Skip to content

feat: Adding pubsub interface #2538

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sozercan merged 25 commits into from
May 25, 2023
Merged

feat: Adding pubsub interface #2538

Show file tree
Hide file tree
Changes from 18 commits
Commits
Show all changes
25 commits
Select commit Hold shift + click to select a range
acec1fe
handling create, update, delete connectoins on reconcile request
JaydipGabani Apr 12, 2023
c91fcb9
using pubsub msg struct from audit for dummy-subscriber
JaydipGabani May 11, 2023
2d795e8
fixing ci
JaydipGabani May 12, 2023
4da87c6
fixnig lint
JaydipGabani May 15, 2023
ce86992
renaming dummy to fake-subscriber
JaydipGabani May 15, 2023
fb3a791
Merge branch 'master' into pubsub
sozercan May 15, 2023
21f3ccd
removing common package, checking pubsub status before publishing, er…
JaydipGabani May 17, 2023
cced7f7
Merge branch 'pubsub' of github.com:JaydipGabani/gatekeeper into pubsub
JaydipGabani May 17, 2023
4a557d5
Merge branch 'master' of https://github.com/open-policy-agent/gatekee…
JaydipGabani May 17, 2023
2581824
creating annotations in tmp dir
JaydipGabani May 18, 2023
2ac3adc
handling create, update, delete connectoins on reconcile request
JaydipGabani Apr 12, 2023
20010f0
using pubsub msg struct from audit for dummy-subscriber
JaydipGabani May 11, 2023
e8793e4
fixing ci
JaydipGabani May 12, 2023
e9a1559
fixnig lint
JaydipGabani May 15, 2023
f8a60f6
renaming dummy to fake-subscriber
JaydipGabani May 15, 2023
f3ddfb9
removing common package, checking pubsub status before publishing, er…
JaydipGabani May 17, 2023
76af8d0
creating annotations in tmp dir
JaydipGabani May 18, 2023
9be106a
Merge branch 'pubsub' of github.com:JaydipGabani/gatekeeper into pubsub
JaydipGabani May 18, 2023
561839a
renaming pubsub-annotation to audit annotations
JaydipGabani May 19, 2023
17e0271
Merge branch 'master' into pubsub
JaydipGabani May 20, 2023
2cf8b7c
changing back auditPodAnnotations to podAnnotations
JaydipGabani May 22, 2023
6bf81ca
Merge branch 'master' into pubsub
JaydipGabani May 22, 2023
43acf63
Merge branch 'pubsub' of github.com:JaydipGabani/gatekeeper into pubsub
JaydipGabani May 22, 2023
a09ff0e
nit: helm variable audit pod annotations
JaydipGabani May 24, 2023
1319b9e
Merge branch 'master' into pubsub
JaydipGabani May 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 69 additions & 0 deletions .github/workflows/dapr-pubsub.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
name: dapr-pubsub
on:
Comment thread
JaydipGabani marked this conversation as resolved.
push:
paths:
- "pkg/pubsub/dapr"
Comment thread
JaydipGabani marked this conversation as resolved.
- "test/pubsub/**"
pull_request:
paths:
- "pkg/pubsub/dapr"
- "test/pubsub/**"
permissions: read-all

Comment thread
JaydipGabani marked this conversation as resolved.
jobs:
dapr_test:
name: "Dapr pubsub test"
runs-on: ubuntu-22.04
timeout-minutes: 15
strategy:
matrix:
DAPR_VERSION: ["1.10"]
steps:
- name: Check out code into the Go module directory
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c

- name: Set up Go 1.20
uses: actions/setup-go@v3
with:
go-version: 1.20

- name: Bootstrap e2e
run: |
mkdir -p $GITHUB_WORKSPACE/bin
mkdir .tmp
echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH
make e2e-bootstrap
make e2e-helm-install
helm repo add dapr https://dapr.github.io/helm-charts/
helm repo add bitnami https://charts.bitnami.com/bitnami
Comment thread
JaydipGabani marked this conversation as resolved.
helm repo update
helm upgrade --install dapr dapr/dapr --version=${{ matrix.DAPR_VERSION }} --namespace dapr-system --create-namespace --wait --debug
helm upgrade --install redis bitnami/redis --namespace default --set image.tag=7.0-debian-11 --wait --debug
make e2e-subscriber-build-load-image
make e2e-subscriber-deploy

- name: Run e2e
run: |
make docker-buildx IMG=gatekeeper-e2e:latest
make e2e-build-load-externaldata-image
make docker-buildx-crds CRD_IMG=gatekeeper-crds:latest
kind load docker-image --name kind gatekeeper-e2e:latest gatekeeper-crds:latest
kubectl create ns gatekeeper-system
Comment thread
JaydipGabani marked this conversation as resolved.
make e2e-publisher-deploy
make e2e-helm-deploy HELM_REPO=gatekeeper-e2e HELM_CRD_REPO=gatekeeper-crds HELM_RELEASE=latest ENABLE_PUBSUB=true
make test-e2e ENABLE_PUBSUB_TESTS=1

- name: Save logs
if: ${{ always() }}
run: |
kubectl logs -n fake-subscriber -l app=sub --tail=-1 > logs-audit-subscribe.json
kubectl logs -n gatekeeper-system -l control-plane=audit-controller --tail=-1 > logs-audit-publish.json

- name: Upload artifacts
uses: actions/upload-artifact@v3
if: ${{ always() }}
with:
name: pubsub-logs
path: |
logs-*.json

3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,3 +362,6 @@ tilt-settings.json

# dummy provider's certificate directory
test/externaldata/dummy-provider/certs/

# annotations for dapr
annotations.yaml

@sozercan sozercan May 11, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think we added this to .tmp, do we still need this?

@JaydipGabani JaydipGabani May 12, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reverted that change back, since creating annotation.yaml in .tmp was causing CI to error out with cannot create /.tmp/annotations.yaml: Directory nonexistent msg.

@maxsmythe maxsmythe May 15, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is the directory nonexistent? Is there a way to remedy this?

It would be good to avoid clutter in the root directory: saying "rm -rf <temp directory> will recover if we have any bad state" is a lot easier than saying "delete these X files"

@maxsmythe maxsmythe May 18, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bump (was not addressed since last review request)

@JaydipGabani JaydipGabani May 18, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad. I addressed it. Creating a tmp dir while bootstrapping to mitigate dir nonexistent error.

@maxsmythe maxsmythe May 19, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, thanks!

44 changes: 43 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,9 @@ GATOR_IMG := $(GATOR_REPOSITORY):latest
DEV_TAG ?= dev
USE_LOCAL_IMG ?= false
ENABLE_GENERATOR_EXPANSION ?= false
ENABLE_PUBSUB ?= false
AUDIT_CONNECTION ?= "audit"
AUDIT_CHANNEL ?= "audit"

VERSION := v3.13.0-beta.0

Expand Down Expand Up @@ -37,6 +40,7 @@ GOLANGCI_LINT_VERSION := v1.51.2
GOLANGCI_LINT_CACHE := $(shell pwd)/.tmp/golangci-lint

BENCHMARK_FILE_NAME ?= benchmarks.txt
FAKE_SUBSCRIBER_IMAGE ?= fake-subscriber:latest

ROOT_DIR := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
BIN_DIR := $(abspath $(ROOT_DIR)/bin)
Expand Down Expand Up @@ -186,6 +190,30 @@ e2e-helm-install:
./.staging/helm/linux-amd64/helm version --client

e2e-helm-deploy: e2e-helm-install
ifeq ($(ENABLE_PUBSUB),true)
@echo 'podPubsubAnnotations: {dapr.io/enabled: "true", dapr.io/app-id: "audit", dapr.io/metrics-port: "9999"}' > .tmp/annotations.yaml
./.staging/helm/linux-amd64/helm install manifest_staging/charts/gatekeeper --name-template=gatekeeper \
--namespace ${GATEKEEPER_NAMESPACE} \
--debug --wait \
--set image.repository=${HELM_REPO} \
--set image.crdRepository=${HELM_CRD_REPO} \
--set image.release=${HELM_RELEASE} \
--set postInstall.labelNamespace.image.repository=${HELM_CRD_REPO} \
--set postInstall.labelNamespace.image.tag=${HELM_RELEASE} \
--set postInstall.labelNamespace.enabled=true \
--set postInstall.probeWebhook.enabled=true \
--set emitAdmissionEvents=true \
--set emitAuditEvents=true \
--set admissionEventsInvolvedNamespace=true \
--set auditEventsInvolvedNamespace=true \
--set disabledBuiltins={http.send} \
--set logMutations=true \
--set audit.enablePubsub=${ENABLE_PUBSUB} \
--set audit.connection=${AUDIT_CONNECTION} \
--set audit.channel=${AUDIT_CHANNEL} \
--values .tmp/annotations.yaml \
--set mutationAnnotations=true;
else
./.staging/helm/linux-amd64/helm install manifest_staging/charts/gatekeeper --name-template=gatekeeper \
--namespace ${GATEKEEPER_NAMESPACE} --create-namespace \
--debug --wait \
Expand All @@ -202,7 +230,8 @@ e2e-helm-deploy: e2e-helm-install
--set auditEventsInvolvedNamespace=true \
--set disabledBuiltins={http.send} \
--set logMutations=true \
--set mutationAnnotations=true;\
--set mutationAnnotations=true
endif

e2e-helm-upgrade-init: e2e-helm-install
./.staging/helm/linux-amd64/helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts;\
Expand Down Expand Up @@ -240,6 +269,19 @@ e2e-helm-upgrade:
--set logMutations=true \
--set mutationAnnotations=true;\

e2e-subscriber-build-load-image:
docker buildx build --platform="linux/amd64" -t ${FAKE_SUBSCRIBER_IMAGE} --load -f test/pubsub/fake-subscriber/Dockerfile test/pubsub/fake-subscriber
kind load docker-image --name kind ${FAKE_SUBSCRIBER_IMAGE}

e2e-subscriber-deploy:
kubectl create ns fake-subscriber
kubectl get secret redis --namespace=default -o yaml | sed 's/namespace: .*/namespace: fake-subscriber/' | kubectl apply -f -
kubectl apply -f test/pubsub/fake-subscriber/manifest/subscriber.yaml

e2e-publisher-deploy:
kubectl get secret redis --namespace=default -o yaml | sed 's/namespace: .*/namespace: gatekeeper-system/' | kubectl apply -f -
kubectl apply -f test/pubsub/publish-components.yaml

# Build manager binary
manager: generate
GO111MODULE=on go build -mod vendor -o bin/manager -ldflags $(LDFLAGS) main.go
Expand Down
1 change: 1 addition & 0 deletions charts/gatekeeper/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,7 @@ preUninstall:
runAsNonRoot: true
runAsUser: 1000
podAnnotations: {}
podPubsubAnnotations: {}
podLabels: {}
podCountLimit: "100"
secretAnnotations: {}
Expand Down
2 changes: 2 additions & 0 deletions cmd/build/helmify/kustomize-for-helm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,7 @@ spec:
metadata:
annotations:
HELMSUBST_ANNOTATIONS: ""
HELMSUBST_PUBSUB_ANNOTATIONS: ""
spec:
containers:
- name: manager
Expand All @@ -163,6 +164,7 @@ spec:
- --audit-events-involved-namespace={{ .Values.auditEventsInvolvedNamespace }}
- --operation=audit
- --operation=status
- HELMSUBST_PUBSUB_ARGS
- HELMSUBST_MUTATION_STATUS_ENABLED_ARG
- --logtostderr
- --health-addr=:HELMSUBST_DEPLOYMENT_AUDIT_HEALTH_PORT
Expand Down
10 changes: 10 additions & 0 deletions cmd/build/helmify/replacements.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,10 @@ var replacements = map[string]string{
{{- toYaml .Values.podAnnotations | trim | nindent 8 }}
{{- end }}`,

`HELMSUBST_PUBSUB_ANNOTATIONS: ""`: `{{- if .Values.podPubsubAnnotations }}

@maxsmythe maxsmythe May 15, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we need a special knob for pubsub annotations when users can already fully customize annotations? What are these annotations used for?

@JaydipGabani JaydipGabani May 17, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, we dont want to inject dapr's pubsub annotation to controller-manager, as we do not want a dapr sidecar running in controller-manager. We just need a sidecar in audit pod. Hence, I needed some way to add annotations per pod.

@JaydipGabani JaydipGabani May 17, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For anyother drivers, if they need any specific annotation on the pod running pubsub, this might be a way to provide it only for audit.

@maxsmythe maxsmythe May 19, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should make this field something like AUDIT_POD_ANNOTATIONS, then. This is more consistent with our stance of not explicitly supporting specific 3rd party tooling in helm, but providing generic knobs that allow for support.

@JaydipGabani JaydipGabani May 20, 2023

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated

{{- toYaml .Values.podPubsubAnnotations | trim | nindent 8 }}
{{- end }}`,

"HELMSUBST_SECRET_ANNOTATIONS": `{{- toYaml .Values.secretAnnotations | trim | nindent 4 }}`,

"- HELMSUBST_TLS_HEALTHCHECK_ENABLED_ARG": `{{ if .Values.enableTLSHealthcheck}}- --enable-tls-healthcheck{{- end }}`,
Expand All @@ -85,6 +89,12 @@ var replacements = map[string]string{

"- HELMSUBST_MUTATION_STATUS_ENABLED_ARG": `{{ if not .Values.disableMutation}}- --operation=mutation-status{{- end }}`,

"- HELMSUBST_PUBSUB_ARGS": `{{ if .Values.audit.enablePubsub}}
- --enable-pub-sub={{ .Values.audit.enablePubsub }}
- --audit-connection={{ .Values.audit.connection }}
- --audit-channel={{ .Values.audit.channel }}
{{- end }}`,

"HELMSUBST_MUTATING_WEBHOOK_FAILURE_POLICY": `{{ .Values.mutatingWebhookFailurePolicy }}`,

"HELMSUBST_MUTATING_WEBHOOK_REINVOCATION_POLICY": `{{ .Values.mutatingWebhookReinvocationPolicy }}`,
Expand Down
2 changes: 2 additions & 0 deletions cmd/build/helmify/static/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,7 @@ preUninstall:
runAsNonRoot: true
runAsUser: 1000
podAnnotations: {}
podPubsubAnnotations: {}
podLabels: {}
podCountLimit: "100"
secretAnnotations: {}
Expand Down Expand Up @@ -201,6 +202,7 @@ controllerManager:
# - ipBlock:
# cidr: 0.0.0.0/0
audit:
enablePubsub: false
hostNetwork: false
dnsPolicy: ClusterFirst
metricsPort: 8888
Expand Down
12 changes: 7 additions & 5 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
module github.com/open-policy-agent/gatekeeper/v3

go 1.18
go 1.20

require (
cloud.google.com/go/trace v1.4.0
cloud.google.com/go/trace v1.8.0
contrib.go.opencensus.io/exporter/ocagent v0.7.0
contrib.go.opencensus.io/exporter/prometheus v0.4.2
contrib.go.opencensus.io/exporter/stackdriver v0.13.14
github.com/dapr/go-sdk v1.6.0
github.com/davecgh/go-spew v1.1.1
github.com/dominikbraun/graph v0.16.2
github.com/go-logr/logr v1.2.4
Expand Down Expand Up @@ -67,6 +68,7 @@ require (
github.com/docker/go-metrics v0.0.1 // indirect
github.com/docker/go-units v0.4.0 // indirect
github.com/emicklei/go-restful/v3 v3.9.0 // indirect
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
github.com/felixge/httpsnoop v1.0.3 // indirect
github.com/fsnotify/fsnotify v1.6.0 // indirect
Expand All @@ -87,7 +89,7 @@ require (
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/google/pprof v0.0.0-20220318212150-b2ab0324ddda // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.1 // indirect
github.com/googleapis/gax-go/v2 v2.7.0 // indirect
github.com/gorilla/mux v1.8.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
Expand Down Expand Up @@ -140,9 +142,9 @@ require (
golang.org/x/text v0.9.0 // indirect
golang.org/x/tools v0.8.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
google.golang.org/api v0.103.0 // indirect
google.golang.org/api v0.108.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa // indirect
google.golang.org/grpc v1.54.0 // indirect
google.golang.org/protobuf v1.28.1 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
19 changes: 11 additions & 8 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,8 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
cloud.google.com/go/trace v1.4.0 h1:qO9eLn2esajC9sxpqp1YKX37nXC3L4BfGnPS0Cx9dYo=
cloud.google.com/go/trace v1.4.0/go.mod h1:UG0v8UBqzusp+z63o7FK74SdFE+AXpCLdFb1rshXG+Y=
cloud.google.com/go/trace v1.8.0 h1:GFPLxbp5/FzdgTzor3nlNYNxMd6hLmzkE7sA9F0qQcA=
cloud.google.com/go/trace v1.8.0/go.mod h1:zH7vcsbAhklH8hWFig58HvxcxyQbaIqMarMg9hn5ECA=
contrib.go.opencensus.io/exporter/ocagent v0.7.0 h1:BEfdCTXfMV30tLZD8c9n64V/tIZX5+9sXiuFLnrr1k8=
contrib.go.opencensus.io/exporter/ocagent v0.7.0/go.mod h1:IshRmMJBhDfFj5Y67nVhMYTTIze91RUeT73ipWKs/GY=
contrib.go.opencensus.io/exporter/prometheus v0.4.2 h1:sqfsYl5GIY/L570iT+l93ehxaWJs2/OwXtiWwew3oAg=
Expand Down Expand Up @@ -362,6 +362,8 @@ github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1S
github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
github.com/dapr/go-sdk v1.6.0 h1:jg5A2khSCHF8bGZsig5RWN/gD0jjitszc2V6Uq2pPdY=
github.com/dapr/go-sdk v1.6.0/go.mod h1:KLQBltoD9K0w5hKTihdcyg9Epob9gypwL5dYcQzPro4=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
Expand Down Expand Up @@ -598,6 +600,7 @@ github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
Expand Down Expand Up @@ -680,8 +683,8 @@ github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/googleapis/enterprise-certificate-proxy v0.2.0 h1:y8Yozv7SZtlU//QXbezB6QkpuE6jMD2/gfzk4AftXjs=
github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
github.com/googleapis/enterprise-certificate-proxy v0.2.1 h1:RY7tHKZcRlk788d5WSo/e83gOyyy742E8GSs771ySpg=
github.com/googleapis/enterprise-certificate-proxy v0.2.1/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
Expand Down Expand Up @@ -1753,8 +1756,8 @@ google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQ
google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
google.golang.org/api v0.103.0 h1:9yuVqlu2JCvcLg9p8S3fcFLZij8EPSyvODIY1rkMizQ=
google.golang.org/api v0.103.0/go.mod h1:hGtW6nK1AC+d9si/UBhw8Xli+QMOf6xyNAyJw4qU9w0=
google.golang.org/api v0.108.0 h1:WVBc/faN0DkKtR43Q/7+tPny9ZoLZdIiAyG5Q9vFClg=
google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
Expand Down Expand Up @@ -1837,8 +1840,8 @@ google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2
google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f h1:BWUVssLB0HVOSY78gIdvk1dTVYtT1y8SBWtPYuTJ/6w=
google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa h1:qQPhfbPO23fwm/9lQr91L1u62Zo6cm+zI+slZT+uf+o=
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
Expand Down
5 changes: 5 additions & 0 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ import (
"github.com/open-policy-agent/gatekeeper/v3/pkg/metrics"
"github.com/open-policy-agent/gatekeeper/v3/pkg/mutation"
"github.com/open-policy-agent/gatekeeper/v3/pkg/operations"
"github.com/open-policy-agent/gatekeeper/v3/pkg/pubsub"
"github.com/open-policy-agent/gatekeeper/v3/pkg/readiness"
"github.com/open-policy-agent/gatekeeper/v3/pkg/target"
"github.com/open-policy-agent/gatekeeper/v3/pkg/upgrade"
Expand Down Expand Up @@ -381,6 +382,7 @@ func setupControllers(mgr ctrl.Manager, sw *watch.ControllerSwitch, tracker *rea

mutationSystem := mutation.NewSystem(mutationOpts)
expansionSystem := expansion.NewSystem(mutationSystem)
pubsubSystem := pubsub.NewSystem()

c := mgr.GetCache()
dc, ok := c.(watch.RemovableCache)
Expand Down Expand Up @@ -416,6 +418,7 @@ func setupControllers(mgr ctrl.Manager, sw *watch.ControllerSwitch, tracker *rea
ExpansionSystem: expansionSystem,
ProviderCache: providerCache,
WatchSet: watchSet,
PubsubSystem: pubsubSystem,
}

if err := controller.AddToManager(mgr, &opts); err != nil {
Expand Down Expand Up @@ -445,6 +448,7 @@ func setupControllers(mgr ctrl.Manager, sw *watch.ControllerSwitch, tracker *rea
ProcessExcluder: processExcluder,
CacheLister: auditCache,
ExpansionSystem: expansionSystem,
PubSubSystem: pubsubSystem,
}
if err := audit.AddToManager(mgr, &auditDeps); err != nil {
setupLog.Error(err, "unable to register audit with the manager")
Expand All @@ -463,6 +467,7 @@ func setupControllers(mgr ctrl.Manager, sw *watch.ControllerSwitch, tracker *rea
setupLog.Error(err, "unable to register metrics with the manager")
return err
}

return nil
}

Expand Down
8 changes: 8 additions & 0 deletions manifest_staging/charts/gatekeeper/templates/gatekeeper-audit-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ spec:
{{- if .Values.podAnnotations }}
{{- toYaml .Values.podAnnotations | trim | nindent 8 }}
{{- end }}
{{- if .Values.podPubsubAnnotations }}
{{- toYaml .Values.podPubsubAnnotations | trim | nindent 8 }}
{{- end }}
labels:
{{- include "gatekeeper.podLabels" . }}
app: '{{ template "gatekeeper.name" . }}'
Expand Down Expand Up @@ -60,6 +63,11 @@ spec:
- --audit-events-involved-namespace={{ .Values.auditEventsInvolvedNamespace }}
- --operation=audit
- --operation=status
{{ if .Values.audit.enablePubsub}}
- --enable-pub-sub={{ .Values.audit.enablePubsub }}
- --audit-connection={{ .Values.audit.connection }}
- --audit-channel={{ .Values.audit.channel }}
{{- end }}
{{ if not .Values.disableMutation}}- --operation=mutation-status{{- end }}
- --logtostderr
- --health-addr=:{{ .Values.audit.healthPort }}
Expand Down
Loading