Merge branch 'master' into dependabot/docker/kubectl-v1.35.4

Author: JaydipGabani

Makefile

@@ -31,7 +31,7 @@ KIND_VERSION ?= 0.29.0
 KIND_CLUSTER_FILE ?= ""
 # note: k8s version pinned since KIND image availability lags k8s releases
 KUBERNETES_VERSION ?= 1.33.0
-KUSTOMIZE_VERSION ?= 3.8.9
+KUSTOMIZE_VERSION ?= 5.6.0
 BATS_VERSION ?= 1.13.0
 ORAS_VERSION ?= 1.3.1
 BATS_TESTS_FILE ?= test/bats/test.bats
@@ -400,7 +400,7 @@ manifests: __controller-gen
 		/gatekeeper/config/default -o /gatekeeper/manifest_staging/deploy/gatekeeper.yaml
 	docker run --rm -v $(shell pwd):/gatekeeper \
 		registry.k8s.io/kustomize/kustomize:v${KUSTOMIZE_VERSION} build \
-		--load_restrictor LoadRestrictionsNone /gatekeeper/cmd/build/helmify | go run cmd/build/helmify/*.go
+		--load-restrictor LoadRestrictionsNone /gatekeeper/cmd/build/helmify | go run cmd/build/helmify/*.go
 
 # lint runs a dockerized golangci-lint, and should give consistent results
 # across systems.

cmd/build/helmify/delete-ports.yaml

@@ -10,10 +10,13 @@ spec:
         - name: manager
           ports:
             - containerPort: 8888
+              protocol: TCP
               $patch: delete
             - containerPort: 8443
+              protocol: TCP
               $patch: delete
             - containerPort: 9090
+              protocol: TCP
               $patch: delete
 ---
 kind: Deployment
@@ -28,6 +31,8 @@ spec:
         - name: manager
           ports:
             - containerPort: 8888
+              protocol: TCP
               $patch: delete
             - containerPort: 9090
+              protocol: TCP
               $patch: delete

cmd/build/helmify/kustomization.yaml

@@ -4,7 +4,7 @@ commonLabels:
   chart: '{{ template "gatekeeper.name" . }}'
   release: "{{ .Release.Name }}"
   heritage: "{{ .Release.Service }}"
-bases:
+resources:
   - "../../../config/default"
 patchesStrategicMerge:
   - kustomize-for-helm.yaml

cmd/build/helmify/kustomize-for-helm.yaml

@@ -276,7 +276,8 @@ spec:
 apiVersion: v1
 kind: Secret
 metadata:
-  annotations: HELMSUBST_SECRET_ANNOTATIONS
+  annotations:
+    HELMSUBST_SECRET_ANNOTATIONS: ""
   name: gatekeeper-webhook-server-cert
   namespace: gatekeeper-system
 ---
@@ -286,7 +287,8 @@ metadata:
   labels:
     gatekeeper.sh/system: "yes"
   name: gatekeeper-mutating-webhook-configuration
-  annotations: HELMSUBST_MUTATING_WEBHOOK_ANNOTATIONS
+  annotations:
+    HELMSUBST_MUTATING_WEBHOOK_ANNOTATIONS: ""
 webhooks:
 - clientConfig:
     service:
@@ -315,7 +317,8 @@ metadata:
   labels:
     gatekeeper.sh/system: "yes"
   name: gatekeeper-validating-webhook-configuration
-  annotations: HELMSUBST_VALIDATING_WEBHOOK_ANNOTATIONS
+  annotations:
+    HELMSUBST_VALIDATING_WEBHOOK_ANNOTATIONS: ""
 webhooks:
 - clientConfig:
     service:

cmd/build/helmify/replacements.go

@@ -110,7 +110,7 @@ var replacements = map[string]string{
 
 	"- HELMSUBST_DEPLOYMENT_AUDIT_LOG_STATS_ADMISSION": `{{ if hasKey .Values "logStatsAudit" }}- --log-stats-audit={{ .Values.logStatsAudit }}{{- end }}`,
 
-	"HELMSUBST_SECRET_ANNOTATIONS": `{{- toYaml .Values.secretAnnotations | trim | nindent 4 }}`,
+	`HELMSUBST_SECRET_ANNOTATIONS: ""`: `{{- toYaml .Values.secretAnnotations | trim | nindent 4 }}`,
 
 	"- HELMSUBST_TLS_HEALTHCHECK_ENABLED_ARG": `{{ if .Values.enableTLSHealthcheck}}- --enable-tls-healthcheck{{- end }}`,
 
@@ -159,7 +159,7 @@ var replacements = map[string]string{
 
 	"HELMSUBST_MUTATING_WEBHOOK_REINVOCATION_POLICY": `{{ .Values.mutatingWebhookReinvocationPolicy }}`,
 
-	"HELMSUBST_MUTATING_WEBHOOK_ANNOTATIONS": `{{- toYaml .Values.mutatingWebhookAnnotations | trim | nindent 4 }}`,
+	`HELMSUBST_MUTATING_WEBHOOK_ANNOTATIONS: ""`: `{{- toYaml .Values.mutatingWebhookAnnotations | trim | nindent 4 }}`,
 
 	"- HELMSUBST_MUTATING_WEBHOOK_EXEMPT_NAMESPACE_LABELS": `
     {{- /* 1. Get mandatory exemption from helper */ -}}
@@ -216,7 +216,7 @@ var replacements = map[string]string{
 
 	"HELMSUBST_VALIDATING_WEBHOOK_FAILURE_POLICY": `{{ .Values.validatingWebhookFailurePolicy }}`,
 
-	"HELMSUBST_VALIDATING_WEBHOOK_ANNOTATIONS": `{{- toYaml .Values.validatingWebhookAnnotations | trim | nindent 4 }}`,
+	`HELMSUBST_VALIDATING_WEBHOOK_ANNOTATIONS: ""`: `{{- toYaml .Values.validatingWebhookAnnotations | trim | nindent 4 }}`,
 
 	"HELMSUBST_VALIDATING_WEBHOOK_MATCHEXPRESSION_METADATANAME": `key: kubernetes.io/metadata.name
       operator: NotIn

config/default/kustomization.yaml

@@ -12,7 +12,7 @@ namePrefix: gatekeeper-
 commonLabels:
   gatekeeper.sh/system: "yes"
 
-bases:
+resources:
 - ../crd
 - ../rbac
 - ../manager