Change Constraint Template CRD to apiextensions.k8s.io/v1 #114

julianKatz · 2021-05-05T21:54:43Z

v1beta1 CRDs will not be supported in upcoming k8s versions, so all our
CRDs will have to be v1. This makes our toolchain output a v1 CRD for
the Constraint Template kind.

Contributes to open-policy-agent/gatekeeper#550

Signed-off-by: juliankatz juliankatz@google.com

codecov-commenter · 2021-05-05T21:57:48Z

Codecov Report

Merging #114 (dcddaff) into master (3f51770) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #114   +/-   ##
=======================================
  Coverage   43.89%   43.89%           
=======================================
  Files          27       27           
  Lines        2383     2383           
=======================================
  Hits         1046     1046           
  Misses       1017     1017           
  Partials      320      320

Flag	Coverage Δ
unittests	`43.89% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3f51770...dcddaff. Read the comment docs.

maxsmythe · 2021-05-05T22:09:57Z

I don't think this entirely fixes open-policy-agent/gatekeeper#550 until the rest of the work has been done?

Definitely change the wording in the description so GitHub doesn't try to autoclose that issue.

maxsmythe

I think we need to also set x-preserve for the JSON schemas

constraint/config/crds/templates.gatekeeper.sh_constrainttemplates.yaml

v1beta1 CRDs will not be supported in upcoming k8s versions, so all our CRDs will have to be v1. This makes our toolchain output a v1 CRD for the Constraint Template kind. Contributes to open-policy-agent/gatekeeper#550 Signed-off-by: juliankatz <juliankatz@google.com>

maxsmythe

LGTM

@sozercan @ritazh @shomron LGTY?

sozercan

LGTM

julianKatz · 2021-05-10T17:25:40Z

ping :) @shomron @ritazh

This fixes the unit tests, which are currently broken. Somehow, I was able to merge my previous PR (open-policy-agent#114) with these tests broken. They passed in the GitHub actions, but are failing for me when I run them locally (without the change in this PR). I'm not sure how that happened. I tried upgrading all the way to controller-runtime 3.0.0, but the developers of that seem to have changed the way the package is delivered. Now, only the binary seems to available for download, instead of a folder full of binaries. Notably, this leaves out the binaries for the API server components (etcd, for example) that are used during unit test runs. Contributes to open-policy-agent/gatekeeper#550 Signed-off-by: juliankatz <juliankatz@google.com>

This fixes the unit tests, which are currently broken. Somehow, I was able to merge my previous PR (#114) with these tests broken. They passed in the GitHub actions, but are failing for me when I run them locally (without the change in this PR). I'm not sure how that happened. I tried upgrading all the way to controller-runtime 3.0.0, but the developers of that seem to have changed the way the package is delivered. Now, only the binary seems to available for download, instead of a folder full of binaries. Notably, this leaves out the binaries for the API server components (etcd, for example) that are used during unit test runs. Contributes to open-policy-agent/gatekeeper#550 Signed-off-by: juliankatz <juliankatz@google.com>

This PR changes the flags passed to controller-gen to generate v1 CRDs for the CRDs defined in this repository. It also includes changes from open-policy-agent/frameworks#114, which update the ConstraintTemplate CRD to v1. Contributes to open-policy-agent#550 Signed-off-by: juliankatz <juliankatz@google.com>

Kubernetes v1 CRDs require structural schemas. This means that, where possible, JSONSchemas should identify the type of a field. Fields without this type information will require the key: value pair of x-kubernetes-unknown-fields: true to be set. This signals the API server to save the content found in that field to etcd without validation. This PR adds the remaining type information to the MatchSchema() function, rendering its output structural. This func's output is what populates the `match` section of the CRD for a Constraint kind. It also imports Constraint Framework, including the updates made in open-policy-agent/frameworks#114. This change transforms the schema information provided by users in a v1beta1 ConstraintTemplate to be structural. Contributes to open-policy-agent#550 Signed-off-by: juliankatz <juliankatz@google.com>

This PR changes the flags passed to controller-gen to generate v1 CRDs for the CRDs defined in this repository. It also includes changes from open-policy-agent/frameworks#114, which update the ConstraintTemplate CRD to v1, and open-policy-agent/frameworks#117, which allowed Gatekeeper to add the Operations field to byPodStatus, which isn't built in to the byPodStatus golang struct. Contributes to open-policy-agent#550 Signed-off-by: juliankatz <juliankatz@google.com>

Kubernetes v1 CRDs require structural schemas. This means that, where possible, JSONSchemas should identify the type of a field. Fields without this type information will require the key: value pair of x-kubernetes-unknown-fields: true to be set. This signals the API server to save the content found in that field to etcd without validation. This PR adds the remaining type information to the MatchSchema() function, rendering its output structural. This func's output is what populates the `match` section of the CRD for a Constraint kind. It also imports Constraint Framework, including the updates made in open-policy-agent/frameworks#114. This change transforms the schema information provided by users in a v1beta1 ConstraintTemplate to be structural. Contributes to open-policy-agent#550 Signed-off-by: juliankatz <juliankatz@google.com>

This PR changes the flags passed to controller-gen to generate v1 CRDs for the CRDs defined in this repository. It also includes changes from open-policy-agent/frameworks#114, which update the ConstraintTemplate CRD to v1, and open-policy-agent/frameworks#117, which allowed Gatekeeper to add the Operations field to byPodStatus, which isn't built in to the byPodStatus golang struct. Contributes to open-policy-agent#550 Signed-off-by: juliankatz <juliankatz@google.com>

Kubernetes v1 CRDs require structural schemas. This means that, where possible, JSONSchemas should identify the type of a field. Fields without this type information will require the key: value pair of x-kubernetes-unknown-fields: true to be set. This signals the API server to save the content found in that field to etcd without validation. This PR adds the remaining type information to the MatchSchema() function, rendering its output structural. This func's output is what populates the `match` section of the CRD for a Constraint kind. It also imports Constraint Framework, including the updates made in open-policy-agent/frameworks#114. This change transforms the schema information provided by users in a v1beta1 ConstraintTemplate to be structural. Contributes to open-policy-agent#550 Signed-off-by: juliankatz <juliankatz@google.com>

Kubernetes v1 CRDs require structural schemas. This means that, where possible, JSONSchemas should identify the type of a field. Fields without this type information will require the key: value pair of x-kubernetes-unknown-fields: true to be set. This signals the API server to save the content found in that field to etcd without validation. This PR adds the remaining type information to the MatchSchema() function, rendering its output structural. This func's output is what populates the `match` section of the CRD for a Constraint kind. It also imports Constraint Framework, including the updates made in open-policy-agent/frameworks#114. This change transforms the schema information provided by users in a v1beta1 ConstraintTemplate to be structural. Contributes to #550 Signed-off-by: juliankatz <juliankatz@google.com>

This PR changes the flags passed to controller-gen to generate v1 CRDs for the CRDs defined in this repository. It also includes changes from open-policy-agent/frameworks#114, which update the ConstraintTemplate CRD to v1, and open-policy-agent/frameworks#117, which allowed Gatekeeper to add the Operations field to byPodStatus, which isn't built in to the byPodStatus golang struct. Contributes to open-policy-agent#550 Signed-off-by: juliankatz <juliankatz@google.com>

This PR changes the flags passed to controller-gen to generate v1 CRDs for the CRDs defined in this repository. It also includes changes from open-policy-agent/frameworks#114, which update the ConstraintTemplate CRD to v1, and open-policy-agent/frameworks#117, which allowed Gatekeeper to add the Operations field to byPodStatus, which isn't built in to the byPodStatus golang struct. Contributes to #550 Signed-off-by: juliankatz <juliankatz@google.com>

julianKatz requested a review from maxsmythe May 5, 2021 21:54

maxsmythe requested changes May 5, 2021

View reviewed changes

constraint/config/crds/templates.gatekeeper.sh_constrainttemplates.yaml Show resolved Hide resolved

constraint/config/crds/templates.gatekeeper.sh_constrainttemplates.yaml Show resolved Hide resolved

julianKatz force-pushed the switch-deploy-folder-to-v1-crd branch from dcddaff to d50a5ea Compare May 5, 2021 22:13

julianKatz force-pushed the switch-deploy-folder-to-v1-crd branch from d50a5ea to 6370717 Compare May 5, 2021 22:23

maxsmythe approved these changes May 5, 2021

View reviewed changes

maxsmythe requested review from ritazh, shomron and sozercan May 5, 2021 22:26

sozercan approved these changes May 7, 2021

View reviewed changes

ritazh approved these changes May 10, 2021

View reviewed changes

shomron approved these changes May 11, 2021

View reviewed changes

julianKatz merged commit 9bbde9f into open-policy-agent:master May 11, 2021

julianKatz deleted the switch-deploy-folder-to-v1-crd branch May 11, 2021 18:38

julianKatz mentioned this pull request May 12, 2021

Upgrade kubebuilder in test image to 2.3.2 #115

Merged

julianKatz mentioned this pull request May 17, 2021

Upgrade v1beta1 CRD yamls to v1 open-policy-agent/gatekeeper#1286

Merged

julianKatz mentioned this pull request May 18, 2021

Add structural information to Constraint Kind CRDs open-policy-agent/gatekeeper#1249

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Change Constraint Template CRD to apiextensions.k8s.io/v1 #114

Change Constraint Template CRD to apiextensions.k8s.io/v1 #114

julianKatz commented May 5, 2021 •

edited

Loading

codecov-commenter commented May 5, 2021

maxsmythe commented May 5, 2021

maxsmythe left a comment

maxsmythe left a comment

sozercan left a comment

julianKatz commented May 10, 2021

Change Constraint Template CRD to apiextensions.k8s.io/v1 #114

Change Constraint Template CRD to apiextensions.k8s.io/v1 #114

Conversation

julianKatz commented May 5, 2021 • edited Loading

codecov-commenter commented May 5, 2021

Codecov Report

maxsmythe commented May 5, 2021

maxsmythe left a comment

Choose a reason for hiding this comment

maxsmythe left a comment

Choose a reason for hiding this comment

sozercan left a comment

Choose a reason for hiding this comment

julianKatz commented May 10, 2021

julianKatz commented May 5, 2021 •

edited

Loading