Skip to content

Commit 90423db

Browse files
ritazhritazh
committed
feat: vap generation
Signed-off-by: Rita Zhang <[email protected]>
1 parent b758571 commit 90423db

File tree

102 files changed

+1673
-446
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

102 files changed

+1673
-446
lines changed

‎.github/workflows/workflow.yaml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
5151
with:
5252
# version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
53-
version: v1.54.2
53+
version: v1.55.2
5454

5555
test:
5656
name: "Unit test"
@@ -178,7 +178,7 @@ jobs:
178178
IMG=gatekeeper-e2e:latest \
179179
USE_LOCAL_IMG=true
180180
181-
make test-e2e
181+
make test-e2e KUBERNETES_VERSION=${{ matrix.KUBERNETES_VERSION }} ENABLE_VAP_TESTS=1
182182
183183
- name: Save logs
184184
if: ${{ always() }}
@@ -219,6 +219,7 @@ jobs:
219219
make e2e-bootstrap
220220
221221
- name: Run e2e
222+
# TODO(ritazh): add helm chart values for vap feature before alpha release
222223
run: |
223224
make docker-buildx \
224225
IMG=gatekeeper-e2e:latest \
@@ -288,7 +289,7 @@ jobs:
288289
make e2e-bootstrap
289290
290291
- name: Run e2e
291-
run: |
292+
run: | # TODO(ritazh): set ENABLE_VAP_TESTS=1 before alpha release
292293
make docker-buildx \
293294
IMG=gatekeeper-e2e:latest
294295

‎Makefile

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ KUSTOMIZE_VERSION ?= 3.8.9
2323
BATS_VERSION ?= 1.8.2
2424
ORAS_VERSION ?= 0.16.0
2525
BATS_TESTS_FILE ?= test/bats/test.bats
26+
KIND_CLUSTER_FILE ?= test/bats/tests/kindcluster.yml
2627
HELM_VERSION ?= 3.7.2
2728
NODE_VERSION ?= 16-bullseye-slim
2829
YQ_VERSION ?= 4.30.6
@@ -32,7 +33,7 @@ GATEKEEPER_NAMESPACE ?= gatekeeper-system
3233

3334
# When updating this, make sure to update the corresponding action in
3435
# workflow.yaml
35-
GOLANGCI_LINT_VERSION := v1.51.2
36+
GOLANGCI_LINT_VERSION := v1.55.2
3637

3738
# Detects the location of the user golangci-lint cache.
3839
GOLANGCI_LINT_CACHE := $(shell pwd)/.tmp/golangci-lint
@@ -70,6 +71,9 @@ MANAGER_IMAGE_PATCH := "apiVersion: apps/v1\
7071
\n - --disable-opa-builtin=http.send\
7172
\n - --log-mutations\
7273
\n - --mutation-annotations\
74+
\n - --vap-enforcement=GATEKEEPER_DEFAULT\
75+
\n - --validate-template-rego=false\
76+
\n - --experimental-enable-k8s-native-validation\
7377
\n---\
7478
\napiVersion: apps/v1\
7579
\nkind: Deployment\
@@ -89,7 +93,11 @@ MANAGER_IMAGE_PATCH := "apiVersion: apps/v1\
8993
\n - --operation=status\
9094
\n - --operation=mutation-status\
9195
\n - --audit-chunk-size=500\
92-
\n - --logtostderr"
96+
\n - --logtostderr\
97+
\n - --vap-enforcement=GATEKEEPER_DEFAULT\
98+
\n - --validate-template-rego=false\
99+
\n - --experimental-enable-k8s-native-validation\
100+
\n"
93101

94102
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
95103
ifeq (,$(shell go env GOBIN))
@@ -160,8 +168,10 @@ KIND_NODE_VERSION := kindest/node:v$(KUBERNETES_VERSION)
160168
e2e-bootstrap: e2e-dependencies
161169
# Check for existing kind cluster
162170
if [ $$(${GITHUB_WORKSPACE}/bin/kind get clusters) ]; then ${GITHUB_WORKSPACE}/bin/kind delete cluster; fi
171+
163172
# Create a new kind cluster
164-
TERM=dumb ${GITHUB_WORKSPACE}/bin/kind create cluster --image $(KIND_NODE_VERSION) --wait 5m
173+
# TODO(ritazh): remove KIND_CLUSTER_FILE when vap feature is GA
174+
if [ $$(echo $(KUBERNETES_VERSION) | cut -d'.' -f2) -lt 28 ]; then ${GITHUB_WORKSPACE}/bin/kind create cluster --image $(KIND_NODE_VERSION) --wait 5m; else ${GITHUB_WORKSPACE}/bin/kind create cluster --config $(KIND_CLUSTER_FILE) --image $(KIND_NODE_VERSION) --wait 5m; fi
165175

166176
e2e-build-load-image: docker-buildx e2e-build-load-externaldata-image
167177
kind load docker-image --name kind ${IMG} ${CRD_IMG}

‎apis/status/v1beta1/constraintpodstatus_types.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ type ConstraintPodStatusStatus struct {
4646
ObservedGeneration int64 `json:"observedGeneration,omitempty"`
4747
}
4848

49-
// Error represents a single error caught while adding a constraint to OPA.
49+
// Error represents a single error caught while adding a constraint to engine.
5050
type Error struct {
5151
Code string `json:"code"`
5252
Message string `json:"message"`

‎cmd/build/helmify/main.go

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,10 @@ var kindRegex = regexp.MustCompile(`(?m)^kind:[\s]+([\S]+)[\s]*$`)
2121
// use exactly two spaces to be sure we are capturing metadata.name.
2222
var nameRegex = regexp.MustCompile(`(?m)^ name:[\s]+([\S]+)[\s]*$`)
2323

24-
const DeploymentKind = "Deployment"
24+
const (
25+
DeploymentKind = "Deployment"
26+
end = "{{- end }}"
27+
)
2528

2629
func isRbacKind(str string) bool {
2730
rbacKinds := [4]string{"Role", "ClusterRole", "RoleBinding", "ClusterRoleBinding"}
@@ -105,12 +108,12 @@ func (ks *kindSet) Write() error {
105108
fileName := fmt.Sprintf("%s-%s.yaml", strings.ToLower(name), strings.ToLower(kind))
106109

107110
if name == "validation.gatekeeper.sh" {
108-
obj = "{{- if not .Values.disableValidatingWebhook }}\n" + obj + "{{- end }}\n"
111+
obj = "{{- if not .Values.disableValidatingWebhook }}\n" + obj + end + "\n"
109112
fileName = fmt.Sprintf("gatekeeper-validating-webhook-configuration-%s.yaml", strings.ToLower(kind))
110113
}
111114

112115
if name == "mutation.gatekeeper.sh" {
113-
obj = "{{- if not .Values.disableMutation }}\n" + obj + "{{- end }}\n"
116+
obj = "{{- if not .Values.disableMutation }}\n" + obj + end + "\n"
114117
fileName = fmt.Sprintf("gatekeeper-mutating-webhook-configuration-%s.yaml", strings.ToLower(kind))
115118
}
116119

@@ -121,7 +124,7 @@ func (ks *kindSet) Write() error {
121124
}
122125

123126
if name == "gatekeeper-critical-pods" && kind == "ResourceQuota" {
124-
obj = "{{- if .Values.resourceQuota }}\n" + obj + "{{- end }}\n"
127+
obj = "{{- if .Values.resourceQuota }}\n" + obj + end + "\n"
125128
}
126129

127130
if name == "gatekeeper-controller-manager" && kind == DeploymentKind {
@@ -145,7 +148,7 @@ func (ks *kindSet) Write() error {
145148
}
146149

147150
if isRbacKind(kind) {
148-
obj = "{{- if .Values.rbac.create }}\n" + obj + "{{- end }}\n"
151+
obj = "{{- if .Values.rbac.create }}\n" + obj + end + "\n"
149152
}
150153

151154
if name == "gatekeeper-controller-manager" && kind == "PodDisruptionBudget" {

‎config/crd/bases/status.gatekeeper.sh_constraintpodstatuses.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ spec:
4646
errors:
4747
items:
4848
description: Error represents a single error caught while adding
49-
a constraint to OPA.
49+
a constraint to engine.
5050
properties:
5151
code:
5252
type: string

‎config/rbac/role.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,19 @@ rules:
3232
- patch
3333
- update
3434
- watch
35+
- apiGroups:
36+
- admissionregistration.k8s.io
37+
resources:
38+
- validatingadmissionpolicies
39+
- validatingadmissionpolicybindings
40+
verbs:
41+
- create
42+
- delete
43+
- get
44+
- list
45+
- patch
46+
- update
47+
- watch
3548
- apiGroups:
3649
- apiextensions.k8s.io
3750
resources:

‎demo/k8s-validating-admission-policy/k8srequiredlabels_template.yaml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ apiVersion: templates.gatekeeper.sh/v1
22
kind: ConstraintTemplate
33
metadata:
44
name: k8srequiredlabels
5+
labels:
6+
"gatekeeper.sh/use-vap": "yes"
57
spec:
68
crd:
79
spec:
@@ -29,7 +31,7 @@ spec:
2931
- engine: K8sNativeValidation
3032
source:
3133
validations:
32-
- expression: "variables.params.labels.all(entry, has(object.metadata.labels) && entry.key in object.metadata.labels)"
34+
- expression: '[object, oldObject].exists(obj, obj != null && has(obj.metadata) && variables.params.labels.all(entry, has(obj.metadata.labels) && entry.key in obj.metadata.labels))'
3335
messageExpression: '"missing required label, requires all of: " + variables.params.labels.map(entry, entry.key).join(", ")'
34-
- expression: "!variables.params.labels.exists(entry, has(object.metadata.labels) && entry.key in object.metadata.labels && !string(object.metadata.labels[entry.key]).matches(string(entry.allowedRegex)))"
36+
- expression: '[object, oldObject].exists(obj, obj != null && !variables.params.labels.exists(entry, has(obj.metadata.labels) && entry.key in obj.metadata.labels && !string(obj.metadata.labels[entry.key]).matches(string(entry.allowedRegex))))'
3537
message: "regex mismatch"

‎demo/k8s-validating-admission-policy/owner_must_be_provided.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@ apiVersion: constraints.gatekeeper.sh/v1beta1
22
kind: K8sRequiredLabels
33
metadata:
44
name: all-must-have-owner
5+
labels:
6+
"gatekeeper.sh/use-vap": "yes"
57
spec:
68
match:
79
kinds:

‎go.mod

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ require (
1616
github.com/golang/protobuf v1.5.3
1717
github.com/google/go-cmp v0.6.0
1818
github.com/google/uuid v1.5.0
19-
github.com/onsi/gomega v1.27.10
19+
github.com/onsi/gomega v1.31.1
2020
github.com/open-policy-agent/cert-controller v0.8.0
21-
github.com/open-policy-agent/frameworks/constraint v0.0.0-20240110234408-18fa1fc7dc06
21+
github.com/open-policy-agent/frameworks/constraint v0.0.0-20240212182527-37bcf5fc60a4
2222
github.com/pkg/errors v0.9.1
2323
github.com/prometheus/client_golang v1.16.0
2424
github.com/spf13/cobra v1.8.0
@@ -33,7 +33,7 @@ require (
3333
go.opentelemetry.io/otel/sdk/metric v1.19.0
3434
go.uber.org/automaxprocs v1.5.3
3535
go.uber.org/zap v1.24.0
36-
golang.org/x/net v0.19.0
36+
golang.org/x/net v0.21.0
3737
golang.org/x/oauth2 v0.13.0
3838
golang.org/x/sync v0.5.0
3939
golang.org/x/time v0.5.0
@@ -143,10 +143,10 @@ require (
143143
go.opentelemetry.io/proto/otlp v1.0.0 // indirect
144144
go.uber.org/atomic v1.11.0 // indirect
145145
go.uber.org/multierr v1.11.0 // indirect
146-
golang.org/x/crypto v0.17.0 // indirect
146+
golang.org/x/crypto v0.19.0 // indirect
147147
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
148-
golang.org/x/sys v0.15.0 // indirect
149-
golang.org/x/term v0.15.0 // indirect
148+
golang.org/x/sys v0.17.0 // indirect
149+
golang.org/x/term v0.17.0 // indirect
150150
golang.org/x/text v0.14.0 // indirect
151151
gomodules.xyz/jsonpatch/v2 v2.3.0 // indirect
152152
google.golang.org/api v0.149.0 // indirect

‎go.sum

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -257,13 +257,13 @@ github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7P
257257
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
258258
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
259259
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
260-
github.com/onsi/ginkgo/v2 v2.11.0 h1:WgqUCUt/lT6yXoQ8Wef0fsNn5cAuMK7+KT9UFRz2tcU=
261-
github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
262-
github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
260+
github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY=
261+
github.com/onsi/gomega v1.31.1 h1:KYppCUK+bUgAZwHOu7EXVBKyQA6ILvOESHkn/tgoqvo=
262+
github.com/onsi/gomega v1.31.1/go.mod h1:y40C95dwAD1Nz36SsEnxvfFe8FFfNxzI5eJ0EYGyAy0=
263263
github.com/open-policy-agent/cert-controller v0.8.0 h1:pao3WCLsKGz5dSWSlNUFrNFQdXtVTQ3lVDgk2IelH34=
264264
github.com/open-policy-agent/cert-controller v0.8.0/go.mod h1:alotCQRwX4M6VEwEgO53FB6nGLSlvah6L0pWxSRslIk=
265-
github.com/open-policy-agent/frameworks/constraint v0.0.0-20240110234408-18fa1fc7dc06 h1:scXMWxph905CdmX5HkFJXipCtG+wT1ynxw31G9qSrMk=
266-
github.com/open-policy-agent/frameworks/constraint v0.0.0-20240110234408-18fa1fc7dc06/go.mod h1:Gl2I/z5dxvTOwa/ANYGGOkUqE4M0CbQpln0Ia/7KVro=
265+
github.com/open-policy-agent/frameworks/constraint v0.0.0-20240212182527-37bcf5fc60a4 h1:P0YvMEnfCME/gKr/3IzDuHwJhQFoMFZTP0v8QQq08lU=
266+
github.com/open-policy-agent/frameworks/constraint v0.0.0-20240212182527-37bcf5fc60a4/go.mod h1:MoEB2MwxsQL+xUDG6WdIpJ6gU+gEQuiBre67F3C+p3I=
267267
github.com/open-policy-agent/opa v0.60.0 h1:ZPoPt4yeNs5UXCpd/P/btpSyR8CR0wfhVoh9BOwgJNs=
268268
github.com/open-policy-agent/opa v0.60.0/go.mod h1:aD5IK6AiLNYBjNXn7E02++yC8l4Z+bRDvgM6Ss0bBzA=
269269
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -385,8 +385,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
385385
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
386386
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
387387
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
388-
golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
389-
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
388+
golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
389+
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
390390
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
391391
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e h1:+WEEuIdZHnUeJJmEUjyYC2gfUMj69yZXw17EnHg/otA=
392392
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e/go.mod h1:Kr81I6Kryrl9sr8s2FK3vxD90NdsKWRuOIl2O4CvYbA=
@@ -414,8 +414,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
414414
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
415415
golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
416416
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
417-
golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
418-
golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
417+
golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
418+
golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
419419
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
420420
golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
421421
golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
@@ -446,12 +446,12 @@ golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBc
446446
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
447447
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
448448
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
449-
golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
450-
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
449+
golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
450+
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
451451
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
452452
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
453-
golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
454-
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
453+
golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
454+
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
455455
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
456456
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
457457
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=

‎main.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ import (
4646
"github.com/open-policy-agent/gatekeeper/v3/pkg/cachemanager"
4747
"github.com/open-policy-agent/gatekeeper/v3/pkg/controller"
4848
"github.com/open-policy-agent/gatekeeper/v3/pkg/controller/config/process"
49+
"github.com/open-policy-agent/gatekeeper/v3/pkg/controller/constraint"
4950
"github.com/open-policy-agent/gatekeeper/v3/pkg/expansion"
5051
"github.com/open-policy-agent/gatekeeper/v3/pkg/externaldata"
5152
"github.com/open-policy-agent/gatekeeper/v3/pkg/metrics"
@@ -131,6 +132,7 @@ func init() {
131132

132133
// +kubebuilder:scaffold:scheme
133134
flag.Var(disabledBuiltins, "disable-opa-builtin", "disable opa built-in function, this flag can be declared more than once.")
135+
flag.Var(&constraint.VapEnforcement, "vap-enforcement", "control VAP resource generation. Allowed values are NONE:do not generate, GATEKEEPER_DEFAULT:do not generate unless label gatekeeper.sh/use-vap: yes is added to policy explicitly, VAP_DEFAULT: generate unless label gatekeeper.sh/use-vap: no is added to policy explicitly.")
134136
}
135137

136138
func main() {

‎manifest_staging/charts/gatekeeper/crds/constraintpodstatus-customresourcedefinition.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ spec:
3939
type: boolean
4040
errors:
4141
items:
42-
description: Error represents a single error caught while adding a constraint to OPA.
42+
description: Error represents a single error caught while adding a constraint to engine.
4343
properties:
4444
code:
4545
type: string

‎manifest_staging/charts/gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,19 @@ rules:
3838
- patch
3939
- update
4040
- watch
41+
- apiGroups:
42+
- admissionregistration.k8s.io
43+
resources:
44+
- validatingadmissionpolicies
45+
- validatingadmissionpolicybindings
46+
verbs:
47+
- create
48+
- delete
49+
- get
50+
- list
51+
- patch
52+
- update
53+
- watch
4154
- apiGroups:
4255
- apiextensions.k8s.io
4356
resources:

‎manifest_staging/deploy/gatekeeper.yaml

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1829,7 +1829,7 @@ spec:
18291829
type: boolean
18301830
errors:
18311831
items:
1832-
description: Error represents a single error caught while adding a constraint to OPA.
1832+
description: Error represents a single error caught while adding a constraint to engine.
18331833
properties:
18341834
code:
18351835
type: string
@@ -3496,6 +3496,19 @@ rules:
34963496
- patch
34973497
- update
34983498
- watch
3499+
- apiGroups:
3500+
- admissionregistration.k8s.io
3501+
resources:
3502+
- validatingadmissionpolicies
3503+
- validatingadmissionpolicybindings
3504+
verbs:
3505+
- create
3506+
- delete
3507+
- get
3508+
- list
3509+
- patch
3510+
- update
3511+
- watch
34993512
- apiGroups:
35003513
- apiextensions.k8s.io
35013514
resources:

‎pkg/controller/config/config_controller_suite_test.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,17 @@ import (
3131
var cfg *rest.Config
3232

3333
func TestMain(m *testing.M) {
34+
apiserverFlags := []string{
35+
"--runtime-config=api/all=true",
36+
"--feature-gates=ValidatingAdmissionPolicy=true",
37+
}
3438
t := &envtest.Environment{
3539
CRDDirectoryPaths: []string{
3640
filepath.Join("..", "..", "..", "vendor", "github.com", "open-policy-agent", "frameworks", "constraint", "deploy", "crds.yaml"),
3741
filepath.Join("..", "..", "..", "config", "crd", "bases"),
3842
},
3943
ErrorIfCRDPathMissing: true,
44+
KubeAPIServerFlags: apiserverFlags,
4045
}
4146
if err := apis.AddToScheme(scheme.Scheme); err != nil {
4247
stdlog.Fatal(err)

‎pkg/controller/constraint/constants.go

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
package constraint
2+
3+
const (
4+
// VapGenerationLabel indicates opting in and out preference for generating VAP objects.
5+
VapGenerationLabel = "gatekeeper.sh/use-vap"
6+
// VapFlagNone:do not generate.
7+
VapFlagNone = "NONE"
8+
// VapFlagGatekeeperDefault:do not generate unless label gatekeeper.sh/use-vap: yes is added to policy explicitly.
9+
VapFlagGatekeeperDefault = "GATEKEEPER_DEFAULT"
10+
// VapFlagVapDefault: generate unless label gatekeeper.sh/use-vap: no is added to policy explicitly.
11+
VapFlagVapDefault = "VAP_DEFAULT"
12+
)

0 commit comments

Comments
 (0)