Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update operation generate in deployment yaml and add docs #3738

Merged
merged 4 commits into from
Dec 16, 2024
Merged

chore: update operation generate in deployment yaml and add docs #3738

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8c89acf
adding docs for operation: generate
JaydipGabani Dec 12, 2024
0302ed2
updating docs
JaydipGabani Dec 12, 2024
f0924aa
updating docs and adding oepration generate in audit manager deployment
JaydipGabani Dec 12, 2024
49d683b
Merge branch 'master' into docs-op-generate
JaydipGabani Dec 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,7 @@ spec:
- --operation=audit
- --operation=status
- --operation=mutation-status
- --operation=generate
- --logtostderr
- --disable-opa-builtin={http.send}
- --disable-cert-rotation
Expand Down
1 change: 1 addition & 0 deletions manifest_staging/deploy/gatekeeper.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5084,6 +5084,7 @@ spec:
- --operation=audit
- --operation=status
- --operation=mutation-status
- --operation=generate
- --logtostderr
- --disable-opa-builtin={http.send}
- --disable-cert-rotation
Expand Down
25 changes: 24 additions & 1 deletion website/docs/operations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,6 @@ At a high level, this requires:
* It will also need the ability to write to the webhook secret in Gatekeeper's namespace
* If you have events enabled, you will need permissions to create events in Gatekeeper's namespace


## Mutating Webhook

__--operation key:__ `mutation-webhook`
Expand Down Expand Up @@ -176,6 +175,30 @@ At a high level, this requires:

* The ability to read all objects in the group `mutations.gatekeeper.sh` (mutators)

## Generation

__--operation key:__ `generate`

This operation enables CRD and VAP/VAPB generation.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
This operation enables CRD and VAP/VAPB generation.
This operation enables CRD and VAP/VAPB generation.
To avoid write contention, the Generate operation should be run as a singleton.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we are missing the operation here: https://github.com/open-policy-agent/gatekeeper/blob/master/manifest_staging/deploy/gatekeeper.yaml#L5084-L5086

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch! I fixed it. Do we want to cut 3.18.1 to update deploy/gatekeeper.yaml?


To avoid write contention, the Generate operation should be run as a singleton.

### Required Behaviors

At a high level, this requires:

* Creating CRDs for a corresponding constraint template
* Creating ValidatingAdmissionPolicies for ConstraintTemplates
* Creating ValidatingAdmissionPolicyBindings for Constraints

### Permissions Required

* The ability to read all `ConstraintTemplate` objects
* The ability to create CRDs (unfortunately RBAC doesn't have the syntax to scope this down to just CRDs in the `constraints.gatekeeper.sh` group)
* The ability to read all `Constraint` resources (members of the group `constraints.gatekeeper.sh`)
* The ability to create `ValidatingAdmissionPolicy` objects
* The ability to create `ValidatingAdmissionPolicyBinding` objects

# A Note on Permissions

"Create" implies the `create` and `delete` permissions in addition to the permissions implied by "Read" and "Write".
Expand Down
24 changes: 24 additions & 0 deletions website/versioned_docs/version-v3.18.x/operations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,30 @@ At a high level, this requires:

* The ability to read all objects in the group `mutations.gatekeeper.sh` (mutators)

## Generation

__--operation key:__ `generate`

This operation enables CRD and VAP/VAPB generation.

To avoid write contention, the Generate operation should be run as a singleton.

### Required Behaviors

At a high level, this requires:

* Creating CRDs for a corresponding constraint template
* Creating ValidatingAdmissionPolicies for ConstraintTemplates
* Creating ValidatingAdmissionPolicyBindings for Constraints

### Permissions Required

* The ability to read all `ConstraintTemplate` objects
* The ability to create CRDs (unfortunately RBAC doesn't have the syntax to scope this down to just CRDs in the `constraints.gatekeeper.sh` group)
* The ability to read all `Constraint` resources (members of the group `constraints.gatekeeper.sh`)
* The ability to create `ValidatingAdmissionPolicy` objects
* The ability to create `ValidatingAdmissionPolicyBinding` objects

# A Note on Permissions

"Create" implies the `create` and `delete` permissions in addition to the permissions implied by "Read" and "Write".
Expand Down
Loading