Merge branch 'master' into add_disallow_interactive_tty_constraint

open-policy-agent · Dec 6, 2023 · 56a24f7 · 56a24f7
2 parents 317f82e + 1136967
commit 56a24f7
Show file tree

Hide file tree

Showing 23 changed files with 34 additions and 34 deletions.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -50,7 +50,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7
+        uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7
+        uses: github/codeql-action/autobuild@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7
+        uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -24,4 +24,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@7bbfa034e752445ea40215fff1c3bf9597993d3f # v3.1.3
+        uses: actions/dependency-review-action@01bc87099ba56df1e897b6874784491ea6309bc4 # v3.1.4
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@66b90a5db151a8042fa97405c6cf843bbe433f7b # v2.22.7
+        uses: github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/scripts.yaml b/.github/workflows/scripts.yaml
@@ -30,5 +30,5 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
-          version: v1.54.2
+          version: v1.55.2
           working-directory: scripts/${{ matrix.folder }}
diff --git a/mutation/pod-security-policy/allow-privilege-escalation/samples/mutation.yaml b/mutation/pod-security-policy/allow-privilege-escalation/samples/mutation.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspdefaultallowprivilegeescalation
@@ -15,7 +15,7 @@ spec:
     assign:
       value: false
 ---
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspdefaultallowprivilegeescalation-init
@@ -32,7 +32,7 @@ spec:
     assign:
       value: false
 ---
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspdefaultallowprivilegeescalation-ephemeral

diff --git a/mutation/pod-security-policy/capabilities/samples/mutation-assign.yaml b/mutation/pod-security-policy/capabilities/samples/mutation-assign.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspcapabilities

diff --git a/mutation/pod-security-policy/capabilities/samples/mutation-modifyset.yaml b/mutation/pod-security-policy/capabilities/samples/mutation-modifyset.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: ModifySet
 metadata:
   name: k8spspcapabilities

diff --git a/mutation/pod-security-policy/read-only-root-filesystem/samples/mutation.yaml b/mutation/pod-security-policy/read-only-root-filesystem/samples/mutation.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspreadonlyrootfs

diff --git a/mutation/pod-security-policy/seccomp/samples/mutation.yaml b/mutation/pod-security-policy/seccomp/samples/mutation.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: AssignMetadata
 metadata:
   name: k8spspseccomp

diff --git a/mutation/pod-security-policy/selinux/samples/mutation.yaml b/mutation/pod-security-policy/selinux/samples/mutation.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspselinux

diff --git a/mutation/pod-security-policy/users/samples/mutation-fsGroup.yaml b/mutation/pod-security-policy/users/samples/mutation-fsGroup.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspfsGroup

diff --git a/mutation/pod-security-policy/users/samples/mutation-mustRunAsNonRoot.yaml b/mutation/pod-security-policy/users/samples/mutation-mustRunAsNonRoot.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spsprunasnonroot
@@ -15,7 +15,7 @@ spec:
     assign:
       value: true
 ---
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spsprunasnonroot-init

diff --git a/mutation/pod-security-policy/users/samples/mutation-runAsGroup.yaml b/mutation/pod-security-policy/users/samples/mutation-runAsGroup.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spsprunasgroup
@@ -15,7 +15,7 @@ spec:
     assign:
       value: 2000
 ---
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spsprunasgroup-init

diff --git a/mutation/pod-security-policy/users/samples/mutation-runAsUser.yaml b/mutation/pod-security-policy/users/samples/mutation-runAsUser.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spsprunasuser
@@ -15,7 +15,7 @@ spec:
     assign:
       value: 1000
 ---
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spsprunasuser-init

diff --git a/mutation/pod-security-policy/users/samples/mutation-supplementalGroups.yaml b/mutation/pod-security-policy/users/samples/mutation-supplementalGroups.yaml
@@ -1,4 +1,4 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspsupplementalgroups

diff --git a/scripts/require-sync/go.mod b/scripts/require-sync/go.mod
@@ -5,7 +5,7 @@ go 1.20
 require (
 	github.com/open-policy-agent/frameworks/constraint v0.0.0-20231030230613-2e0cb3d68575
 	github.com/open-policy-agent/gatekeeper/v3 v3.14.0
-	k8s.io/apimachinery v0.27.7
+	k8s.io/apimachinery v0.27.8
 )
 
 require (

diff --git a/scripts/require-sync/go.sum b/scripts/require-sync/go.sum
@@ -442,7 +442,7 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -513,8 +513,8 @@ k8s.io/api v0.27.4 h1:0pCo/AN9hONazBKlNUdhQymmnfLRbSZjd5H5H3f0bSs=
 k8s.io/api v0.27.4/go.mod h1:O3smaaX15NfxjzILfiln1D8Z3+gEYpjEpiNA/1EVK1Y=
 k8s.io/apiextensions-apiserver v0.27.4 h1:ie1yZG4nY/wvFMIR2hXBeSVq+HfNzib60FjnBYtPGSs=
 k8s.io/apiextensions-apiserver v0.27.4/go.mod h1:KHZaDr5H9IbGEnSskEUp/DsdXe1hMQ7uzpQcYUFt2bM=
-k8s.io/apimachinery v0.27.7 h1:Gxgtb7Y/Rsu8ymgmUEaiErkxa6RY4oTd8kNUI6SUR58=
-k8s.io/apimachinery v0.27.7/go.mod h1:jBGQgTjkw99ef6q5hv1YurDd3BqKDk9YRxmX0Ozo0i8=
+k8s.io/apimachinery v0.27.8 h1:Xg+ogjDm8s7KmV3vZGf7uOZ0jrC6FPy2Lk/h7BIRmvg=
+k8s.io/apimachinery v0.27.8/go.mod h1:EIXLxLt/b1muPITiF5zlrcm7I+YnXsIgM+0GdnPTQvA=
 k8s.io/apiserver v0.27.4 h1:ncZ0MBR9yQ/Gf34rtu1EK+HqT8In1YpfAUINu/Akvho=
 k8s.io/apiserver v0.27.4/go.mod h1:GDEFRfFZ4/l+pAvwYRnoSfz0K4j3TWiN4WsG2KnRteE=
 k8s.io/client-go v0.27.4 h1:vj2YTtSJ6J4KxaC88P4pMPEQECWMY8gqPqsTgUKzvjk=

diff --git a/website/docs/mutation-examples/allow-privilege-escalation.md b/website/docs/mutation-examples/allow-privilege-escalation.md
@@ -11,7 +11,7 @@ kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-
 ```
 ## Mutation Examples
 ```yaml
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspdefaultallowprivilegeescalation
@@ -28,7 +28,7 @@ spec:
     assign:
       value: false
 ---
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspdefaultallowprivilegeescalation-init
@@ -45,7 +45,7 @@ spec:
     assign:
       value: false
 ---
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspdefaultallowprivilegeescalation-ephemeral

diff --git a/website/docs/mutation-examples/capabilities.md b/website/docs/mutation-examples/capabilities.md
@@ -11,7 +11,7 @@ kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-
 ```
 ## Mutation Examples
 ```yaml
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: ModifySet
 metadata:
   name: k8spspcapabilities

diff --git a/website/docs/mutation-examples/read-only-root-filesystem.md b/website/docs/mutation-examples/read-only-root-filesystem.md
@@ -11,7 +11,7 @@ kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-
 ```
 ## Mutation Examples
 ```yaml
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspreadonlyrootfs

diff --git a/website/docs/mutation-examples/seccomp.md b/website/docs/mutation-examples/seccomp.md
@@ -11,7 +11,7 @@ kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-
 ```
 ## Mutation Examples
 ```yaml
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: AssignMetadata
 metadata:
   name: k8spspseccomp

diff --git a/website/docs/mutation-examples/selinux.md b/website/docs/mutation-examples/selinux.md
@@ -11,7 +11,7 @@ kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-
 ```
 ## Mutation Examples
 ```yaml
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspselinux

diff --git a/website/docs/mutation-examples/users.md b/website/docs/mutation-examples/users.md
@@ -11,7 +11,7 @@ kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-
 ```
 ## Mutation Examples
 ```yaml
-apiVersion: mutations.gatekeeper.sh/v1alpha1
+apiVersion: mutations.gatekeeper.sh/v1
 kind: Assign
 metadata:
   name: k8spspsupplementalgroups