--- # Source: gatekeeper/crds/assign-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: assign.mutations.gatekeeper.sh spec: group: mutations.gatekeeper.sh names: kind: Assign listKind: AssignList plural: assign singular: assign scope: Cluster versions: - name: v1 schema: openAPIV3Schema: description: Assign is the Schema for the assign API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: name: maxLength: 63 type: string type: object spec: description: AssignSpec defines the desired state of Assign. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array location: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' type: string match: description: |- Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: description: Parameters define the behavior of the mutator. properties: assign: description: Assign.value holds the value to be assigned properties: externalData: description: ExternalData describes the external data provider to be used for mutation. properties: dataSource: default: ValueAtLocation description: |- DataSource specifies where to extract the data that will be sent to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: description: |- Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail description: |- FailurePolicy specifies the policy to apply when the external data provider returns an error. enum: - UseDefault - Ignore - Fail type: string provider: description: Provider is the name of the external data provider. type: string required: - provider type: object fromMetadata: description: FromMetadata assigns a value from the specified metadata field. properties: field: description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. type: string type: object value: description: Value is a constant value that will be assigned to `location` x-kubernetes-preserve-unknown-fields: true type: object pathTests: items: description: |- PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object enum: - MustExist - MustNotExist type: string subPath: type: string type: object type: array type: object type: object status: description: AssignStatus defines the observed state of Assign. properties: byPod: items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: true subresources: status: {} - name: v1alpha1 schema: openAPIV3Schema: description: Assign is the Schema for the assign API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: AssignSpec defines the desired state of Assign. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array location: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' type: string match: description: |- Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: description: Parameters define the behavior of the mutator. properties: assign: description: Assign.value holds the value to be assigned properties: externalData: description: ExternalData describes the external data provider to be used for mutation. properties: dataSource: default: ValueAtLocation description: |- DataSource specifies where to extract the data that will be sent to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: description: |- Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail description: |- FailurePolicy specifies the policy to apply when the external data provider returns an error. enum: - UseDefault - Ignore - Fail type: string provider: description: Provider is the name of the external data provider. type: string required: - provider type: object fromMetadata: description: FromMetadata assigns a value from the specified metadata field. properties: field: description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. type: string type: object value: description: Value is a constant value that will be assigned to `location` x-kubernetes-preserve-unknown-fields: true type: object pathTests: items: description: |- PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object enum: - MustExist - MustNotExist type: string subPath: type: string type: object type: array type: object type: object status: description: AssignStatus defines the observed state of Assign. properties: byPod: items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: false subresources: status: {} - name: v1beta1 schema: openAPIV3Schema: description: Assign is the Schema for the assign API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: AssignSpec defines the desired state of Assign. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array location: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main]`.' type: string match: description: |- Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: description: Parameters define the behavior of the mutator. properties: assign: description: Assign.value holds the value to be assigned properties: externalData: description: ExternalData describes the external data provider to be used for mutation. properties: dataSource: default: ValueAtLocation description: |- DataSource specifies where to extract the data that will be sent to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: description: |- Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail description: |- FailurePolicy specifies the policy to apply when the external data provider returns an error. enum: - UseDefault - Ignore - Fail type: string provider: description: Provider is the name of the external data provider. type: string required: - provider type: object fromMetadata: description: FromMetadata assigns a value from the specified metadata field. properties: field: description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. type: string type: object value: description: Value is a constant value that will be assigned to `location` x-kubernetes-preserve-unknown-fields: true type: object pathTests: items: description: |- PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object enum: - MustExist - MustNotExist type: string subPath: type: string type: object type: array type: object type: object status: description: AssignStatus defines the observed state of Assign. properties: byPod: items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: false subresources: status: {} --- # Source: gatekeeper/crds/assignimage-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: assignimage.mutations.gatekeeper.sh spec: group: mutations.gatekeeper.sh names: kind: AssignImage listKind: AssignImageList plural: assignimage singular: assignimage scope: Cluster versions: - name: v1alpha1 schema: openAPIV3Schema: description: AssignImage is the Schema for the assignimage API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: name: maxLength: 63 type: string type: object spec: description: AssignImageSpec defines the desired state of AssignImage. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array location: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].image`.' type: string match: description: |- Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: description: Parameters define the behavior of the mutator. properties: assignDomain: description: |- AssignDomain sets the domain component on an image string. The trailing slash should not be included. type: string assignPath: description: AssignPath sets the domain component on an image string. type: string assignTag: description: |- AssignImage sets the image component on an image string. It must start with a `:` or `@`. type: string pathTests: items: description: |- PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object enum: - MustExist - MustNotExist type: string subPath: type: string type: object type: array type: object type: object status: description: AssignImageStatus defines the observed state of AssignImage. properties: byPod: items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: true subresources: status: {} --- # Source: gatekeeper/crds/assignmetadata-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: assignmetadata.mutations.gatekeeper.sh spec: group: mutations.gatekeeper.sh names: kind: AssignMetadata listKind: AssignMetadataList plural: assignmetadata singular: assignmetadata scope: Cluster versions: - name: v1 schema: openAPIV3Schema: description: AssignMetadata is the Schema for the assignmetadata API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: name: maxLength: 63 type: string type: object spec: description: AssignMetadataSpec defines the desired state of AssignMetadata. properties: location: type: string match: description: Match selects which objects are in scope. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: properties: assign: description: Assign.value holds the value to be assigned properties: externalData: description: ExternalData describes the external data provider to be used for mutation. properties: dataSource: default: ValueAtLocation description: |- DataSource specifies where to extract the data that will be sent to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: description: |- Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail description: |- FailurePolicy specifies the policy to apply when the external data provider returns an error. enum: - UseDefault - Ignore - Fail type: string provider: description: Provider is the name of the external data provider. type: string required: - provider type: object fromMetadata: description: FromMetadata assigns a value from the specified metadata field. properties: field: description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. type: string type: object value: description: Value is a constant value that will be assigned to `location` x-kubernetes-preserve-unknown-fields: true type: object type: object type: object status: description: AssignMetadataStatus defines the observed state of AssignMetadata. properties: byPod: description: |- INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: true subresources: status: {} - name: v1alpha1 schema: openAPIV3Schema: description: AssignMetadata is the Schema for the assignmetadata API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: AssignMetadataSpec defines the desired state of AssignMetadata. properties: location: type: string match: description: Match selects which objects are in scope. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: properties: assign: description: Assign.value holds the value to be assigned properties: externalData: description: ExternalData describes the external data provider to be used for mutation. properties: dataSource: default: ValueAtLocation description: |- DataSource specifies where to extract the data that will be sent to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: description: |- Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail description: |- FailurePolicy specifies the policy to apply when the external data provider returns an error. enum: - UseDefault - Ignore - Fail type: string provider: description: Provider is the name of the external data provider. type: string required: - provider type: object fromMetadata: description: FromMetadata assigns a value from the specified metadata field. properties: field: description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. type: string type: object value: description: Value is a constant value that will be assigned to `location` x-kubernetes-preserve-unknown-fields: true type: object type: object type: object status: description: AssignMetadataStatus defines the observed state of AssignMetadata. properties: byPod: description: |- INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: false subresources: status: {} - name: v1beta1 schema: openAPIV3Schema: description: AssignMetadata is the Schema for the assignmetadata API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: AssignMetadataSpec defines the desired state of AssignMetadata. properties: location: type: string match: description: Match selects which objects are in scope. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: properties: assign: description: Assign.value holds the value to be assigned properties: externalData: description: ExternalData describes the external data provider to be used for mutation. properties: dataSource: default: ValueAtLocation description: |- DataSource specifies where to extract the data that will be sent to the external data provider as parameters. enum: - ValueAtLocation - Username type: string default: description: |- Default specifies the default value to use when the external data provider returns an error and the failure policy is set to "UseDefault". type: string failurePolicy: default: Fail description: |- FailurePolicy specifies the policy to apply when the external data provider returns an error. enum: - UseDefault - Ignore - Fail type: string provider: description: Provider is the name of the external data provider. type: string required: - provider type: object fromMetadata: description: FromMetadata assigns a value from the specified metadata field. properties: field: description: Field specifies which metadata field provides the assigned value. Valid fields are `namespace` and `name`. type: string type: object value: description: Value is a constant value that will be assigned to `location` x-kubernetes-preserve-unknown-fields: true type: object type: object type: object status: description: AssignMetadataStatus defines the observed state of AssignMetadata. properties: byPod: description: |- INSERT ADDITIONAL STATUS FIELD - define observed state of cluster Important: Run "make" to regenerate code after modifying this file items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: false subresources: status: {} --- # Source: gatekeeper/crds/config-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: configs.config.gatekeeper.sh spec: group: config.gatekeeper.sh names: kind: Config listKind: ConfigList plural: configs singular: config scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: Config is the Schema for the configs API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ConfigSpec defines the desired state of Config. properties: match: description: Configuration for namespace exclusion items: properties: excludedNamespaces: items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array processes: items: type: string type: array type: object type: array readiness: description: Configuration for readiness tracker properties: statsEnabled: type: boolean type: object sync: description: Configuration for syncing k8s objects properties: syncOnly: description: If non-empty, only entries on this list will be replicated into OPA items: properties: group: type: string kind: type: string version: type: string type: object type: array type: object validation: description: Configuration for validation properties: traces: description: List of requests to trace. Both "user" and "kinds" must be specified items: properties: dump: description: Also dump the state of OPA with the trace. Set to `All` to dump everything. type: string kind: description: Only trace requests of the following GroupVersionKind properties: group: type: string kind: type: string version: type: string type: object user: description: Only trace requests from the specified user type: string type: object type: array type: object type: object status: description: ConfigStatus defines the observed state of Config. properties: byPod: items: properties: configUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string errors: items: properties: message: type: string type: type: string required: - message type: object type: array id: type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: true subresources: status: {} --- # Source: gatekeeper/crds/configpodstatus-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: configpodstatuses.status.gatekeeper.sh spec: group: status.gatekeeper.sh names: kind: ConfigPodStatus listKind: ConfigPodStatusList plural: configpodstatuses singular: configpodstatus scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object status: properties: configUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string errors: items: properties: message: type: string type: type: string required: - message type: object type: array id: type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: object served: true storage: true --- # Source: gatekeeper/crds/connection-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: connections.connection.gatekeeper.sh spec: group: connection.gatekeeper.sh names: kind: Connection listKind: ConnectionList plural: connections singular: connection scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: Connection is the Schema for the connections API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ConnectionSpec defines the desired state of Connection. properties: config: x-kubernetes-preserve-unknown-fields: true driver: description: Driver is the name of one of the expected drivers i.e. dapr, disk type: string required: - config - driver type: object status: description: ConnectionStatus defines the observed state of Connection. properties: byPod: items: description: ConnectionPodStatusStatus defines the observed state of ConnectionPodStatus. properties: active: description: Indicator for alive connection with at least one successful publish type: boolean connectionUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string errors: items: properties: message: type: string type: type: string required: - message - type type: object type: array id: description: ID is the unique identifier for the pod that wrote the status type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: true subresources: status: {} --- # Source: gatekeeper/crds/connectionpodstatus-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: connectionpodstatuses.status.gatekeeper.sh spec: group: status.gatekeeper.sh names: kind: ConnectionPodStatus listKind: ConnectionPodStatusList plural: connectionpodstatuses singular: connectionpodstatus scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: ConnectionPodStatus is the Schema for the connectionpodstatuses API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object status: description: No spec field is defined here, as this is a status-only resource. properties: active: description: Indicator for alive connection with at least one successful publish type: boolean connectionUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string errors: items: properties: message: type: string type: type: string required: - message - type type: object type: array id: description: ID is the unique identifier for the pod that wrote the status type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: object served: true storage: true --- # Source: gatekeeper/crds/constraintpodstatus-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: constraintpodstatuses.status.gatekeeper.sh spec: group: status.gatekeeper.sh names: kind: ConstraintPodStatus listKind: ConstraintPodStatusList plural: constraintpodstatuses singular: constraintpodstatus scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: ConstraintPodStatus is the Schema for the constraintpodstatuses API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object status: description: ConstraintPodStatusStatus defines the observed state of ConstraintPodStatus. properties: constraintUID: description: |- Storing the constraint UID allows us to detect drift, such as when a constraint has been recreated after its CRD was deleted out from under it, interrupting the watch type: string enforced: type: boolean enforcementPointsStatus: items: description: EnforcementPointStatus represents the status of a single enforcement point. properties: enforcementPoint: type: string message: type: string observedGeneration: format: int64 type: integer state: type: string required: - enforcementPoint - state type: object type: array errors: items: description: Error represents a single error caught while adding a constraint to engine. properties: code: type: string location: type: string message: type: string required: - code - message type: object type: array id: type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: object served: true storage: true --- # Source: gatekeeper/crds/constrainttemplate-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: constrainttemplates.templates.gatekeeper.sh spec: group: templates.gatekeeper.sh names: kind: ConstraintTemplate listKind: ConstraintTemplateList plural: constrainttemplates singular: constrainttemplate scope: Cluster versions: - name: v1 schema: openAPIV3Schema: description: ConstraintTemplate is the Schema for the constrainttemplates API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ConstraintTemplateSpec defines the desired state of ConstraintTemplate. properties: crd: description: CRD defines the custom resource definition specification for the constraint. properties: spec: description: CRDSpec defines the spec for the CRD. properties: names: description: Names defines the naming conventions for the constraint kind. properties: kind: type: string shortNames: items: type: string type: array type: object validation: default: legacySchema: false description: Validation defines the schema for constraint parameters. properties: legacySchema: default: false type: boolean openAPIV3Schema: type: object x-kubernetes-preserve-unknown-fields: true type: object type: object type: object targets: items: description: Target defines the target handler and policy for the constraint template. properties: code: description: |- The source code options for the constraint template. "Rego" can only be specified in one place (either here or in the "rego" field) items: description: Code defines the policy source code for a specific engine. properties: engine: description: 'The engine used to evaluate the code. Example: "Rego". Required.' type: string source: description: The source code for the template. Required. x-kubernetes-preserve-unknown-fields: true required: - engine - source type: object type: array x-kubernetes-list-map-keys: - engine x-kubernetes-list-type: map libs: items: type: string type: array operations: items: description: OperationType specifies an operation for a request. enum: - '*' - CREATE - DELETE - UPDATE - CONNECT type: string type: array rego: type: string target: type: string type: object type: array type: object status: description: ConstraintTemplateStatus defines the observed state of ConstraintTemplate. properties: byPod: items: description: |- ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller properties: errors: items: description: CreateCRDError represents a single error caught during parsing, compiling, etc. properties: code: type: string location: type: string message: type: string required: - code - message type: object type: array id: description: a unique identifier for the pod that wrote the status type: string observedGeneration: format: int64 type: integer type: object x-kubernetes-preserve-unknown-fields: true type: array created: type: boolean type: object type: object served: true storage: true subresources: status: {} - name: v1alpha1 schema: openAPIV3Schema: description: ConstraintTemplate is the Schema for the constrainttemplates API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ConstraintTemplateSpec defines the desired state of ConstraintTemplate. properties: crd: description: CRD defines the custom resource definition specification for the constraint. properties: spec: description: CRDSpec defines the spec for the CRD. properties: names: description: Names defines the naming conventions for the constraint kind. properties: kind: type: string shortNames: items: type: string type: array type: object validation: default: legacySchema: true description: Validation defines the schema for constraint parameters. properties: legacySchema: default: true type: boolean openAPIV3Schema: type: object x-kubernetes-preserve-unknown-fields: true type: object type: object type: object targets: items: description: Target defines the target handler and policy for the constraint template. properties: code: description: |- The source code options for the constraint template. "Rego" can only be specified in one place (either here or in the "rego" field) items: description: Code defines the policy source code for a specific engine. properties: engine: description: 'The engine used to evaluate the code. Example: "Rego". Required.' type: string source: description: The source code for the template. Required. x-kubernetes-preserve-unknown-fields: true required: - engine - source type: object type: array x-kubernetes-list-map-keys: - engine x-kubernetes-list-type: map libs: items: type: string type: array operations: enum: - '*' - CREATE - DELETE - UPDATE - CONNECT items: description: OperationType specifies an operation for a request. type: string type: array rego: type: string target: type: string type: object type: array type: object status: description: ConstraintTemplateStatus defines the observed state of ConstraintTemplate. properties: byPod: items: description: |- ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller properties: errors: items: description: CreateCRDError represents a single error caught during parsing, compiling, etc. properties: code: type: string location: type: string message: type: string required: - code - message type: object type: array id: description: a unique identifier for the pod that wrote the status type: string observedGeneration: format: int64 type: integer type: object x-kubernetes-preserve-unknown-fields: true type: array created: type: boolean type: object type: object served: true storage: false subresources: status: {} - name: v1beta1 schema: openAPIV3Schema: description: ConstraintTemplate is the Schema for the constrainttemplates API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ConstraintTemplateSpec defines the desired state of ConstraintTemplate. properties: crd: description: CRD defines the custom resource definition specification for the constraint. properties: spec: description: CRDSpec defines the spec for the CRD. properties: names: description: Names defines the naming conventions for the constraint kind. properties: kind: type: string shortNames: items: type: string type: array type: object validation: default: legacySchema: true description: Validation defines the schema for constraint parameters. properties: legacySchema: default: true type: boolean openAPIV3Schema: type: object x-kubernetes-preserve-unknown-fields: true type: object type: object type: object targets: items: description: Target defines the target handler and policy for the constraint template. properties: code: description: |- The source code options for the constraint template. "Rego" can only be specified in one place (either here or in the "rego" field) items: description: Code defines the policy source code for a specific engine. properties: engine: description: 'The engine used to evaluate the code. Example: "Rego". Required.' type: string source: description: The source code for the template. Required. x-kubernetes-preserve-unknown-fields: true required: - engine - source type: object type: array x-kubernetes-list-map-keys: - engine x-kubernetes-list-type: map libs: items: type: string type: array operations: items: description: OperationType specifies an operation for a request. enum: - '*' - CREATE - DELETE - UPDATE - CONNECT type: string type: array rego: type: string target: type: string type: object type: array type: object status: description: ConstraintTemplateStatus defines the observed state of ConstraintTemplate. properties: byPod: items: description: |- ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller properties: errors: items: description: CreateCRDError represents a single error caught during parsing, compiling, etc. properties: code: type: string location: type: string message: type: string required: - code - message type: object type: array id: description: a unique identifier for the pod that wrote the status type: string observedGeneration: format: int64 type: integer type: object x-kubernetes-preserve-unknown-fields: true type: array created: type: boolean type: object type: object served: true storage: false subresources: status: {} --- # Source: gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: constrainttemplatepodstatuses.status.gatekeeper.sh spec: group: status.gatekeeper.sh names: kind: ConstraintTemplatePodStatus listKind: ConstraintTemplatePodStatusList plural: constrainttemplatepodstatuses singular: constrainttemplatepodstatus scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: ConstraintTemplatePodStatus is the Schema for the constrainttemplatepodstatuses API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object status: description: ConstraintTemplatePodStatusStatus defines the observed state of ConstraintTemplatePodStatus. properties: errors: items: description: CreateCRDError represents a single error caught during parsing, compiling, etc. properties: code: type: string location: type: string message: type: string required: - code - message type: object type: array id: description: 'Important: Run "make" to regenerate code after modifying this file' type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array templateUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string vapGenerationStatus: description: VAPGenerationStatus represents the status of VAP generation. properties: observedGeneration: format: int64 type: integer state: type: string warning: type: string type: object type: object type: object served: true storage: true --- # Source: gatekeeper/crds/expansiontemplate-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: expansiontemplate.expansion.gatekeeper.sh spec: group: expansion.gatekeeper.sh names: kind: ExpansionTemplate listKind: ExpansionTemplateList plural: expansiontemplate singular: expansiontemplate scope: Cluster versions: - name: v1alpha1 schema: openAPIV3Schema: description: ExpansionTemplate is the Schema for the ExpansionTemplate API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: name: maxLength: 63 type: string type: object spec: description: ExpansionTemplateSpec defines the desired state of ExpansionTemplate. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds of generator resources which will be expanded. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array enforcementAction: description: |- EnforcementAction specifies the enforcement action to be used for resources matching the ExpansionTemplate. Specifying an empty value will use the enforcement action specified by the Constraint in violation. type: string generatedGVK: description: |- GeneratedGVK specifies the GVK of the resources which the generator resource creates. properties: group: type: string kind: type: string version: type: string type: object templateSource: description: |- TemplateSource specifies the source field on the generator resource to use as the base for expanded resource. For Pod-creating generators, this is usually spec.template type: string type: object status: description: ExpansionTemplateStatus defines the observed state of ExpansionTemplate. properties: byPod: items: description: ExpansionTemplatePodStatusStatus defines the observed state of ExpansionTemplatePodStatus. properties: errors: items: properties: message: type: string type: type: string required: - message type: object type: array id: description: 'Important: Run "make" to regenerate code after modifying this file' type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array templateUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string type: object type: array type: object type: object served: true storage: true subresources: status: {} - name: v1beta1 schema: openAPIV3Schema: description: ExpansionTemplate is the Schema for the ExpansionTemplate API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ExpansionTemplateSpec defines the desired state of ExpansionTemplate. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds of generator resources which will be expanded. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array enforcementAction: description: |- EnforcementAction specifies the enforcement action to be used for resources matching the ExpansionTemplate. Specifying an empty value will use the enforcement action specified by the Constraint in violation. type: string generatedGVK: description: |- GeneratedGVK specifies the GVK of the resources which the generator resource creates. properties: group: type: string kind: type: string version: type: string type: object templateSource: description: |- TemplateSource specifies the source field on the generator resource to use as the base for expanded resource. For Pod-creating generators, this is usually spec.template type: string type: object status: description: ExpansionTemplateStatus defines the observed state of ExpansionTemplate. properties: byPod: items: description: ExpansionTemplatePodStatusStatus defines the observed state of ExpansionTemplatePodStatus. properties: errors: items: properties: message: type: string type: type: string required: - message type: object type: array id: description: 'Important: Run "make" to regenerate code after modifying this file' type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array templateUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string type: object type: array type: object type: object served: true storage: false subresources: status: {} --- # Source: gatekeeper/crds/expansiontemplatepodstatus-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: expansiontemplatepodstatuses.status.gatekeeper.sh spec: group: status.gatekeeper.sh names: kind: ExpansionTemplatePodStatus listKind: ExpansionTemplatePodStatusList plural: expansiontemplatepodstatuses singular: expansiontemplatepodstatus scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: ExpansionTemplatePodStatus is the Schema for the expansiontemplatepodstatuses API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object status: description: ExpansionTemplatePodStatusStatus defines the observed state of ExpansionTemplatePodStatus. properties: errors: items: properties: message: type: string type: type: string required: - message type: object type: array id: description: 'Important: Run "make" to regenerate code after modifying this file' type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array templateUID: description: |- UID is a type that holds unique ID values, including UUIDs. Because we don't ONLY use UUIDs, this is an alias to string. Being a type captures intent and helps make sure that UIDs and names do not get conflated. type: string type: object type: object served: true storage: true --- # Source: gatekeeper/crds/modifyset-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: modifyset.mutations.gatekeeper.sh spec: group: mutations.gatekeeper.sh names: kind: ModifySet listKind: ModifySetList plural: modifyset singular: modifyset scope: Cluster versions: - name: v1 schema: openAPIV3Schema: description: |- ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: name: maxLength: 63 type: string type: object spec: description: ModifySetSpec defines the desired state of ModifySet. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array location: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' type: string match: description: |- Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: description: Parameters define the behavior of the mutator. properties: operation: default: merge description: Operation describes whether values should be merged in ("merge"), or pruned ("prune"). Default value is "merge" enum: - merge - prune type: string pathTests: description: |- PathTests are a series of existence tests that can be checked before a mutation is applied items: description: |- PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object enum: - MustExist - MustNotExist type: string subPath: type: string type: object type: array values: description: Values describes the values provided to the operation as `values.fromList`. type: object x-kubernetes-preserve-unknown-fields: true type: object type: object status: description: ModifySetStatus defines the observed state of ModifySet. properties: byPod: items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: true subresources: status: {} - name: v1alpha1 schema: openAPIV3Schema: description: |- ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ModifySetSpec defines the desired state of ModifySet. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array location: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' type: string match: description: |- Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: description: Parameters define the behavior of the mutator. properties: operation: default: merge description: Operation describes whether values should be merged in ("merge"), or pruned ("prune"). Default value is "merge" enum: - merge - prune type: string pathTests: description: |- PathTests are a series of existence tests that can be checked before a mutation is applied items: description: |- PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object enum: - MustExist - MustNotExist type: string subPath: type: string type: object type: array values: description: Values describes the values provided to the operation as `values.fromList`. type: object x-kubernetes-preserve-unknown-fields: true type: object type: object status: description: ModifySetStatus defines the observed state of ModifySet. properties: byPod: items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: false subresources: status: {} - name: v1beta1 schema: openAPIV3Schema: description: |- ModifySet allows the user to modify non-keyed lists, such as the list of arguments to a container. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ModifySetSpec defines the desired state of ModifySet. properties: applyTo: description: |- ApplyTo lists the specific groups, versions and kinds a mutation will be applied to. This is necessary because every mutation implies part of an object schema and object schemas are associated with specific GVKs. items: description: |- ApplyTo determines what GVKs items the mutation should apply to. Globs are not allowed. properties: groups: items: type: string type: array kinds: items: type: string type: array versions: items: type: string type: array type: object type: array location: description: 'Location describes the path to be mutated, for example: `spec.containers[name: main].args`.' type: string match: description: |- Match allows the user to limit which resources get mutated. Individual match criteria are AND-ed together. An undefined match criteria matches everything. properties: excludedNamespaces: description: |- ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array kinds: items: description: |- Kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the mutation will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope. properties: apiGroups: description: |- APIGroups is the API groups the resources belong to. '*' is all groups. If '*' is present, the length of the slice must be one. Required. items: type: string type: array kinds: items: type: string type: array type: object type: array labelSelector: description: |- LabelSelector is the combination of two optional fields: `matchLabels` and `matchExpressions`. These two fields provide different methods of selecting or excluding k8s objects based on the label keys and values included in object metadata. All selection expressions from both sections are ANDed to determine if an object meets the cumulative requirements of the selector. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic name: description: |- Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`. pattern: ^\*?[-:a-z0-9]*\*?$ type: string namespaceSelector: description: |- NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array x-kubernetes-list-type: atomic required: - key - operator type: object type: array x-kubernetes-list-type: atomic matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`. items: description: |- A string that supports globbing at its front and end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system", "*system*" will match "system-kube" or "kube-system". The asterisk is required for wildcard matching. pattern: ^\*?[-:a-z0-9]*\*?$ type: string type: array scope: description: |- Scope determines if cluster-scoped and/or namespaced-scoped resources are matched. Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`) type: string source: description: |- Source determines whether generated or original resources are matched. Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of `Generated` will only match generated resources, while `Original` will only match regular resources. enum: - All - Generated - Original type: string type: object parameters: description: Parameters define the behavior of the mutator. properties: operation: default: merge description: Operation describes whether values should be merged in ("merge"), or pruned ("prune"). Default value is "merge" enum: - merge - prune type: string pathTests: description: |- PathTests are a series of existence tests that can be checked before a mutation is applied items: description: |- PathTest allows the user to customize how the mutation works if parent paths are missing. It traverses the list in order. All sub paths are tested against the provided condition, if the test fails, the mutation is not applied. All `subPath` entries must be a prefix of `location`. Any glob characters will take on the same value as was used to expand the matching glob in `location`. Available Tests: * MustExist - the path must exist or do not mutate * MustNotExist - the path must not exist or do not mutate. properties: condition: description: Condition describes whether the path either MustExist or MustNotExist in the original object enum: - MustExist - MustNotExist type: string subPath: type: string type: object type: array values: description: Values describes the values provided to the operation as `values.fromList`. type: object x-kubernetes-preserve-unknown-fields: true type: object type: object status: description: ModifySetStatus defines the observed state of ModifySet. properties: byPod: items: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: array type: object type: object served: true storage: false subresources: status: {} --- # Source: gatekeeper/crds/mutatorpodstatus-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: mutatorpodstatuses.status.gatekeeper.sh spec: group: status.gatekeeper.sh names: kind: MutatorPodStatus listKind: MutatorPodStatusList plural: mutatorpodstatuses singular: mutatorpodstatus scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: MutatorPodStatus is the Schema for the mutationpodstatuses API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object status: description: MutatorPodStatusStatus defines the observed state of MutatorPodStatus. properties: enforced: type: boolean errors: items: description: MutatorError represents a single error caught while adding a mutator to a system. properties: message: type: string type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string mutatorUID: description: |- Storing the mutator UID allows us to detect drift, such as when a mutator has been recreated after its CRD was deleted out from under it, interrupting the watch type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array type: object type: object served: true storage: true --- # Source: gatekeeper/crds/provider-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: providers.externaldata.gatekeeper.sh spec: group: externaldata.gatekeeper.sh names: kind: Provider listKind: ProviderList plural: providers singular: provider scope: Cluster versions: - deprecated: true deprecationWarning: externaldata.gatekeeper.sh/v1alpha1 is deprecated. Use externaldata.gatekeeper.sh/v1beta1 instead. name: v1alpha1 schema: openAPIV3Schema: description: Provider is the Schema for the Provider API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: Spec defines the Provider specifications. properties: caBundle: description: |- CABundle is a base64-encoded string that contains the TLS CA bundle in PEM format. It is used to verify the signature of the provider's certificate. type: string timeout: description: Timeout is the timeout when querying the provider. type: integer url: description: URL is the url for the provider. URL is prefixed with https://. type: string type: object status: description: ProviderStatus defines the observed state of Provider. properties: byPod: description: ByPod is the status of the provider by pod items: description: ProviderPodStatusStatus defines the observed state of ProviderPodStatus. properties: active: type: boolean errors: items: description: ProviderError represents a single error caught while managing providers. properties: errorTimestamp: format: date-time type: string message: type: string retryable: type: boolean type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string lastCacheUpdateTime: format: date-time type: string lastTransitionTime: format: date-time type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array providerUID: description: |- Storing the provider UID allows us to detect drift, such as when a provider has been recreated after its CRD was deleted out from under it, interrupting the watch type: string type: object type: array type: object type: object served: true storage: false subresources: status: {} - name: v1beta1 schema: openAPIV3Schema: description: Provider is the Schema for the providers API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: Spec defines the Provider specifications. properties: caBundle: description: |- CABundle is a base64-encoded string that contains the TLS CA bundle in PEM format. It is used to verify the signature of the provider's certificate. type: string timeout: description: Timeout is the timeout when querying the provider. type: integer url: description: URL is the url for the provider. URL is prefixed with https://. type: string type: object status: description: ProviderStatus defines the observed state of Provider. properties: byPod: description: ByPod is the status of the provider by pod items: description: ProviderPodStatusStatus defines the observed state of ProviderPodStatus. properties: active: type: boolean errors: items: description: ProviderError represents a single error caught while managing providers. properties: errorTimestamp: format: date-time type: string message: type: string retryable: type: boolean type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - message type: object type: array id: type: string lastCacheUpdateTime: format: date-time type: string lastTransitionTime: format: date-time type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array providerUID: description: |- Storing the provider UID allows us to detect drift, such as when a provider has been recreated after its CRD was deleted out from under it, interrupting the watch type: string type: object type: array type: object type: object served: true storage: true subresources: status: {} --- # Source: gatekeeper/crds/providerpodstatus-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: providerpodstatuses.status.gatekeeper.sh spec: group: status.gatekeeper.sh names: kind: ProviderPodStatus listKind: ProviderPodStatusList plural: providerpodstatuses singular: providerpodstatus scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: ProviderPodStatus is the Schema for the providerpodstatuses API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object status: description: No spec field is defined here, as this is a status-only resource. properties: active: type: boolean errors: items: description: ProviderError represents a single error caught while managing providers. properties: errorTimestamp: format: date-time type: string message: type: string retryable: type: boolean type: description: |- Type indicates a specific class of error for use by controller code. If not present, the error should be treated as not matching any known type. type: string required: - errorTimestamp - message - retryable - type type: object type: array id: type: string lastCacheUpdateTime: format: date-time type: string lastTransitionTime: format: date-time type: string observedGeneration: format: int64 type: integer operations: items: type: string type: array providerUID: description: |- Storing the provider UID allows us to detect drift, such as when a provider has been recreated after its CRD was deleted out from under it, interrupting the watch type: string type: object type: object served: true storage: true --- # Source: gatekeeper/crds/syncset-customresourcedefinition.yaml --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.19.0 labels: gatekeeper.sh/system: "yes" name: syncsets.syncset.gatekeeper.sh spec: group: syncset.gatekeeper.sh names: kind: SyncSet listKind: SyncSetList plural: syncsets singular: syncset scope: Cluster versions: - name: v1alpha1 schema: openAPIV3Schema: description: SyncSet defines which resources Gatekeeper will cache. The union of all SyncSets plus the syncOnly field of Gatekeeper's Config resource defines the sets of resources that will be synced. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: properties: name: maxLength: 63 type: string type: object spec: properties: gvks: items: properties: group: type: string kind: type: string version: type: string type: object type: array type: object type: object served: true storage: true --- # Source: gatekeeper/templates/gatekeeper-critical-pods-resourcequota.yaml apiVersion: v1 kind: ResourceQuota metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-critical-pods namespace: 'default' spec: hard: pods: 100 scopeSelector: matchExpressions: - operator: In scopeName: PriorityClass values: - system-cluster-critical - system-cluster-critical --- # Source: gatekeeper/templates/gatekeeper-controller-manager-poddisruptionbudget.yaml apiVersion: policy/v1 kind: PodDisruptionBudget metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-controller-manager namespace: 'default' spec: minAvailable: 1 selector: matchLabels: app: 'gatekeeper' chart: 'gatekeeper' control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' --- # Source: gatekeeper/templates/gatekeeper-admin-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-admin namespace: 'default' --- # Source: gatekeeper/templates/gatekeeper-webhook-server-cert-secret.yaml apiVersion: v1 kind: Secret metadata: annotations: {} labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-webhook-server-cert namespace: 'default' --- # Source: gatekeeper/templates/gatekeeper-manager-role-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-manager-role rules: - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - '*' resources: - '*' verbs: - get - list - watch - apiGroups: - admissionregistration.k8s.io resourceNames: - gatekeeper-mutating-webhook-configuration resources: - mutatingwebhookconfigurations verbs: - get - list - patch - update - watch - apiGroups: - admissionregistration.k8s.io resources: - validatingadmissionpolicies - validatingadmissionpolicybindings verbs: - create - delete - get - list - patch - update - watch - apiGroups: - admissionregistration.k8s.io resources: - validatingwebhookconfigurations verbs: - get - list - watch - apiGroups: - apiextensions.k8s.io resources: - customresourcedefinitions verbs: - create - delete - get - list - patch - update - watch - apiGroups: - config.gatekeeper.sh resources: - '*' - configs verbs: - create - delete - get - list - patch - update - watch - apiGroups: - config.gatekeeper.sh resources: - configs/status verbs: - get - patch - update - apiGroups: - connection.gatekeeper.sh - constraints.gatekeeper.sh - expansion.gatekeeper.sh - mutations.gatekeeper.sh - status.gatekeeper.sh resources: - '*' verbs: - create - delete - get - list - patch - update - watch - apiGroups: - externaldata.gatekeeper.sh resources: - providers verbs: - create - delete - get - list - patch - update - watch - apiGroups: - externaldata.gatekeeper.sh resources: - providers/status verbs: - get - list - patch - update - watch - apiGroups: - templates.gatekeeper.sh resources: - constrainttemplates verbs: - create - delete - get - list - patch - update - watch - apiGroups: - templates.gatekeeper.sh resources: - constrainttemplates/finalizers verbs: - update - apiGroups: - templates.gatekeeper.sh resources: - constrainttemplates/status verbs: - get - patch - update - apiGroups: - admissionregistration.k8s.io resourceNames: - gatekeeper-validating-webhook-configuration resources: - validatingwebhookconfigurations verbs: - create - delete - get - list - patch - update - watch --- # Source: gatekeeper/templates/gatekeeper-manager-rolebinding-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-manager-rolebinding roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: gatekeeper-manager-role subjects: - kind: ServiceAccount name: gatekeeper-admin namespace: 'default' --- # Source: gatekeeper/templates/gatekeeper-manager-role-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-manager-role namespace: 'default' rules: - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - "" resources: - secrets verbs: - create - delete - get - list - patch - update - watch --- # Source: gatekeeper/templates/gatekeeper-manager-rolebinding-rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-manager-rolebinding namespace: 'default' roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: gatekeeper-manager-role subjects: - kind: ServiceAccount name: gatekeeper-admin namespace: 'default' --- # Source: gatekeeper/templates/gatekeeper-webhook-service-service.yaml apiVersion: v1 kind: Service metadata: labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-webhook-service namespace: 'default' spec: ports: - name: https-webhook-server port: 443 targetPort: webhook-server selector: app: 'gatekeeper' chart: 'gatekeeper' control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' --- # Source: gatekeeper/templates/gatekeeper-audit-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: annotations: labels: helm.sh/chart: gatekeeper-3.22.2 app.kubernetes.io/name: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/version: "3.22.2" app.kubernetes.io/managed-by: Helm app: 'gatekeeper' chart: 'gatekeeper' control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-audit namespace: 'default' spec: replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: 'gatekeeper' chart: 'gatekeeper' control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' template: metadata: annotations: labels: helm.sh/chart: gatekeeper-3.22.2 app.kubernetes.io/name: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/version: "3.22.2" app.kubernetes.io/managed-by: Helm app: 'gatekeeper' chart: 'gatekeeper' control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' spec: affinity: {} automountServiceAccountToken: true containers: - image: openpolicyagent/gatekeeper:v3.22.2 args: - --audit-interval=60 - --log-level=INFO - --constraint-violations-limit=20 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --audit-from-cache=false - --audit-chunk-size=500 - --audit-match-kind-only=false - --audit-events-involved-namespace=false - --operation=generate - --operation=audit - --operation=status - --operation=mutation-status - --logtostderr - --health-addr=:9090 - --prometheus-port=8888 - --enable-external-data=true - --enable-generator-resource-expansion=true - --metrics-backend=prometheus - --disable-cert-rotation=false - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) imagePullPolicy: 'IfNotPresent' livenessProbe: httpGet: path: /healthz port: 9090 timeoutSeconds: 1 name: 'manager' ports: - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: httpGet: path: /readyz port: 9090 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: seccompProfile: type: RuntimeDefault allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /tmp/audit name: tmp-volume dnsPolicy: ClusterFirst hostNetwork: false imagePullSecrets: [] nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: [] volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - emptyDir: {} name: tmp-volume --- # Source: gatekeeper/templates/gatekeeper-controller-manager-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: annotations: labels: helm.sh/chart: gatekeeper-3.22.2 app.kubernetes.io/name: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/version: "3.22.2" app.kubernetes.io/managed-by: Helm app: 'gatekeeper' chart: 'gatekeeper' control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: gatekeeper-controller-manager namespace: 'default' spec: replicas: 3 revisionHistoryLimit: 10 selector: matchLabels: app: 'gatekeeper' chart: 'gatekeeper' control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' strategy: type: RollingUpdate template: metadata: annotations: labels: helm.sh/chart: gatekeeper-3.22.2 app.kubernetes.io/name: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/version: "3.22.2" app.kubernetes.io/managed-by: Helm app: 'gatekeeper' chart: 'gatekeeper' control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - image: openpolicyagent/gatekeeper:v3.22.2 args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=default - --operation=webhook - --enable-external-data=true - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) imagePullPolicy: 'IfNotPresent' livenessProbe: httpGet: path: /healthz port: 9090 timeoutSeconds: 1 name: 'manager' ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: httpGet: path: /readyz port: 9090 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: seccompProfile: type: RuntimeDefault allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 volumeMounts: - mountPath: /certs name: cert readOnly: true dnsPolicy: ClusterFirst hostNetwork: false imagePullSecrets: [] nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: [] topologySpreadConstraints: [] volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert --- # Source: gatekeeper/templates/gatekeeper-mutating-webhook-configuration-mutatingwebhookconfiguration.yaml apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: annotations: {} labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: 'gatekeeper-mutating-webhook-configuration' webhooks: - admissionReviewVersions: - v1 - v1beta1 clientConfig: service: name: gatekeeper-webhook-service namespace: 'default' path: /v1/mutate failurePolicy: Ignore matchPolicy: Exact name: mutation.gatekeeper.sh namespaceSelector: matchExpressions: - key: admission.gatekeeper.sh/ignore operator: DoesNotExist - key: kubernetes.io/metadata.name operator: NotIn values: - default objectSelector: {} reinvocationPolicy: Never rules: - apiGroups: - '*' apiVersions: - '*' operations: - CREATE - UPDATE resources: - '*' - pods/ephemeralcontainers - pods/exec - pods/log - pods/eviction - pods/portforward - pods/proxy - pods/attach - pods/binding - deployments/scale - replicasets/scale - statefulsets/scale - replicationcontrollers/scale - services/proxy - nodes/proxy - services/status scope: '*' sideEffects: None timeoutSeconds: 1 --- # Source: gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: annotations: {} labels: app: 'gatekeeper' chart: 'gatekeeper' gatekeeper.sh/system: "yes" heritage: 'Helm' release: 'gatekeeper' name: 'gatekeeper-validating-webhook-configuration' webhooks: - admissionReviewVersions: - v1 - v1beta1 clientConfig: service: name: gatekeeper-webhook-service namespace: 'default' path: /v1/admit failurePolicy: Ignore matchPolicy: Exact name: validation.gatekeeper.sh namespaceSelector: matchExpressions: - key: admission.gatekeeper.sh/ignore operator: DoesNotExist - key: kubernetes.io/metadata.name operator: NotIn values: - default objectSelector: {} rules: - apiGroups: - '*' apiVersions: - '*' operations: - CREATE - UPDATE resources: - '*' # Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper). # You can find a rough list of subresources by doing a case-sensitive search in the Kubernetes codebase for 'Subresource("' - pods/ephemeralcontainers - pods/exec - pods/log - pods/eviction - pods/portforward - pods/proxy - pods/attach - pods/binding - pods/resize - deployments/scale - replicasets/scale - statefulsets/scale - replicationcontrollers/scale - services/proxy - nodes/proxy - services/status scope: '*' sideEffects: None timeoutSeconds: 3 - admissionReviewVersions: - v1 - v1beta1 clientConfig: service: name: gatekeeper-webhook-service namespace: 'default' path: /v1/admitlabel failurePolicy: Fail matchPolicy: Exact name: check-ignore-label.gatekeeper.sh namespaceSelector: matchExpressions: - key: kubernetes.io/metadata.name operator: NotIn values: - default rules: - apiGroups: - "" apiVersions: - '*' operations: - CREATE - UPDATE resources: - namespaces scope: '*' sideEffects: None timeoutSeconds: 3