diff --git a/Makefile b/Makefile index 34002937f33..90ea4fbe1e6 100644 --- a/Makefile +++ b/Makefile @@ -272,7 +272,7 @@ generate: __conversion-gen __controller-gen $(CONTROLLER_GEN) object:headerFile=./hack/boilerplate.go.txt paths="./apis/..." paths="./pkg/..." $(CONVERSION_GEN) \ --output-base=/gatekeeper \ - --input-dirs=./apis/mutations/v1beta1,./apis/mutations/v1alpha1,./apis/expansion/v1alpha1 \ + --input-dirs=./apis/mutations/v1,./apis/mutations/v1beta1,./apis/mutations/v1alpha1,./apis/expansion/v1alpha1 \ --go-header-file=./hack/boilerplate.go.txt \ --output-file-base=zz_generated.conversion diff --git a/apis/addtoscheme_mutations_v1.go b/apis/addtoscheme_mutations_v1.go new file mode 100644 index 00000000000..481ce040ef2 --- /dev/null +++ b/apis/addtoscheme_mutations_v1.go @@ -0,0 +1,25 @@ +/* + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package apis + +import ( + v1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1" +) + +func init() { + // Register the types with the Scheme so the components can map objects to GroupVersionKinds and back + AddToSchemes = append(AddToSchemes, v1.AddToScheme) +} diff --git a/apis/mutations/v1/assign_types.go b/apis/mutations/v1/assign_types.go new file mode 100644 index 00000000000..7df489dec80 --- /dev/null +++ b/apis/mutations/v1/assign_types.go @@ -0,0 +1,109 @@ +/* + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1 + +import ( + "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" + "github.com/open-policy-agent/gatekeeper/pkg/mutation/match" + "github.com/open-policy-agent/gatekeeper/pkg/mutation/path/tester" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN! +// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized. + +// AssignSpec defines the desired state of Assign. +type AssignSpec struct { + // INSERT ADDITIONAL SPEC FIELDS - desired state of cluster + // Important: Run "make" to regenerate code after modifying this file + + // ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + // This is necessary because every mutation implies part of an object schema and object + // schemas are associated with specific GVKs. + ApplyTo []match.ApplyTo `json:"applyTo,omitempty"` + + // Match allows the user to limit which resources get mutated. + // Individual match criteria are AND-ed together. An undefined + // match criteria matches everything. + Match match.Match `json:"match,omitempty"` + + // Location describes the path to be mutated, for example: `spec.containers[name: main]`. + Location string `json:"location,omitempty"` + + // Parameters define the behavior of the mutator. + Parameters Parameters `json:"parameters,omitempty"` +} + +type Parameters struct { + PathTests []PathTest `json:"pathTests,omitempty"` + + // TODO(maxsmythe): Now that https://github.com/kubernetes-sigs/controller-tools/pull/528 + // is merged, we can use an actual object for `Assign` + + // Assign.value holds the value to be assigned + Assign AssignField `json:"assign,omitempty"` +} + +// PathTest allows the user to customize how the mutation works if parent +// paths are missing. It traverses the list in order. All sub paths are +// tested against the provided condition, if the test fails, the mutation is +// not applied. All `subPath` entries must be a prefix of `location`. Any +// glob characters will take on the same value as was used to +// expand the matching glob in `location`. +// +// Available Tests: +// * MustExist - the path must exist or do not mutate +// * MustNotExist - the path must not exist or do not mutate. +type PathTest struct { + SubPath string `json:"subPath,omitempty"` + Condition tester.Condition `json:"condition,omitempty"` +} + +// AssignStatus defines the observed state of Assign. +type AssignStatus struct { + // INSERT ADDITIONAL STATUS FIELD - define observed state of cluster + // Important: Run "make" to regenerate code after modifying this file + + ByPod []v1beta1.MutatorPodStatusStatus `json:"byPod,omitempty"` +} + +// +kubebuilder:object:root=true +// +kubebuilder:resource:path="assign" +// +kubebuilder:resource:scope="Cluster" +// +kubebuilder:subresource:status +// +kubebuilder:storageversion + +// Assign is the Schema for the assign API. +type Assign struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec AssignSpec `json:"spec,omitempty"` + Status AssignStatus `json:"status,omitempty"` +} + +// +kubebuilder:object:root=true + +// AssignList contains a list of Assign. +type AssignList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []Assign `json:"items"` +} + +func init() { + SchemeBuilder.Register(&Assign{}, &AssignList{}) +} diff --git a/apis/mutations/v1/assignmetadata_types.go b/apis/mutations/v1/assignmetadata_types.go new file mode 100644 index 00000000000..3e623c1b582 --- /dev/null +++ b/apis/mutations/v1/assignmetadata_types.go @@ -0,0 +1,71 @@ +/* + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1 + +import ( + "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" + "github.com/open-policy-agent/gatekeeper/pkg/mutation/match" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN! +// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized. + +// AssignMetadataSpec defines the desired state of AssignMetadata. +type AssignMetadataSpec struct { + Match match.Match `json:"match,omitempty"` + Location string `json:"location,omitempty"` + Parameters MetadataParameters `json:"parameters,omitempty"` +} + +type MetadataParameters struct { + // Assign.value holds the value to be assigned + Assign AssignField `json:"assign,omitempty"` +} + +// AssignMetadataStatus defines the observed state of AssignMetadata. +type AssignMetadataStatus struct { + // INSERT ADDITIONAL STATUS FIELD - define observed state of cluster + // Important: Run "make" to regenerate code after modifying this file + ByPod []v1beta1.MutatorPodStatusStatus `json:"byPod,omitempty"` +} + +// +kubebuilder:object:root=true +// +kubebuilder:resource:scope="Cluster" +// +kubebuilder:subresource:status +// +kubebuilder:storageversion + +// AssignMetadata is the Schema for the assignmetadata API. +type AssignMetadata struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec AssignMetadataSpec `json:"spec,omitempty"` + Status AssignMetadataStatus `json:"status,omitempty"` +} + +// +kubebuilder:object:root=true + +// AssignMetadataList contains a list of AssignMetadata. +type AssignMetadataList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []AssignMetadata `json:"items"` +} + +func init() { + SchemeBuilder.Register(&AssignMetadata{}, &AssignMetadataList{}) +} diff --git a/apis/mutations/v1/doc.go b/apis/mutations/v1/doc.go new file mode 100644 index 00000000000..bd3e26d94be --- /dev/null +++ b/apis/mutations/v1/doc.go @@ -0,0 +1,5 @@ +// Package v1 includes v1 mutators + +// +k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/apis/mutations/unversioned +// -external-types=github.com/open-policy-agent/gatekeeper/apis/mutations/v1beta1 +package v1 diff --git a/apis/mutations/v1/externaldata_types.go b/apis/mutations/v1/externaldata_types.go new file mode 100644 index 00000000000..b88bc1ea055 --- /dev/null +++ b/apis/mutations/v1/externaldata_types.go @@ -0,0 +1,26 @@ +package v1 + +import ( + "github.com/open-policy-agent/gatekeeper/pkg/mutation/types" +) + +// ExternalData describes the external data source to use for the mutation. +type ExternalData struct { + // Provider is the name of the external data provider. + // +kubebuilder:validation:Required + Provider string `json:"provider,omitempty"` + + // DataSource specifies where to extract the data that will be sent + // to the external data provider as parameters. + // +kubebuilder:default="ValueAtLocation" + DataSource types.ExternalDataSource `json:"dataSource,omitempty"` + + // FailurePolicy specifies the policy to apply when the external data + // provider returns an error. + // +kubebuilder:default="Fail" + FailurePolicy types.ExternalDataFailurePolicy `json:"failurePolicy,omitempty"` + + // Default specifies the default value to use when the external data + // provider returns an error and the failure policy is set to "UseDefault". + Default string `json:"default,omitempty"` +} diff --git a/apis/mutations/v1/groupversion_info.go b/apis/mutations/v1/groupversion_info.go new file mode 100644 index 00000000000..eb5847396ab --- /dev/null +++ b/apis/mutations/v1/groupversion_info.go @@ -0,0 +1,38 @@ +/* + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Package v1alpha1 contains API Schema definitions for the mutations v1alpha1 API group +// +kubebuilder:object:generate=true +// +groupName=mutations.gatekeeper.sh +package v1 + +import ( + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + "sigs.k8s.io/controller-runtime/pkg/scheme" +) + +var ( + // GroupVersion is group version used to register these objects. + GroupVersion = schema.GroupVersion{Group: "mutations.gatekeeper.sh", Version: "v1"} + + // SchemeBuilder is used to add go types to the GroupVersionKind scheme. + SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion} + + localSchemeBuilder = runtime.NewSchemeBuilder(SchemeBuilder.AddToScheme) + + // AddToScheme adds the types in this group-version to the given scheme. + AddToScheme = localSchemeBuilder.AddToScheme +) diff --git a/apis/mutations/v1/modifyset_types.go b/apis/mutations/v1/modifyset_types.go new file mode 100644 index 00000000000..b2a768fa579 --- /dev/null +++ b/apis/mutations/v1/modifyset_types.go @@ -0,0 +1,148 @@ +/* + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package v1 + +import ( + "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" + "github.com/open-policy-agent/gatekeeper/pkg/mutation/match" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" +) + +// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN! +// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized. + +// ModifySetSpec defines the desired state of ModifySet. +type ModifySetSpec struct { + // INSERT ADDITIONAL SPEC FIELDS - desired state of cluster + // Important: Run "make" to regenerate code after modifying this file + + // ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. + // This is necessary because every mutation implies part of an object schema and object + // schemas are associated with specific GVKs. + ApplyTo []match.ApplyTo `json:"applyTo,omitempty"` + + // Match allows the user to limit which resources get mutated. + // Individual match criteria are AND-ed together. An undefined + // match criteria matches everything. + Match match.Match `json:"match,omitempty"` + + // Location describes the path to be mutated, for example: `spec.containers[name: main].args`. + Location string `json:"location,omitempty"` + + // Parameters define the behavior of the mutator. + Parameters ModifySetParameters `json:"parameters,omitempty"` +} + +type ModifySetParameters struct { + // PathTests are a series of existence tests that can be checked + // before a mutation is applied + PathTests []PathTest `json:"pathTests,omitempty"` + + // Operation describes whether values should be merged in ("merge"), or pruned ("prune"). Default value is "merge" + // +kubebuilder:validation:Enum=merge;prune + // +kubebuilder:default=merge + Operation Operation `json:"operation,omitempty"` + + // Values describes the values provided to the operation as `values.fromList`. + // +kubebuilder:validation:Schemaless + // +kubebuilder:validation:Type=object + // +kubebuilder:validation:XPreserveUnknownFields + Values Values `json:"values,omitempty"` +} + +type Operation string + +const ( + // MergeOp means that the provided values should be merged with the existing values. + MergeOp Operation = "merge" + + // PruneOp means that the provided values should be removed from the existing values. + PruneOp Operation = "prune" +) + +// Values describes the values provided to the operation. +// +kubebuilder:object:generate=false +type Values struct { + FromList []interface{} `json:"fromList,omitempty"` +} + +func (in *Values) DeepCopy() *Values { + if in == nil { + return nil + } + + var fromList []interface{} + if in.FromList != nil { + fromList = make([]interface{}, len(in.FromList)) + for i := range fromList { + fromList[i] = runtime.DeepCopyJSONValue(in.FromList[i]) + } + } + + return &Values{ + FromList: fromList, + } +} + +func (in *Values) DeepCopyInto(out *Values) { + *in = *out + + if in.FromList != nil { + fromList := make([]interface{}, len(in.FromList)) + for i := range fromList { + fromList[i] = runtime.DeepCopyJSONValue(in.FromList[i]) + } + out.FromList = fromList + } +} + +// ModifySetStatus defines the observed state of ModifySet. +type ModifySetStatus struct { + // INSERT ADDITIONAL STATUS FIELD - define observed state of cluster + // Important: Run "make" to regenerate code after modifying this file + + ByPod []v1beta1.MutatorPodStatusStatus `json:"byPod,omitempty"` +} + +// +kubebuilder:object:root=true +// +kubebuilder:resource:path="modifyset" +// +kubebuilder:resource:scope="Cluster" +// +kubebuilder:subresource:status +// +kubebuilder:storageversion + +// ModifySet allows the user to modify non-keyed lists, such as +// the list of arguments to a container. +type ModifySet struct { + metav1.TypeMeta `json:",inline"` + metav1.ObjectMeta `json:"metadata,omitempty"` + + Spec ModifySetSpec `json:"spec,omitempty"` + Status ModifySetStatus `json:"status,omitempty"` +} + +// +kubebuilder:object:root=true + +// ModifySetList contains a list of ModifySet. +type ModifySetList struct { + metav1.TypeMeta `json:",inline"` + metav1.ListMeta `json:"metadata,omitempty"` + Items []ModifySet `json:"items"` +} + +func init() { + SchemeBuilder.Register(&ModifySet{}, &ModifySetList{}) +} diff --git a/apis/mutations/v1/value.go b/apis/mutations/v1/value.go new file mode 100644 index 00000000000..877d80d4a69 --- /dev/null +++ b/apis/mutations/v1/value.go @@ -0,0 +1,24 @@ +package v1 + +import ( + "github.com/open-policy-agent/gatekeeper/apis/mutations/unversioned" + "github.com/open-policy-agent/gatekeeper/pkg/mutation/types" +) + +type AssignField struct { + // Value is a constant value that will be assigned to `location` + // +kubebuilder:validation:Schemaless + // +kubebuilder:validation:XPreserveUnknownFields + Value *types.Anything `json:"value,omitempty"` + + // FromMetadata assigns a value from the specified metadata field. + FromMetadata *FromMetadata `json:"fromMetadata,omitempty"` + + // ExternalData describes the external data provider to be used for mutation. + ExternalData *ExternalData `json:"externalData,omitempty"` +} + +type FromMetadata struct { + // Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. + Field unversioned.Field `json:"field,omitempty"` +} diff --git a/apis/mutations/v1/zz_generated.conversion.go b/apis/mutations/v1/zz_generated.conversion.go new file mode 100644 index 00000000000..71689e6d74a --- /dev/null +++ b/apis/mutations/v1/zz_generated.conversion.go @@ -0,0 +1,742 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +// Code generated by conversion-gen. DO NOT EDIT. + +package v1 + +import ( + unsafe "unsafe" + + unversioned "github.com/open-policy-agent/gatekeeper/apis/mutations/unversioned" + v1beta1 "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" + match "github.com/open-policy-agent/gatekeeper/pkg/mutation/match" + tester "github.com/open-policy-agent/gatekeeper/pkg/mutation/path/tester" + types "github.com/open-policy-agent/gatekeeper/pkg/mutation/types" + conversion "k8s.io/apimachinery/pkg/conversion" + runtime "k8s.io/apimachinery/pkg/runtime" +) + +func init() { + localSchemeBuilder.Register(RegisterConversions) +} + +// RegisterConversions adds conversion functions to the given scheme. +// Public to allow building arbitrary schemes. +func RegisterConversions(s *runtime.Scheme) error { + if err := s.AddGeneratedConversionFunc((*Assign)(nil), (*unversioned.Assign)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_Assign_To_unversioned_Assign(a.(*Assign), b.(*unversioned.Assign), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.Assign)(nil), (*Assign)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_Assign_To_v1_Assign(a.(*unversioned.Assign), b.(*Assign), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignField)(nil), (*unversioned.AssignField)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignField_To_unversioned_AssignField(a.(*AssignField), b.(*unversioned.AssignField), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignField)(nil), (*AssignField)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignField_To_v1_AssignField(a.(*unversioned.AssignField), b.(*AssignField), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignList)(nil), (*unversioned.AssignList)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignList_To_unversioned_AssignList(a.(*AssignList), b.(*unversioned.AssignList), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignList)(nil), (*AssignList)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignList_To_v1_AssignList(a.(*unversioned.AssignList), b.(*AssignList), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignMetadata)(nil), (*unversioned.AssignMetadata)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignMetadata_To_unversioned_AssignMetadata(a.(*AssignMetadata), b.(*unversioned.AssignMetadata), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignMetadata)(nil), (*AssignMetadata)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignMetadata_To_v1_AssignMetadata(a.(*unversioned.AssignMetadata), b.(*AssignMetadata), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignMetadataList)(nil), (*unversioned.AssignMetadataList)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignMetadataList_To_unversioned_AssignMetadataList(a.(*AssignMetadataList), b.(*unversioned.AssignMetadataList), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignMetadataList)(nil), (*AssignMetadataList)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignMetadataList_To_v1_AssignMetadataList(a.(*unversioned.AssignMetadataList), b.(*AssignMetadataList), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignMetadataSpec)(nil), (*unversioned.AssignMetadataSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignMetadataSpec_To_unversioned_AssignMetadataSpec(a.(*AssignMetadataSpec), b.(*unversioned.AssignMetadataSpec), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignMetadataSpec)(nil), (*AssignMetadataSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignMetadataSpec_To_v1_AssignMetadataSpec(a.(*unversioned.AssignMetadataSpec), b.(*AssignMetadataSpec), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignMetadataStatus)(nil), (*unversioned.AssignMetadataStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignMetadataStatus_To_unversioned_AssignMetadataStatus(a.(*AssignMetadataStatus), b.(*unversioned.AssignMetadataStatus), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignMetadataStatus)(nil), (*AssignMetadataStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignMetadataStatus_To_v1_AssignMetadataStatus(a.(*unversioned.AssignMetadataStatus), b.(*AssignMetadataStatus), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignSpec)(nil), (*unversioned.AssignSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignSpec_To_unversioned_AssignSpec(a.(*AssignSpec), b.(*unversioned.AssignSpec), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignSpec)(nil), (*AssignSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignSpec_To_v1_AssignSpec(a.(*unversioned.AssignSpec), b.(*AssignSpec), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AssignStatus)(nil), (*unversioned.AssignStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_AssignStatus_To_unversioned_AssignStatus(a.(*AssignStatus), b.(*unversioned.AssignStatus), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.AssignStatus)(nil), (*AssignStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_AssignStatus_To_v1_AssignStatus(a.(*unversioned.AssignStatus), b.(*AssignStatus), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ExternalData)(nil), (*unversioned.ExternalData)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_ExternalData_To_unversioned_ExternalData(a.(*ExternalData), b.(*unversioned.ExternalData), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.ExternalData)(nil), (*ExternalData)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_ExternalData_To_v1_ExternalData(a.(*unversioned.ExternalData), b.(*ExternalData), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*FromMetadata)(nil), (*unversioned.FromMetadata)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_FromMetadata_To_unversioned_FromMetadata(a.(*FromMetadata), b.(*unversioned.FromMetadata), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.FromMetadata)(nil), (*FromMetadata)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_FromMetadata_To_v1_FromMetadata(a.(*unversioned.FromMetadata), b.(*FromMetadata), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*MetadataParameters)(nil), (*unversioned.MetadataParameters)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_MetadataParameters_To_unversioned_MetadataParameters(a.(*MetadataParameters), b.(*unversioned.MetadataParameters), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.MetadataParameters)(nil), (*MetadataParameters)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_MetadataParameters_To_v1_MetadataParameters(a.(*unversioned.MetadataParameters), b.(*MetadataParameters), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ModifySet)(nil), (*unversioned.ModifySet)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_ModifySet_To_unversioned_ModifySet(a.(*ModifySet), b.(*unversioned.ModifySet), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.ModifySet)(nil), (*ModifySet)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_ModifySet_To_v1_ModifySet(a.(*unversioned.ModifySet), b.(*ModifySet), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ModifySetList)(nil), (*unversioned.ModifySetList)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_ModifySetList_To_unversioned_ModifySetList(a.(*ModifySetList), b.(*unversioned.ModifySetList), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.ModifySetList)(nil), (*ModifySetList)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_ModifySetList_To_v1_ModifySetList(a.(*unversioned.ModifySetList), b.(*ModifySetList), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ModifySetParameters)(nil), (*unversioned.ModifySetParameters)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_ModifySetParameters_To_unversioned_ModifySetParameters(a.(*ModifySetParameters), b.(*unversioned.ModifySetParameters), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.ModifySetParameters)(nil), (*ModifySetParameters)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_ModifySetParameters_To_v1_ModifySetParameters(a.(*unversioned.ModifySetParameters), b.(*ModifySetParameters), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ModifySetSpec)(nil), (*unversioned.ModifySetSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_ModifySetSpec_To_unversioned_ModifySetSpec(a.(*ModifySetSpec), b.(*unversioned.ModifySetSpec), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.ModifySetSpec)(nil), (*ModifySetSpec)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_ModifySetSpec_To_v1_ModifySetSpec(a.(*unversioned.ModifySetSpec), b.(*ModifySetSpec), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ModifySetStatus)(nil), (*unversioned.ModifySetStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_ModifySetStatus_To_unversioned_ModifySetStatus(a.(*ModifySetStatus), b.(*unversioned.ModifySetStatus), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.ModifySetStatus)(nil), (*ModifySetStatus)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_ModifySetStatus_To_v1_ModifySetStatus(a.(*unversioned.ModifySetStatus), b.(*ModifySetStatus), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*Parameters)(nil), (*unversioned.Parameters)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_Parameters_To_unversioned_Parameters(a.(*Parameters), b.(*unversioned.Parameters), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.Parameters)(nil), (*Parameters)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_Parameters_To_v1_Parameters(a.(*unversioned.Parameters), b.(*Parameters), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*PathTest)(nil), (*unversioned.PathTest)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_PathTest_To_unversioned_PathTest(a.(*PathTest), b.(*unversioned.PathTest), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.PathTest)(nil), (*PathTest)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_PathTest_To_v1_PathTest(a.(*unversioned.PathTest), b.(*PathTest), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*Values)(nil), (*unversioned.Values)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1_Values_To_unversioned_Values(a.(*Values), b.(*unversioned.Values), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*unversioned.Values)(nil), (*Values)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_unversioned_Values_To_v1_Values(a.(*unversioned.Values), b.(*Values), scope) + }); err != nil { + return err + } + return nil +} + +func autoConvert_v1_Assign_To_unversioned_Assign(in *Assign, out *unversioned.Assign, s conversion.Scope) error { + out.ObjectMeta = in.ObjectMeta + if err := Convert_v1_AssignSpec_To_unversioned_AssignSpec(&in.Spec, &out.Spec, s); err != nil { + return err + } + if err := Convert_v1_AssignStatus_To_unversioned_AssignStatus(&in.Status, &out.Status, s); err != nil { + return err + } + return nil +} + +// Convert_v1_Assign_To_unversioned_Assign is an autogenerated conversion function. +func Convert_v1_Assign_To_unversioned_Assign(in *Assign, out *unversioned.Assign, s conversion.Scope) error { + return autoConvert_v1_Assign_To_unversioned_Assign(in, out, s) +} + +func autoConvert_unversioned_Assign_To_v1_Assign(in *unversioned.Assign, out *Assign, s conversion.Scope) error { + out.ObjectMeta = in.ObjectMeta + if err := Convert_unversioned_AssignSpec_To_v1_AssignSpec(&in.Spec, &out.Spec, s); err != nil { + return err + } + if err := Convert_unversioned_AssignStatus_To_v1_AssignStatus(&in.Status, &out.Status, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_Assign_To_v1_Assign is an autogenerated conversion function. +func Convert_unversioned_Assign_To_v1_Assign(in *unversioned.Assign, out *Assign, s conversion.Scope) error { + return autoConvert_unversioned_Assign_To_v1_Assign(in, out, s) +} + +func autoConvert_v1_AssignField_To_unversioned_AssignField(in *AssignField, out *unversioned.AssignField, s conversion.Scope) error { + out.Value = (*types.Anything)(unsafe.Pointer(in.Value)) + out.FromMetadata = (*unversioned.FromMetadata)(unsafe.Pointer(in.FromMetadata)) + out.ExternalData = (*unversioned.ExternalData)(unsafe.Pointer(in.ExternalData)) + return nil +} + +// Convert_v1_AssignField_To_unversioned_AssignField is an autogenerated conversion function. +func Convert_v1_AssignField_To_unversioned_AssignField(in *AssignField, out *unversioned.AssignField, s conversion.Scope) error { + return autoConvert_v1_AssignField_To_unversioned_AssignField(in, out, s) +} + +func autoConvert_unversioned_AssignField_To_v1_AssignField(in *unversioned.AssignField, out *AssignField, s conversion.Scope) error { + out.Value = (*types.Anything)(unsafe.Pointer(in.Value)) + out.FromMetadata = (*FromMetadata)(unsafe.Pointer(in.FromMetadata)) + out.ExternalData = (*ExternalData)(unsafe.Pointer(in.ExternalData)) + return nil +} + +// Convert_unversioned_AssignField_To_v1_AssignField is an autogenerated conversion function. +func Convert_unversioned_AssignField_To_v1_AssignField(in *unversioned.AssignField, out *AssignField, s conversion.Scope) error { + return autoConvert_unversioned_AssignField_To_v1_AssignField(in, out, s) +} + +func autoConvert_v1_AssignList_To_unversioned_AssignList(in *AssignList, out *unversioned.AssignList, s conversion.Scope) error { + out.ListMeta = in.ListMeta + out.Items = *(*[]unversioned.Assign)(unsafe.Pointer(&in.Items)) + return nil +} + +// Convert_v1_AssignList_To_unversioned_AssignList is an autogenerated conversion function. +func Convert_v1_AssignList_To_unversioned_AssignList(in *AssignList, out *unversioned.AssignList, s conversion.Scope) error { + return autoConvert_v1_AssignList_To_unversioned_AssignList(in, out, s) +} + +func autoConvert_unversioned_AssignList_To_v1_AssignList(in *unversioned.AssignList, out *AssignList, s conversion.Scope) error { + out.ListMeta = in.ListMeta + out.Items = *(*[]Assign)(unsafe.Pointer(&in.Items)) + return nil +} + +// Convert_unversioned_AssignList_To_v1_AssignList is an autogenerated conversion function. +func Convert_unversioned_AssignList_To_v1_AssignList(in *unversioned.AssignList, out *AssignList, s conversion.Scope) error { + return autoConvert_unversioned_AssignList_To_v1_AssignList(in, out, s) +} + +func autoConvert_v1_AssignMetadata_To_unversioned_AssignMetadata(in *AssignMetadata, out *unversioned.AssignMetadata, s conversion.Scope) error { + out.ObjectMeta = in.ObjectMeta + if err := Convert_v1_AssignMetadataSpec_To_unversioned_AssignMetadataSpec(&in.Spec, &out.Spec, s); err != nil { + return err + } + if err := Convert_v1_AssignMetadataStatus_To_unversioned_AssignMetadataStatus(&in.Status, &out.Status, s); err != nil { + return err + } + return nil +} + +// Convert_v1_AssignMetadata_To_unversioned_AssignMetadata is an autogenerated conversion function. +func Convert_v1_AssignMetadata_To_unversioned_AssignMetadata(in *AssignMetadata, out *unversioned.AssignMetadata, s conversion.Scope) error { + return autoConvert_v1_AssignMetadata_To_unversioned_AssignMetadata(in, out, s) +} + +func autoConvert_unversioned_AssignMetadata_To_v1_AssignMetadata(in *unversioned.AssignMetadata, out *AssignMetadata, s conversion.Scope) error { + out.ObjectMeta = in.ObjectMeta + if err := Convert_unversioned_AssignMetadataSpec_To_v1_AssignMetadataSpec(&in.Spec, &out.Spec, s); err != nil { + return err + } + if err := Convert_unversioned_AssignMetadataStatus_To_v1_AssignMetadataStatus(&in.Status, &out.Status, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_AssignMetadata_To_v1_AssignMetadata is an autogenerated conversion function. +func Convert_unversioned_AssignMetadata_To_v1_AssignMetadata(in *unversioned.AssignMetadata, out *AssignMetadata, s conversion.Scope) error { + return autoConvert_unversioned_AssignMetadata_To_v1_AssignMetadata(in, out, s) +} + +func autoConvert_v1_AssignMetadataList_To_unversioned_AssignMetadataList(in *AssignMetadataList, out *unversioned.AssignMetadataList, s conversion.Scope) error { + out.ListMeta = in.ListMeta + out.Items = *(*[]unversioned.AssignMetadata)(unsafe.Pointer(&in.Items)) + return nil +} + +// Convert_v1_AssignMetadataList_To_unversioned_AssignMetadataList is an autogenerated conversion function. +func Convert_v1_AssignMetadataList_To_unversioned_AssignMetadataList(in *AssignMetadataList, out *unversioned.AssignMetadataList, s conversion.Scope) error { + return autoConvert_v1_AssignMetadataList_To_unversioned_AssignMetadataList(in, out, s) +} + +func autoConvert_unversioned_AssignMetadataList_To_v1_AssignMetadataList(in *unversioned.AssignMetadataList, out *AssignMetadataList, s conversion.Scope) error { + out.ListMeta = in.ListMeta + out.Items = *(*[]AssignMetadata)(unsafe.Pointer(&in.Items)) + return nil +} + +// Convert_unversioned_AssignMetadataList_To_v1_AssignMetadataList is an autogenerated conversion function. +func Convert_unversioned_AssignMetadataList_To_v1_AssignMetadataList(in *unversioned.AssignMetadataList, out *AssignMetadataList, s conversion.Scope) error { + return autoConvert_unversioned_AssignMetadataList_To_v1_AssignMetadataList(in, out, s) +} + +func autoConvert_v1_AssignMetadataSpec_To_unversioned_AssignMetadataSpec(in *AssignMetadataSpec, out *unversioned.AssignMetadataSpec, s conversion.Scope) error { + out.Match = in.Match + out.Location = in.Location + if err := Convert_v1_MetadataParameters_To_unversioned_MetadataParameters(&in.Parameters, &out.Parameters, s); err != nil { + return err + } + return nil +} + +// Convert_v1_AssignMetadataSpec_To_unversioned_AssignMetadataSpec is an autogenerated conversion function. +func Convert_v1_AssignMetadataSpec_To_unversioned_AssignMetadataSpec(in *AssignMetadataSpec, out *unversioned.AssignMetadataSpec, s conversion.Scope) error { + return autoConvert_v1_AssignMetadataSpec_To_unversioned_AssignMetadataSpec(in, out, s) +} + +func autoConvert_unversioned_AssignMetadataSpec_To_v1_AssignMetadataSpec(in *unversioned.AssignMetadataSpec, out *AssignMetadataSpec, s conversion.Scope) error { + out.Match = in.Match + out.Location = in.Location + if err := Convert_unversioned_MetadataParameters_To_v1_MetadataParameters(&in.Parameters, &out.Parameters, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_AssignMetadataSpec_To_v1_AssignMetadataSpec is an autogenerated conversion function. +func Convert_unversioned_AssignMetadataSpec_To_v1_AssignMetadataSpec(in *unversioned.AssignMetadataSpec, out *AssignMetadataSpec, s conversion.Scope) error { + return autoConvert_unversioned_AssignMetadataSpec_To_v1_AssignMetadataSpec(in, out, s) +} + +func autoConvert_v1_AssignMetadataStatus_To_unversioned_AssignMetadataStatus(in *AssignMetadataStatus, out *unversioned.AssignMetadataStatus, s conversion.Scope) error { + out.ByPod = *(*[]v1beta1.MutatorPodStatusStatus)(unsafe.Pointer(&in.ByPod)) + return nil +} + +// Convert_v1_AssignMetadataStatus_To_unversioned_AssignMetadataStatus is an autogenerated conversion function. +func Convert_v1_AssignMetadataStatus_To_unversioned_AssignMetadataStatus(in *AssignMetadataStatus, out *unversioned.AssignMetadataStatus, s conversion.Scope) error { + return autoConvert_v1_AssignMetadataStatus_To_unversioned_AssignMetadataStatus(in, out, s) +} + +func autoConvert_unversioned_AssignMetadataStatus_To_v1_AssignMetadataStatus(in *unversioned.AssignMetadataStatus, out *AssignMetadataStatus, s conversion.Scope) error { + out.ByPod = *(*[]v1beta1.MutatorPodStatusStatus)(unsafe.Pointer(&in.ByPod)) + return nil +} + +// Convert_unversioned_AssignMetadataStatus_To_v1_AssignMetadataStatus is an autogenerated conversion function. +func Convert_unversioned_AssignMetadataStatus_To_v1_AssignMetadataStatus(in *unversioned.AssignMetadataStatus, out *AssignMetadataStatus, s conversion.Scope) error { + return autoConvert_unversioned_AssignMetadataStatus_To_v1_AssignMetadataStatus(in, out, s) +} + +func autoConvert_v1_AssignSpec_To_unversioned_AssignSpec(in *AssignSpec, out *unversioned.AssignSpec, s conversion.Scope) error { + out.ApplyTo = *(*[]match.ApplyTo)(unsafe.Pointer(&in.ApplyTo)) + out.Match = in.Match + out.Location = in.Location + if err := Convert_v1_Parameters_To_unversioned_Parameters(&in.Parameters, &out.Parameters, s); err != nil { + return err + } + return nil +} + +// Convert_v1_AssignSpec_To_unversioned_AssignSpec is an autogenerated conversion function. +func Convert_v1_AssignSpec_To_unversioned_AssignSpec(in *AssignSpec, out *unversioned.AssignSpec, s conversion.Scope) error { + return autoConvert_v1_AssignSpec_To_unversioned_AssignSpec(in, out, s) +} + +func autoConvert_unversioned_AssignSpec_To_v1_AssignSpec(in *unversioned.AssignSpec, out *AssignSpec, s conversion.Scope) error { + out.ApplyTo = *(*[]match.ApplyTo)(unsafe.Pointer(&in.ApplyTo)) + out.Match = in.Match + out.Location = in.Location + if err := Convert_unversioned_Parameters_To_v1_Parameters(&in.Parameters, &out.Parameters, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_AssignSpec_To_v1_AssignSpec is an autogenerated conversion function. +func Convert_unversioned_AssignSpec_To_v1_AssignSpec(in *unversioned.AssignSpec, out *AssignSpec, s conversion.Scope) error { + return autoConvert_unversioned_AssignSpec_To_v1_AssignSpec(in, out, s) +} + +func autoConvert_v1_AssignStatus_To_unversioned_AssignStatus(in *AssignStatus, out *unversioned.AssignStatus, s conversion.Scope) error { + out.ByPod = *(*[]v1beta1.MutatorPodStatusStatus)(unsafe.Pointer(&in.ByPod)) + return nil +} + +// Convert_v1_AssignStatus_To_unversioned_AssignStatus is an autogenerated conversion function. +func Convert_v1_AssignStatus_To_unversioned_AssignStatus(in *AssignStatus, out *unversioned.AssignStatus, s conversion.Scope) error { + return autoConvert_v1_AssignStatus_To_unversioned_AssignStatus(in, out, s) +} + +func autoConvert_unversioned_AssignStatus_To_v1_AssignStatus(in *unversioned.AssignStatus, out *AssignStatus, s conversion.Scope) error { + out.ByPod = *(*[]v1beta1.MutatorPodStatusStatus)(unsafe.Pointer(&in.ByPod)) + return nil +} + +// Convert_unversioned_AssignStatus_To_v1_AssignStatus is an autogenerated conversion function. +func Convert_unversioned_AssignStatus_To_v1_AssignStatus(in *unversioned.AssignStatus, out *AssignStatus, s conversion.Scope) error { + return autoConvert_unversioned_AssignStatus_To_v1_AssignStatus(in, out, s) +} + +func autoConvert_v1_ExternalData_To_unversioned_ExternalData(in *ExternalData, out *unversioned.ExternalData, s conversion.Scope) error { + out.Provider = in.Provider + out.DataSource = types.ExternalDataSource(in.DataSource) + out.FailurePolicy = types.ExternalDataFailurePolicy(in.FailurePolicy) + out.Default = in.Default + return nil +} + +// Convert_v1_ExternalData_To_unversioned_ExternalData is an autogenerated conversion function. +func Convert_v1_ExternalData_To_unversioned_ExternalData(in *ExternalData, out *unversioned.ExternalData, s conversion.Scope) error { + return autoConvert_v1_ExternalData_To_unversioned_ExternalData(in, out, s) +} + +func autoConvert_unversioned_ExternalData_To_v1_ExternalData(in *unversioned.ExternalData, out *ExternalData, s conversion.Scope) error { + out.Provider = in.Provider + out.DataSource = types.ExternalDataSource(in.DataSource) + out.FailurePolicy = types.ExternalDataFailurePolicy(in.FailurePolicy) + out.Default = in.Default + return nil +} + +// Convert_unversioned_ExternalData_To_v1_ExternalData is an autogenerated conversion function. +func Convert_unversioned_ExternalData_To_v1_ExternalData(in *unversioned.ExternalData, out *ExternalData, s conversion.Scope) error { + return autoConvert_unversioned_ExternalData_To_v1_ExternalData(in, out, s) +} + +func autoConvert_v1_FromMetadata_To_unversioned_FromMetadata(in *FromMetadata, out *unversioned.FromMetadata, s conversion.Scope) error { + out.Field = unversioned.Field(in.Field) + return nil +} + +// Convert_v1_FromMetadata_To_unversioned_FromMetadata is an autogenerated conversion function. +func Convert_v1_FromMetadata_To_unversioned_FromMetadata(in *FromMetadata, out *unversioned.FromMetadata, s conversion.Scope) error { + return autoConvert_v1_FromMetadata_To_unversioned_FromMetadata(in, out, s) +} + +func autoConvert_unversioned_FromMetadata_To_v1_FromMetadata(in *unversioned.FromMetadata, out *FromMetadata, s conversion.Scope) error { + out.Field = unversioned.Field(in.Field) + return nil +} + +// Convert_unversioned_FromMetadata_To_v1_FromMetadata is an autogenerated conversion function. +func Convert_unversioned_FromMetadata_To_v1_FromMetadata(in *unversioned.FromMetadata, out *FromMetadata, s conversion.Scope) error { + return autoConvert_unversioned_FromMetadata_To_v1_FromMetadata(in, out, s) +} + +func autoConvert_v1_MetadataParameters_To_unversioned_MetadataParameters(in *MetadataParameters, out *unversioned.MetadataParameters, s conversion.Scope) error { + if err := Convert_v1_AssignField_To_unversioned_AssignField(&in.Assign, &out.Assign, s); err != nil { + return err + } + return nil +} + +// Convert_v1_MetadataParameters_To_unversioned_MetadataParameters is an autogenerated conversion function. +func Convert_v1_MetadataParameters_To_unversioned_MetadataParameters(in *MetadataParameters, out *unversioned.MetadataParameters, s conversion.Scope) error { + return autoConvert_v1_MetadataParameters_To_unversioned_MetadataParameters(in, out, s) +} + +func autoConvert_unversioned_MetadataParameters_To_v1_MetadataParameters(in *unversioned.MetadataParameters, out *MetadataParameters, s conversion.Scope) error { + if err := Convert_unversioned_AssignField_To_v1_AssignField(&in.Assign, &out.Assign, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_MetadataParameters_To_v1_MetadataParameters is an autogenerated conversion function. +func Convert_unversioned_MetadataParameters_To_v1_MetadataParameters(in *unversioned.MetadataParameters, out *MetadataParameters, s conversion.Scope) error { + return autoConvert_unversioned_MetadataParameters_To_v1_MetadataParameters(in, out, s) +} + +func autoConvert_v1_ModifySet_To_unversioned_ModifySet(in *ModifySet, out *unversioned.ModifySet, s conversion.Scope) error { + out.ObjectMeta = in.ObjectMeta + if err := Convert_v1_ModifySetSpec_To_unversioned_ModifySetSpec(&in.Spec, &out.Spec, s); err != nil { + return err + } + if err := Convert_v1_ModifySetStatus_To_unversioned_ModifySetStatus(&in.Status, &out.Status, s); err != nil { + return err + } + return nil +} + +// Convert_v1_ModifySet_To_unversioned_ModifySet is an autogenerated conversion function. +func Convert_v1_ModifySet_To_unversioned_ModifySet(in *ModifySet, out *unversioned.ModifySet, s conversion.Scope) error { + return autoConvert_v1_ModifySet_To_unversioned_ModifySet(in, out, s) +} + +func autoConvert_unversioned_ModifySet_To_v1_ModifySet(in *unversioned.ModifySet, out *ModifySet, s conversion.Scope) error { + out.ObjectMeta = in.ObjectMeta + if err := Convert_unversioned_ModifySetSpec_To_v1_ModifySetSpec(&in.Spec, &out.Spec, s); err != nil { + return err + } + if err := Convert_unversioned_ModifySetStatus_To_v1_ModifySetStatus(&in.Status, &out.Status, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_ModifySet_To_v1_ModifySet is an autogenerated conversion function. +func Convert_unversioned_ModifySet_To_v1_ModifySet(in *unversioned.ModifySet, out *ModifySet, s conversion.Scope) error { + return autoConvert_unversioned_ModifySet_To_v1_ModifySet(in, out, s) +} + +func autoConvert_v1_ModifySetList_To_unversioned_ModifySetList(in *ModifySetList, out *unversioned.ModifySetList, s conversion.Scope) error { + out.ListMeta = in.ListMeta + out.Items = *(*[]unversioned.ModifySet)(unsafe.Pointer(&in.Items)) + return nil +} + +// Convert_v1_ModifySetList_To_unversioned_ModifySetList is an autogenerated conversion function. +func Convert_v1_ModifySetList_To_unversioned_ModifySetList(in *ModifySetList, out *unversioned.ModifySetList, s conversion.Scope) error { + return autoConvert_v1_ModifySetList_To_unversioned_ModifySetList(in, out, s) +} + +func autoConvert_unversioned_ModifySetList_To_v1_ModifySetList(in *unversioned.ModifySetList, out *ModifySetList, s conversion.Scope) error { + out.ListMeta = in.ListMeta + out.Items = *(*[]ModifySet)(unsafe.Pointer(&in.Items)) + return nil +} + +// Convert_unversioned_ModifySetList_To_v1_ModifySetList is an autogenerated conversion function. +func Convert_unversioned_ModifySetList_To_v1_ModifySetList(in *unversioned.ModifySetList, out *ModifySetList, s conversion.Scope) error { + return autoConvert_unversioned_ModifySetList_To_v1_ModifySetList(in, out, s) +} + +func autoConvert_v1_ModifySetParameters_To_unversioned_ModifySetParameters(in *ModifySetParameters, out *unversioned.ModifySetParameters, s conversion.Scope) error { + out.PathTests = *(*[]unversioned.PathTest)(unsafe.Pointer(&in.PathTests)) + out.Operation = unversioned.Operation(in.Operation) + if err := Convert_v1_Values_To_unversioned_Values(&in.Values, &out.Values, s); err != nil { + return err + } + return nil +} + +// Convert_v1_ModifySetParameters_To_unversioned_ModifySetParameters is an autogenerated conversion function. +func Convert_v1_ModifySetParameters_To_unversioned_ModifySetParameters(in *ModifySetParameters, out *unversioned.ModifySetParameters, s conversion.Scope) error { + return autoConvert_v1_ModifySetParameters_To_unversioned_ModifySetParameters(in, out, s) +} + +func autoConvert_unversioned_ModifySetParameters_To_v1_ModifySetParameters(in *unversioned.ModifySetParameters, out *ModifySetParameters, s conversion.Scope) error { + out.PathTests = *(*[]PathTest)(unsafe.Pointer(&in.PathTests)) + out.Operation = Operation(in.Operation) + if err := Convert_unversioned_Values_To_v1_Values(&in.Values, &out.Values, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_ModifySetParameters_To_v1_ModifySetParameters is an autogenerated conversion function. +func Convert_unversioned_ModifySetParameters_To_v1_ModifySetParameters(in *unversioned.ModifySetParameters, out *ModifySetParameters, s conversion.Scope) error { + return autoConvert_unversioned_ModifySetParameters_To_v1_ModifySetParameters(in, out, s) +} + +func autoConvert_v1_ModifySetSpec_To_unversioned_ModifySetSpec(in *ModifySetSpec, out *unversioned.ModifySetSpec, s conversion.Scope) error { + out.ApplyTo = *(*[]match.ApplyTo)(unsafe.Pointer(&in.ApplyTo)) + out.Match = in.Match + out.Location = in.Location + if err := Convert_v1_ModifySetParameters_To_unversioned_ModifySetParameters(&in.Parameters, &out.Parameters, s); err != nil { + return err + } + return nil +} + +// Convert_v1_ModifySetSpec_To_unversioned_ModifySetSpec is an autogenerated conversion function. +func Convert_v1_ModifySetSpec_To_unversioned_ModifySetSpec(in *ModifySetSpec, out *unversioned.ModifySetSpec, s conversion.Scope) error { + return autoConvert_v1_ModifySetSpec_To_unversioned_ModifySetSpec(in, out, s) +} + +func autoConvert_unversioned_ModifySetSpec_To_v1_ModifySetSpec(in *unversioned.ModifySetSpec, out *ModifySetSpec, s conversion.Scope) error { + out.ApplyTo = *(*[]match.ApplyTo)(unsafe.Pointer(&in.ApplyTo)) + out.Match = in.Match + out.Location = in.Location + if err := Convert_unversioned_ModifySetParameters_To_v1_ModifySetParameters(&in.Parameters, &out.Parameters, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_ModifySetSpec_To_v1_ModifySetSpec is an autogenerated conversion function. +func Convert_unversioned_ModifySetSpec_To_v1_ModifySetSpec(in *unversioned.ModifySetSpec, out *ModifySetSpec, s conversion.Scope) error { + return autoConvert_unversioned_ModifySetSpec_To_v1_ModifySetSpec(in, out, s) +} + +func autoConvert_v1_ModifySetStatus_To_unversioned_ModifySetStatus(in *ModifySetStatus, out *unversioned.ModifySetStatus, s conversion.Scope) error { + out.ByPod = *(*[]v1beta1.MutatorPodStatusStatus)(unsafe.Pointer(&in.ByPod)) + return nil +} + +// Convert_v1_ModifySetStatus_To_unversioned_ModifySetStatus is an autogenerated conversion function. +func Convert_v1_ModifySetStatus_To_unversioned_ModifySetStatus(in *ModifySetStatus, out *unversioned.ModifySetStatus, s conversion.Scope) error { + return autoConvert_v1_ModifySetStatus_To_unversioned_ModifySetStatus(in, out, s) +} + +func autoConvert_unversioned_ModifySetStatus_To_v1_ModifySetStatus(in *unversioned.ModifySetStatus, out *ModifySetStatus, s conversion.Scope) error { + out.ByPod = *(*[]v1beta1.MutatorPodStatusStatus)(unsafe.Pointer(&in.ByPod)) + return nil +} + +// Convert_unversioned_ModifySetStatus_To_v1_ModifySetStatus is an autogenerated conversion function. +func Convert_unversioned_ModifySetStatus_To_v1_ModifySetStatus(in *unversioned.ModifySetStatus, out *ModifySetStatus, s conversion.Scope) error { + return autoConvert_unversioned_ModifySetStatus_To_v1_ModifySetStatus(in, out, s) +} + +func autoConvert_v1_Parameters_To_unversioned_Parameters(in *Parameters, out *unversioned.Parameters, s conversion.Scope) error { + out.PathTests = *(*[]unversioned.PathTest)(unsafe.Pointer(&in.PathTests)) + if err := Convert_v1_AssignField_To_unversioned_AssignField(&in.Assign, &out.Assign, s); err != nil { + return err + } + return nil +} + +// Convert_v1_Parameters_To_unversioned_Parameters is an autogenerated conversion function. +func Convert_v1_Parameters_To_unversioned_Parameters(in *Parameters, out *unversioned.Parameters, s conversion.Scope) error { + return autoConvert_v1_Parameters_To_unversioned_Parameters(in, out, s) +} + +func autoConvert_unversioned_Parameters_To_v1_Parameters(in *unversioned.Parameters, out *Parameters, s conversion.Scope) error { + out.PathTests = *(*[]PathTest)(unsafe.Pointer(&in.PathTests)) + if err := Convert_unversioned_AssignField_To_v1_AssignField(&in.Assign, &out.Assign, s); err != nil { + return err + } + return nil +} + +// Convert_unversioned_Parameters_To_v1_Parameters is an autogenerated conversion function. +func Convert_unversioned_Parameters_To_v1_Parameters(in *unversioned.Parameters, out *Parameters, s conversion.Scope) error { + return autoConvert_unversioned_Parameters_To_v1_Parameters(in, out, s) +} + +func autoConvert_v1_PathTest_To_unversioned_PathTest(in *PathTest, out *unversioned.PathTest, s conversion.Scope) error { + out.SubPath = in.SubPath + out.Condition = tester.Condition(in.Condition) + return nil +} + +// Convert_v1_PathTest_To_unversioned_PathTest is an autogenerated conversion function. +func Convert_v1_PathTest_To_unversioned_PathTest(in *PathTest, out *unversioned.PathTest, s conversion.Scope) error { + return autoConvert_v1_PathTest_To_unversioned_PathTest(in, out, s) +} + +func autoConvert_unversioned_PathTest_To_v1_PathTest(in *unversioned.PathTest, out *PathTest, s conversion.Scope) error { + out.SubPath = in.SubPath + out.Condition = tester.Condition(in.Condition) + return nil +} + +// Convert_unversioned_PathTest_To_v1_PathTest is an autogenerated conversion function. +func Convert_unversioned_PathTest_To_v1_PathTest(in *unversioned.PathTest, out *PathTest, s conversion.Scope) error { + return autoConvert_unversioned_PathTest_To_v1_PathTest(in, out, s) +} + +func autoConvert_v1_Values_To_unversioned_Values(in *Values, out *unversioned.Values, s conversion.Scope) error { + out.FromList = *(*[]interface{})(unsafe.Pointer(&in.FromList)) + return nil +} + +// Convert_v1_Values_To_unversioned_Values is an autogenerated conversion function. +func Convert_v1_Values_To_unversioned_Values(in *Values, out *unversioned.Values, s conversion.Scope) error { + return autoConvert_v1_Values_To_unversioned_Values(in, out, s) +} + +func autoConvert_unversioned_Values_To_v1_Values(in *unversioned.Values, out *Values, s conversion.Scope) error { + out.FromList = *(*[]interface{})(unsafe.Pointer(&in.FromList)) + return nil +} + +// Convert_unversioned_Values_To_v1_Values is an autogenerated conversion function. +func Convert_unversioned_Values_To_v1_Values(in *unversioned.Values, out *Values, s conversion.Scope) error { + return autoConvert_unversioned_Values_To_v1_Values(in, out, s) +} diff --git a/apis/mutations/v1/zz_generated.deepcopy.go b/apis/mutations/v1/zz_generated.deepcopy.go new file mode 100644 index 00000000000..bf207418367 --- /dev/null +++ b/apis/mutations/v1/zz_generated.deepcopy.go @@ -0,0 +1,467 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +/* + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +// Code generated by controller-gen. DO NOT EDIT. + +package v1 + +import ( + "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" + "github.com/open-policy-agent/gatekeeper/pkg/mutation/match" + "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Assign) DeepCopyInto(out *Assign) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Assign. +func (in *Assign) DeepCopy() *Assign { + if in == nil { + return nil + } + out := new(Assign) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *Assign) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignField) DeepCopyInto(out *AssignField) { + *out = *in + if in.Value != nil { + in, out := &in.Value, &out.Value + *out = (*in).DeepCopy() + } + if in.FromMetadata != nil { + in, out := &in.FromMetadata, &out.FromMetadata + *out = new(FromMetadata) + **out = **in + } + if in.ExternalData != nil { + in, out := &in.ExternalData, &out.ExternalData + *out = new(ExternalData) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignField. +func (in *AssignField) DeepCopy() *AssignField { + if in == nil { + return nil + } + out := new(AssignField) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignList) DeepCopyInto(out *AssignList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]Assign, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignList. +func (in *AssignList) DeepCopy() *AssignList { + if in == nil { + return nil + } + out := new(AssignList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *AssignList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignMetadata) DeepCopyInto(out *AssignMetadata) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignMetadata. +func (in *AssignMetadata) DeepCopy() *AssignMetadata { + if in == nil { + return nil + } + out := new(AssignMetadata) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *AssignMetadata) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignMetadataList) DeepCopyInto(out *AssignMetadataList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]AssignMetadata, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignMetadataList. +func (in *AssignMetadataList) DeepCopy() *AssignMetadataList { + if in == nil { + return nil + } + out := new(AssignMetadataList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *AssignMetadataList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignMetadataSpec) DeepCopyInto(out *AssignMetadataSpec) { + *out = *in + in.Match.DeepCopyInto(&out.Match) + in.Parameters.DeepCopyInto(&out.Parameters) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignMetadataSpec. +func (in *AssignMetadataSpec) DeepCopy() *AssignMetadataSpec { + if in == nil { + return nil + } + out := new(AssignMetadataSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignMetadataStatus) DeepCopyInto(out *AssignMetadataStatus) { + *out = *in + if in.ByPod != nil { + in, out := &in.ByPod, &out.ByPod + *out = make([]v1beta1.MutatorPodStatusStatus, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignMetadataStatus. +func (in *AssignMetadataStatus) DeepCopy() *AssignMetadataStatus { + if in == nil { + return nil + } + out := new(AssignMetadataStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignSpec) DeepCopyInto(out *AssignSpec) { + *out = *in + if in.ApplyTo != nil { + in, out := &in.ApplyTo, &out.ApplyTo + *out = make([]match.ApplyTo, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + in.Match.DeepCopyInto(&out.Match) + in.Parameters.DeepCopyInto(&out.Parameters) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignSpec. +func (in *AssignSpec) DeepCopy() *AssignSpec { + if in == nil { + return nil + } + out := new(AssignSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AssignStatus) DeepCopyInto(out *AssignStatus) { + *out = *in + if in.ByPod != nil { + in, out := &in.ByPod, &out.ByPod + *out = make([]v1beta1.MutatorPodStatusStatus, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AssignStatus. +func (in *AssignStatus) DeepCopy() *AssignStatus { + if in == nil { + return nil + } + out := new(AssignStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExternalData) DeepCopyInto(out *ExternalData) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalData. +func (in *ExternalData) DeepCopy() *ExternalData { + if in == nil { + return nil + } + out := new(ExternalData) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FromMetadata) DeepCopyInto(out *FromMetadata) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FromMetadata. +func (in *FromMetadata) DeepCopy() *FromMetadata { + if in == nil { + return nil + } + out := new(FromMetadata) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *MetadataParameters) DeepCopyInto(out *MetadataParameters) { + *out = *in + in.Assign.DeepCopyInto(&out.Assign) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MetadataParameters. +func (in *MetadataParameters) DeepCopy() *MetadataParameters { + if in == nil { + return nil + } + out := new(MetadataParameters) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ModifySet) DeepCopyInto(out *ModifySet) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) + in.Spec.DeepCopyInto(&out.Spec) + in.Status.DeepCopyInto(&out.Status) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ModifySet. +func (in *ModifySet) DeepCopy() *ModifySet { + if in == nil { + return nil + } + out := new(ModifySet) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *ModifySet) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ModifySetList) DeepCopyInto(out *ModifySetList) { + *out = *in + out.TypeMeta = in.TypeMeta + in.ListMeta.DeepCopyInto(&out.ListMeta) + if in.Items != nil { + in, out := &in.Items, &out.Items + *out = make([]ModifySet, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ModifySetList. +func (in *ModifySetList) DeepCopy() *ModifySetList { + if in == nil { + return nil + } + out := new(ModifySetList) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *ModifySetList) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ModifySetParameters) DeepCopyInto(out *ModifySetParameters) { + *out = *in + if in.PathTests != nil { + in, out := &in.PathTests, &out.PathTests + *out = make([]PathTest, len(*in)) + copy(*out, *in) + } + in.Values.DeepCopyInto(&out.Values) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ModifySetParameters. +func (in *ModifySetParameters) DeepCopy() *ModifySetParameters { + if in == nil { + return nil + } + out := new(ModifySetParameters) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ModifySetSpec) DeepCopyInto(out *ModifySetSpec) { + *out = *in + if in.ApplyTo != nil { + in, out := &in.ApplyTo, &out.ApplyTo + *out = make([]match.ApplyTo, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + in.Match.DeepCopyInto(&out.Match) + in.Parameters.DeepCopyInto(&out.Parameters) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ModifySetSpec. +func (in *ModifySetSpec) DeepCopy() *ModifySetSpec { + if in == nil { + return nil + } + out := new(ModifySetSpec) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ModifySetStatus) DeepCopyInto(out *ModifySetStatus) { + *out = *in + if in.ByPod != nil { + in, out := &in.ByPod, &out.ByPod + *out = make([]v1beta1.MutatorPodStatusStatus, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ModifySetStatus. +func (in *ModifySetStatus) DeepCopy() *ModifySetStatus { + if in == nil { + return nil + } + out := new(ModifySetStatus) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Parameters) DeepCopyInto(out *Parameters) { + *out = *in + if in.PathTests != nil { + in, out := &in.PathTests, &out.PathTests + *out = make([]PathTest, len(*in)) + copy(*out, *in) + } + in.Assign.DeepCopyInto(&out.Assign) +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Parameters. +func (in *Parameters) DeepCopy() *Parameters { + if in == nil { + return nil + } + out := new(Parameters) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PathTest) DeepCopyInto(out *PathTest) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PathTest. +func (in *PathTest) DeepCopy() *PathTest { + if in == nil { + return nil + } + out := new(PathTest) + in.DeepCopyInto(out) + return out +} diff --git a/apis/mutations/v1beta1/assign_types.go b/apis/mutations/v1beta1/assign_types.go index 314ae312158..db4e6fdd2c9 100644 --- a/apis/mutations/v1beta1/assign_types.go +++ b/apis/mutations/v1beta1/assign_types.go @@ -84,7 +84,6 @@ type AssignStatus struct { // +kubebuilder:resource:path="assign" // +kubebuilder:resource:scope="Cluster" // +kubebuilder:subresource:status -// +kubebuilder:storageversion // Assign is the Schema for the assign API. type Assign struct { diff --git a/apis/mutations/v1beta1/assignmetadata_types.go b/apis/mutations/v1beta1/assignmetadata_types.go index f3322856564..e4616db8e69 100644 --- a/apis/mutations/v1beta1/assignmetadata_types.go +++ b/apis/mutations/v1beta1/assignmetadata_types.go @@ -46,7 +46,6 @@ type AssignMetadataStatus struct { // +kubebuilder:object:root=true // +kubebuilder:resource:scope="Cluster" // +kubebuilder:subresource:status -// +kubebuilder:storageversion // AssignMetadata is the Schema for the assignmetadata API. type AssignMetadata struct { diff --git a/apis/mutations/v1beta1/modifyset_types.go b/apis/mutations/v1beta1/modifyset_types.go index 16700669b0c..81a72f0f72e 100644 --- a/apis/mutations/v1beta1/modifyset_types.go +++ b/apis/mutations/v1beta1/modifyset_types.go @@ -122,7 +122,6 @@ type ModifySetStatus struct { // +kubebuilder:resource:path="modifyset" // +kubebuilder:resource:scope="Cluster" // +kubebuilder:subresource:status -// +kubebuilder:storageversion // ModifySet allows the user to modify non-keyed lists, such as // the list of arguments to a container. diff --git a/config/crd/bases/mutations.gatekeeper.sh_assign.yaml b/config/crd/bases/mutations.gatekeeper.sh_assign.yaml index c78f241644b..e38936f21f3 100644 --- a/config/crd/bases/mutations.gatekeeper.sh_assign.yaml +++ b/config/crd/bases/mutations.gatekeeper.sh_assign.yaml @@ -15,6 +15,353 @@ spec: singular: assign scope: Cluster versions: + - name: v1 + schema: + openAPIV3Schema: + description: Assign is the Schema for the assign API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AssignSpec defines the desired state of Assign. + properties: + applyTo: + description: ApplyTo lists the specific groups, versions and kinds + a mutation will be applied to. This is necessary because every mutation + implies part of an object schema and object schemas are associated + with specific GVKs. + items: + description: ApplyTo determines what GVKs items the mutation should + apply to. Globs are not allowed. + properties: + groups: + items: + type: string + type: array + kinds: + items: + type: string + type: array + versions: + items: + type: string + type: array + type: object + type: array + location: + description: 'Location describes the path to be mutated, for example: + `spec.containers[name: main]`.' + type: string + match: + description: Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined match + criteria matches everything. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. + If defined, a constraint only applies to resources not in a + listed namespace. ExcludedNamespaces also supports a prefix + or suffix based glob. For example, `excludedNamespaces: [kube-*]` + matches both `kube-system` and `kube-public`, and `excludedNamespaces: + [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or + end. Ex: "kube-*" will match "kube-system" or "kube-public", + "*-system" will match "kube-system" or "gatekeeper-system". The + asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups + and kinds fields that list the groups/kinds of objects to + which the mutation will apply. If multiple groups/kinds objects + are specified, only one match is needed for the resource to + be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong + to. '*' is all groups. If '*' is present, the length of + the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional + fields: `matchLabels` and `matchExpressions`. These two fields + provide different methods of selecting or excluding k8s objects + based on the label keys and values included in object metadata. All + selection expressions from both sections are ANDed to determine + if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If + the operator is In or NotIn, the values array must + be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced + during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A + single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is "key", + the operator is "In", and the values array contains only + "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will + match against objects with the specified name. Name also supports + a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both + `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an + object's containing namespace or the object itself, if the object + is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If + the operator is In or NotIn, the values array must + be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced + during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A + single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is "key", + the operator is "In", and the values array contains only + "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, + a constraint only applies to resources in a listed namespace. Namespaces + also supports a prefix or suffix based glob. For example, `namespaces: + [kube-*]` matches both `kube-system` and `kube-public`, and + `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or + end. Ex: "kube-*" will match "kube-system" or "kube-public", + "*-system" will match "kube-system" or "gatekeeper-system". The + asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped + resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. + (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources + are matched. Accepts `Generated`|`Original`|`All` (defaults + to `All`). A value of `Generated` will only match generated + resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + description: Parameters define the behavior of the mutator. + properties: + assign: + description: Assign.value holds the value to be assigned + properties: + externalData: + description: ExternalData describes the external data provider + to be used for mutation. + properties: + dataSource: + default: ValueAtLocation + description: DataSource specifies where to extract the + data that will be sent to the external data provider + as parameters. + enum: + - ValueAtLocation + - Username + type: string + default: + description: Default specifies the default value to use + when the external data provider returns an error and + the failure policy is set to "UseDefault". + type: string + failurePolicy: + default: Fail + description: FailurePolicy specifies the policy to apply + when the external data provider returns an error. + enum: + - UseDefault + - Ignore + - Fail + type: string + provider: + description: Provider is the name of the external data + provider. + type: string + type: object + fromMetadata: + description: FromMetadata assigns a value from the specified + metadata field. + properties: + field: + description: Field specifies which metadata field provides + the assigned value. Valid fields are `namespace` and + `name`. + type: string + type: object + value: + description: Value is a constant value that will be assigned + to `location` + x-kubernetes-preserve-unknown-fields: true + type: object + pathTests: + items: + description: "PathTest allows the user to customize how the + mutation works if parent paths are missing. It traverses the + list in order. All sub paths are tested against the provided + condition, if the test fails, the mutation is not applied. + All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. \n Available Tests: + * MustExist - the path must exist or do not mutate * MustNotExist + - the path must not exist or do not mutate." + properties: + condition: + description: Condition describes whether the path either + MustExist or MustNotExist in the original object + enum: + - MustExist + - MustNotExist + type: string + subPath: + type: string + type: object + type: array + type: object + type: object + status: + description: AssignStatus defines the observed state of Assign. + properties: + byPod: + items: + description: MutatorPodStatusStatus defines the observed state of + MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught + while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error + for use by controller code. If not present, the error + should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, + such as when a mutator has been recreated after its CRD was + deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} - name: v1alpha1 schema: openAPIV3Schema: @@ -706,7 +1053,7 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} status: diff --git a/config/crd/bases/mutations.gatekeeper.sh_assignmetadata.yaml b/config/crd/bases/mutations.gatekeeper.sh_assignmetadata.yaml index 0957905e048..8dc6de11843 100644 --- a/config/crd/bases/mutations.gatekeeper.sh_assignmetadata.yaml +++ b/config/crd/bases/mutations.gatekeeper.sh_assignmetadata.yaml @@ -15,6 +15,305 @@ spec: singular: assignmetadata scope: Cluster versions: + - name: v1 + schema: + openAPIV3Schema: + description: AssignMetadata is the Schema for the assignmetadata API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AssignMetadataSpec defines the desired state of AssignMetadata. + properties: + location: + type: string + match: + description: Match selects objects to apply mutations to. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. + If defined, a constraint only applies to resources not in a + listed namespace. ExcludedNamespaces also supports a prefix + or suffix based glob. For example, `excludedNamespaces: [kube-*]` + matches both `kube-system` and `kube-public`, and `excludedNamespaces: + [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or + end. Ex: "kube-*" will match "kube-system" or "kube-public", + "*-system" will match "kube-system" or "gatekeeper-system". The + asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups + and kinds fields that list the groups/kinds of objects to + which the mutation will apply. If multiple groups/kinds objects + are specified, only one match is needed for the resource to + be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong + to. '*' is all groups. If '*' is present, the length of + the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional + fields: `matchLabels` and `matchExpressions`. These two fields + provide different methods of selecting or excluding k8s objects + based on the label keys and values included in object metadata. All + selection expressions from both sections are ANDed to determine + if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If + the operator is In or NotIn, the values array must + be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced + during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A + single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is "key", + the operator is "In", and the values array contains only + "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will + match against objects with the specified name. Name also supports + a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both + `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an + object's containing namespace or the object itself, if the object + is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If + the operator is In or NotIn, the values array must + be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced + during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A + single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is "key", + the operator is "In", and the values array contains only + "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, + a constraint only applies to resources in a listed namespace. Namespaces + also supports a prefix or suffix based glob. For example, `namespaces: + [kube-*]` matches both `kube-system` and `kube-public`, and + `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or + end. Ex: "kube-*" will match "kube-system" or "kube-public", + "*-system" will match "kube-system" or "gatekeeper-system". The + asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped + resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. + (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources + are matched. Accepts `Generated`|`Original`|`All` (defaults + to `All`). A value of `Generated` will only match generated + resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + properties: + assign: + description: Assign.value holds the value to be assigned + properties: + externalData: + description: ExternalData describes the external data provider + to be used for mutation. + properties: + dataSource: + default: ValueAtLocation + description: DataSource specifies where to extract the + data that will be sent to the external data provider + as parameters. + enum: + - ValueAtLocation + - Username + type: string + default: + description: Default specifies the default value to use + when the external data provider returns an error and + the failure policy is set to "UseDefault". + type: string + failurePolicy: + default: Fail + description: FailurePolicy specifies the policy to apply + when the external data provider returns an error. + enum: + - UseDefault + - Ignore + - Fail + type: string + provider: + description: Provider is the name of the external data + provider. + type: string + type: object + fromMetadata: + description: FromMetadata assigns a value from the specified + metadata field. + properties: + field: + description: Field specifies which metadata field provides + the assigned value. Valid fields are `namespace` and + `name`. + type: string + type: object + value: + description: Value is a constant value that will be assigned + to `location` + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + type: object + status: + description: AssignMetadataStatus defines the observed state of AssignMetadata. + properties: + byPod: + description: 'INSERT ADDITIONAL STATUS FIELD - define observed state + of cluster Important: Run "make" to regenerate code after modifying + this file' + items: + description: MutatorPodStatusStatus defines the observed state of + MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught + while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error + for use by controller code. If not present, the error + should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, + such as when a mutator has been recreated after its CRD was + deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} - name: v1alpha1 schema: openAPIV3Schema: @@ -610,7 +909,7 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} status: diff --git a/config/crd/bases/mutations.gatekeeper.sh_modifyset.yaml b/config/crd/bases/mutations.gatekeeper.sh_modifyset.yaml index ab8cd91ebd8..f9044966f46 100644 --- a/config/crd/bases/mutations.gatekeeper.sh_modifyset.yaml +++ b/config/crd/bases/mutations.gatekeeper.sh_modifyset.yaml @@ -15,6 +15,319 @@ spec: singular: modifyset scope: Cluster versions: + - name: v1 + schema: + openAPIV3Schema: + description: ModifySet allows the user to modify non-keyed lists, such as + the list of arguments to a container. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ModifySetSpec defines the desired state of ModifySet. + properties: + applyTo: + description: ApplyTo lists the specific groups, versions and kinds + a mutation will be applied to. This is necessary because every mutation + implies part of an object schema and object schemas are associated + with specific GVKs. + items: + description: ApplyTo determines what GVKs items the mutation should + apply to. Globs are not allowed. + properties: + groups: + items: + type: string + type: array + kinds: + items: + type: string + type: array + versions: + items: + type: string + type: array + type: object + type: array + location: + description: 'Location describes the path to be mutated, for example: + `spec.containers[name: main].args`.' + type: string + match: + description: Match allows the user to limit which resources get mutated. + Individual match criteria are AND-ed together. An undefined match + criteria matches everything. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. + If defined, a constraint only applies to resources not in a + listed namespace. ExcludedNamespaces also supports a prefix + or suffix based glob. For example, `excludedNamespaces: [kube-*]` + matches both `kube-system` and `kube-public`, and `excludedNamespaces: + [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or + end. Ex: "kube-*" will match "kube-system" or "kube-public", + "*-system" will match "kube-system" or "gatekeeper-system". The + asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups + and kinds fields that list the groups/kinds of objects to + which the mutation will apply. If multiple groups/kinds objects + are specified, only one match is needed for the resource to + be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong + to. '*' is all groups. If '*' is present, the length of + the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional + fields: `matchLabels` and `matchExpressions`. These two fields + provide different methods of selecting or excluding k8s objects + based on the label keys and values included in object metadata. All + selection expressions from both sections are ANDed to determine + if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If + the operator is In or NotIn, the values array must + be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced + during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A + single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is "key", + the operator is "In", and the values array contains only + "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will + match against objects with the specified name. Name also supports + a prefix or suffix glob. For example, `name: pod-*` would match + both `pod-a` and `pod-b`, and `name: *-pod` would match both + `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an + object's containing namespace or the object itself, if the object + is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If + the operator is In or NotIn, the values array must + be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced + during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A + single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is "key", + the operator is "In", and the values array contains only + "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, + a constraint only applies to resources in a listed namespace. Namespaces + also supports a prefix or suffix based glob. For example, `namespaces: + [kube-*]` matches both `kube-system` and `kube-public`, and + `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or + end. Ex: "kube-*" will match "kube-system" or "kube-public", + "*-system" will match "kube-system" or "gatekeeper-system". The + asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped + resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. + (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources + are matched. Accepts `Generated`|`Original`|`All` (defaults + to `All`). A value of `Generated` will only match generated + resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + description: Parameters define the behavior of the mutator. + properties: + operation: + default: merge + description: Operation describes whether values should be merged + in ("merge"), or pruned ("prune"). Default value is "merge" + enum: + - merge + - prune + type: string + pathTests: + description: PathTests are a series of existence tests that can + be checked before a mutation is applied + items: + description: "PathTest allows the user to customize how the + mutation works if parent paths are missing. It traverses the + list in order. All sub paths are tested against the provided + condition, if the test fails, the mutation is not applied. + All `subPath` entries must be a prefix of `location`. Any + glob characters will take on the same value as was used to + expand the matching glob in `location`. \n Available Tests: + * MustExist - the path must exist or do not mutate * MustNotExist + - the path must not exist or do not mutate." + properties: + condition: + description: Condition describes whether the path either + MustExist or MustNotExist in the original object + enum: + - MustExist + - MustNotExist + type: string + subPath: + type: string + type: object + type: array + values: + description: Values describes the values provided to the operation + as `values.fromList`. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + status: + description: ModifySetStatus defines the observed state of ModifySet. + properties: + byPod: + items: + description: MutatorPodStatusStatus defines the observed state of + MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught + while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error + for use by controller code. If not present, the error + should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, + such as when a mutator has been recreated after its CRD was + deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} - name: v1alpha1 schema: openAPIV3Schema: @@ -638,7 +951,7 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} status: diff --git a/manifest_staging/charts/gatekeeper/crds/assign-customresourcedefinition.yaml b/manifest_staging/charts/gatekeeper/crds/assign-customresourcedefinition.yaml index 0031844e938..a2a4d8d05f2 100644 --- a/manifest_staging/charts/gatekeeper/crds/assign-customresourcedefinition.yaml +++ b/manifest_staging/charts/gatekeeper/crds/assign-customresourcedefinition.yaml @@ -16,7 +16,7 @@ spec: preserveUnknownFields: false scope: Cluster versions: - - name: v1alpha1 + - name: v1 schema: openAPIV3Schema: description: Assign is the Schema for the assign API. @@ -262,6 +262,251 @@ spec: type: object type: object served: true + storage: true + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Assign is the Schema for the assign API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AssignSpec defines the desired state of Assign. + properties: + applyTo: + description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + items: + description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + properties: + groups: + items: + type: string + type: array + kinds: + items: + type: string + type: array + versions: + items: + type: string + type: array + type: object + type: array + location: + description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' + type: string + match: + description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + description: Parameters define the behavior of the mutator. + properties: + assign: + description: Assign.value holds the value to be assigned + properties: + externalData: + description: ExternalData describes the external data provider to be used for mutation. + properties: + dataSource: + default: ValueAtLocation + description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + enum: + - ValueAtLocation + - Username + type: string + default: + description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + type: string + failurePolicy: + default: Fail + description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + enum: + - UseDefault + - Ignore + - Fail + type: string + provider: + description: Provider is the name of the external data provider. + type: string + type: object + fromMetadata: + description: FromMetadata assigns a value from the specified metadata field. + properties: + field: + description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. + type: string + type: object + value: + description: Value is a constant value that will be assigned to `location` + x-kubernetes-preserve-unknown-fields: true + type: object + pathTests: + items: + description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + properties: + condition: + description: Condition describes whether the path either MustExist or MustNotExist in the original object + enum: + - MustExist + - MustNotExist + type: string + subPath: + type: string + type: object + type: array + type: object + type: object + status: + description: AssignStatus defines the observed state of Assign. + properties: + byPod: + items: + description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true storage: false subresources: status: {} @@ -507,6 +752,6 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} diff --git a/manifest_staging/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml b/manifest_staging/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml index a167592c48f..189cb424f3e 100644 --- a/manifest_staging/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml +++ b/manifest_staging/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml @@ -16,7 +16,7 @@ spec: preserveUnknownFields: false scope: Cluster versions: - - name: v1alpha1 + - name: v1 schema: openAPIV3Schema: description: AssignMetadata is the Schema for the assignmetadata API. @@ -228,6 +228,217 @@ spec: type: object type: object served: true + storage: true + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: AssignMetadata is the Schema for the assignmetadata API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AssignMetadataSpec defines the desired state of AssignMetadata. + properties: + location: + type: string + match: + description: Match selects objects to apply mutations to. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + properties: + assign: + description: Assign.value holds the value to be assigned + properties: + externalData: + description: ExternalData describes the external data provider to be used for mutation. + properties: + dataSource: + default: ValueAtLocation + description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + enum: + - ValueAtLocation + - Username + type: string + default: + description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + type: string + failurePolicy: + default: Fail + description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + enum: + - UseDefault + - Ignore + - Fail + type: string + provider: + description: Provider is the name of the external data provider. + type: string + type: object + fromMetadata: + description: FromMetadata assigns a value from the specified metadata field. + properties: + field: + description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. + type: string + type: object + value: + description: Value is a constant value that will be assigned to `location` + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + type: object + status: + description: AssignMetadataStatus defines the observed state of AssignMetadata. + properties: + byPod: + description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file' + items: + description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true storage: false subresources: status: {} @@ -439,6 +650,6 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} diff --git a/manifest_staging/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml b/manifest_staging/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml index 35b373a0c3d..f5fb40b4fd5 100644 --- a/manifest_staging/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml +++ b/manifest_staging/charts/gatekeeper/crds/modifyset-customresourcedefinition.yaml @@ -16,7 +16,7 @@ spec: preserveUnknownFields: false scope: Cluster versions: - - name: v1alpha1 + - name: v1 schema: openAPIV3Schema: description: ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. @@ -235,6 +235,224 @@ spec: type: object type: object served: true + storage: true + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ModifySetSpec defines the desired state of ModifySet. + properties: + applyTo: + description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + items: + description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + properties: + groups: + items: + type: string + type: array + kinds: + items: + type: string + type: array + versions: + items: + type: string + type: array + type: object + type: array + location: + description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' + type: string + match: + description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + description: Parameters define the behavior of the mutator. + properties: + operation: + default: merge + description: Operation describes whether values should be merged in ("merge"), or pruned ("prune"). Default value is "merge" + enum: + - merge + - prune + type: string + pathTests: + description: PathTests are a series of existence tests that can be checked before a mutation is applied + items: + description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + properties: + condition: + description: Condition describes whether the path either MustExist or MustNotExist in the original object + enum: + - MustExist + - MustNotExist + type: string + subPath: + type: string + type: object + type: array + values: + description: Values describes the values provided to the operation as `values.fromList`. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + status: + description: ModifySetStatus defines the observed state of ModifySet. + properties: + byPod: + items: + description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true storage: false subresources: status: {} @@ -453,7 +671,7 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} status: diff --git a/manifest_staging/deploy/gatekeeper.yaml b/manifest_staging/deploy/gatekeeper.yaml index e607ee1aa71..4e9c1f4fabe 100644 --- a/manifest_staging/deploy/gatekeeper.yaml +++ b/manifest_staging/deploy/gatekeeper.yaml @@ -48,7 +48,7 @@ spec: preserveUnknownFields: false scope: Cluster versions: - - name: v1alpha1 + - name: v1 schema: openAPIV3Schema: description: Assign is the Schema for the assign API. @@ -294,6 +294,251 @@ spec: type: object type: object served: true + storage: true + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Assign is the Schema for the assign API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AssignSpec defines the desired state of Assign. + properties: + applyTo: + description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + items: + description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + properties: + groups: + items: + type: string + type: array + kinds: + items: + type: string + type: array + versions: + items: + type: string + type: array + type: object + type: array + location: + description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' + type: string + match: + description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + description: Parameters define the behavior of the mutator. + properties: + assign: + description: Assign.value holds the value to be assigned + properties: + externalData: + description: ExternalData describes the external data provider to be used for mutation. + properties: + dataSource: + default: ValueAtLocation + description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + enum: + - ValueAtLocation + - Username + type: string + default: + description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + type: string + failurePolicy: + default: Fail + description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + enum: + - UseDefault + - Ignore + - Fail + type: string + provider: + description: Provider is the name of the external data provider. + type: string + type: object + fromMetadata: + description: FromMetadata assigns a value from the specified metadata field. + properties: + field: + description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. + type: string + type: object + value: + description: Value is a constant value that will be assigned to `location` + x-kubernetes-preserve-unknown-fields: true + type: object + pathTests: + items: + description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + properties: + condition: + description: Condition describes whether the path either MustExist or MustNotExist in the original object + enum: + - MustExist + - MustNotExist + type: string + subPath: + type: string + type: object + type: array + type: object + type: object + status: + description: AssignStatus defines the observed state of Assign. + properties: + byPod: + items: + description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true storage: false subresources: status: {} @@ -501,9 +746,249 @@ spec: type: object type: object status: - description: AssignStatus defines the observed state of Assign. + description: AssignStatus defines the observed state of Assign. + properties: + byPod: + items: + description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + labels: + gatekeeper.sh/system: "yes" + name: assignmetadata.mutations.gatekeeper.sh +spec: + group: mutations.gatekeeper.sh + names: + kind: AssignMetadata + listKind: AssignMetadataList + plural: assignmetadata + singular: assignmetadata + preserveUnknownFields: false + scope: Cluster + versions: + - name: v1 + schema: + openAPIV3Schema: + description: AssignMetadata is the Schema for the assignmetadata API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + properties: + name: + maxLength: 63 + type: string + type: object + spec: + description: AssignMetadataSpec defines the desired state of AssignMetadata. + properties: + location: + type: string + match: + description: Match selects objects to apply mutations to. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + properties: + assign: + description: Assign.value holds the value to be assigned + properties: + externalData: + description: ExternalData describes the external data provider to be used for mutation. + properties: + dataSource: + default: ValueAtLocation + description: DataSource specifies where to extract the data that will be sent to the external data provider as parameters. + enum: + - ValueAtLocation + - Username + type: string + default: + description: Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". + type: string + failurePolicy: + default: Fail + description: FailurePolicy specifies the policy to apply when the external data provider returns an error. + enum: + - UseDefault + - Ignore + - Fail + type: string + provider: + description: Provider is the name of the external data provider. + type: string + type: object + fromMetadata: + description: FromMetadata assigns a value from the specified metadata field. + properties: + field: + description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. + type: string + type: object + value: + description: Value is a constant value that will be assigned to `location` + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + type: object + status: + description: AssignMetadataStatus defines the observed state of AssignMetadata. properties: byPod: + description: 'INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file' items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: @@ -542,31 +1027,6 @@ spec: storage: true subresources: status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.8.0 - labels: - gatekeeper.sh/system: "yes" - name: assignmetadata.mutations.gatekeeper.sh -spec: - group: mutations.gatekeeper.sh - names: - kind: AssignMetadata - listKind: AssignMetadataList - plural: assignmetadata - singular: assignmetadata - preserveUnknownFields: false - scope: Cluster - versions: - name: v1alpha1 schema: openAPIV3Schema: @@ -579,10 +1039,6 @@ spec: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: - properties: - name: - maxLength: 63 - type: string type: object spec: description: AssignMetadataSpec defines the desired state of AssignMetadata. @@ -990,7 +1446,7 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} status: @@ -1667,7 +2123,7 @@ spec: preserveUnknownFields: false scope: Cluster versions: - - name: v1alpha1 + - name: v1 schema: openAPIV3Schema: description: ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. @@ -1886,6 +2342,224 @@ spec: type: object type: object served: true + storage: true + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ModifySetSpec defines the desired state of ModifySet. + properties: + applyTo: + description: ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. + items: + description: ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. + properties: + groups: + items: + type: string + type: array + kinds: + items: + type: string + type: array + versions: + items: + type: string + type: array + type: object + type: array + location: + description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' + type: string + match: + description: Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. + properties: + excludedNamespaces: + description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + kinds: + items: + description: Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. + properties: + apiGroups: + description: APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. + items: + type: string + type: array + kinds: + items: + type: string + type: array + type: object + type: array + labelSelector: + description: 'LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector.' + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + name: + description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + namespaceSelector: + description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + namespaces: + description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.' + items: + description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.' + pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$ + type: string + type: array + scope: + description: Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) + type: string + source: + description: Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. + enum: + - All + - Generated + - Original + type: string + type: object + parameters: + description: Parameters define the behavior of the mutator. + properties: + operation: + default: merge + description: Operation describes whether values should be merged in ("merge"), or pruned ("prune"). Default value is "merge" + enum: + - merge + - prune + type: string + pathTests: + description: PathTests are a series of existence tests that can be checked before a mutation is applied + items: + description: "PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. \n Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate." + properties: + condition: + description: Condition describes whether the path either MustExist or MustNotExist in the original object + enum: + - MustExist + - MustNotExist + type: string + subPath: + type: string + type: object + type: array + values: + description: Values describes the values provided to the operation as `values.fromList`. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + status: + description: ModifySetStatus defines the observed state of ModifySet. + properties: + byPod: + items: + description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. + properties: + enforced: + type: boolean + errors: + items: + description: MutatorError represents a single error caught while adding a mutator to a system. + properties: + message: + type: string + type: + description: Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. + type: string + required: + - message + type: object + type: array + id: + type: string + mutatorUID: + description: Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch + type: string + observedGeneration: + format: int64 + type: integer + operations: + items: + type: string + type: array + type: object + type: array + type: object + type: object + served: true storage: false subresources: status: {} @@ -2104,7 +2778,7 @@ spec: type: object type: object served: true - storage: true + storage: false subresources: status: {} status: diff --git a/pkg/controller/mutators/core/controller_test.go b/pkg/controller/mutators/core/controller_test.go index 80265084fa6..6e9985715f8 100644 --- a/pkg/controller/mutators/core/controller_test.go +++ b/pkg/controller/mutators/core/controller_test.go @@ -24,7 +24,7 @@ import ( "github.com/google/go-cmp/cmp/cmpopts" "github.com/onsi/gomega" mutationsinternal "github.com/open-policy-agent/gatekeeper/apis/mutations/unversioned" - mutationsv1beta1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1beta1" + mutationsv1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1" podstatus "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" "github.com/open-policy-agent/gatekeeper/pkg/controller/mutatorstatus" "github.com/open-policy-agent/gatekeeper/pkg/fakes" @@ -55,8 +55,8 @@ import ( const timeout = time.Second * 15 -func makeValue(v interface{}) mutationsv1beta1.AssignField { - return mutationsv1beta1.AssignField{Value: &types.Anything{Value: v}} +func makeValue(v interface{}) mutationsv1.AssignField { + return mutationsv1.AssignField{Value: &types.Anything{Value: v}} } // setupManager sets up a controller-runtime manager with registered watch manager. @@ -77,17 +77,17 @@ func setupManager(t *testing.T) manager.Manager { return mgr } -func newAssign(name, location, value string) *mutationsv1beta1.Assign { - return &mutationsv1beta1.Assign{ +func newAssign(name, location, value string) *mutationsv1.Assign { + return &mutationsv1.Assign{ TypeMeta: metav1.TypeMeta{ - APIVersion: mutationsv1beta1.GroupVersion.String(), + APIVersion: mutationsv1.GroupVersion.String(), Kind: "Assign", }, ObjectMeta: metav1.ObjectMeta{Name: name}, - Spec: mutationsv1beta1.AssignSpec{ + Spec: mutationsv1.AssignSpec{ ApplyTo: []match.ApplyTo{{Groups: []string{""}, Versions: []string{"v1"}, Kinds: []string{"ConfigMap"}}}, Location: location, - Parameters: mutationsv1beta1.Parameters{ + Parameters: mutationsv1.Parameters{ Assign: makeValue(value), }, }, @@ -96,14 +96,14 @@ func newAssign(name, location, value string) *mutationsv1beta1.Assign { func TestReconcile(t *testing.T) { g := gomega.NewGomegaWithT(t) - mutator := &mutationsv1beta1.Assign{ + mutator := &mutationsv1.Assign{ ObjectMeta: metav1.ObjectMeta{ Name: "assign-test-obj", }, - Spec: mutationsv1beta1.AssignSpec{ + Spec: mutationsv1.AssignSpec{ ApplyTo: []match.ApplyTo{{Groups: []string{""}, Versions: []string{"v1"}, Kinds: []string{"ConfigMap"}}}, Location: "spec.test", - Parameters: mutationsv1beta1.Parameters{ + Parameters: mutationsv1.Parameters{ Assign: makeValue("works"), }, }, @@ -135,9 +135,9 @@ func TestReconcile(t *testing.T) { ) kind := "Assign" - newObj := func() client.Object { return &mutationsv1beta1.Assign{} } + newObj := func() client.Object { return &mutationsv1.Assign{} } newMutator := func(obj client.Object) (types.Mutator, error) { - assign := obj.(*mutationsv1beta1.Assign) // nolint:forcetypeassert + assign := obj.(*mutationsv1.Assign) // nolint:forcetypeassert unversioned := &mutationsinternal.Assign{} if err := mgr.GetScheme().Convert(assign, unversioned, nil); err != nil { return nil, err @@ -172,7 +172,7 @@ func TestReconcile(t *testing.T) { t.Run("Mutator is reported as enforced", func(t *testing.T) { g.Eventually(func() error { - v := &mutationsv1beta1.Assign{} + v := &mutationsv1.Assign{} v.SetName("assign-test-obj") if err := c.Get(ctx, objName, v); err != nil { return errors.Wrap(err, "cannot get mutator") diff --git a/pkg/controller/mutators/core/reconciler.go b/pkg/controller/mutators/core/reconciler.go index f7f85eebb07..d3490c71817 100644 --- a/pkg/controller/mutators/core/reconciler.go +++ b/pkg/controller/mutators/core/reconciler.go @@ -23,7 +23,7 @@ import ( "time" "github.com/go-logr/logr" - mutationsv1beta1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1beta1" + mutationsv1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1" statusv1beta1 "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" ctrlmutators "github.com/open-policy-agent/gatekeeper/pkg/controller/mutators" "github.com/open-policy-agent/gatekeeper/pkg/logging" @@ -63,7 +63,7 @@ func newReconciler( scheme: mgr.GetScheme(), reporter: ctrlmutators.NewStatsReporter(), cache: ctrlmutators.NewMutationCache(), - gvk: mutationsv1beta1.GroupVersion.WithKind(kind), + gvk: mutationsv1.GroupVersion.WithKind(kind), newMutationObj: newMutationObj, mutatorFor: mutatorFor, log: logf.Log.WithName("controller").WithValues(logging.Process, fmt.Sprintf("%s_controller", strings.ToLower(kind))), diff --git a/pkg/controller/mutators/core/reconciler_test.go b/pkg/controller/mutators/core/reconciler_test.go index 4307a1b54dd..1cdc07cd59a 100644 --- a/pkg/controller/mutators/core/reconciler_test.go +++ b/pkg/controller/mutators/core/reconciler_test.go @@ -11,7 +11,7 @@ import ( "github.com/go-logr/logr" "github.com/google/go-cmp/cmp" "github.com/google/go-cmp/cmp/cmpopts" - mutationsv1alpha1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1alpha1" + mutationsv1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1" statusv1beta1 "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" "github.com/open-policy-agent/gatekeeper/pkg/controller/mutators" "github.com/open-policy-agent/gatekeeper/pkg/fakes" @@ -316,7 +316,7 @@ func newFakeReconciler(t *testing.T, c client.Client, events chan event.GenericE ), nil }, scheme: s, - gvk: mutationsv1alpha1.GroupVersion.WithKind("fake"), + gvk: mutationsv1.GroupVersion.WithKind("fake"), events: events, } } diff --git a/pkg/controller/mutators/instances/mutator_controllers.go b/pkg/controller/mutators/instances/mutator_controllers.go index f2691757202..b5074ea380c 100644 --- a/pkg/controller/mutators/instances/mutator_controllers.go +++ b/pkg/controller/mutators/instances/mutator_controllers.go @@ -6,7 +6,7 @@ import ( constraintclient "github.com/open-policy-agent/frameworks/constraint/pkg/client" "github.com/open-policy-agent/frameworks/constraint/pkg/externaldata" mutationsunversioned "github.com/open-policy-agent/gatekeeper/apis/mutations/unversioned" - mutationsv1beta1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1beta1" + mutationsv1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1" "github.com/open-policy-agent/gatekeeper/pkg/controller/mutators/core" "github.com/open-policy-agent/gatekeeper/pkg/expansion" "github.com/open-policy-agent/gatekeeper/pkg/mutation" @@ -43,12 +43,12 @@ func (a *Adder) Add(mgr manager.Manager) error { GetPod: a.GetPod, MutationSystem: a.MutationSystem, Kind: "Assign", - NewMutationObj: func() client.Object { return &mutationsv1beta1.Assign{} }, + NewMutationObj: func() client.Object { return &mutationsv1.Assign{} }, MutatorFor: func(obj client.Object) (types.Mutator, error) { // The type is provided by the `NewObj` function above. If we // are fed the wrong type, this is a non-recoverable error and we // may as well crash for visibility - assign := obj.(*mutationsv1beta1.Assign) // nolint:forcetypeassert + assign := obj.(*mutationsv1.Assign) // nolint:forcetypeassert unversioned := &mutationsunversioned.Assign{} if err := scheme.Convert(assign, unversioned, nil); err != nil { return nil, err @@ -67,12 +67,12 @@ func (a *Adder) Add(mgr manager.Manager) error { GetPod: a.GetPod, MutationSystem: a.MutationSystem, Kind: "ModifySet", - NewMutationObj: func() client.Object { return &mutationsv1beta1.ModifySet{} }, + NewMutationObj: func() client.Object { return &mutationsv1.ModifySet{} }, MutatorFor: func(obj client.Object) (types.Mutator, error) { // The type is provided by the `NewObj` function above. If we // are fed the wrong type, this is a non-recoverable error and we // may as well crash for visibility - modifyset := obj.(*mutationsv1beta1.ModifySet) // nolint:forcetypeassert + modifyset := obj.(*mutationsv1.ModifySet) // nolint:forcetypeassert unversioned := &mutationsunversioned.ModifySet{} if err := scheme.Convert(modifyset, unversioned, nil); err != nil { return nil, err @@ -92,12 +92,12 @@ func (a *Adder) Add(mgr manager.Manager) error { GetPod: a.GetPod, MutationSystem: a.MutationSystem, Kind: "AssignMetadata", - NewMutationObj: func() client.Object { return &mutationsv1beta1.AssignMetadata{} }, + NewMutationObj: func() client.Object { return &mutationsv1.AssignMetadata{} }, MutatorFor: func(obj client.Object) (types.Mutator, error) { // The type is provided by the `NewObj` function above. If we // are fed the wrong type, this is a non-recoverable error and we // may as well crash for visibility - assignMeta := obj.(*mutationsv1beta1.AssignMetadata) // nolint:forcetypeassert + assignMeta := obj.(*mutationsv1.AssignMetadata) // nolint:forcetypeassert unversioned := &mutationsunversioned.AssignMetadata{} if err := scheme.Convert(assignMeta, unversioned, nil); err != nil { return nil, err diff --git a/pkg/controller/mutatorstatus/mutatorstatus_controller.go b/pkg/controller/mutatorstatus/mutatorstatus_controller.go index fa037219d7c..bb1b422fc16 100644 --- a/pkg/controller/mutatorstatus/mutatorstatus_controller.go +++ b/pkg/controller/mutatorstatus/mutatorstatus_controller.go @@ -24,7 +24,7 @@ import ( "github.com/go-logr/logr" constraintclient "github.com/open-policy-agent/frameworks/constraint/pkg/client" "github.com/open-policy-agent/frameworks/constraint/pkg/externaldata" - mutationsv1beta1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1beta1" + mutationsv1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1" "github.com/open-policy-agent/gatekeeper/apis/status/v1beta1" "github.com/open-policy-agent/gatekeeper/pkg/expansion" "github.com/open-policy-agent/gatekeeper/pkg/logging" @@ -124,7 +124,7 @@ func PodStatusToMutatorMapper(selfOnly bool, kindMatch string, packerMap handler } } u := &unstructured.Unstructured{} - u.SetGroupVersionKind(schema.GroupVersionKind{Group: v1beta1.MutationsGroup, Version: "v1beta1", Kind: kind}) + u.SetGroupVersionKind(schema.GroupVersionKind{Group: v1beta1.MutationsGroup, Version: "v1", Kind: kind}) u.SetName(name) return packerMap(u) } @@ -149,15 +149,22 @@ func add(mgr manager.Manager, r reconcile.Reconciler) error { // Watch for changes to mutators err = c.Watch( - &source.Kind{Type: &mutationsv1beta1.Assign{}}, - handler.EnqueueRequestsFromMapFunc(util.EventPackerMapFuncHardcodeGVK(schema.GroupVersionKind{Group: v1beta1.MutationsGroup, Version: "v1beta1", Kind: "Assign"})), + &source.Kind{Type: &mutationsv1.Assign{}}, + handler.EnqueueRequestsFromMapFunc(util.EventPackerMapFuncHardcodeGVK(schema.GroupVersionKind{Group: v1beta1.MutationsGroup, Version: "v1", Kind: "Assign"})), + ) + if err != nil { + return err + } + err = c.Watch( + &source.Kind{Type: &mutationsv1.AssignMetadata{}}, + handler.EnqueueRequestsFromMapFunc(util.EventPackerMapFuncHardcodeGVK(schema.GroupVersionKind{Group: v1beta1.MutationsGroup, Version: "v1", Kind: "AssignMetadata"})), ) if err != nil { return err } return c.Watch( - &source.Kind{Type: &mutationsv1beta1.AssignMetadata{}}, - handler.EnqueueRequestsFromMapFunc(util.EventPackerMapFuncHardcodeGVK(schema.GroupVersionKind{Group: v1beta1.MutationsGroup, Version: "v1beta1", Kind: "AssignMetadata"})), + &source.Kind{Type: &mutationsv1.ModifySet{}}, + handler.EnqueueRequestsFromMapFunc(util.EventPackerMapFuncHardcodeGVK(schema.GroupVersionKind{Group: v1beta1.MutationsGroup, Version: "v1", Kind: "ModifySet"})), ) } diff --git a/pkg/readiness/ready_tracker.go b/pkg/readiness/ready_tracker.go index aad57704b7f..6dc080764d9 100644 --- a/pkg/readiness/ready_tracker.go +++ b/pkg/readiness/ready_tracker.go @@ -26,7 +26,7 @@ import ( "github.com/open-policy-agent/frameworks/constraint/pkg/apis/templates/v1beta1" "github.com/open-policy-agent/frameworks/constraint/pkg/core/templates" configv1alpha1 "github.com/open-policy-agent/gatekeeper/apis/config/v1alpha1" - mutationv1beta1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1beta1" + mutationv1 "github.com/open-policy-agent/gatekeeper/apis/mutations/v1" "github.com/open-policy-agent/gatekeeper/pkg/keys" "github.com/open-policy-agent/gatekeeper/pkg/operations" "github.com/open-policy-agent/gatekeeper/pkg/syncutil" @@ -94,9 +94,9 @@ func newTracker(lister Lister, mutationEnabled bool, externalDataEnabled bool, f externalDataEnabled: externalDataEnabled, } if mutationEnabled { - tracker.assignMetadata = newObjTracker(mutationv1beta1.GroupVersion.WithKind("AssignMetadata"), fn) - tracker.assign = newObjTracker(mutationv1beta1.GroupVersion.WithKind("Assign"), fn) - tracker.modifySet = newObjTracker(mutationv1beta1.GroupVersion.WithKind("ModifySet"), fn) + tracker.assignMetadata = newObjTracker(mutationv1.GroupVersion.WithKind("AssignMetadata"), fn) + tracker.assign = newObjTracker(mutationv1.GroupVersion.WithKind("Assign"), fn) + tracker.modifySet = newObjTracker(mutationv1.GroupVersion.WithKind("ModifySet"), fn) } if externalDataEnabled { tracker.externalDataProvider = newObjTracker(externaldatav1alpha1.SchemeGroupVersion.WithKind("Provider"), fn) @@ -129,17 +129,17 @@ func (t *Tracker) For(gvk schema.GroupVersionKind) Expectations { return t.config case gvk.GroupVersion() == externaldatav1alpha1.SchemeGroupVersion && gvk.Kind == "Provider": return t.externalDataProvider - case gvk.GroupVersion() == mutationv1beta1.GroupVersion && gvk.Kind == "AssignMetadata": + case gvk.GroupVersion() == mutationv1.GroupVersion && gvk.Kind == "AssignMetadata": if t.mutationEnabled { return t.assignMetadata } return noopExpectations{} - case gvk.GroupVersion() == mutationv1beta1.GroupVersion && gvk.Kind == "Assign": + case gvk.GroupVersion() == mutationv1.GroupVersion && gvk.Kind == "Assign": if t.mutationEnabled { return t.assign } return noopExpectations{} - case gvk.GroupVersion() == mutationv1beta1.GroupVersion && gvk.Kind == "ModifySet": + case gvk.GroupVersion() == mutationv1.GroupVersion && gvk.Kind == "ModifySet": if t.mutationEnabled { return t.modifySet } @@ -465,7 +465,7 @@ func (t *Tracker) trackAssignMetadata(ctx context.Context) error { return nil } - assignMetadataList := &mutationv1beta1.AssignMetadataList{} + assignMetadataList := &mutationv1.AssignMetadataList{} lister := retryLister(t.lister, retryAll) if err := lister.List(ctx, assignMetadataList); err != nil { return fmt.Errorf("listing AssignMetadata: %w", err) @@ -490,7 +490,7 @@ func (t *Tracker) trackAssign(ctx context.Context) error { return nil } - assignList := &mutationv1beta1.AssignList{} + assignList := &mutationv1.AssignList{} lister := retryLister(t.lister, retryAll) if err := lister.List(ctx, assignList); err != nil { return fmt.Errorf("listing Assign: %w", err) @@ -515,7 +515,7 @@ func (t *Tracker) trackModifySet(ctx context.Context) error { return nil } - modifySetList := &mutationv1beta1.ModifySetList{} + modifySetList := &mutationv1.ModifySetList{} lister := retryLister(t.lister, retryAll) if err := lister.List(ctx, modifySetList); err != nil { return fmt.Errorf("listing ModifySet: %w", err) diff --git a/test/bats/tests/mutations/dummy_modifyset.yaml b/test/bats/tests/mutations/dummy_modifyset.yaml index 79acc58c612..e16c1d46461 100644 --- a/test/bats/tests/mutations/dummy_modifyset.yaml +++ b/test/bats/tests/mutations/dummy_modifyset.yaml @@ -1,4 +1,4 @@ -apiVersion: mutations.gatekeeper.sh/v1beta1 +apiVersion: mutations.gatekeeper.sh/v1 kind: ModifySet metadata: name: conflict diff --git a/test/bats/tests/mutations/k8sexternalip_assign.yaml b/test/bats/tests/mutations/k8sexternalip_assign.yaml index 418e7ec877e..bcca5f10444 100644 --- a/test/bats/tests/mutations/k8sexternalip_assign.yaml +++ b/test/bats/tests/mutations/k8sexternalip_assign.yaml @@ -1,4 +1,4 @@ -apiVersion: mutations.gatekeeper.sh/v1beta1 +apiVersion: mutations.gatekeeper.sh/v1 kind: Assign metadata: name: k8sexternalip