Convert to using beta resources.

.gitignore

@@ -16,7 +16,7 @@ bin
 *.out
 
 # Manager image patch file
-config/manager_image_patch.yaml
+config/overlays/dev/manager_image_patch.yaml
 
 # Kubernetes Generated files - skip generated files, except for vendored files
 

Makefile

@@ -62,14 +62,16 @@ install: manifests
 
 # Deploy controller in the configured Kubernetes cluster in ~/.kube/config
 deploy: manifests
-	touch -a ./config/manager_image_patch.yaml
+	touch -a ./overlays/dev/manager_image_patch.yaml
 	kubectl apply -f config/crds
-	kubectl apply -f vendor/github.com/open-policy-agent/frameworks/constraint/config/crds
-	kustomize build config | kubectl apply -f -
+	kubectl apply -f vendor/github.com/open-policy-agent/frameworks/constraint/deploy
+	kustomize build overlays/dev | kubectl apply -f -
 
 # Generate manifests e.g. CRD, RBAC etc.
 manifests:
 	go run vendor/sigs.k8s.io/controller-tools/cmd/controller-gen/main.go all
+	kustomize build config  -o deploy/gatekeeper.yaml
+	bash -c 'for x in vendor/github.com/open-policy-agent/frameworks/constraint/deploy/*.yaml ; do echo --- >> deploy/gatekeeper.yaml ; cat $${x} >> deploy/gatekeeper.yaml ; done'
 
 # Run go fmt against code
 fmt:
@@ -94,7 +96,7 @@ docker-tag-dev:
 # Tag for Dev
 docker-tag-release:
 	@docker tag $(IMG) $(REPOSITORY):$(VERSION)
-	@docker tag $(IMG) $(REPOSITORY):latest	
+	@docker tag $(IMG) $(REPOSITORY):latest
 
 # Push for Dev
 docker-push-dev:  docker-tag-dev
@@ -110,9 +112,9 @@ docker-build:
 	docker build . -t ${IMG}
 	@echo "updating kustomize image patch file for manager resource"
 
-	@test -s ./config/manager_image_patch.yaml || bash -c 'echo -e ${MANAGER_IMAGE_PATCH} > ./config/manager_image_patch.yaml'
+	@test -s ./overlays/dev/manager_image_patch.yaml || bash -c 'echo -e ${MANAGER_IMAGE_PATCH} > ./overlays/dev/manager_image_patch.yaml'
 
-	@sed -i'' -e 's@image: .*@image: '"${IMG}"'@' ./config/manager_image_patch.yaml
+	@sed -i'' -e 's@image: .*@image: '"${IMG}"'@' ./overlays/dev/manager_image_patch.yaml
 
 docker-build-ci:
 	docker build . -t $(IMG) -f Dockerfile_ci

README.md

@@ -144,7 +144,7 @@ spec:
 
         violation[{"msg": msg, "details": {"missing_labels": missing}}] {
           provided := {label | input.review.object.metadata.labels[label]}
-          required := {label | label := input.constraint.spec.parameters.labels[_]}
+          required := {label | label := input.parameters.labels[_]}
           missing := required - provided
           count(missing) > 0
           msg := sprintf("you must provide labels: %v", [missing])

cmd/manager/main.go

@@ -21,6 +21,7 @@ import (
 	"github.com/open-policy-agent/frameworks/constraint/pkg/client/drivers/local"
 	"github.com/open-policy-agent/gatekeeper/pkg/apis"
 	"github.com/open-policy-agent/gatekeeper/pkg/audit"
+	"github.com/open-policy-agent/gatekeeper/pkg/upgrade"
 	"github.com/open-policy-agent/gatekeeper/pkg/controller"
 	"github.com/open-policy-agent/gatekeeper/pkg/target"
 	"github.com/open-policy-agent/gatekeeper/pkg/webhook"
@@ -95,6 +96,12 @@ func main() {
 		os.Exit(1)
 	}
 
+	log.Info("setting up upgrade")
+	if err := upgrade.AddToManager(mgr); err != nil {
+		log.Error(err, "unable to register upgrade to the manager")
+		os.Exit(1)
+	}
+
 	// Start the Cmd
 	log.Info("Starting the Cmd.")
 	if err := mgr.Start(signals.SetupSignalHandler()); err != nil {

config/kustomization.yaml

@@ -21,9 +21,7 @@ resources:
 - rbac/rbac_role.yaml
 - rbac/rbac_role_binding.yaml
 - manager/manager.yaml
-
-patches:
-- manager_image_patch.yaml
+- crds/config_v1alpha1_config.yaml
 
 vars:
 - name: WEBHOOK_SECRET_NAME

config/manager/manager.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   labels:
+    control-plane: controller-manager
     controller-tools.k8s.io: "1.0"
   name: system
 ---
@@ -43,17 +44,19 @@ spec:
       containers:
       - command:
         - /root/manager
-        # args:
+        args:
+          - "--auditInterval=30"
           # - "--alsologtostderr"
           # - "--stderrthreshold=INFO"
           # - "-v=100"
-        image: controller:latest
+        image: quay.io/open-policy-agent/gatekeeper:v3.0.4-alpha.0
         imagePullPolicy: Always
         name: manager
         env:
           - name: POD_NAMESPACE
             valueFrom:
               fieldRef:
+                apiVersion: v1
                 fieldPath: metadata.namespace
           - name: POD_NAME
             valueFrom:
@@ -69,7 +72,7 @@ spec:
             cpu: 100m
             memory: 256Mi
         ports:
-        - containerPort: 9876
+        - containerPort: 443
           name: webhook-server
           protocol: TCP
         volumeMounts:

demo/agilebank/constraints/containers_must_be_limited.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sContainerLimits
 metadata:
   name: container-must-have-limits

demo/agilebank/constraints/owner_must_be_provided.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sRequiredLabels
 metadata:
   name: all-must-have-owner

demo/agilebank/constraints/prod_repo_is_openpolicyagent.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sAllowedRepos
 metadata:
   name: prod-repo-is-openpolicyagent

demo/agilebank/constraints/unique_service_selector.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sUniqueServiceSelector
 metadata:
   name: unique-service-selector

demo/agilebank/remediation/ban_latest_tag.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sBannedImageTags
 metadata:
   name: ban-latest-tag

demo/agilebank/remediation/k8sbannedimagetags_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8sbannedimagetags

demo/agilebank/templates/k8sallowedrepos_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8sallowedrepos
@@ -25,7 +25,7 @@ spec:
 
         violation[{"msg": msg}] {
           container := input.review.object.spec.containers[_]
-          satisfied := [good | repo = input.constraint.spec.parameters.repos[_] ; good = startswith(container.image, repo)]
+          satisfied := [good | repo = input.parameters.repos[_] ; good = startswith(container.image, repo)]
           not any(satisfied)
-          msg := sprintf("container <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.constraint.spec.parameters.repos])
+          msg := sprintf("container <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
         }

demo/agilebank/templates/k8scontainterlimits_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8scontainerlimits
@@ -166,7 +166,7 @@ spec:
           container := input.review.object.spec.containers[_]
           cpu_orig := container.resources.limits.cpu
           cpu := canonify_cpu(cpu_orig)
-          max_cpu_orig := input.constraint.spec.parameters.cpu
+          max_cpu_orig := input.parameters.cpu
           max_cpu := canonify_cpu(max_cpu_orig)
           cpu > max_cpu
           msg := sprintf("container <%v> cpu limit <%v> is higher than the maximum allowed of <%v>", [container.name, cpu_orig, max_cpu_orig])
@@ -176,7 +176,7 @@ spec:
           container := input.review.object.spec.containers[_]
           mem_orig := container.resources.limits.memory
           mem := canonify_mem(mem_orig)
-          max_mem_orig := input.constraint.spec.parameters.memory
+          max_mem_orig := input.parameters.memory
           max_mem := canonify_mem(max_mem_orig)
           mem > max_mem
           msg := sprintf("container <%v> memory limit <%v> is higher than the maximum allowed of <%v>", [container.name, mem_orig, max_mem_orig])

demo/agilebank/templates/k8srequiredlabels_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8srequiredlabels
@@ -30,31 +30,31 @@ spec:
       rego: |
         package k8srequiredlabels
 
-        get_message(constraint, _default) = msg {
-          not constraint.spec.parameters.message
+        get_message(parameters, _default) = msg {
+          not parameters.message
           msg := _default
         }
 
-        get_message(constraint, _default) = msg {
-          msg := constraint.spec.parameters.message
+        get_message(parameters, _default) = msg {
+          msg := parameters.message
         }
 
         violation[{"msg": msg, "details": {"missing_labels": missing}}] {
           provided := {label | input.review.object.metadata.labels[label]}
-          required := {label | label := input.constraint.spec.parameters.labels[_].key}
+          required := {label | label := input.parameters.labels[_].key}
           missing := required - provided
           count(missing) > 0
           def_msg := sprintf("you must provide labels: %v", [missing])
-          msg := get_message(input.constraint, def_msg)
+          msg := get_message(input.parameters, def_msg)
         }
 
         violation[{"msg": msg}] {
           value := input.review.object.metadata.labels[key]
-          expected := input.constraint.spec.parameters.labels[_]
+          expected := input.parameters.labels[_]
           expected.key == key
           # do not match if allowedRegex is not defined, or is an empty string
           expected.allowedRegex != ""
           not re_match(expected.allowedRegex, value)
           def_msg := sprintf("Label <%v: %v> does not satisfy allowed regex: %v", [key, value, expected.allowedRegex])
-          msg := get_message(input.constraint, def_msg)
+          msg := get_message(input.parameters, def_msg)
         }

demo/agilebank/templates/k8suniqueserviceselector_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8suniqueserviceselector

demo/basic/bad/bad_constraint_labelselector.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sUniqueLabel
 metadata:
   name: ns-gk-label-unique

demo/basic/bad/bad_schema.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sRequiredLabel
 metadata:
   name: bad-schema

demo/basic/bad/bad_schema2.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sRequiredLabel
 metadata:
   name: bad-schema

demo/basic/bad/bad_schema3.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sRequiredLabel
 metadata:
   name: bad-schema

demo/basic/bad/bad_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8suniquelabels

demo/basic/constraints/all_ns_gatekeeper_label_unique.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sUniqueLabel
 metadata:
   name: ns-gk-label-unique

demo/basic/constraints/all_ns_must_have_gatekeeper.yaml

@@ -1,4 +1,4 @@
-apiVersion: constraints.gatekeeper.sh/v1alpha1
+apiVersion: constraints.gatekeeper.sh/v1beta1
 kind: K8sRequiredLabels
 metadata:
   name: ns-must-have-gk

demo/basic/demo.sh

@@ -22,9 +22,9 @@ pe "cat good/good_ns.yaml"
 
 pe "kubectl apply -f good/good_ns.yaml"
 
-pe "cat templates/k8suniquelabels_template.yaml"
+pe "cat templates/k8suniquelabel_template.yaml"
 
-pe "kubectl apply -f templates/k8suniquelabels_template.yaml"
+pe "kubectl apply -f templates/k8suniquelabel_template.yaml"
 
 pe "kubectl apply -f constraints/all_ns_gatekeeper_label_unique.yaml"
 

demo/basic/templates/k8srequiredlabels_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8srequiredlabels
@@ -24,7 +24,7 @@ spec:
 
         violation[{"msg": msg, "details": {"missing_labels": missing}}] {
           provided := {label | input.review.object.metadata.labels[label]}
-          required := {label | label := input.constraint.spec.parameters.labels[_]}
+          required := {label | label := input.parameters.labels[_]}
           missing := required - provided
           count(missing) > 0
           msg := sprintf("you must provide labels: %v", [missing])

demo/basic/templates/k8srequiredlabels_template_external_data.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8srequiredlabels
@@ -24,7 +24,7 @@ spec:
 
         violation[{"msg": msg, "details": {"missing_labels": missing}}] {
           provided := {label | input.review.object.metadata.labels[label]}
-          required := {label | label := input.constraint.spec.parameters.labels[_]}
+          required := {label | label := input.parameters.labels[_]}
           missing := required - provided
           count(missing) > 0
           ns := [n | data.inventory.cluster.v1.Namespace[n]]

demo/basic/templates/k8suniquelabel_template.yaml

@@ -1,4 +1,4 @@
-apiVersion: templates.gatekeeper.sh/v1alpha1
+apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   name: k8suniquelabel
@@ -47,7 +47,7 @@ spec:
         }
 
         violation[{"msg": msg, "details": {"value": val, "label": label}}] {
-          label := input.constraint.spec.parameters.label
+          label := input.parameters.label
           val := input.review.object.metadata.labels[label]
           cluster_objs := [o | o = data.inventory.cluster[_][_][_]; not identical_cluster(o, input.review)]
           ns_objs := [o | o = data.inventory.namespace[_][_][_][_]; not identical_namespace(o, input.review)]