Skip to content

Commit 229d143

Browse files
julianKatzjulianKatz
committed
Upgrade controller-gen to 0.5.0
In support of the move to v1 CRDs, we will need up-to-date generation tooling. Gatekeeper was still on controller-gen 0.3.0, so this PR updates that to 0.5.0. One notable detail here is the removal of the caBundle field from the webhook configurations. This is not a mistake. This field was related to a bug in k8s that is now fixed, and thus the field was removed from the generated output in controller-gen 0.4.1. See kubernetes-sigs/controller-tools#495 for more info. This PR contributes to open-policy-agent#550 Signed-off-by: juliankatz <[email protected]>
1 parent f6d0fc9 commit 229d143

16 files changed

+86
-215
lines changed

‎Makefile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,6 @@ MANAGER_IMAGE_PATCH := "apiVersion: apps/v1\
6767

6868
FRAMEWORK_PACKAGE := github.com/open-policy-agent/frameworks/constraint
6969

70-
# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
71-
CRD_OPTIONS ?= crd:trivialVersions=true
72-
7370
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
7471
ifeq (,$(shell go env GOBIN))
7572
GOBIN=$(shell go env GOPATH)/bin
@@ -175,7 +172,11 @@ deploy: patch-image manifests
175172

176173
# Generate manifests e.g. CRD, RBAC etc.
177174
manifests: __controller-gen
178-
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./apis/..." paths="./pkg/..." output:crd:artifacts:config=config/crd/bases
175+
$(CONTROLLER_GEN) \
176+
crd:trivialVersions=true,crdVersions="v1beta1" \
177+
rbac:roleName=manager-role \
178+
webhook paths="./apis/..." \
179+
output:crd:artifacts:config=config/crd/bases
179180
rm -rf manifest_staging
180181
mkdir -p manifest_staging/deploy
181182
mkdir -p manifest_staging/charts/gatekeeper

‎build/tooling/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
FROM golang:1.16
22

3-
RUN GO111MODULE=on go get sigs.k8s.io/controller-tools/cmd/controller-gen@v0.3.0
3+
RUN GO111MODULE=on go get sigs.k8s.io/controller-tools/cmd/controller-gen@v0.5.0
44

55
RUN mkdir /gatekeeper
66
WORKDIR /gatekeeper

‎config/crd/bases/config.gatekeeper.sh_configs.yaml

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1beta1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.3.0
7+
controller-gen.kubebuilder.io/version: v0.5.0
88
creationTimestamp: null
99
name: configs.config.gatekeeper.sh
1010
spec:
@@ -20,14 +20,10 @@ spec:
2020
description: Config is the Schema for the configs API
2121
properties:
2222
apiVersion:
23-
description: 'APIVersion defines the versioned schema of this representation
24-
of an object. Servers should convert recognized schemas to the latest
25-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
23+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2624
type: string
2725
kind:
28-
description: 'Kind is a string value representing the REST resource this
29-
object represents. Servers may infer this from the endpoint the client
30-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
26+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
3127
type: string
3228
metadata:
3329
type: object
@@ -58,8 +54,7 @@ spec:
5854
description: Configuration for syncing k8s objects
5955
properties:
6056
syncOnly:
61-
description: If non-empty, only entries on this list will be replicated
62-
into OPA
57+
description: If non-empty, only entries on this list will be replicated into OPA
6358
items:
6459
properties:
6560
group:
@@ -75,13 +70,11 @@ spec:
7570
description: Configuration for validation
7671
properties:
7772
traces:
78-
description: List of requests to trace. Both "user" and "kinds"
79-
must be specified
73+
description: List of requests to trace. Both "user" and "kinds" must be specified
8074
items:
8175
properties:
8276
dump:
83-
description: Also dump the state of OPA with the trace. Set
84-
to `All` to dump everything.
77+
description: Also dump the state of OPA with the trace. Set to `All` to dump everything.
8578
type: string
8679
kind:
8780
description: Only trace requests of the following GroupVersionKind

‎config/crd/bases/mutations.gatekeeper.sh_assign.yaml

Lines changed: 25 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ apiVersion: apiextensions.k8s.io/v1beta1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
controller-gen.kubebuilder.io/version: v0.3.0
7+
controller-gen.kubebuilder.io/version: v0.5.0
88
creationTimestamp: null
99
name: assign.mutations.gatekeeper.sh
1010
spec:
@@ -20,26 +20,20 @@ spec:
2020
description: Assign is the Schema for the assign API
2121
properties:
2222
apiVersion:
23-
description: 'APIVersion defines the versioned schema of this representation
24-
of an object. Servers should convert recognized schemas to the latest
25-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
23+
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
2624
type: string
2725
kind:
28-
description: 'Kind is a string value representing the REST resource this
29-
object represents. Servers may infer this from the endpoint the client
30-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
26+
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
3127
type: string
3228
metadata:
3329
type: object
3430
spec:
3531
description: AssignSpec defines the desired state of Assign
3632
properties:
3733
applyTo:
38-
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
39-
Important: Run "make" to regenerate code after modifying this file'
34+
description: 'INSERT ADDITIONAL SPEC FIELDS - desired state of cluster Important: Run "make" to regenerate code after modifying this file'
4035
items:
41-
description: ApplyTo determines what GVKs items the mutation should
42-
apply to. Globs are not allowed.
36+
description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed.
4337
properties:
4438
groups:
4539
items:
@@ -65,16 +59,10 @@ spec:
6559
type: array
6660
kinds:
6761
items:
68-
description: Kinds accepts a list of objects with apiGroups and
69-
kinds fields that list the groups/kinds of objects to which
70-
the mutation will apply. If multiple groups/kinds objects are
71-
specified, only one match is needed for the resource to be in
72-
scope.
62+
description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope.
7363
properties:
7464
apiGroups:
75-
description: APIGroups is the API groups the resources belong
76-
to. '*' is all groups. If '*' is present, the length of
77-
the slice must be one. Required.
65+
description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required.
7866
items:
7967
type: string
8068
type: array
@@ -85,34 +73,21 @@ spec:
8573
type: object
8674
type: array
8775
labelSelector:
88-
description: A label selector is a label query over a set of resources.
89-
The result of matchLabels and matchExpressions are ANDed. An empty
90-
label selector matches all objects. A null label selector matches
91-
no objects.
76+
description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
9277
properties:
9378
matchExpressions:
94-
description: matchExpressions is a list of label selector requirements.
95-
The requirements are ANDed.
79+
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
9680
items:
97-
description: A label selector requirement is a selector that
98-
contains values, a key, and an operator that relates the
99-
key and values.
81+
description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
10082
properties:
10183
key:
102-
description: key is the label key that the selector applies
103-
to.
84+
description: key is the label key that the selector applies to.
10485
type: string
10586
operator:
106-
description: operator represents a key's relationship
107-
to a set of values. Valid operators are In, NotIn, Exists
108-
and DoesNotExist.
87+
description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
10988
type: string
11089
values:
111-
description: values is an array of string values. If the
112-
operator is In or NotIn, the values array must be non-empty.
113-
If the operator is Exists or DoesNotExist, the values
114-
array must be empty. This array is replaced during a
115-
strategic merge patch.
90+
description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
11691
items:
11792
type: string
11893
type: array
@@ -124,42 +99,25 @@ spec:
12499
matchLabels:
125100
additionalProperties:
126101
type: string
127-
description: matchLabels is a map of {key,value} pairs. A single
128-
{key,value} in the matchLabels map is equivalent to an element
129-
of matchExpressions, whose key field is "key", the operator
130-
is "In", and the values array contains only "value". The requirements
131-
are ANDed.
102+
description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
132103
type: object
133104
type: object
134105
namespaceSelector:
135-
description: A label selector is a label query over a set of resources.
136-
The result of matchLabels and matchExpressions are ANDed. An empty
137-
label selector matches all objects. A null label selector matches
138-
no objects.
106+
description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
139107
properties:
140108
matchExpressions:
141-
description: matchExpressions is a list of label selector requirements.
142-
The requirements are ANDed.
109+
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
143110
items:
144-
description: A label selector requirement is a selector that
145-
contains values, a key, and an operator that relates the
146-
key and values.
111+
description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
147112
properties:
148113
key:
149-
description: key is the label key that the selector applies
150-
to.
114+
description: key is the label key that the selector applies to.
151115
type: string
152116
operator:
153-
description: operator represents a key's relationship
154-
to a set of values. Valid operators are In, NotIn, Exists
155-
and DoesNotExist.
117+
description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
156118
type: string
157119
values:
158-
description: values is an array of string values. If the
159-
operator is In or NotIn, the values array must be non-empty.
160-
If the operator is Exists or DoesNotExist, the values
161-
array must be empty. This array is replaced during a
162-
strategic merge patch.
120+
description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
163121
items:
164122
type: string
165123
type: array
@@ -171,20 +129,15 @@ spec:
171129
matchLabels:
172130
additionalProperties:
173131
type: string
174-
description: matchLabels is a map of {key,value} pairs. A single
175-
{key,value} in the matchLabels map is equivalent to an element
176-
of matchExpressions, whose key field is "key", the operator
177-
is "In", and the values array contains only "value". The requirements
178-
are ANDed.
132+
description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
179133
type: object
180134
type: object
181135
namespaces:
182136
items:
183137
type: string
184138
type: array
185139
scope:
186-
description: ResourceScope is an enum defining the different scopes
187-
available to a custom resource
140+
description: ResourceScope is an enum defining the different scopes available to a custom resource
188141
type: string
189142
type: object
190143
parameters:
@@ -194,24 +147,14 @@ spec:
194147
type: object
195148
x-kubernetes-preserve-unknown-fields: true
196149
assignIf:
197-
description: once https://github.com/kubernetes-sigs/controller-tools/pull/528
198-
is merged, we can use an actual object
150+
description: once https://github.com/kubernetes-sigs/controller-tools/pull/528 is merged, we can use an actual object
199151
type: object
200152
pathTests:
201153
items:
202-
description: "PathTest allows the user to customize how the mutation
203-
works if parent paths are missing. It traverses the list in
204-
order. All sub paths are tested against the provided condition,
205-
if the test fails, the mutation is not applied. All `subPath`
206-
entries must be a prefix of `location`. Any glob characters
207-
will take on the same value as was used to expand the matching
208-
glob in `location`. \n Available Tests: * MustExist - the
209-
path must exist or do not mutate * MustNotExist - the path must
210-
not exist or do not mutate"
154+
description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate"
211155
properties:
212156
condition:
213-
description: Condition describes whether the path either MustExist
214-
or MustNotExist in the original object
157+
description: Condition describes whether the path either MustExist or MustNotExist in the original object
215158
enum:
216159
- MustExist
217160
- MustNotExist

0 commit comments

Comments
 (0)