Merge branch 'master' into dependabot/go_modules/github.com/go-logr/z…

…apr-1.2.4

.github/workflows/codeql.yaml

@@ -25,12 +25,12 @@ jobs:
         uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@29b1f65c5e92e24fe6b6647da1eaabe529cec70f
+        uses: github/codeql-action/init@489225d82a57396c6f426a40e66d461b16b3461d
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@29b1f65c5e92e24fe6b6647da1eaabe529cec70f
+        uses: github/codeql-action/autobuild@489225d82a57396c6f426a40e66d461b16b3461d
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@29b1f65c5e92e24fe6b6647da1eaabe529cec70f
+        uses: github/codeql-action/analyze@489225d82a57396c6f426a40e66d461b16b3461d

.github/workflows/scorecards.yml

@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
+        uses: github/codeql-action/upload-sarif@489225d82a57396c6f426a40e66d461b16b3461d # v2.20.4
         with:
           sarif_file: results.sarif

Makefile

@@ -538,7 +538,7 @@ gator: bin/gator-$(GOOS)-$(GOARCH)
 	mv bin/gator-$(GOOS)-$(GOARCH) bin/gator
 
 bin/gator-$(GOOS)-$(GOARCH):
-	GOOS=$(GOOS) GOARCH=$(GOARCH) go build -o $(BIN_DIR)/gator-$(GOOS)-$(GOARCH) -ldflags $(LDFLAGS) ./cmd/gator
+	GOOS=$(GOOS) GOARCH=$(GOARCH) CGO_ENABLED=0 GO111MODULE=on go build -o $(BIN_DIR)/gator-$(GOOS)-$(GOARCH) -ldflags $(LDFLAGS) ./cmd/gator
 
 tilt-prepare:
 	mkdir -p .tiltbuild/charts

apis/addtoscheme_expansion_v1beta1.go

@@ -0,0 +1,25 @@
+/*
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apis
+
+import (
+	"github.com/open-policy-agent/gatekeeper/v3/apis/expansion/v1beta1"
+)
+
+func init() {
+	// Register the types with the Scheme so the components can map objects to GroupVersionKinds and back
+	AddToSchemes = append(AddToSchemes, v1beta1.AddToScheme)
+}

apis/config/v1alpha1/config_types.go

@@ -16,7 +16,7 @@ limitations under the License.
 package v1alpha1
 
 import (
-	"github.com/open-policy-agent/gatekeeper/v3/pkg/util"
+	"github.com/open-policy-agent/gatekeeper/v3/pkg/wildcard"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -63,8 +63,8 @@ type SyncOnlyEntry struct {
 }
 
 type MatchEntry struct {
-	Processes          []string        `json:"processes,omitempty"`
-	ExcludedNamespaces []util.Wildcard `json:"excludedNamespaces,omitempty"`
+	Processes          []string            `json:"processes,omitempty"`
+	ExcludedNamespaces []wildcard.Wildcard `json:"excludedNamespaces,omitempty"`
 }
 
 type ReadinessSpec struct {

apis/expansion/v1beta1/doc.go

@@ -0,0 +1,5 @@
+// Package v1beta1 includes v1beta1 expansion
+
+// +k8s:conversion-gen=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/unversioned
+// -external-types=github.com/open-policy-agent/gatekeeper/v3/apis/expansion/v1beta1
+package v1beta1

apis/expansion/v1beta1/expansiontemplate_types.go

@@ -0,0 +1,87 @@
+/*
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	status "github.com/open-policy-agent/gatekeeper/v3/apis/status/v1beta1"
+	"github.com/open-policy-agent/gatekeeper/v3/pkg/mutation/match"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
+// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.
+
+// ExpansionTemplateSpec defines the desired state of ExpansionTemplate.
+type ExpansionTemplateSpec struct {
+	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
+	// Important: Run "make" to regenerate code after modifying this file
+
+	// ApplyTo lists the specific groups, versions and kinds of generator resources
+	// which will be expanded.
+	ApplyTo []match.ApplyTo `json:"applyTo,omitempty"`
+
+	// TemplateSource specifies the source field on the generator resource to
+	// use as the base for expanded resource. For Pod-creating generators, this
+	// is usually spec.template
+	TemplateSource string `json:"templateSource,omitempty"`
+
+	// GeneratedGVK specifies the GVK of the resources which the generator
+	// resource creates.
+	GeneratedGVK GeneratedGVK `json:"generatedGVK,omitempty"`
+
+	// EnforcementAction specifies the enforcement action to be used for resources
+	// matching the ExpansionTemplate. Specifying an empty value will use the
+	// enforcement action specified by the Constraint in violation.
+	EnforcementAction string `json:"enforcementAction,omitempty"`
+}
+
+type GeneratedGVK struct {
+	Group   string `json:"group,omitempty"`
+	Version string `json:"version,omitempty"`
+	Kind    string `json:"kind,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:path="expansiontemplate"
+// +kubebuilder:resource:scope="Cluster"
+// +kubebuilder:subresource:status
+
+// ExpansionTemplate is the Schema for the ExpansionTemplate API.
+type ExpansionTemplate struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   ExpansionTemplateSpec   `json:"spec,omitempty"`
+	Status ExpansionTemplateStatus `json:"status,omitempty"`
+}
+
+// ExpansionTemplateStatus defines the observed state of ExpansionTemplate.
+type ExpansionTemplateStatus struct {
+	ByPod []status.ExpansionTemplatePodStatusStatus `json:"byPod,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// ExpansionTemplateList contains a list of ExpansionTemplate.
+type ExpansionTemplateList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []ExpansionTemplate `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&ExpansionTemplate{}, &ExpansionTemplateList{})
+}

apis/expansion/v1beta1/groupversion_info.go

@@ -0,0 +1,38 @@
+/*
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1beta1 contains API Schema definitions for the expansion v1beta1 API group
+// +kubebuilder:object:generate=true
+// +groupName=expansion.gatekeeper.sh
+package v1beta1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// GroupVersion is group version used to register these objects.
+	GroupVersion = schema.GroupVersion{Group: "expansion.gatekeeper.sh", Version: "v1beta1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	localSchemeBuilder = runtime.NewSchemeBuilder(SchemeBuilder.AddToScheme)
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = localSchemeBuilder.AddToScheme
+)