Rename security.knative.dev -> policy.run.google.cloud.com

cmd/security-controller/main.go → cmd/policy/controller/main.go

@@ -17,8 +17,8 @@ limitations under the License.
 package main
 
 import (
-	"github.com/google/knative-gcp/pkg/reconciler/security/istio/eventpolicybinding"
-	"github.com/google/knative-gcp/pkg/reconciler/security/istio/httppolicybinding"
+	"github.com/google/knative-gcp/pkg/reconciler/policy/istio/eventpolicybinding"
+	"github.com/google/knative-gcp/pkg/reconciler/policy/istio/httppolicybinding"
 
 	// The following line to load the gcp plugin (only required to authenticate against GKE clusters).
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"

cmd/security-webhook/main.go → cmd/policy/webhook/main.go

@@ -20,7 +20,7 @@ import (
 	"context"
 
 	configvalidation "github.com/google/knative-gcp/pkg/apis/configs/validation"
-	securityv1alpha1 "github.com/google/knative-gcp/pkg/apis/security/v1alpha1"
+	policyv1alpha1 "github.com/google/knative-gcp/pkg/apis/policy/v1alpha1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"knative.dev/eventing/pkg/logconfig"
 	"knative.dev/pkg/configmap"
@@ -39,10 +39,10 @@ import (
 )
 
 var types = map[schema.GroupVersionKind]resourcesemantics.GenericCRD{
-	securityv1alpha1.SchemeGroupVersion.WithKind("HTTPPolicy"):         &securityv1alpha1.HTTPPolicy{},
-	securityv1alpha1.SchemeGroupVersion.WithKind("EventPolicy"):        &securityv1alpha1.EventPolicy{},
-	securityv1alpha1.SchemeGroupVersion.WithKind("HTTPPolicyBinding"):  &securityv1alpha1.HTTPPolicyBinding{},
-	securityv1alpha1.SchemeGroupVersion.WithKind("EventPolicyBinding"): &securityv1alpha1.EventPolicyBinding{},
+	policyv1alpha1.SchemeGroupVersion.WithKind("HTTPPolicy"):         &policyv1alpha1.HTTPPolicy{},
+	policyv1alpha1.SchemeGroupVersion.WithKind("EventPolicy"):        &policyv1alpha1.EventPolicy{},
+	policyv1alpha1.SchemeGroupVersion.WithKind("HTTPPolicyBinding"):  &policyv1alpha1.HTTPPolicyBinding{},
+	policyv1alpha1.SchemeGroupVersion.WithKind("EventPolicyBinding"): &policyv1alpha1.EventPolicyBinding{},
 }
 
 func NewDefaultingAdmissionController(ctx context.Context, cmw configmap.Watcher) *controller.Impl {
@@ -54,7 +54,7 @@ func NewDefaultingAdmissionController(ctx context.Context, cmw configmap.Watcher
 	return defaulting.NewAdmissionController(ctx,
 
 		// Name of the default webhook.
-		"webhook.security.knative.dev",
+		"webhook.policy.run.cloud.google.com",
 
 		// The path on which to serve the webhook.
 		"/defaulting",
@@ -74,7 +74,7 @@ func NewValidationAdmissionController(ctx context.Context, cmw configmap.Watcher
 	return validation.NewAdmissionController(ctx,
 
 		// Name of the validation webhook.
-		"validation.webhook.security.knative.dev",
+		"validation.webhook.policy.run.cloud.google.com",
 
 		// The path on which to serve the webhook.
 		"/validation",
@@ -97,7 +97,7 @@ func NewConfigValidationController(ctx context.Context, cmw configmap.Watcher) *
 	return configmaps.NewAdmissionController(ctx,
 
 		// Name of the configmap webhook.
-		"config.webhook.security.knative.dev",
+		"config.webhook.policy.run.cloud.google.com",
 
 		// The path on which to serve the webhook.
 		"/config-validation",
@@ -118,7 +118,7 @@ func main() {
 		ServiceName: logconfig.WebhookName(),
 		Port:        8443,
 		// SecretName must match the name of the Secret created in the configuration.
-		SecretName: "security-webhook-certs",
+		SecretName: "policy-webhook-certs",
 	})
 
 	sharedmain.WebhookMainWithContext(ctx, logconfig.WebhookName(),

config/security/100-namespace.yaml → config/policy/100-namespace.yaml

@@ -15,6 +15,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: knative-security
+  name: cloud-run-policy
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel

config/security/200-serviceaccount.yaml → config/policy/200-serviceaccount.yaml

@@ -15,17 +15,17 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: security-controller
-  namespace: knative-security
+  name: policy-controller
+  namespace: cloud-run-policy
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel
 
 ---
 
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: security-webhook
-  namespace: knative-security
+  name: policy-webhook
+  namespace: cloud-run-policy
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel

config/security/201-clusterrole.yaml → config/policy/201-clusterrole.yaml

@@ -15,13 +15,13 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: security-controller
+  name: policy-controller
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel
 rules:
 
 - apiGroups:
-    - security.knative.dev
+    - policy.run.cloud.google.com
   resources:
     - httppolicies
     - eventpolicies
@@ -37,7 +37,7 @@ rules:
     - delete
 
 - apiGroups:
-    - security.knative.dev
+    - policy.run.cloud.google.com
   resources:
     - httppolicybindings/status
     - eventpolicybindings/status
@@ -61,6 +61,13 @@ rules:
   verbs:
     - get
 
+- apiGroups: [“”]
+  resources:
+    - events
+  verbs:
+    - create
+    - patch
+
 # All supported subjects.
 # TODO: is there a better way to grant get/list permission
 # for all resources?

config/security/201-role.yaml → config/policy/201-role.yaml

@@ -14,12 +14,11 @@
 
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
-
 metadata:
-  name: security-controller
-  namespace: knative-security
+  name: policy-controller
+  namespace: cloud-run-policy
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel
 rules:
 - apiGroups:
     - ""

config/security/201-webhook-clusterrole.yaml → config/policy/201-webhook-clusterrole.yaml

@@ -15,9 +15,9 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: security-webhook
+  name: policy-webhook
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel
 rules:
   # For watching logging configuration and getting certs.
   - apiGroups:

config/security/202-clusterrolebinding.yaml → config/policy/202-clusterrolebinding.yaml

@@ -15,31 +15,31 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: security-controller
+  name: policy-controller
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel
 subjects:
 - kind: ServiceAccount
-  name: security-controller
-  namespace: knative-security
+  name: policy-controller
+  namespace: cloud-run-policy
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: security-controller
+  name: policy-controller
 
 ---
 
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: security-webhook
+  name: policy-webhook
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel
 subjects:
   - kind: ServiceAccount
-    name: security-webhook
-    namespace: knative-security
+    name: policy-webhook
+    namespace: cloud-run-policy
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: security-webhook
+  name: policy-webhook

config/security/202-rolebinding.yaml → config/policy/202-rolebinding.yaml

@@ -15,15 +15,15 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: security-controller
-  namespace: knative-security
+  name: policy-controller
+  namespace: cloud-run-policy
   labels:
-    security.knative.dev/release: devel
+    policy.run.cloud.google.com/release: devel
 subjects:
 - kind: ServiceAccount
-  name: security-controller
-  namespace: knative-security
+  name: policy-controller
+  namespace: cloud-run-policy
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: security-controller
+  name: policy-controller

config/security/300-eventpolicy.yaml → config/policy/300-eventpolicy.yaml

@@ -14,12 +14,12 @@
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
-  name: eventpolicies.security.knative.dev
+  name: eventpolicies.policy.run.cloud.google.com
   labels:
-    security.knative.dev/release: devel
-    security.knative.dev/crd-install: "true"
+    policy.run.cloud.google.com/release: devel
+    policy.run.cloud.google.com/crd-install: "true"
 spec:
-  group: security.knative.dev
+  group: policy.run.cloud.google.com
   version: v1alpha1
   names:
     kind: EventPolicy
@@ -28,7 +28,7 @@ spec:
     categories:
     - all
     - knative
-    - security
+    - policy
   scope: Namespaced
   additionalPrinterColumns:
     - name: Age

config/security/300-eventpolicybinding.yaml → config/policy/300-eventpolicybinding.yaml

@@ -14,12 +14,12 @@
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
-  name: eventpolicybindings.security.knative.dev
+  name: eventpolicybindings.policy.run.cloud.google.com
   labels:
-    security.knative.dev/release: devel
-    security.knative.dev/crd-install: "true"
+    policy.run.cloud.google.com/release: devel
+    policy.run.cloud.google.com/crd-install: "true"
 spec:
-  group: security.knative.dev
+  group: policy.run.cloud.google.com
   version: v1alpha1
   names:
     kind: EventPolicyBinding
@@ -28,7 +28,7 @@ spec:
     categories:
     - all
     - knative
-    - security
+    - policy
   scope: Namespaced
   subresources:
     status: {}

config/security/300-httppolicy.yaml → config/policy/300-httppolicy.yaml

@@ -14,12 +14,12 @@
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
-  name: httppolicies.security.knative.dev
+  name: httppolicies.policy.run.cloud.google.com
   labels:
-    security.knative.dev/release: devel
-    security.knative.dev/crd-install: "true"
+    policy.run.cloud.google.com/release: devel
+    policy.run.cloud.google.com/crd-install: "true"
 spec:
-  group: security.knative.dev
+  group: policy.run.cloud.google.com
   version: v1alpha1
   names:
     kind: HTTPPolicy
@@ -28,7 +28,7 @@ spec:
     categories:
     - all
     - knative
-    - security
+    - policy
   scope: Namespaced
   additionalPrinterColumns:
     - name: Age

config/security/300-httppolicybinding.yaml → config/policy/300-httppolicybinding.yaml

@@ -14,12 +14,12 @@
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
-  name: httppolicybindings.security.knative.dev
+  name: httppolicybindings.policy.run.cloud.google.com
   labels:
-    security.knative.dev/release: devel
-    security.knative.dev/crd-install: "true"
+    policy.run.cloud.google.com/release: devel
+    policy.run.cloud.google.com/crd-install: "true"
 spec:
-  group: security.knative.dev
+  group: policy.run.cloud.google.com
   version: v1alpha1
   names:
     kind: HTTPPolicyBinding
@@ -28,7 +28,7 @@ spec:
     categories:
     - all
     - knative
-    - security
+    - policy
   scope: Namespaced
   subresources:
     status: {}

config/security/400-webhook-service.yaml → config/policy/400-webhook-service.yaml

@@ -16,13 +16,13 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    role: security-webhook
-    security.knative.dev/release: devel
-  name: security-webhook
-  namespace: knative-security
+    role: policy-webhook
+    policy.run.cloud.google.com/release: devel
+  name: policy-webhook
+  namespace: cloud-run-policy
 spec:
   ports:
     - port: 443
       targetPort: 8443
   selector:
-    role: security-webhook
+    role: policy-webhook