Use staging manifests

Signed-off-by: Max Smythe <smythe@google.com>
open-policy-agent · Jan 22, 2020 · 09729e1 · 09729e1
1 parent cb22346
commit 09729e1
Show file tree

Hide file tree

Showing 6 changed files with 83 additions and 83 deletions.
diff --git a/chart/gatekeeper-operator/helm-modifications/helm-modifications.yaml b/chart/gatekeeper-operator/helm-modifications/helm-modifications.yaml
@@ -53,7 +53,6 @@ spec:
             - --port=8443
             - --logtostderr
             - --constraint-violations-limit={{ .Values.constraintViolationsLimit }}
-            - --exempt-namespaces=gatekeeper-system
           imagePullPolicy: "{{ .Values.image.pullPolicy }}"
           image: "{{ .Values.image.repository }}:{{ .Values.image.release }}"
           resources: HELMSUBST_DEPLOYMENT_CONTAINER_RESOURCES

diff --git a/chart/gatekeeper-operator/templates/gatekeeper.yaml b/chart/gatekeeper-operator/templates/gatekeeper.yaml
@@ -2,11 +2,9 @@ apiVersion: v1
 kind: Namespace
 metadata:
   labels:
-    admission.gatekeeper.sh/ignore: no-self-managing
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
     control-plane: controller-manager
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-system
@@ -22,7 +20,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: configs.config.gatekeeper.sh
@@ -220,7 +217,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-manager-role
@@ -246,7 +242,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-manager-role
@@ -342,7 +337,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-manager-rolebinding
@@ -362,7 +356,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-manager-rolebinding
@@ -381,7 +374,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-webhook-server-cert
@@ -393,7 +385,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-webhook-service
@@ -406,7 +397,6 @@ spec:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
     control-plane: controller-manager
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
 ---
@@ -417,7 +407,6 @@ metadata:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
     control-plane: controller-manager
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-controller-manager
@@ -429,7 +418,6 @@ spec:
       app: '{{ template "gatekeeper-operator.name" . }}'
       chart: '{{ template "gatekeeper-operator.name" . }}'
       control-plane: controller-manager
-      gatekeeper.sh/system: "yes"
       heritage: '{{ .Release.Service }}'
       release: '{{ .Release.Name }}'
   template:
@@ -438,7 +426,6 @@ spec:
         app: '{{ template "gatekeeper-operator.name" . }}'
         chart: '{{ template "gatekeeper-operator.name" . }}'
         control-plane: controller-manager
-        gatekeeper.sh/system: "yes"
         heritage: '{{ .Release.Service }}'
         release: '{{ .Release.Name }}'
     spec:
@@ -448,7 +435,6 @@ spec:
         - --port=8443
         - --logtostderr
         - --constraint-violations-limit={{ .Values.constraintViolationsLimit }}
-        - --exempt-namespaces=gatekeeper-system
         command:
         - /manager
         env:
@@ -513,7 +499,6 @@ metadata:
   labels:
     app: '{{ template "gatekeeper-operator.name" . }}'
     chart: '{{ template "gatekeeper-operator.name" . }}'
-    gatekeeper.sh/system: "yes"
     heritage: '{{ .Release.Service }}'
     release: '{{ .Release.Name }}'
   name: gatekeeper-validating-webhook-configuration
@@ -530,8 +515,6 @@ webhooks:
     matchExpressions:
     - key: control-plane
       operator: DoesNotExist
-    - key: admission.gatekeeper.sh/ignore
-      operator: DoesNotExist
   rules:
   - apiGroups:
     - '*'
@@ -544,23 +527,3 @@ webhooks:
     - '*'
   sideEffects: None
   timeoutSeconds: 5
-- clientConfig:
-    caBundle: Cg==
-    service:
-      name: gatekeeper-webhook-service
-      namespace: gatekeeper-system
-      path: /v1/admitlabel
-  failurePolicy: Fail
-  name: check-ignore-label.gatekeeper.sh
-  rules:
-  - apiGroups:
-    - ""
-    apiVersions:
-    - '*'
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - namespaces
-  sideEffects: None
-  timeoutSeconds: 5
diff --git a/deploy/gatekeeper.yaml b/deploy/gatekeeper.yaml
@@ -2,9 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   labels:
-    admission.gatekeeper.sh/ignore: no-self-managing
     control-plane: controller-manager
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-system
 ---
 apiVersion: apiextensions.k8s.io/v1beta1
@@ -13,8 +11,6 @@ metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.2.4
   creationTimestamp: null
-  labels:
-    gatekeeper.sh/system: "yes"
   name: configs.config.gatekeeper.sh
 spec:
   group: config.gatekeeper.sh
@@ -109,8 +105,6 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   creationTimestamp: null
-  labels:
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-manager-role
   namespace: gatekeeper-system
 rules:
@@ -131,8 +125,6 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   creationTimestamp: null
-  labels:
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-manager-role
 rules:
 - apiGroups:
@@ -223,8 +215,6 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  labels:
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-manager-rolebinding
   namespace: gatekeeper-system
 roleRef:
@@ -239,8 +229,6 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  labels:
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-manager-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -254,16 +242,12 @@ subjects:
 apiVersion: v1
 kind: Secret
 metadata:
-  labels:
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-webhook-server-cert
   namespace: gatekeeper-system
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-webhook-service
   namespace: gatekeeper-system
 spec:
@@ -272,34 +256,29 @@ spec:
     targetPort: 8443
   selector:
     control-plane: controller-manager
-    gatekeeper.sh/system: "yes"
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
     control-plane: controller-manager
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-controller-manager
   namespace: gatekeeper-system
 spec:
   replicas: 1
   selector:
     matchLabels:
       control-plane: controller-manager
-      gatekeeper.sh/system: "yes"
   template:
     metadata:
       labels:
         control-plane: controller-manager
-        gatekeeper.sh/system: "yes"
     spec:
       containers:
       - args:
         - --audit-interval=30
         - --port=8443
         - --logtostderr
-        - --exempt-namespaces=gatekeeper-system
         command:
         - /manager
         env:
@@ -360,8 +339,6 @@ apiVersion: admissionregistration.k8s.io/v1beta1
 kind: ValidatingWebhookConfiguration
 metadata:
   creationTimestamp: null
-  labels:
-    gatekeeper.sh/system: "yes"
   name: gatekeeper-validating-webhook-configuration
 webhooks:
 - clientConfig:
@@ -376,8 +353,6 @@ webhooks:
     matchExpressions:
     - key: control-plane
       operator: DoesNotExist
-    - key: admission.gatekeeper.sh/ignore
-      operator: DoesNotExist
   rules:
   - apiGroups:
     - '*'
@@ -390,26 +365,6 @@ webhooks:
     - '*'
   sideEffects: None
   timeoutSeconds: 5
-- clientConfig:
-    caBundle: Cg==
-    service:
-      name: gatekeeper-webhook-service
-      namespace: gatekeeper-system
-      path: /v1/admitlabel
-  failurePolicy: Fail
-  name: check-ignore-label.gatekeeper.sh
-  rules:
-  - apiGroups:
-    - ""
-    apiVersions:
-    - '*'
-    operations:
-    - CREATE
-    - UPDATE
-    resources:
-    - namespaces
-  sideEffects: None
-  timeoutSeconds: 5
 ---
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition

diff --git a/manifest_staging/chart/gatekeeper-operator/helm-modifications/helm-modifications.yaml b/manifest_staging/chart/gatekeeper-operator/helm-modifications/helm-modifications.yaml
@@ -53,6 +53,7 @@ spec:
             - --port=8443
             - --logtostderr
             - --constraint-violations-limit={{ .Values.constraintViolationsLimit }}
+            - --exempt-namespaces=gatekeeper-system
           imagePullPolicy: "{{ .Values.image.pullPolicy }}"
           image: "{{ .Values.image.repository }}:{{ .Values.image.release }}"
           resources: HELMSUBST_DEPLOYMENT_CONTAINER_RESOURCES