From e49da0e885e4f56cb280970449f2dd70c97fffe1 Mon Sep 17 00:00:00 2001 From: Diogo Souza Date: Wed, 16 Aug 2023 21:33:28 -0300 Subject: [PATCH] make prepare/patch gatekeeper 3.13.0 --- .../generated-changes/patch/Chart.yaml.patch | 6 ++-- .../generated-changes/patch/README.md.patch | 18 ++++++------ .../patch/templates/_helpers.tpl.patch | 2 +- .../gatekeeper-audit-deployment.yaml.patch | 8 ++--- ...r-controller-manager-deployment.yaml.patch | 8 ++--- ...keeper-manager-role-clusterrole.yaml.patch | 2 +- .../namespace-post-install.yaml.patch | 6 ++-- .../namespace-post-upgrade.yaml.patch | 8 ++--- .../probe-webhook-post-install.yaml.patch | 4 +-- .../templates/upgrade-crds-hook.yaml.patch | 9 +++--- .../webhook-configs-pre-delete.yaml.patch | 17 +++-------- .../generated-changes/patch/values.yaml.patch | 29 ++++++++++--------- packages/rancher-gatekeeper/package.yaml | 4 +-- 13 files changed, 57 insertions(+), 64 deletions(-) diff --git a/packages/rancher-gatekeeper/generated-changes/patch/Chart.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/Chart.yaml.patch index 622b464d5..c9078fdfd 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/Chart.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/Chart.yaml.patch @@ -5,7 +5,7 @@ + catalog.cattle.io/auto-install: rancher-gatekeeper-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: OPA Gatekeeper -+ catalog.cattle.io/kube-version: '>= 1.20.0-0 < 1.28.0-0' ++ catalog.cattle.io/kube-version: '>= 1.20.0-0' + catalog.cattle.io/namespace: cattle-gatekeeper-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows @@ -15,7 +15,7 @@ + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: gatekeeper apiVersion: v2 - appVersion: v3.12.0 + appVersion: v3.13.0 -description: A Helm chart for Gatekeeper +description: Modifies Open Policy Agent's upstream gatekeeper chart that provides + policy-based control for cloud native environments @@ -29,4 +29,4 @@ +name: rancher-gatekeeper sources: - https://github.com/open-policy-agent/gatekeeper.git - version: 3.12.0 + version: 3.13.0 diff --git a/packages/rancher-gatekeeper/generated-changes/patch/README.md.patch b/packages/rancher-gatekeeper/generated-changes/patch/README.md.patch index 49df9ac6e..5a9be3249 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/README.md.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/README.md.patch @@ -1,11 +1,11 @@ --- charts-original/README.md +++ charts/README.md -@@ -118,7 +118,7 @@ - | crds.nodeSelector | The node selector to use for pod scheduling in crds hook jobs | `kubernetes.io/os: linux` | - | crds.resources | The resource request/limits for the container image in crds hook jobs | `{}` | - | crds.securityContext | Security context applied to the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 65532, "runAsNonRoot": true, "runAsUser": 65532 }` | --| auditInterval | The frequency with which audit is run | `60` | -+| auditInterval | The frequency with which audit is run | `300` | - | constraintViolationsLimit | The maximum # of audit violations reported on a constraint | `20` | - | auditFromCache | Take the roster of resources to audit from the audit cache | `false` | - | auditChunkSize | Chunk size for listing cluster resources for audit (alpha feature) | `500` | +@@ -129,7 +129,7 @@ + | crds.nodeSelector | The node selector to use for pod scheduling in crds hook jobs | `kubernetes.io/os: linux` | + | crds.resources | The resource request/limits for the container image in crds hook jobs | `{}` | + | crds.securityContext | Security context applied to the container | `{ "allowPrivilegeEscalation": false, "capabilities": "drop": [all], "readOnlyRootFilesystem": true, "runAsGroup": 65532, "runAsNonRoot": true, "runAsUser": 65532 }` | +-| auditInterval | The frequency with which audit is run | `60` | ++| auditInterval | The frequency with which audit is run | `300` | + | constraintViolationsLimit | The maximum # of audit violations reported on a constraint | `20` | + | auditFromCache | Take the roster of resources to audit from the audit cache | `false` | + | auditChunkSize | Chunk size for listing cluster resources for audit (alpha feature) | `500` | diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/_helpers.tpl.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/_helpers.tpl.patch index dcd1cbdee..ce45c3b67 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/_helpers.tpl.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/_helpers.tpl.patch @@ -37,7 +37,7 @@ imagePullPolicy: {{ .Values.postInstall.probeWebhook.image.pullPolicy }} command: - "curl" -@@ -69,10 +92,10 @@ +@@ -70,10 +93,10 @@ resources: {{- toYaml .Values.postInstall.resources | nindent 4 }} securityContext: diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-audit-deployment.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-audit-deployment.yaml.patch index 67a3e0e96..b6aae9fa0 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-audit-deployment.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-audit-deployment.yaml.patch @@ -1,6 +1,6 @@ --- charts-original/templates/gatekeeper-audit-deployment.yaml +++ charts/templates/gatekeeper-audit-deployment.yaml -@@ -42,11 +42,7 @@ +@@ -45,11 +45,7 @@ {{- toYaml .Values.audit.affinity | nindent 8 }} automountServiceAccountToken: true containers: @@ -13,7 +13,7 @@ args: - --audit-interval={{ .Values.auditInterval }} - --log-level={{ (.Values.audit.logLevel | empty | not) | ternary .Values.audit.logLevel .Values.logLevel }} -@@ -94,7 +90,7 @@ +@@ -102,7 +98,7 @@ fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager @@ -22,7 +22,7 @@ livenessProbe: httpGet: path: /healthz -@@ -130,9 +126,11 @@ +@@ -138,9 +134,11 @@ dnsPolicy: {{ .Values.audit.dnsPolicy }} hostNetwork: {{ .Values.audit.hostNetwork }} imagePullSecrets: @@ -37,7 +37,7 @@ {{- if .Values.audit.priorityClassName }} priorityClassName: {{ .Values.audit.priorityClassName }} {{- end }} -@@ -140,8 +138,10 @@ +@@ -148,8 +146,10 @@ {{- toYaml .Values.audit.podSecurityContext | nindent 8 }} serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-controller-manager-deployment.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-controller-manager-deployment.yaml.patch index 293ff80c8..46e7dfa3e 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-controller-manager-deployment.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-controller-manager-deployment.yaml.patch @@ -1,6 +1,6 @@ --- charts-original/templates/gatekeeper-controller-manager-deployment.yaml +++ charts/templates/gatekeeper-controller-manager-deployment.yaml -@@ -42,11 +42,8 @@ +@@ -44,11 +44,8 @@ {{- toYaml .Values.controllerManager.affinity | nindent 8 }} automountServiceAccountToken: true containers: @@ -14,7 +14,7 @@ args: - --port={{ .Values.controllerManager.port }} - --health-addr=:{{ .Values.controllerManager.healthPort }} -@@ -111,7 +108,6 @@ +@@ -113,7 +110,6 @@ fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager @@ -22,7 +22,7 @@ livenessProbe: httpGet: path: /healthz -@@ -148,9 +144,11 @@ +@@ -150,9 +146,11 @@ dnsPolicy: {{ .Values.controllerManager.dnsPolicy }} hostNetwork: {{ .Values.controllerManager.hostNetwork }} imagePullSecrets: @@ -37,7 +37,7 @@ {{- if .Values.controllerManager.priorityClassName }} priorityClassName: {{ .Values.controllerManager.priorityClassName }} {{- end }} -@@ -158,8 +156,10 @@ +@@ -160,8 +158,10 @@ {{- toYaml .Values.controllerManager.podSecurityContext | nindent 8 }} serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-manager-role-clusterrole.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-manager-role-clusterrole.yaml.patch index 0199eedb9..9cfd28a45 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-manager-role-clusterrole.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/gatekeeper-manager-role-clusterrole.yaml.patch @@ -1,6 +1,6 @@ --- charts-original/templates/gatekeeper-manager-role-clusterrole.yaml +++ charts/templates/gatekeeper-manager-role-clusterrole.yaml -@@ -106,7 +106,7 @@ +@@ -118,7 +118,7 @@ - patch - update - watch diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-install.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-install.yaml.patch index 0cd078747..c7e4a2591 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-install.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-install.yaml.patch @@ -1,6 +1,6 @@ --- charts-original/templates/namespace-post-install.yaml +++ charts/templates/namespace-post-install.yaml -@@ -44,7 +44,7 @@ +@@ -47,7 +47,7 @@ {{- end }} containers: - name: kubectl-label @@ -9,7 +9,7 @@ imagePullPolicy: {{ .Values.postInstall.labelNamespace.image.pullPolicy }} args: - label -@@ -85,12 +85,10 @@ +@@ -88,12 +88,10 @@ {{- toYaml .Values.postInstall.securityContext | nindent 12 }} {{- end }} {{- with .Values.postInstall }} @@ -24,7 +24,7 @@ {{- end }} --- apiVersion: v1 -@@ -132,6 +130,12 @@ +@@ -135,6 +133,12 @@ {{- range .Values.postInstall.labelNamespace.extraNamespaces }} - {{ . }} {{- end }} diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-upgrade.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-upgrade.yaml.patch index cc9af604c..b194955a6 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-upgrade.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/namespace-post-upgrade.yaml.patch @@ -1,7 +1,7 @@ --- charts-original/templates/namespace-post-upgrade.yaml +++ charts/templates/namespace-post-upgrade.yaml -@@ -36,7 +36,7 @@ - serviceAccount: gatekeeper-update-namespace-label-post-upgrade +@@ -39,7 +39,7 @@ + {{- end }} containers: - name: kubectl-label - image: "{{ .Values.postUpgrade.labelNamespace.image.repository }}:{{ .Values.postUpgrade.labelNamespace.image.tag }}" @@ -9,7 +9,7 @@ imagePullPolicy: {{ .Values.postUpgrade.labelNamespace.image.pullPolicy }} args: - label -@@ -77,12 +77,10 @@ +@@ -80,12 +80,10 @@ {{- toYaml .Values.postUpgrade.securityContext | nindent 12 }} {{- end }} {{- with .Values.postUpgrade }} @@ -24,7 +24,7 @@ {{- end }} --- apiVersion: v1 -@@ -123,6 +121,12 @@ +@@ -126,6 +124,12 @@ {{- range .Values.postUpgrade.labelNamespace.extraNamespaces }} - {{ . }} {{- end }} diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/probe-webhook-post-install.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/probe-webhook-post-install.yaml.patch index 61f57cb65..25cb918db 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/probe-webhook-post-install.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/probe-webhook-post-install.yaml.patch @@ -1,6 +1,6 @@ --- charts-original/templates/probe-webhook-post-install.yaml +++ charts/templates/probe-webhook-post-install.yaml -@@ -37,12 +37,10 @@ +@@ -40,12 +40,10 @@ containers: {{- include "gatekeeper.postInstallWebhookProbeContainer" . | nindent 8 }} {{- with .Values.postInstall }} @@ -13,5 +13,5 @@ - nodeSelector: - {{- toYaml .nodeSelector | nindent 8 }} {{- end }} - {{- end }} + backoffLimit: 3 {{- end }} diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/upgrade-crds-hook.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/upgrade-crds-hook.yaml.patch index 5dd2ed1b7..eb08bd6dc 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/upgrade-crds-hook.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/upgrade-crds-hook.yaml.patch @@ -1,14 +1,15 @@ --- charts-original/templates/upgrade-crds-hook.yaml +++ charts/templates/upgrade-crds-hook.yaml -@@ -87,26 +87,14 @@ +@@ -87,7 +87,7 @@ spec: serviceAccountName: gatekeeper-admin-upgrade-crds restartPolicy: Never - {{- if .Values.image.pullSecrets }} + {{- if .Values.images.pullSecrets }} imagePullSecrets: -- {{- toYaml .Values.image.pullSecrets | nindent 8 }} -+ {{- toYaml .Values.images.pullSecrets | nindent 8 }} + {{- toYaml .Values.image.pullSecrets | nindent 8 }} + {{- end }} +@@ -96,20 +96,8 @@ {{- end }} containers: - name: crds-upgrade @@ -31,7 +32,7 @@ args: - apply - -f -@@ -120,11 +108,9 @@ +@@ -123,11 +111,9 @@ {{- end }} {{- toYaml .Values.crds.securityContext | nindent 10 }} {{- with .Values.crds }} diff --git a/packages/rancher-gatekeeper/generated-changes/patch/templates/webhook-configs-pre-delete.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/templates/webhook-configs-pre-delete.yaml.patch index 3761372aa..9b47c1b16 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/templates/webhook-configs-pre-delete.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/templates/webhook-configs-pre-delete.yaml.patch @@ -1,7 +1,7 @@ --- charts-original/templates/webhook-configs-pre-delete.yaml +++ charts/templates/webhook-configs-pre-delete.yaml -@@ -35,7 +35,7 @@ - serviceAccount: gatekeeper-delete-webhook-configs +@@ -38,7 +38,7 @@ + {{- end }} containers: - name: kubectl-delete - image: "{{ .Values.preUninstall.deleteWebhookConfigurations.image.repository }}:{{ .Values.preUninstall.deleteWebhookConfigurations.image.tag }}" @@ -9,18 +9,9 @@ imagePullPolicy: {{ .Values.preUninstall.deleteWebhookConfigurations.image.pullPolicy }} args: - delete -@@ -46,7 +46,7 @@ - - mutatingwebhookconfiguration/{{ .Values.mutatingWebhookName }} +@@ -57,12 +57,16 @@ {{- end }} - resources: -- {{- toYaml .Values.preUninstall.resources | nindent 10 }} -+ {{- toYaml .Values.preUninstall.resources | nindent 12 }} - securityContext: - {{- if .Values.enableRuntimeDefaultSeccompProfile }} - seccompProfile: -@@ -54,12 +54,16 @@ - {{- end }} - {{- toYaml .Values.preUninstall.securityContext | nindent 10 }} + {{- toYaml .Values.preUninstall.securityContext | nindent 12 }} {{- with .Values.preUninstall }} - nodeSelector: - {{- toYaml .nodeSelector | nindent 8 }} diff --git a/packages/rancher-gatekeeper/generated-changes/patch/values.yaml.patch b/packages/rancher-gatekeeper/generated-changes/patch/values.yaml.patch index a3528259c..b2222ffa1 100644 --- a/packages/rancher-gatekeeper/generated-changes/patch/values.yaml.patch +++ b/packages/rancher-gatekeeper/generated-changes/patch/values.yaml.patch @@ -1,44 +1,44 @@ --- charts-original/values.yaml +++ charts/values.yaml -@@ -37,10 +37,13 @@ +@@ -39,10 +39,13 @@ admissionEventsInvolvedNamespace: false auditEventsInvolvedNamespace: false resourceQuota: true -image: - repository: openpolicyagent/gatekeeper - crdRepository: openpolicyagent/gatekeeper-crds -- release: v3.12.0 +- release: v3.13.0 +images: + gatekeeper: + repository: rancher/mirrored-openpolicyagent-gatekeeper -+ tag: v3.12.0 ++ tag: v3.13.0 + gatekeepercrd: + repository: rancher/mirrored-openpolicyagent-gatekeeper-crds -+ tag: v3.12.0 ++ tag: v3.13.0 pullPolicy: IfNotPresent pullSecrets: [] preInstall: -@@ -52,8 +55,8 @@ +@@ -54,8 +57,8 @@ labelNamespace: enabled: false image: - repository: openpolicyagent/gatekeeper-crds -- tag: v3.12.0 +- tag: v3.13.0 + repository: rancher/kubectl + tag: v1.20.2 pullPolicy: IfNotPresent pullSecrets: [] extraNamespaces: [] -@@ -82,7 +85,7 @@ +@@ -85,7 +88,7 @@ enabled: true extraRules: [] image: - repository: openpolicyagent/gatekeeper-crds + repository: rancher/mirrored-openpolicyagent-gatekeeper-crds - tag: v3.12.0 + tag: v3.13.0 pullPolicy: IfNotPresent pullSecrets: [] -@@ -97,7 +100,7 @@ +@@ -101,7 +104,7 @@ probeWebhook: enabled: true image: @@ -47,15 +47,16 @@ tag: 7.83.1 pullPolicy: IfNotPresent pullSecrets: [] -@@ -121,13 +124,13 @@ +@@ -126,14 +129,14 @@ extraRules: [] enabled: false image: - repository: openpolicyagent/gatekeeper-crds + repository: rancher/mirrored-openpolicyagent-gatekeeper-crds - tag: v3.12.0 + tag: v3.13.0 pullPolicy: IfNotPresent pullSecrets: [] + priorityClassName: "" affinity: {} tolerations: [] - nodeSelector: {kubernetes.io/os: linux} @@ -63,7 +64,7 @@ resources: {} securityContext: allowPrivilegeEscalation: false -@@ -171,7 +174,7 @@ +@@ -179,7 +182,7 @@ weight: 100 topologySpreadConstraints: [] tolerations: [] @@ -72,7 +73,7 @@ resources: limits: memory: 512Mi -@@ -209,7 +212,7 @@ +@@ -218,7 +221,7 @@ disableCertRotation: true affinity: {} tolerations: [] @@ -81,7 +82,7 @@ resources: limits: memory: 512Mi -@@ -248,10 +251,16 @@ +@@ -257,10 +260,16 @@ pdb: controllerManager: minAvailable: 1 diff --git a/packages/rancher-gatekeeper/package.yaml b/packages/rancher-gatekeeper/package.yaml index c953f4990..1f04bcb54 100644 --- a/packages/rancher-gatekeeper/package.yaml +++ b/packages/rancher-gatekeeper/package.yaml @@ -1,5 +1,5 @@ -url: https://open-policy-agent.github.io/gatekeeper/charts/gatekeeper-3.12.0.tgz -version: 103.0.1 +url: https://open-policy-agent.github.io/gatekeeper/charts/gatekeeper-3.13.0.tgz +version: 103.1.0 additionalCharts: - workingDir: charts-crd crdOptions: