Upgrade Gatekeeper image to v3.14.0

Signed-off-by: Yi Rae Kim <[email protected]>

.github/workflows/ci_tests.yaml

@@ -130,7 +130,7 @@ jobs:
 
     - name: Set Up Environment Variables
       run: |
-        GATEKEEPER_VERSION=$(awk '/^GATEKEEPER_VERSION/ {print $3}' Makefile)
+        GATEKEEPER_VERSION=v$(cut -d '-' -f 1 VERSION)
         echo "GATEKEEPER_VERSION=${GATEKEEPER_VERSION}" >> ${GITHUB_ENV}
 
     # Checkout a local copy of Gatekeeper to use its bats e2e tests.
@@ -145,7 +145,7 @@ jobs:
     # TODO: gatekeeper-operator does not --log-mutations nor --mutation-annotations
     - name: Remove unhandled gatekeeper bats tests
       run: |
-        sed -i -e '67,71d;80,83d' /home/runner/work/gatekeeper-operator/gatekeeper-operator/gatekeeper/test/bats/test.bats
+        sed -i -e '67,73d;82,85d' /home/runner/work/gatekeeper-operator/gatekeeper-operator/gatekeeper/test/bats/test.bats
 
     - name: Gatekeeper E2E Tests
       run: |

.github/workflows/olm_tests.yaml

@@ -44,7 +44,7 @@ jobs:
         REGISTRY_PORT=5000
         REPO=localhost:${REGISTRY_PORT}
         IMG=${REPO}/gatekeeper-operator:${GITHUB_SHA}
-        PREV_BUNDLE_INDEX_IMG=quay.io/gatekeeper/gatekeeper-operator-bundle-index:$(cat REPLACES_VERSION)
+        PREV_BUNDLE_INDEX_IMG=quay.io/gatekeeper/gatekeeper-operator-bundle-index:v$(cat REPLACES_VERSION)
         make build-and-push-bundle-images IMG=${IMG} REPO=${REPO} VERSION=${GITHUB_SHA} OPERATOR_VERSION=$(cat VERSION)
 
     - name: Deploy OLM

.gitignore

@@ -20,4 +20,5 @@ testbin/*
 
 ci-tools/
 
-.vscode/*
+.vscode/
+gatekeeper/

Makefile

@@ -146,7 +146,7 @@ tidy: ## Run go mod tidy
 
 .PHONY: test
 test: manifests generate fmt vet envtest ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" GOFLAGS=$(GOFLAGS) go test $(go list ./... | grep -v /test/) -coverprofile cover.out
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" GOFLAGS=$(GOFLAGS) go test $$(go list ./... | grep -v /test/) -coverprofile cover.out
 
 .PHONY: test-e2e
 test-e2e: e2e-dependencies generate fmt vet ## Run e2e tests, using the configured Kubernetes cluster in ~/.kube/config
@@ -375,7 +375,7 @@ TMP_IMPORT_MANIFESTS_PATH := $(shell mktemp -d)
 .PHONY: import-manifests
 import-manifests: kustomize
 	if [[ $(IMPORT_MANIFESTS_PATH) =~ https://* ]]; then \
-		git clone --branch $(GATEKEEPER_VERSION) $(IMPORT_MANIFESTS_PATH) $(TMP_IMPORT_MANIFESTS_PATH) ; \
+		git clone --branch v$(shell cut -d '-' -f 1 VERSION)  $(IMPORT_MANIFESTS_PATH) $(TMP_IMPORT_MANIFESTS_PATH) ; \
 		cd $(TMP_IMPORT_MANIFESTS_PATH) && make patch-image ; \
 		$(KUSTOMIZE) build --load-restrictor LoadRestrictionsNone $(TMP_IMPORT_MANIFESTS_PATH)/config/default -o $(MAKEFILE_DIR)/$(GATEKEEPER_MANIFEST_DIR); \
 		rm -rf "$${TMP_IMPORT_MANIFESTS_PATH}" ; \
@@ -443,9 +443,6 @@ $(OPERATOR_SDK):
 	curl -L $(OPERATOR_SDK_URL) -o $(OPERATOR_SDK) || (echo "curl returned $$? trying to fetch operator-sdk"; exit 1)
 	chmod +x $(OPERATOR_SDK)
 
-# Current Gatekeeper version
-GATEKEEPER_VERSION ?= v3.11.1
-
 # Default bundle index image tag
 BUNDLE_INDEX_IMG ?= $(IMAGE_TAG_BASE)-bundle-index:v$(VERSION)
 # Default previous bundle index image tag

REPLACES_VERSION

@@ -1 +1 @@
-0.2.6
+3.11.1

VERSION

@@ -1 +1 @@
-3.11.1
+3.14.0

api/v1alpha1/gatekeeper_types.go

@@ -103,6 +103,8 @@ type AuditConfig struct {
 	// +optional
 	EmitAuditEvents *EmitEventsMode `json:"emitAuditEvents,omitempty"`
 	// +optional
+	AuditEventsInvolvedNamespace *EventsInvolvedNsMode `json:"auditEventsInvolvedNamespace,omitempty"`
+	// +optional
 	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
 }
 
@@ -123,6 +125,8 @@ type WebhookConfig struct {
 	// +optional
 	EmitAdmissionEvents *EmitEventsMode `json:"emitAdmissionEvents,omitempty"`
 	// +optional
+	AdmissionEventsInvolvedNamespace *EventsInvolvedNsMode `json:"admissionEventsInvolvedNamespace,omitempty"`
+	// +optional
 	FailurePolicy *admregv1.FailurePolicyType `json:"failurePolicy,omitempty"`
 	// +optional
 	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
@@ -159,6 +163,14 @@ const (
 	EmitEventsDisabled EmitEventsMode = "Disabled"
 )
 
+// +kubebuilder:validation:Enum:=Enabled;Disabled
+type EventsInvolvedNsMode string
+
+const (
+	EventsInvolvedNsModeEnabled  EventsInvolvedNsMode = "Enabled"
+	EventsInvolvedNsModeDisabled EventsInvolvedNsMode = "Disabled"
+)
+
 // GatekeeperStatus defines the observed state of Gatekeeper
 type GatekeeperStatus struct {
 	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster

bundle.Dockerfile

@@ -5,7 +5,7 @@ LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
 LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
 LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
 LABEL operators.operatorframework.io.bundle.package.v1=gatekeeper-operator
-LABEL operators.operatorframework.io.bundle.channels.v1=stable,3.11
+LABEL operators.operatorframework.io.bundle.channels.v1=stable,3.14
 LABEL operators.operatorframework.io.bundle.channel.default.v1=stable
 LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.31.0
 LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1

bundle/manifests/gatekeeper-operator.clusterserviceversion.yaml

@@ -16,10 +16,10 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    olm.skipRange: "<3.11.0"
+    olm.skipRange: "<3.14.0"
     operators.operatorframework.io/builder: operator-sdk-v1.31.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
-  name: gatekeeper-operator.v3.11.1
+  name: gatekeeper-operator.v3.14.0
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -196,6 +196,7 @@ spec:
         - apiGroups:
           - ""
           resources:
+          - events
           - namespaces
           verbs:
           - create
@@ -205,6 +206,18 @@ spec:
           - patch
           - update
           - watch
+        - apiGroups:
+          - expansion.gatekeeper.sh
+          resources:
+          - '*'
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - update
+          - watch
         - apiGroups:
           - externaldata.gatekeeper.sh
           resources:
@@ -377,8 +390,8 @@ spec:
                 - /manager
                 env:
                 - name: RELATED_IMAGE_GATEKEEPER
-                  value: openpolicyagent/gatekeeper:v3.11.1
-                image: quay.io/gatekeeper/gatekeeper-operator:v3.11.1
+                  value: openpolicyagent/gatekeeper:v3.14.0
+                image: quay.io/gatekeeper/gatekeeper-operator:v3.14.0
                 imagePullPolicy: Always
                 livenessProbe:
                   httpGet:
@@ -514,7 +527,7 @@ spec:
   provider:
     name: Red Hat
   relatedImages:
-  - image: openpolicyagent/gatekeeper:v3.11.1
+  - image: openpolicyagent/gatekeeper:v3.14.0
     name: gatekeeper
-  replaces: gatekeeper-operator.v0.2.6
-  version: "3.11.1"
+  replaces: gatekeeper-operator.v3.11.1
+  version: "3.14.0"

bundle/manifests/operator.gatekeeper.sh_gatekeepers.yaml

@@ -863,6 +863,11 @@ spec:
                     format: int64
                     minimum: 0
                     type: integer
+                  auditEventsInvolvedNamespace:
+                    enum:
+                    - Enabled
+                    - Disabled
+                    type: string
                   auditFromCache:
                     description: Setting Automatic lets the Gatekeeper operator manage
                       syncOnly in the config resource. It is not recommended to use
@@ -1021,6 +1026,11 @@ spec:
                 type: string
               webhook:
                 properties:
+                  admissionEventsInvolvedNamespace:
+                    enum:
+                    - Enabled
+                    - Disabled
+                    type: string
                   disabledBuiltins:
                     items:
                       type: string

bundle/metadata/annotations.yaml

@@ -4,7 +4,7 @@ annotations:
   operators.operatorframework.io.bundle.manifests.v1: manifests/
   operators.operatorframework.io.bundle.metadata.v1: metadata/
   operators.operatorframework.io.bundle.package.v1: gatekeeper-operator
-  operators.operatorframework.io.bundle.channels.v1: "stable,3.11"
+  operators.operatorframework.io.bundle.channels.v1: "stable,3.14"
   operators.operatorframework.io.bundle.channel.default.v1: stable
   operators.operatorframework.io.metrics.builder: operator-sdk-v1.31.0
   operators.operatorframework.io.metrics.mediatype.v1: metrics+v1

config/crd/bases/operator.gatekeeper.sh_gatekeepers.yaml

@@ -863,6 +863,11 @@ spec:
                     format: int64
                     minimum: 0
                     type: integer
+                  auditEventsInvolvedNamespace:
+                    enum:
+                    - Enabled
+                    - Disabled
+                    type: string
                   auditFromCache:
                     description: Setting Automatic lets the Gatekeeper operator manage
                       syncOnly in the config resource. It is not recommended to use
@@ -1021,6 +1026,11 @@ spec:
                 type: string
               webhook:
                 properties:
+                  admissionEventsInvolvedNamespace:
+                    enum:
+                    - Enabled
+                    - Disabled
+                    type: string
                   disabledBuiltins:
                     items:
                       type: string

config/gatekeeper/apiextensions.k8s.io_v1_customresourcedefinition_assign.mutations.gatekeeper.sh.yaml

@@ -85,7 +85,7 @@ spec:
                         end. Ex: "kube-*" will match "kube-system" or "kube-public",
                         "*-system" will match "kube-system" or "gatekeeper-system".  The
                         asterisk is required for wildcard matching.'
-                      pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                      pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                       type: string
                     type: array
                   kinds:
@@ -164,7 +164,7 @@ spec:
                       a prefix or suffix glob.  For example, `name: pod-*` would match
                       both `pod-a` and `pod-b`, and `name: *-pod` would match both
                       `a-pod` and `b-pod`.'
-                    pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                    pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                     type: string
                   namespaceSelector:
                     description: NamespaceSelector is a label selector against an
@@ -223,7 +223,7 @@ spec:
                         end. Ex: "kube-*" will match "kube-system" or "kube-public",
                         "*-system" will match "kube-system" or "gatekeeper-system".  The
                         asterisk is required for wildcard matching.'
-                      pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                      pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                       type: string
                     type: array
                   scope:
@@ -432,7 +432,7 @@ spec:
                         end. Ex: "kube-*" will match "kube-system" or "kube-public",
                         "*-system" will match "kube-system" or "gatekeeper-system".  The
                         asterisk is required for wildcard matching.'
-                      pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                      pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                       type: string
                     type: array
                   kinds:
@@ -511,7 +511,7 @@ spec:
                       a prefix or suffix glob.  For example, `name: pod-*` would match
                       both `pod-a` and `pod-b`, and `name: *-pod` would match both
                       `a-pod` and `b-pod`.'
-                    pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                    pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                     type: string
                   namespaceSelector:
                     description: NamespaceSelector is a label selector against an
@@ -570,7 +570,7 @@ spec:
                         end. Ex: "kube-*" will match "kube-system" or "kube-public",
                         "*-system" will match "kube-system" or "gatekeeper-system".  The
                         asterisk is required for wildcard matching.'
-                      pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                      pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                       type: string
                     type: array
                   scope:
@@ -779,7 +779,7 @@ spec:
                         end. Ex: "kube-*" will match "kube-system" or "kube-public",
                         "*-system" will match "kube-system" or "gatekeeper-system".  The
                         asterisk is required for wildcard matching.'
-                      pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                      pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                       type: string
                     type: array
                   kinds:
@@ -858,7 +858,7 @@ spec:
                       a prefix or suffix glob.  For example, `name: pod-*` would match
                       both `pod-a` and `pod-b`, and `name: *-pod` would match both
                       `a-pod` and `b-pod`.'
-                    pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                    pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                     type: string
                   namespaceSelector:
                     description: NamespaceSelector is a label selector against an
@@ -917,7 +917,7 @@ spec:
                         end. Ex: "kube-*" will match "kube-system" or "kube-public",
                         "*-system" will match "kube-system" or "gatekeeper-system".  The
                         asterisk is required for wildcard matching.'
-                      pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
+                      pattern: ^(\*|\*-)?[a-z0-9]([-:a-z0-9]*[a-z0-9])?(\*|-\*)?$
                       type: string
                     type: array
                   scope: