feat: Implement config pod status

apis/config/v1alpha1/config_types.go

@@ -16,6 +16,7 @@ limitations under the License.
 package v1alpha1
 
 import (
+ status "github.com/open-policy-agent/gatekeeper/v3/apis/status/v1beta1"
  "github.com/open-policy-agent/gatekeeper/v3/pkg/wildcard"
  metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
  "k8s.io/apimachinery/pkg/runtime/schema"
@@ -82,6 +83,7 @@ type ReadinessSpec struct {
 
 // ConfigStatus defines the observed state of Config.
 type ConfigStatus struct { // Important: Run "make" to regenerate code after modifying this file
+ ByPod []status.ConfigPodStatusStatus `json:"byPod,omitempty"`
 }
 
 type GVK struct {
@@ -92,6 +94,8 @@ type GVK struct {
 
 // +kubebuilder:resource:scope=Namespaced
 // +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:storageversion
 
 // Config is the Schema for the configs API.
 type Config struct {

apis/status/v1beta1/configpodstatus_types.go

@@ -0,0 +1,86 @@
+package v1beta1
+
+import (
+ "github.com/open-policy-agent/gatekeeper/v3/pkg/operations"
+ "github.com/open-policy-agent/gatekeeper/v3/pkg/util"
+ corev1 "k8s.io/api/core/v1"
+ metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+ "k8s.io/apimachinery/pkg/runtime"
+ "k8s.io/apimachinery/pkg/types"
+ "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+)
+
+// ConfigPodStatusStatus defines the observed state of ConfigPodStatus.
+
+// +kubebuilder:object:generate=true
+
+type ConfigPodStatusStatus struct {
+ ID string `json:"id,omitempty"`
+ ConfigUID types.UID `json:"configUID,omitempty"`
+ Operations []string `json:"operations,omitempty"`
+ ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+ Errors []*ConfigError `json:"errors,omitempty"`
+}
+
+// +kubebuilder:object:generate=true
+
+type ConfigError struct {
+ Type string `json:"type,omitempty"`
+ Message string `json:"message"`
+}
+
+// ConfigPodStatus is the Schema for the configpodstatuses API.
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:scope=Namespaced
+
+type ConfigPodStatus struct {
+ metav1.TypeMeta `json:",inline"`
+ metav1.ObjectMeta `json:"metadata,omitempty"`
+
+ Status ConfigPodStatusStatus `json:"status,omitempty"`
+}
+
+// ConfigPodStatusList contains a list of ConfigPodStatus.
+
+// +kubebuilder:object:root=true
+type ConfigPodStatusList struct {
+ metav1.TypeMeta `json:",inline"`
+ metav1.ListMeta `json:"metadata,omitempty"`
+ Items []ConfigPodStatus `json:"items"`
+}
+
+func init() {
+ SchemeBuilder.Register(&ConfigPodStatus{}, &ConfigPodStatusList{})
+}
+
+// NewConfigStatusForPod returns an config status object
+// that has been initialized with the bare minimum of fields to make it functional
+// with the config status controller.
+func NewConfigStatusForPod(pod *corev1.Pod, configName string, scheme *runtime.Scheme) (*ConfigPodStatus, error) {
+ obj := &ConfigPodStatus{}
+ name, err := KeyForConfig(pod.Name, configName)
+ if err != nil {
+ return nil, err
+ }
+ obj.SetName(name)
+ obj.SetNamespace(util.GetNamespace())
+ obj.Status.ID = pod.Name
+ obj.Status.Operations = operations.AssignedStringList()
+ obj.SetLabels(map[string]string{
+ ConfigNameLabel: configName,
+ PodLabel: pod.Name,
+ })
+
+ if err := controllerutil.SetOwnerReference(pod, obj, scheme); err != nil {
+ return nil, err
+ }
+
+ return obj, nil
+}
+
+// KeyForConfig returns a unique status object name given the Pod ID and
+// a config object.
+func KeyForConfig(id string, configName string) (string, error) {
+ return DashPacker(id, configName)
+}

apis/status/v1beta1/configpodstatus_types_test.go

@@ -0,0 +1,68 @@
+package v1beta1_test
+
+import (
+ "testing"
+
+ "github.com/google/go-cmp/cmp"
+ "github.com/open-policy-agent/gatekeeper/v3/apis/status/v1beta1"
+ "github.com/open-policy-agent/gatekeeper/v3/pkg/fakes"
+ "github.com/open-policy-agent/gatekeeper/v3/pkg/operations"
+ "github.com/open-policy-agent/gatekeeper/v3/test/testutils"
+ corev1 "k8s.io/api/core/v1"
+ "k8s.io/apimachinery/pkg/runtime"
+ "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+)
+
+func TestNewConfigStatusForPod(t *testing.T) {
+ const podName = "some-gk-pod"
+ const podNS = "a-gk-namespace"
+ const configName = "a-config"
+
+ testutils.Setenv(t, "POD_NAMESPACE", podNS)
+
+ scheme := runtime.NewScheme()
+ err := v1beta1.AddToScheme(scheme)
+ if err != nil {
+ t.Fatal(err)
+ }
+
+ err = corev1.AddToScheme(scheme)
+ if err != nil {
+ t.Fatal(err)
+ }
+
+ pod := fakes.Pod(
+ fakes.WithNamespace(podNS),
+ fakes.WithName(podName),
+ )
+
+ expectedStatus := &v1beta1.ConfigPodStatus{}
+ expectedStatus.SetName("some--gk--pod-a--config")
+ expectedStatus.SetNamespace(podNS)
+ expectedStatus.Status.ID = podName
+ expectedStatus.Status.Operations = operations.AssignedStringList()
+ expectedStatus.SetLabels(map[string]string{
+ v1beta1.ConfigNameLabel: configName,
+ v1beta1.PodLabel: podName,
+ })
+
+ err = controllerutil.SetOwnerReference(pod, expectedStatus, scheme)
+ if err != nil {
+ t.Fatal(err)
+ }
+
+ status, err := v1beta1.NewConfigStatusForPod(pod, configName, scheme)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if diff := cmp.Diff(expectedStatus, status); diff != "" {
+ t.Fatal(diff)
+ }
+ n, err := v1beta1.KeyForConfig(podName, configName)
+ if err != nil {
+ t.Fatal(err)
+ }
+ if status.Name != n {
+ t.Fatal("got status.Name != n, want equal")
+ }
+}

apis/status/v1beta1/labels.go

@@ -2,6 +2,7 @@ package v1beta1
 
 // Label keys used for internal gatekeeper operations.
 const (
+ ConfigNameLabel = "internal.gatekeeper.sh/config-name"
  ExpansionTemplateNameLabel = "internal.gatekeeper.sh/expansiontemplate-name"
  ConstraintNameLabel = "internal.gatekeeper.sh/constraint-name"
  ConstraintKindLabel = "internal.gatekeeper.sh/constraint-kind"

cmd/build/helmify/kustomization.yaml

@@ -40,6 +40,12 @@ patchesJson6902:
  kind: CustomResourceDefinition
  name: expansiontemplatepodstatuses.status.gatekeeper.sh
  path: labels_patch.yaml
+ - target:
+ group: apiextensions.k8s.io
+ version: v1
+ kind: CustomResourceDefinition
+ name: configpodstatuses.status.gatekeeper.sh
+ path: labels_patch.yaml
  - target:
  group: apiextensions.k8s.io
  version: v1

config/crd/bases/config.gatekeeper.sh_configs.yaml

@@ -112,7 +112,41 @@ spec:
  type: object
  status:
  description: ConfigStatus defines the observed state of Config.
+ properties:
+ byPod:
+ items:
+ properties:
+ configUID:
+ description: |-
+ UID is a type that holds unique ID values, including UUIDs. Because we
+ don't ONLY use UUIDs, this is an alias to string. Being a type captures
+ intent and helps make sure that UIDs and names do not get conflated.
+ type: string
+ errors:
+ items:
+ properties:
+ message:
+ type: string
+ type:
+ type: string
+ required:
+ - message
+ type: object
+ type: array
+ id:
+ type: string
+ observedGeneration:
+ format: int64
+ type: integer
+ operations:
+ items:
+ type: string
+ type: array
+ type: object
+ type: array
  type: object
  type: object
  served: true
  storage: true
+ subresources:
+ status: {}