: v1 schema: openAPIV3Schema: - description: ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. + description: |- + ModifySet allows the user to modify non-keyed lists, such as + the list of arguments to a container. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: @@ -37,9 +49,14 @@ spec: description: ModifySetSpec defines the desired state of ModifySet. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + description: |- + ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + This is necessary because every mutation implies part of an object schema and object + schemas are associated with specific GVKs. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -59,21 +76,40 @@ spec: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' type: string match: - description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + description: |- + Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined + match criteria matches everything. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -84,81 +120,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -176,9 +265,22 @@ spec: - prune type: string pathTests: - description: PathTests are a series of existence tests that can be checked before a mutation is applied + description: |- + PathTests are a series of existence tests that can be checked + before a mutation is applied items: - description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + description: |- + PathTest allows the user to customize how the mutation works if parent + paths are missing. It traverses the list in order. All sub paths are + tested against the provided condition, if the test fails, the mutation is + not applied. All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. + + + Available Tests: + * MustExist - the path must exist or do not mutate + * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object @@ -212,7 +314,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -221,7 +325,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 @@ -241,13 +348,24 @@ spec: - name: v1alpha1 schema: openAPIV3Schema: - description: ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. + description: |- + ModifySet allows the user to modify non-keyed lists, such as + the list of arguments to a container. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -255,9 +373,14 @@ spec: description: ModifySetSpec defines the desired state of ModifySet. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + description: |- + ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + This is necessary because every mutation implies part of an object schema and object + schemas are associated with specific GVKs. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -277,21 +400,40 @@ spec: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' type: string match: - description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + description: |- + Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined + match criteria matches everything. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -302,81 +444,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -394,9 +589,22 @@ spec: - prune type: string pathTests: - description: PathTests are a series of existence tests that can be checked before a mutation is applied + description: |- + PathTests are a series of existence tests that can be checked + before a mutation is applied items: - description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + description: |- + PathTest allows the user to customize how the mutation works if parent + paths are missing. It traverses the list in order. All sub paths are + tested against the provided condition, if the test fails, the mutation is + not applied. All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. + + + Available Tests: + * MustExist - the path must exist or do not mutate + * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object @@ -430,7 +638,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -439,7 +649,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 @@ -459,13 +672,24 @@ spec: - name: v1beta1 schema: openAPIV3Schema: - description: ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. + description: |- + ModifySet allows the user to modify non-keyed lists, such as + the list of arguments to a container. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -473,9 +697,14 @@ spec: description: ModifySetSpec defines the desired state of ModifySet. properties: applyTo: - description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + description: |- + ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + This is necessary because every mutation implies part of an object schema and object + schemas are associated with specific GVKs. items: - description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + description: |- + ApplyTo determines what GVKs items the mutation should apply to. + Globs are not allowed. properties: groups: items: @@ -495,21 +724,40 @@ spec: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' type: string match: - description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + description: |- + Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined + match criteria matches everything. properties: excludedNamespaces: - description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + ExcludedNamespaces is a list of namespace names. If defined, a + constraint only applies to resources not in a listed namespace. + ExcludedNamespaces also supports a prefix or suffix based glob. For example, + `excludedNamespaces: [kube-*]` matches both `kube-system` and + `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and + `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: - description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + description: |- + Kinds accepts a list of objects with apiGroups and kinds fields + that list the groups/kinds of objects to which the mutation will apply. + If multiple groups/kinds objects are specified, + only one match is needed for the resource to be in scope. properties: apiGroups: - description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + description: |- + APIGroups is the API groups the resources belong to. '*' is all groups. + If '*' is present, the length of the slice must be one. + Required. items: type: string type: array @@ -520,81 +768,134 @@ spec: type: object type: array labelSelector: - description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + description: |- + LabelSelector is the combination of two optional fields: `matchLabels` + and `matchExpressions`. These two fields provide different methods of + selecting or excluding k8s objects based on the label keys and values + included in object metadata. All selection expressions from both + sections are ANDed to determine if an object meets the cumulative + requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic name: - description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + Name is the name of an object. If defined, it will match against objects with the specified + name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: - description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + description: |- + NamespaceSelector is a label selector against an object's containing + namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: - description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: - description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: - description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. items: type: string type: array + x-kubernetes-list-type: atomic required: - key - operator type: object type: array + x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string - description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object + x-kubernetes-map-type: atomic namespaces: - description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + description: |- + Namespaces is a list of namespace names. If defined, a constraint only + applies to resources in a listed namespace. Namespaces also supports a + prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both + `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both + `kube-system` and `gatekeeper-system`. items: - description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' - pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + description: |- + A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or + "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will + match "system-kube" or "kube-system". The asterisk is required for wildcard matching. + pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: - description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + description: |- + Scope determines if cluster-scoped and/or namespaced-scoped resources + are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: - description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + description: |- + Source determines whether generated or original resources are matched. + Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of + `Generated` will only match generated resources, while `Original` will only + match regular resources. enum: - All - Generated @@ -612,9 +913,22 @@ spec: - prune type: string pathTests: - description: PathTests are a series of existence tests that can be checked before a mutation is applied + description: |- + PathTests are a series of existence tests that can be checked + before a mutation is applied items: - description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + description: |- + PathTest allows the user to customize how the mutation works if parent + paths are missing. It traverses the list in order. All sub paths are + tested against the provided condition, if the test fails, the mutation is + not applied. All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. + + + Available Tests: + * MustExist - the path must exist or do not mutate + * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object @@ -648,7 +962,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -657,7 +973,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 diff --git a/charts/gatekeeper/crds/mutatorpodstatus-customresourcedefinition.yaml b/charts/gatekeeper/crds/mutatorpodstatus-customresourcedefinition.yaml index fd6a0f6..3711169 100644 --- a/charts/gatekeeper/crds/mutatorpodstatus-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/mutatorpodstatus-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.10.0 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: mutatorpodstatuses.status.gatekeeper.sh @@ -22,10 +23,19 @@ spec: description: MutatorPodStatus is the Schema for the mutationpodstatuses API. properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -41,7 +51,9 @@ spec: message: type: string type: - description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + description: |- + Type indicates a specific class of error for use by controller code. + If not present, the error should be treated as not matching any known type. type: string required: - message @@ -50,7 +62,10 @@ spec: id: type: string mutatorUID: - description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + description: |- + Storing the mutator UID allows us to detect drift, such as + when a mutator has been recreated after its CRD was deleted + out from under it, interrupting the watch type: string observedGeneration: format: int64 diff --git a/charts/gatekeeper/crds/provider-customresourcedefinition.yaml b/charts/gatekeeper/crds/provider-customresourcedefinition.yaml index 95e66a8..901c9cc 100644 --- a/charts/gatekeeper/crds/provider-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/provider-customresourcedefinition.yaml @@ -1,8 +1,9 @@ +--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.11.3 + controller-gen.kubebuilder.io/version: v0.14.0 labels: gatekeeper.sh/system: "yes" name: providers.externaldata.gatekeeper.sh @@ -24,10 +25,19 @@ spec: description: Provider is the Schema for the Provider API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -35,7 +45,9 @@ spec: description: Spec defines the Provider specifications. properties: caBundle: - description: CABundle is a base64-encoded string that contains the TLS CA bundle in PEM format. It is used to verify the signature of the provider's certificate. + description: |- + CABundle is a base64-encoded string that contains the TLS CA bundle in PEM format. + It is used to verify the signature of the provider's certificate. type: string timeout: description: Timeout is the timeout when querying the provider. @@ -53,10 +65,19 @@ spec: description: Provider is the Schema for the providers API properties: apiVersion: - description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: - description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object @@ -64,7 +85,9 @@ spec: description: Spec defines the Provider specifications. properties: caBundle: - description: CABundle is a base64-encoded string that contains the TLS CA bundle in PEM format. It is used to verify the signature of the provider's certificate. + description: |- + CABundle is a base64-encoded string that contains the TLS CA bundle in PEM format. + It is used to verify the signature of the provider's certificate. type: string timeout: description: Timeout is the timeout when querying the provider. diff --git a/charts/gatekeeper/crds/syncset-customresourcedefinition.yaml b/charts/gatekeeper/crds/syncset-customresourcedefinition.yaml new file mode 100644 index 0000000..6f055bf --- /dev/null +++ b/charts/gatekeeper/crds/syncset-customresourcedefinition.yaml @@ -0,0 +1,62 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + labels: + gatekeeper.sh/system: "yes" + name: syncsets.syncset.gatekeeper.sh +spec: + group: syncset.gatekeeper.sh + names: + kind: SyncSet + listKind: SyncSetList + plural: syncsets + singular: syncset + preserveUnknownFields: false + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: SyncSet defines which resources Gatekeeper will cache. The union of all SyncSets plus the syncOnly field of Gatekeeper's Config resource defines the sets of resources that will be synced. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + properties: + name: + maxLength: 63 + type: string + type: object + spec: + properties: + gvks: + items: + properties: + group: + type: string + kind: + type: string + version: + type: string + type: object + type: array + type: object + type: object + served: true + storage: true diff --git a/charts/gatekeeper/templates/_helpers.tpl b/charts/gatekeeper/templates/_helpers.tpl index c486ca0..c8ffb26 100644 --- a/charts/gatekeeper/templates/_helpers.tpl +++ b/charts/gatekeeper/templates/_helpers.tpl @@ -36,10 +36,63 @@ Adds additional pod labels to the common ones */}} {{- define "gatekeeper.podLabels" -}} {{- if .Values.podLabels }} -{{- toYaml .Values.podLabels | nindent 8 }} +{{- toYaml .Values.podLabels }} {{- end }} {{- end -}} +{{/* +Adds additional controller-manager pod labels to the common ones +*/}} +{{- define "controllerManager.podLabels" -}} +{{- if .Values.controllerManager.podLabels }} +{{- toYaml .Values.controllerManager.podLabels }} +{{- end }} +{{- end -}} + +{{/* +Adds additional audit pod labels to the common ones +*/}} +{{- define "audit.podLabels" -}} +{{- if .Values.audit.podLabels }} +{{- toYaml .Values.audit.podLabels }} +{{- end }} +{{- end -}} + + +{{/* +Mandatory labels +*/}} +{{- define "gatekeeper.mandatoryLabels" -}} +app: {{ include "gatekeeper.name" . }} +chart: {{ include "gatekeeper.name" . }} +gatekeeper.sh/system: "yes" +heritage: {{ .Release.Service }} +release: {{ .Release.Name }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "gatekeeper.commonLabels" -}} +helm.sh/chart: {{ include "gatekeeper.chart" . }} +{{ include "gatekeeper.selectorLabels" . }} +{{- if .Chart.Version }} +app.kubernetes.io/version: {{ .Chart.Version | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.commonLabels }} +{{ toYaml .Values.commonLabels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "gatekeeper.selectorLabels" -}} +app.kubernetes.io/name: {{ include "gatekeeper.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + {{/* Output post install webhook probe container entry */}} @@ -52,6 +105,7 @@ Output post install webhook probe container entry args: - "--retry" - "99999" + - "--retry-connrefused" - "--retry-max-time" - "{{ .Values.postInstall.probeWebhook.waitTimeout }}" - "--retry-delay" diff --git a/charts/gatekeeper/templates/gatekeeper-admin-podsecuritypolicy.yaml b/charts/gatekeeper/templates/gatekeeper-admin-podsecuritypolicy.yaml index 398b146..8c02264 100644 --- a/charts/gatekeeper/templates/gatekeeper-admin-podsecuritypolicy.yaml +++ b/charts/gatekeeper/templates/gatekeeper-admin-podsecuritypolicy.yaml @@ -5,11 +5,8 @@ metadata: annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' labels: - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.mandatoryLabels" . | nindent 4 }} + {{- include "gatekeeper.commonLabels" . | nindent 4 }} name: gatekeeper-admin spec: allowPrivilegeEscalation: false diff --git a/charts/gatekeeper/templates/gatekeeper-admin-serviceaccount.yaml b/charts/gatekeeper/templates/gatekeeper-admin-serviceaccount.yaml index 4b68998..4fd37c8 100644 --- a/charts/gatekeeper/templates/gatekeeper-admin-serviceaccount.yaml +++ b/charts/gatekeeper/templates/gatekeeper-admin-serviceaccount.yaml @@ -1,3 +1,5 @@ +--- +{{- if .Values.serviceAccount.gatekeeperAdmin.create }} apiVersion: v1 kind: ServiceAccount metadata: @@ -9,3 +11,4 @@ metadata: release: '{{ .Release.Name }}' name: gatekeeper-admin namespace: '{{ .Release.Namespace }}' +{{- end }} diff --git a/charts/gatekeeper/templates/gatekeeper-audit-deployment.yaml b/charts/gatekeeper/templates/gatekeeper-audit-deployment.yaml index a2437ef..03e2d6b 100644 --- a/charts/gatekeeper/templates/gatekeeper-audit-deployment.yaml +++ b/charts/gatekeeper/templates/gatekeeper-audit-deployment.yaml @@ -1,3 +1,5 @@ +--- +{{- if not .Values.disableAudit }} apiVersion: apps/v1 kind: Deployment metadata: @@ -13,6 +15,7 @@ metadata: namespace: '{{ .Release.Namespace }}' spec: replicas: 1 + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} selector: matchLabels: app: '{{ template "gatekeeper.name" . }}' @@ -28,8 +31,13 @@ spec: {{- if .Values.podAnnotations }} {{- toYaml .Values.podAnnotations | trim | nindent 8 }} {{- end }} + {{- if .Values.auditPodAnnotations }} + {{- toYaml .Values.auditPodAnnotations | trim | nindent 8 }} + {{- end }} labels: -{{- include "gatekeeper.podLabels" . }} + {{- include "gatekeeper.podLabels" . | nindent 8 }} + {{- include "audit.podLabels" . | nindent 8 }} + {{- include "gatekeeper.commonLabels" . | nindent 8 }} app: '{{ template "gatekeeper.name" . }}' chart: '{{ template "gatekeeper.name" . }}' control-plane: audit-controller @@ -60,6 +68,11 @@ spec: - --audit-events-involved-namespace={{ .Values.auditEventsInvolvedNamespace }} - --operation=audit - --operation=status + {{ if .Values.audit.enablePubsub}} + - --enable-pub-sub={{ .Values.audit.enablePubsub }} + - --audit-connection={{ .Values.audit.connection }} + - --audit-channel={{ .Values.audit.channel }} + {{- end }} {{ if not .Values.disableMutation}}- --operation=mutation-status{{- end }} - --logtostderr - --health-addr=:{{ .Values.audit.healthPort }} @@ -75,6 +88,16 @@ spec: - --log-file={{ .Values.audit.logFile }} {{- end }} - --disable-cert-rotation={{ or .Values.audit.disableCertRotation .Values.externalCertInjection.enabled }} + - --external-data-provider-response-cache-ttl={{ .Values.externaldataProviderResponseCacheTTL }} + - --enable-k8s-native-validation={{ .Values.enableK8sNativeValidation }} + + {{- if hasKey .Values "defaultCreateVAPForTemplates"}} + - --default-create-vap-for-templates={{ .Values.defaultCreateVAPForTemplates }} + {{- end }} + + {{- if hasKey .Values "defaultCreateVAPBindingForConstraints"}} + - --default-create-vap-binding-for-constraints={{ .Values.defaultCreateVAPBindingForConstraints }} + {{- end }} command: - /manager env: @@ -94,6 +117,8 @@ spec: fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager + - name: OTEL_RESOURCE_ATTRIBUTES + value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) imagePullPolicy: '{{ .Values.image.pullPolicy }}' livenessProbe: httpGet: @@ -138,7 +163,7 @@ spec: {{- end }} securityContext: {{- toYaml .Values.audit.podSecurityContext | nindent 8 }} - serviceAccountName: gatekeeper-admin + serviceAccountName: {{ .Values.audit.serviceAccount.name }} terminationGracePeriodSeconds: 60 tolerations: {{- toYaml .Values.audit.tolerations | nindent 8 }} @@ -154,3 +179,4 @@ spec: - emptyDir: {} {{- end }} name: tmp-volume +{{- end }} diff --git a/charts/gatekeeper/templates/gatekeeper-controller-manager-deployment.yaml b/charts/gatekeeper/templates/gatekeeper-controller-manager-deployment.yaml index 95ddefa..4f2927c 100644 --- a/charts/gatekeeper/templates/gatekeeper-controller-manager-deployment.yaml +++ b/charts/gatekeeper/templates/gatekeeper-controller-manager-deployment.yaml @@ -1,3 +1,4 @@ +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -13,6 +14,7 @@ metadata: namespace: '{{ .Release.Namespace }}' spec: replicas: {{ .Values.replicas }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} selector: matchLabels: app: '{{ template "gatekeeper.name" . }}' @@ -22,6 +24,12 @@ spec: gatekeeper.sh/system: "yes" heritage: '{{ .Release.Service }}' release: '{{ .Release.Name }}' + strategy: + {{- if .Values.controllerManager.strategyRollingUpdate }} + rollingUpdate: + {{- toYaml .Values.controllerManager.strategyRollingUpdate | nindent 6 }} + {{- end }} + type: {{ .Values.controllerManager.strategyType }} template: metadata: annotations: @@ -29,7 +37,9 @@ spec: {{- toYaml .Values.podAnnotations | trim | nindent 8 }} {{- end }} labels: -{{- include "gatekeeper.podLabels" . }} + {{- include "gatekeeper.podLabels" . | nindent 8 }} + {{- include "controllerManager.podLabels" . | nindent 8 }} + {{- include "gatekeeper.commonLabels" . | nindent 8 }} app: '{{ template "gatekeeper.name" . }}' chart: '{{ template "gatekeeper.name" . }}' control-plane: controller-manager @@ -65,6 +75,10 @@ spec: - --disable-cert-rotation={{ .Values.controllerManager.disableCertRotation }} - --max-serving-threads={{ .Values.maxServingThreads }} - --tls-min-version={{ .Values.controllerManager.tlsMinVersion }} + - --validating-webhook-configuration-name={{ .Values.validatingWebhookName }} + - --mutating-webhook-configuration-name={{ .Values.mutatingWebhookName }} + - --external-data-provider-response-cache-ttl={{ .Values.externaldataProviderResponseCacheTTL }} + - --enable-k8s-native-validation={{ .Values.enableK8sNativeValidation }} {{ if ne .Values.controllerManager.clientCertName "" }}- --client-cert-name={{ .Values.controllerManager.clientCertName }}{{- end }} {{- range .Values.metricsBackends}} @@ -92,6 +106,14 @@ spec: {{- if .Values.controllerManager.logFile}} - --log-file={{ .Values.controllerManager.logFile }} {{- end }} + + {{- if hasKey .Values "defaultCreateVAPForTemplates"}} + - --default-create-vap-for-templates={{ .Values.defaultCreateVAPForTemplates }} + {{- end }} + + {{- if hasKey .Values "defaultCreateVAPBindingForConstraints"}} + - --default-create-vap-binding-for-constraints={{ .Values.defaultCreateVAPBindingForConstraints }} + {{- end }} command: - /manager env: @@ -111,6 +133,8 @@ spec: fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager + - name: OTEL_RESOURCE_ATTRIBUTES + value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) imagePullPolicy: '{{ .Values.image.pullPolicy }}' livenessProbe: httpGet: @@ -156,7 +180,7 @@ spec: {{- end }} securityContext: {{- toYaml .Values.controllerManager.podSecurityContext | nindent 8 }} - serviceAccountName: gatekeeper-admin + serviceAccountName: {{ .Values.controllerManager.serviceAccount.name }} terminationGracePeriodSeconds: 60 tolerations: {{- toYaml .Values.controllerManager.tolerations | nindent 8 }} diff --git a/charts/gatekeeper/templates/gatekeeper-controller-manager-network-policy.yaml b/charts/gatekeeper/templates/gatekeeper-controller-manager-network-policy.yaml index e05213f..5ac3ca6 100644 --- a/charts/gatekeeper/templates/gatekeeper-controller-manager-network-policy.yaml +++ b/charts/gatekeeper/templates/gatekeeper-controller-manager-network-policy.yaml @@ -3,16 +3,15 @@ kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: labels: - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.mandatoryLabels" . | nindent 4 }} + {{- include "gatekeeper.commonLabels" . | nindent 4 }} name: gatekeeper-controller-manager spec: ingress: - from: - podSelector: matchLabels: + {{- include "gatekeeper.commonLabels" . | nindent 14 }} app: '{{ template "gatekeeper.name" . }}' release: '{{ .Release.Name }}' {{- with .Values.controllerManager.networkPolicy.ingress }} @@ -20,11 +19,8 @@ spec: {{- end }} podSelector: matchLabels: - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' + {{- include "gatekeeper.mandatoryLabels" . | nindent 6 }} + {{- include "gatekeeper.commonLabels" . | nindent 6 }} control-plane: controller-manager gatekeeper.sh/operation: webhook - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' {{- end -}} diff --git a/charts/gatekeeper/templates/gatekeeper-controller-manager-poddisruptionbudget.yaml b/charts/gatekeeper/templates/gatekeeper-controller-manager-poddisruptionbudget.yaml index 424f6a6..140c55f 100644 --- a/charts/gatekeeper/templates/gatekeeper-controller-manager-poddisruptionbudget.yaml +++ b/charts/gatekeeper/templates/gatekeeper-controller-manager-poddisruptionbudget.yaml @@ -1,5 +1,6 @@ -{{- $v1 := .Capabilities.APIVersions.Has "policy/v1/PodDisruptionBudget" -}} -{{- $v1beta1 := .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" -}} +--- +{{ $v1 := .Capabilities.APIVersions.Has "policy/v1/PodDisruptionBudget" -}} +{{ $v1beta1 := .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" -}} apiVersion: policy/v1{{- if and (not $v1) $v1beta1 -}}beta1{{- end }} kind: PodDisruptionBudget metadata: diff --git a/charts/gatekeeper/templates/gatekeeper-critical-pods-resourcequota.yaml b/charts/gatekeeper/templates/gatekeeper-critical-pods-resourcequota.yaml index 1546463..356e877 100644 --- a/charts/gatekeeper/templates/gatekeeper-critical-pods-resourcequota.yaml +++ b/charts/gatekeeper/templates/gatekeeper-critical-pods-resourcequota.yaml @@ -1,3 +1,4 @@ +--- {{- if .Values.resourceQuota }} apiVersion: v1 kind: ResourceQuota diff --git a/charts/gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml b/charts/gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml index a57b2b8..a6306b3 100644 --- a/charts/gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml +++ b/charts/gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml @@ -1,8 +1,8 @@ +--- {{- if .Values.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - creationTimestamp: null labels: app: '{{ template "gatekeeper.name" . }}' chart: '{{ template "gatekeeper.name" . }}' @@ -38,6 +38,19 @@ rules: - patch - update - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingadmissionpolicies + - validatingadmissionpolicybindings + verbs: + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - apiextensions.k8s.io resources: @@ -82,6 +95,18 @@ rules: - patch - update - watch +- apiGroups: + - expansion.gatekeeper.sh + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - update + - watch - apiGroups: - externaldata.gatekeeper.sh resources: diff --git a/charts/gatekeeper/templates/gatekeeper-manager-role-role.yaml b/charts/gatekeeper/templates/gatekeeper-manager-role-role.yaml index 1018dcd..0a5eecf 100644 --- a/charts/gatekeeper/templates/gatekeeper-manager-role-role.yaml +++ b/charts/gatekeeper/templates/gatekeeper-manager-role-role.yaml @@ -1,8 +1,8 @@ +--- {{- if .Values.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: - creationTimestamp: null labels: app: '{{ template "gatekeeper.name" . }}' chart: '{{ template "gatekeeper.name" . }}' diff --git a/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-clusterrolebinding.yaml b/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-clusterrolebinding.yaml index 1fb9f6c..3c876bd 100644 --- a/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-clusterrolebinding.yaml +++ b/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-clusterrolebinding.yaml @@ -1,3 +1,4 @@ +--- {{- if .Values.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding diff --git a/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-rolebinding.yaml b/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-rolebinding.yaml index fbe9580..a932d59 100644 --- a/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-rolebinding.yaml +++ b/charts/gatekeeper/templates/gatekeeper-manager-rolebinding-rolebinding.yaml @@ -1,3 +1,4 @@ +--- {{- if .Values.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml b/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml index 0bc3bc4..6b48211 100644 --- a/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml +++ b/charts/gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml @@ -1,3 +1,4 @@ +--- {{- if not .Values.disableMutation }} apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration @@ -15,11 +16,20 @@ webhooks: - v1 - v1beta1 clientConfig: + {{- if .Values.mutatingWebhookURL }} + url: https://{{ .Values.mutatingWebhookURL }}/v1/mutate + {{- else }} service: name: gatekeeper-webhook-service namespace: '{{ .Release.Namespace }}' path: /v1/mutate + {{- end }} failurePolicy: {{ .Values.mutatingWebhookFailurePolicy }} + {{- if .Values.mutatingWebhookMatchConditions }} + {{- if ge (int .Capabilities.KubeVersion.Minor) 28 }} + matchConditions: {{ toYaml .Values.mutatingWebhookMatchConditions | nindent 4 }} + {{- end }} + {{- end }} matchPolicy: Exact name: mutation.gatekeeper.sh namespaceSelector: @@ -39,7 +49,7 @@ webhooks: - {{ . }} {{- end }} {{- end }} - objectSelector: {{ toYaml .Values.mutatingWebhookObjectSelector }} + objectSelector: {{ toYaml .Values.mutatingWebhookObjectSelector | nindent 4 }} reinvocationPolicy: {{ .Values.mutatingWebhookReinvocationPolicy }} rules: {{- if .Values.mutatingWebhookCustomRules }} @@ -54,6 +64,21 @@ webhooks: - UPDATE resources: - '*' + - pods/ephemeralcontainers + - pods/exec + - pods/log + - pods/eviction + - pods/portforward + - pods/proxy + - pods/attach + - pods/binding + - deployments/scale + - replicasets/scale + - statefulsets/scale + - replicationcontrollers/scale + - services/proxy + - nodes/proxy + - services/status {{- end }} sideEffects: None timeoutSeconds: {{ .Values.mutatingWebhookTimeoutSeconds }} diff --git a/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml b/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml index f0dd85d..d2cdd77 100644 --- a/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml +++ b/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml @@ -1,3 +1,4 @@ +--- {{- if not .Values.disableValidatingWebhook }} apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -15,11 +16,20 @@ webhooks: - v1 - v1beta1 clientConfig: + {{- if .Values.validatingWebhookURL }} + url: https://{{ .Values.validatingWebhookURL }}/v1/admit + {{- else }} service: name: gatekeeper-webhook-service namespace: '{{ .Release.Namespace }}' path: /v1/admit + {{- end }} failurePolicy: {{ .Values.validatingWebhookFailurePolicy }} + {{- if .Values.validatingWebhookMatchConditions }} + {{- if ge (int .Capabilities.KubeVersion.Minor) 28 }} + matchConditions: {{ toYaml .Values.validatingWebhookMatchConditions | nindent 4 }} + {{- end }} + {{- end }} matchPolicy: Exact name: validation.gatekeeper.sh namespaceSelector: @@ -39,7 +49,7 @@ webhooks: - {{ . }} {{- end }} {{- end }} - objectSelector: {{ toYaml .Values.validatingWebhookObjectSelector }} + objectSelector: {{ toYaml .Values.validatingWebhookObjectSelector | nindent 4 }} rules: {{- if .Values.validatingWebhookCustomRules }} {{- toYaml .Values.validatingWebhookCustomRules | nindent 2 }} @@ -54,6 +64,9 @@ webhooks: {{- if .Values.enableDeleteOperations }} - DELETE {{- end }} + {{- if .Values.enableConnectOperations }} + - CONNECT + {{- end }} resources: - '*' # Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper). diff --git a/charts/gatekeeper/templates/gatekeeper-webhook-server-cert-secret.yaml b/charts/gatekeeper/templates/gatekeeper-webhook-server-cert-secret.yaml index a841780..79d331c 100644 --- a/charts/gatekeeper/templates/gatekeeper-webhook-server-cert-secret.yaml +++ b/charts/gatekeeper/templates/gatekeeper-webhook-server-cert-secret.yaml @@ -1,3 +1,4 @@ +--- {{- if not .Values.externalCertInjection.enabled }} apiVersion: v1 kind: Secret diff --git a/charts/gatekeeper/templates/gatekeeper-webhook-service-service.yaml b/charts/gatekeeper/templates/gatekeeper-webhook-service-service.yaml index 3c0f445..5773f39 100644 --- a/charts/gatekeeper/templates/gatekeeper-webhook-service-service.yaml +++ b/charts/gatekeeper/templates/gatekeeper-webhook-service-service.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Service metadata: diff --git a/charts/gatekeeper/templates/namespace-post-install.yaml b/charts/gatekeeper/templates/namespace-post-install.yaml index d152aee..2586ca2 100644 --- a/charts/gatekeeper/templates/namespace-post-install.yaml +++ b/charts/gatekeeper/templates/namespace-post-install.yaml @@ -5,11 +5,8 @@ metadata: name: gatekeeper-update-namespace-label namespace: {{ .Release.Namespace | quote }} labels: - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.mandatoryLabels" . | nindent 4 }} + {{- include "gatekeeper.commonLabels" . | nindent 4 }} annotations: "helm.sh/hook": post-install "helm.sh/hook-weight": "-5" @@ -23,19 +20,19 @@ spec: annotations: {{- toYaml .Values.podAnnotations | trim | nindent 8 }} labels: - {{- include "gatekeeper.podLabels" . }} - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.podLabels" . | nindent 8 }} + {{- include "gatekeeper.mandatoryLabels" . | nindent 8 }} + {{- include "gatekeeper.commonLabels" . | nindent 8 }} spec: restartPolicy: OnFailure + {{- if .Values.postInstall.labelNamespace.priorityClassName }} + priorityClassName: {{ .Values.postInstall.labelNamespace.priorityClassName }} + {{- end }} {{- if .Values.postInstall.labelNamespace.image.pullSecrets }} imagePullSecrets: {{- .Values.postInstall.labelNamespace.image.pullSecrets | toYaml | nindent 12 }} {{- end }} - serviceAccount: gatekeeper-update-namespace-label + serviceAccount: {{ .Values.postInstall.labelNamespace.serviceAccount.name }} {{- if .Values.postInstall.probeWebhook.enabled }} volumes: {{- include "gatekeeper.postInstallWebhookProbeVolume" . | nindent 8 }} @@ -93,18 +90,21 @@ spec: {{- toYaml .tolerations | nindent 8 }} {{- end }} --- +{{- if .Values.postInstall.labelNamespace.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount metadata: - name: gatekeeper-update-namespace-label + name: {{ .Values.postInstall.labelNamespace.serviceAccount.name }} namespace: {{ .Release.Namespace | quote }} labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: "helm.sh/hook": post-install "helm.sh/hook-weight": "-5" "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation +{{- end }} --- {{- if .Values.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 @@ -112,6 +112,7 @@ kind: ClusterRole metadata: name: gatekeeper-update-namespace-label labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -143,6 +144,7 @@ kind: ClusterRoleBinding metadata: name: gatekeeper-update-namespace-label labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -155,7 +157,7 @@ roleRef: name: gatekeeper-update-namespace-label subjects: - kind: ServiceAccount - name: gatekeeper-update-namespace-label + name: {{ .Values.postInstall.labelNamespace.serviceAccount.name }} namespace: {{ .Release.Namespace | quote }} {{- end }} {{- end }} diff --git a/charts/gatekeeper/templates/namespace-post-upgrade.yaml b/charts/gatekeeper/templates/namespace-post-upgrade.yaml index f1f7592..c758e40 100644 --- a/charts/gatekeeper/templates/namespace-post-upgrade.yaml +++ b/charts/gatekeeper/templates/namespace-post-upgrade.yaml @@ -5,11 +5,8 @@ metadata: name: gatekeeper-update-namespace-label-post-upgrade namespace: {{ .Release.Namespace | quote }} labels: - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.mandatoryLabels" . | nindent 4 }} + {{- include "gatekeeper.commonLabels" . | nindent 4 }} annotations: "helm.sh/hook": post-upgrade "helm.sh/hook-weight": "-5" @@ -21,19 +18,19 @@ spec: template: metadata: labels: - {{- include "gatekeeper.podLabels" . }} - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.podLabels" . | nindent 8 }} + {{- include "gatekeeper.mandatoryLabels" . | nindent 8 }} + {{- include "gatekeeper.commonLabels" . | nindent 8 }} spec: restartPolicy: OnFailure {{- if .Values.postUpgrade.labelNamespace.image.pullSecrets }} imagePullSecrets: {{- .Values.postUpgrade.labelNamespace.image.pullSecrets | toYaml | nindent 12 }} {{- end }} - serviceAccount: gatekeeper-update-namespace-label-post-upgrade + serviceAccount: {{ .Values.postUpgrade.labelNamespace.serviceAccount.name }} + {{- if .Values.postUpgrade.labelNamespace.priorityClassName }} + priorityClassName: {{ .Values.postUpgrade.labelNamespace.priorityClassName }} + {{- end }} containers: - name: kubectl-label image: "{{ .Values.postUpgrade.labelNamespace.image.repository }}:{{ .Values.postUpgrade.labelNamespace.image.tag }}" @@ -85,17 +82,20 @@ spec: {{- toYaml .nodeSelector | nindent 8 }} {{- end }} --- +{{- if .Values.postUpgrade.labelNamespace.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount metadata: - name: gatekeeper-update-namespace-label-post-upgrade + name: {{ .Values.postUpgrade.labelNamespace.serviceAccount.name }} labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: "helm.sh/hook": post-upgrade "helm.sh/hook-weight": "-5" "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation +{{- end }} --- {{- if .Values.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 @@ -103,6 +103,7 @@ kind: ClusterRole metadata: name: gatekeeper-update-namespace-label-post-upgrade labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -131,6 +132,7 @@ kind: ClusterRoleBinding metadata: name: gatekeeper-update-namespace-label-post-upgrade labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -143,7 +145,7 @@ roleRef: name: gatekeeper-update-namespace-label-post-upgrade subjects: - kind: ServiceAccount - name: gatekeeper-update-namespace-label-post-upgrade + name: {{ .Values.postUpgrade.labelNamespace.serviceAccount.name }} namespace: {{ .Release.Namespace | quote }} {{- end }} {{- end }} diff --git a/charts/gatekeeper/templates/probe-webhook-post-install.yaml b/charts/gatekeeper/templates/probe-webhook-post-install.yaml index 5a140d3..e6ef25b 100644 --- a/charts/gatekeeper/templates/probe-webhook-post-install.yaml +++ b/charts/gatekeeper/templates/probe-webhook-post-install.yaml @@ -5,11 +5,8 @@ kind: Job metadata: name: gatekeeper-probe-webhook-post-install labels: - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.mandatoryLabels" . | nindent 4 }} + {{- include "gatekeeper.commonLabels" . | nindent 4 }} annotations: "helm.sh/hook": post-install "helm.sh/hook-weight": "-5" @@ -20,14 +17,14 @@ spec: annotations: {{- toYaml .Values.podAnnotations | trim | nindent 8 }} labels: - {{- include "gatekeeper.podLabels" . }} - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.podLabels" . | nindent 8 }} + {{- include "gatekeeper.mandatoryLabels" . | nindent 8 }} + {{- include "gatekeeper.commonLabels" . | nindent 8 }} spec: restartPolicy: Never + {{- if .Values.postInstall.probeWebhook.priorityClassName }} + priorityClassName: {{ .Values.postInstall.probeWebhook.priorityClassName }} + {{- end }} {{- if .Values.postInstall.probeWebhook.image.pullSecrets }} imagePullSecrets: {{- .Values.postInstall.probeWebhook.image.pullSecrets | toYaml | nindent 12 }} @@ -44,5 +41,6 @@ spec: nodeSelector: {{- toYaml .nodeSelector | nindent 8 }} {{- end }} + backoffLimit: 3 {{- end }} {{- end }} diff --git a/charts/gatekeeper/templates/upgrade-crds-hook.yaml b/charts/gatekeeper/templates/upgrade-crds-hook.yaml index 07b74d9..a0f1ed4 100644 --- a/charts/gatekeeper/templates/upgrade-crds-hook.yaml +++ b/charts/gatekeeper/templates/upgrade-crds-hook.yaml @@ -5,6 +5,7 @@ kind: ClusterRole metadata: name: gatekeeper-admin-upgrade-crds labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -26,6 +27,7 @@ kind: ClusterRoleBinding metadata: name: gatekeeper-admin-upgrade-crds labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -34,7 +36,7 @@ metadata: helm.sh/hook-weight: "1" subjects: - kind: ServiceAccount - name: gatekeeper-admin-upgrade-crds + name: {{ .Values.upgradeCRDs.serviceAccount.name }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole @@ -42,18 +44,21 @@ roleRef: apiGroup: rbac.authorization.k8s.io {{- end }} --- +{{- if .Values.upgradeCRDs.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount metadata: labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} - name: gatekeeper-admin-upgrade-crds + name: {{ .Values.upgradeCRDs.serviceAccount.name }} namespace: '{{ .Release.Namespace }}' annotations: helm.sh/hook: pre-install,pre-upgrade helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" helm.sh/hook-weight: "1" +{{- end }} --- apiVersion: batch/v1 kind: Job @@ -61,36 +66,33 @@ metadata: name: gatekeeper-update-crds-hook namespace: {{ .Release.Namespace }} labels: - app: {{ template "gatekeeper.name" . }} - chart: {{ template "gatekeeper.name" . }} - gatekeeper.sh/system: "yes" - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + {{- include "gatekeeper.mandatoryLabels" . | nindent 4 }} + {{- include "gatekeeper.commonLabels" . | nindent 4 }} annotations: helm.sh/hook: pre-install,pre-upgrade helm.sh/hook-weight: "1" helm.sh/hook-delete-policy: "hook-succeeded,before-hook-creation" spec: - backoffLimit: 0 + backoffLimit: 3 template: metadata: name: gatekeeper-update-crds-hook annotations: {{- toYaml .Values.podAnnotations | trim | nindent 8 }} labels: - {{- include "gatekeeper.podLabels" . }} - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.podLabels" . | nindent 8 }} + {{- include "gatekeeper.mandatoryLabels" . | nindent 8 }} + {{- include "gatekeeper.commonLabels" . | nindent 8 }} spec: - serviceAccountName: gatekeeper-admin-upgrade-crds + serviceAccountName: {{ .Values.upgradeCRDs.serviceAccount.name }} restartPolicy: Never {{- if .Values.image.pullSecrets }} imagePullSecrets: {{- toYaml .Values.image.pullSecrets | nindent 8 }} {{- end }} + {{- if .Values.upgradeCRDs.priorityClassName }} + priorityClassName: {{ .Values.upgradeCRDs.priorityClassName }} + {{- end }} containers: - name: crds-upgrade {{- if .Values.preInstall.crdRepository.image.repository }} diff --git a/charts/gatekeeper/templates/webhook-configs-pre-delete.yaml b/charts/gatekeeper/templates/webhook-configs-pre-delete.yaml index ec52f3a..19c6ff0 100644 --- a/charts/gatekeeper/templates/webhook-configs-pre-delete.yaml +++ b/charts/gatekeeper/templates/webhook-configs-pre-delete.yaml @@ -5,11 +5,8 @@ metadata: name: gatekeeper-delete-webhook-configs namespace: {{ .Release.Namespace | quote }} labels: - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.mandatoryLabels" . | nindent 4 }} + {{- include "gatekeeper.commonLabels" . | nindent 4 }} annotations: "helm.sh/hook": pre-delete "helm.sh/hook-weight": "-5" @@ -20,19 +17,19 @@ spec: annotations: {{- toYaml .Values.podAnnotations | trim | nindent 8 }} labels: - {{- include "gatekeeper.podLabels" . }} - app: '{{ template "gatekeeper.name" . }}' - chart: '{{ template "gatekeeper.name" . }}' - gatekeeper.sh/system: "yes" - heritage: '{{ .Release.Service }}' - release: '{{ .Release.Name }}' + {{- include "gatekeeper.podLabels" . | nindent 8 }} + {{- include "gatekeeper.mandatoryLabels" . | nindent 8 }} + {{- include "gatekeeper.commonLabels" . | nindent 8 }} spec: restartPolicy: OnFailure {{- if .Values.preUninstall.deleteWebhookConfigurations.image.pullSecrets }} imagePullSecrets: {{- .Values.preUninstall.deleteWebhookConfigurations.image.pullSecrets | toYaml | nindent 12 }} {{- end }} - serviceAccount: gatekeeper-delete-webhook-configs + serviceAccount: {{ .Values.preUninstall.deleteWebhookConfigurations.serviceAccount.name }} + {{- if .Values.preUninstall.deleteWebhookConfigurations.priorityClassName }} + priorityClassName: {{ .Values.preUninstall.deleteWebhookConfigurations.priorityClassName }} + {{- end }} containers: - name: kubectl-delete image: "{{ .Values.preUninstall.deleteWebhookConfigurations.image.repository }}:{{ .Values.preUninstall.deleteWebhookConfigurations.image.tag }}" @@ -46,13 +43,13 @@ spec: - mutatingwebhookconfiguration/{{ .Values.mutatingWebhookName }} {{- end }} resources: - {{- toYaml .Values.preUninstall.resources | nindent 10 }} + {{- toYaml .Values.preUninstall.resources | nindent 12 }} securityContext: {{- if .Values.enableRuntimeDefaultSeccompProfile }} seccompProfile: type: RuntimeDefault {{- end }} - {{- toYaml .Values.preUninstall.securityContext | nindent 10 }} + {{- toYaml .Values.preUninstall.securityContext | nindent 12 }} {{- with .Values.preUninstall }} nodeSelector: {{- toYaml .nodeSelector | nindent 8 }} @@ -62,18 +59,21 @@ spec: {{- toYaml .tolerations | nindent 8 }} {{- end }} --- +{{- if .Values.preUninstall.deleteWebhookConfigurations.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount metadata: - name: gatekeeper-delete-webhook-configs + name: {{ .Values.preUninstall.deleteWebhookConfigurations.serviceAccount.name }} namespace: {{ .Release.Namespace | quote }} labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: "helm.sh/hook": pre-delete "helm.sh/hook-weight": "-5" "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation +{{- end }} --- {{- if .Values.rbac.create }} apiVersion: rbac.authorization.k8s.io/v1 @@ -81,6 +81,7 @@ kind: ClusterRole metadata: name: gatekeeper-delete-webhook-configs labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -119,6 +120,7 @@ kind: ClusterRoleBinding metadata: name: gatekeeper-delete-webhook-configs labels: + {{- include "gatekeeper.commonLabels" . | nindent 4 }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: @@ -131,7 +133,7 @@ roleRef: name: gatekeeper-delete-webhook-configs subjects: - kind: ServiceAccount - name: gatekeeper-delete-webhook-configs + name: {{ .Values.preUninstall.deleteWebhookConfigurations.name }} namespace: {{ .Release.Namespace | quote }} {{- end }} {{- end }} diff --git a/charts/gatekeeper/values.yaml b/charts/gatekeeper/values.yaml index a14ea55..ac6e336 100644 --- a/charts/gatekeeper/values.yaml +++ b/charts/gatekeeper/values.yaml @@ -1,9 +1,11 @@ replicas: 3 +revisionHistoryLimit: 10 auditInterval: 60 metricsBackends: ["prometheus"] auditMatchKindOnly: false constraintViolationsLimit: 20 auditFromCache: false +disableAudit: false disableMutation: false disableValidatingWebhook: false validatingWebhookName: gatekeeper-validating-webhook-configuration @@ -12,11 +14,14 @@ validatingWebhookFailurePolicy: Ignore validatingWebhookAnnotations: {} validatingWebhookExemptNamespacesLabels: {} validatingWebhookObjectSelector: {} +validatingWebhookMatchConditions: [] validatingWebhookCheckIgnoreFailurePolicy: Fail validatingWebhookCustomRules: {} +validatingWebhookURL: null enableDeleteOperations: false +enableConnectOperations: false enableExternalData: true -enableGeneratorResourceExpansion: false +enableGeneratorResourceExpansion: true enableTLSHealthcheck: false maxServingThreads: -1 mutatingWebhookName: gatekeeper-mutating-webhook-configuration @@ -25,8 +30,10 @@ mutatingWebhookReinvocationPolicy: Never mutatingWebhookAnnotations: {} mutatingWebhookExemptNamespacesLabels: {} mutatingWebhookObjectSelector: {} +mutatingWebhookMatchConditions: [] mutatingWebhookTimeoutSeconds: 1 mutatingWebhookCustomRules: {} +mutatingWebhookURL: null mutationAnnotations: false auditChunkSize: 500 logLevel: INFO @@ -37,34 +44,39 @@ emitAuditEvents: false admissionEventsInvolvedNamespace: false auditEventsInvolvedNamespace: false resourceQuota: true +externaldataProviderResponseCacheTTL: 3m +enableK8sNativeValidation: true image: repository: openpolicyagent/gatekeeper crdRepository: openpolicyagent/gatekeeper-crds - release: v3.12.0 + release: v3.17.1 pullPolicy: IfNotPresent pullSecrets: [] preInstall: crdRepository: image: repository: null - tag: v3.12.0 + tag: v3.17.1 postUpgrade: labelNamespace: + serviceAccount: + name: gatekeeper-update-namespace-label-post-upgrade + create: true enabled: false image: repository: openpolicyagent/gatekeeper-crds - tag: v3.12.0 + tag: v3.17.1 pullPolicy: IfNotPresent pullSecrets: [] extraNamespaces: [] - podSecurity: - - "pod-security.kubernetes.io/audit=restricted" - - "pod-security.kubernetes.io/audit-version=latest" - - "pod-security.kubernetes.io/warn=restricted" - - "pod-security.kubernetes.io/warn-version=latest" - - "pod-security.kubernetes.io/enforce=restricted" - - "pod-security.kubernetes.io/enforce-version=v1.24" + podSecurity: ["pod-security.kubernetes.io/audit=restricted", + "pod-security.kubernetes.io/audit-version=latest", + "pod-security.kubernetes.io/warn=restricted", + "pod-security.kubernetes.io/warn-version=latest", + "pod-security.kubernetes.io/enforce=restricted", + "pod-security.kubernetes.io/enforce-version=v1.24"] extraAnnotations: {} + priorityClassName: "" affinity: {} tolerations: [] nodeSelector: {kubernetes.io/os: linux} @@ -80,22 +92,25 @@ postUpgrade: runAsUser: 1000 postInstall: labelNamespace: + serviceAccount: + name: gatekeeper-update-namespace-label + create: true enabled: true extraRules: [] image: repository: openpolicyagent/gatekeeper-crds - tag: v3.12.0 + tag: v3.17.1 pullPolicy: IfNotPresent pullSecrets: [] extraNamespaces: [] - podSecurity: - - "pod-security.kubernetes.io/audit=restricted" - - "pod-security.kubernetes.io/audit-version=latest" - - "pod-security.kubernetes.io/warn=restricted" - - "pod-security.kubernetes.io/warn-version=latest" - - "pod-security.kubernetes.io/enforce=restricted" - - "pod-security.kubernetes.io/enforce-version=v1.24" + podSecurity: ["pod-security.kubernetes.io/audit=restricted", + "pod-security.kubernetes.io/audit-version=latest", + "pod-security.kubernetes.io/warn=restricted", + "pod-security.kubernetes.io/warn-version=latest", + "pod-security.kubernetes.io/enforce=restricted", + "pod-security.kubernetes.io/enforce-version=v1.24"] extraAnnotations: {} + priorityClassName: "" probeWebhook: enabled: true image: @@ -106,6 +121,7 @@ postInstall: waitTimeout: 60 httpTimeout: 2 insecureHTTPS: false + priorityClassName: "" affinity: {} tolerations: [] nodeSelector: {kubernetes.io/os: linux} @@ -120,13 +136,17 @@ postInstall: runAsUser: 1000 preUninstall: deleteWebhookConfigurations: + serviceAccount: + name: gatekeeper-delete-webhook-configs + create: true extraRules: [] enabled: false image: repository: openpolicyagent/gatekeeper-crds - tag: v3.12.0 + tag: v3.17.1 pullPolicy: IfNotPresent pullSecrets: [] + priorityClassName: "" affinity: {} tolerations: [] nodeSelector: {kubernetes.io/os: linux} @@ -141,11 +161,14 @@ preUninstall: runAsNonRoot: true runAsUser: 1000 podAnnotations: {} +auditPodAnnotations: {} podLabels: {} podCountLimit: "100" secretAnnotations: {} enableRuntimeDefaultSeccompProfile: true controllerManager: + serviceAccount: + name: gatekeeper-admin exemptNamespaces: [] exemptNamespacePrefixes: [] hostNetwork: false @@ -159,6 +182,9 @@ controllerManager: disableCertRotation: false tlsMinVersion: 1.3 clientCertName: "" + strategyType: RollingUpdate + strategyRollingUpdate: {} + podLabels: {} affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -196,11 +222,16 @@ controllerManager: extraRules: [] networkPolicy: enabled: false - ingress: {} + ingress: { } # - from: # - ipBlock: # cidr: 0.0.0.0/0 audit: + serviceAccount: + name: gatekeeper-admin + enablePubsub: false + connection: audit-connection + channel: audit-channel hostNetwork: false dnsPolicy: ClusterFirst metricsPort: 8888 @@ -208,7 +239,8 @@ audit: readinessTimeout: 1 livenessTimeout: 1 priorityClassName: system-cluster-critical - disableCertRotation: true + disableCertRotation: false + podLabels: {} affinity: {} tolerations: [] nodeSelector: {kubernetes.io/os: linux} @@ -253,15 +285,22 @@ pdb: service: {} disabledBuiltins: ["{http.send}"] psp: - enabled: true + enabled: false upgradeCRDs: + serviceAccount: + create: true + name: gatekeeper-admin-upgrade-crds enabled: true extraRules: [] + priorityClassName: "" rbac: create: true externalCertInjection: enabled: false secretName: gatekeeper-webhook-server-cert +serviceAccount: + gatekeeperAdmin: + create: true podMonitor: enabled: false extraLabels: {} From c334ceb4e99613cd6131a462168706f6e50f80b2 Mon Sep 17 00:00:00 2001 From: qizhicheng Date: Tue, 29 Oct 2024 12:41:45 +0800 Subject: [PATCH 2/3] ci --- charts/gatekeeper/values.yaml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/charts/gatekeeper/values.yaml b/charts/gatekeeper/values.yaml index ac6e336..16478ed 100644 --- a/charts/gatekeeper/values.yaml +++ b/charts/gatekeeper/values.yaml @@ -69,12 +69,14 @@ postUpgrade: pullPolicy: IfNotPresent pullSecrets: [] extraNamespaces: [] - podSecurity: ["pod-security.kubernetes.io/audit=restricted", + podSecurity: [ + "pod-security.kubernetes.io/audit=restricted", "pod-security.kubernetes.io/audit-version=latest", "pod-security.kubernetes.io/warn=restricted", "pod-security.kubernetes.io/warn-version=latest", "pod-security.kubernetes.io/enforce=restricted", - "pod-security.kubernetes.io/enforce-version=v1.24"] + "pod-security.kubernetes.io/enforce-version=v1.24" + ] extraAnnotations: {} priorityClassName: "" affinity: {} @@ -103,12 +105,14 @@ postInstall: pullPolicy: IfNotPresent pullSecrets: [] extraNamespaces: [] - podSecurity: ["pod-security.kubernetes.io/audit=restricted", + podSecurity: [ + "pod-security.kubernetes.io/audit=restricted", "pod-security.kubernetes.io/audit-version=latest", "pod-security.kubernetes.io/warn=restricted", "pod-security.kubernetes.io/warn-version=latest", "pod-security.kubernetes.io/enforce=restricted", - "pod-security.kubernetes.io/enforce-version=v1.24"] + "pod-security.kubernetes.io/enforce-version=v1.24" + ] extraAnnotations: {} priorityClassName: "" probeWebhook: @@ -222,7 +226,7 @@ controllerManager: extraRules: [] networkPolicy: enabled: false - ingress: { } + ingress: {} # - from: # - ipBlock: # cidr: 0.0.0.0/0 From 312c9b35e840a6fb91b4e7de5a919bd7343c08ec Mon Sep 17 00:00:00 2001 From: qizhicheng Date: Tue, 29 Oct 2024 12:43:39 +0800 Subject: [PATCH 3/3] add maintainer --- charts/gatekeeper/Chart.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/charts/gatekeeper/Chart.yaml b/charts/gatekeeper/Chart.yaml index 97ce48c..d864319 100644 --- a/charts/gatekeeper/Chart.yaml +++ b/charts/gatekeeper/Chart.yaml @@ -9,3 +9,5 @@ home: https://github.com/open-policy-agent/gatekeeper sources: - https://github.com/open-policy-agent/gatekeeper.git appVersion: v3.17.1 +maintainers: +- name: LeoQuote