Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ch16 OPA gatekeeper specification invalid #36

Open
Alibirb opened this issue Mar 3, 2022 · 0 comments
Open

Ch16 OPA gatekeeper specification invalid #36

Alibirb opened this issue Mar 3, 2022 · 0 comments

Comments

@Alibirb
Copy link

Alibirb commented Mar 3, 2022

The opa/gatekeeper.yaml file requires modifications to work with Kubernetes 1.22 due to API changes (mainly removal of v1beta1 API). I had to make the following changes to get kubectl to apply it:

  • Change all occurrences of apiextensions.k8s.io/v1beta1 in apiVersion to apiextensions.k8s.io/v1 (don't touch the v1beta1s within spec.versions, because those refer to versions of custom resources which Gatekeeper will attempt to use itself)
  • Add admissionReviewVersions: ["v1"] to both entries for webhook in the ValidatingWebhookConfiguration
  • Remove all spec.version fields in CustomResourceDefinition
  • All spec.validation fields in CustomResourcDefiniton must be renamed to schema and moved into each entry in spec.versions
  • For the constrainttemplates.templates.gatekeeper.sh CustomResourceDefinition, add type: object to schema.openAPIV3Schema for each entry in spec.versions

This gets kubectl to apply the definitions and the controller runs, but applying the requiredLabels.yaml constraint fails claiming parameters is an unknown field, so it seems there are some additional changes to be made somewhere.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant