From 2df38d0b4430655ea313336e153b9edd2eb5ff86 Mon Sep 17 00:00:00 2001 From: Amir Alavi Date: Fri, 3 Jul 2026 16:46:05 -0400 Subject: [PATCH] feat: add status subresource to ConstraintTemplatePodStatus CRD Declare a Kubernetes status subresource on ConstraintTemplatePodStatus and switch the ConstraintTemplate reconciler to write pod status via Status().Update instead of a full-object Update. This aligns the write path with other Gatekeeper controllers that update status subresources. It does not replace the stale-cache conflict retry in #4596; Status().Update still requires a current resourceVersion. Signed-off-by: Amir Alavi --- apis/status/v1beta1/constrainttemplatepodstatus_types.go | 1 + ...onstrainttemplatepodstatus-customresourcedefinition.yaml | 2 ++ .../status.gatekeeper.sh_constrainttemplatepodstatuses.yaml | 2 ++ deploy/gatekeeper.yaml | 2 ++ ...onstrainttemplatepodstatus-customresourcedefinition.yaml | 2 ++ manifest_staging/deploy/gatekeeper.yaml | 2 ++ .../constrainttemplate/constrainttemplate_controller.go | 6 +++--- 7 files changed, 14 insertions(+), 3 deletions(-) diff --git a/apis/status/v1beta1/constrainttemplatepodstatus_types.go b/apis/status/v1beta1/constrainttemplatepodstatus_types.go index ff4751e5998..449730483a7 100644 --- a/apis/status/v1beta1/constrainttemplatepodstatus_types.go +++ b/apis/status/v1beta1/constrainttemplatepodstatus_types.go @@ -46,6 +46,7 @@ type VAPGenerationStatus struct { // +kubebuilder:object:root=true // +kubebuilder:resource:scope=Namespaced +// +kubebuilder:subresource:status // ConstraintTemplatePodStatus is the Schema for the constrainttemplatepodstatuses API. type ConstraintTemplatePodStatus struct { diff --git a/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml b/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml index fd80da38ad2..2b68b561b76 100644 --- a/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml +++ b/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml @@ -87,3 +87,5 @@ spec: type: object served: true storage: true + subresources: + status: {} diff --git a/config/crd/bases/status.gatekeeper.sh_constrainttemplatepodstatuses.yaml b/config/crd/bases/status.gatekeeper.sh_constrainttemplatepodstatuses.yaml index 11b370dffbf..d93524526b6 100644 --- a/config/crd/bases/status.gatekeeper.sh_constrainttemplatepodstatuses.yaml +++ b/config/crd/bases/status.gatekeeper.sh_constrainttemplatepodstatuses.yaml @@ -89,3 +89,5 @@ spec: type: object served: true storage: true + subresources: + status: {} diff --git a/deploy/gatekeeper.yaml b/deploy/gatekeeper.yaml index 935df25fd0b..2ff67ac439e 100644 --- a/deploy/gatekeeper.yaml +++ b/deploy/gatekeeper.yaml @@ -2973,6 +2973,8 @@ spec: type: object served: true storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition diff --git a/manifest_staging/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml b/manifest_staging/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml index 77e5aae26c6..5743c3aae52 100644 --- a/manifest_staging/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml +++ b/manifest_staging/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml @@ -91,3 +91,5 @@ spec: type: object served: true storage: true + subresources: + status: {} diff --git a/manifest_staging/deploy/gatekeeper.yaml b/manifest_staging/deploy/gatekeeper.yaml index f5c449742b5..6c5ce11edde 100644 --- a/manifest_staging/deploy/gatekeeper.yaml +++ b/manifest_staging/deploy/gatekeeper.yaml @@ -3145,6 +3145,8 @@ spec: type: object served: true storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition diff --git a/pkg/controller/constrainttemplate/constrainttemplate_controller.go b/pkg/controller/constrainttemplate/constrainttemplate_controller.go index 0bd3193983a..3adfae15403 100644 --- a/pkg/controller/constrainttemplate/constrainttemplate_controller.go +++ b/pkg/controller/constrainttemplate/constrainttemplate_controller.go @@ -394,7 +394,7 @@ func (r *ReconcileConstraintTemplate) Reconcile(ctx context.Context, request rec createErr := &v1beta1.CreateCRDError{Code: ErrCreateCode, Message: err.Error()} status.Status.Errors = append(status.Status.Errors, createErr) - if updateErr := r.Update(ctx, status); updateErr != nil { + if updateErr := r.Status().Update(ctx, status); updateErr != nil { logger.Error(updateErr, "update status error") return reconcile.Result{Requeue: true}, nil } @@ -454,7 +454,7 @@ func (r *ReconcileConstraintTemplate) reportErrorOnCTStatus(ctx context.Context, Message: fmt.Sprintf("%s: %s", message, err), } status.Status.Errors = append(status.Status.Errors, createErr) - if err2 := r.Update(ctx, status); err2 != nil { + if err2 := r.Status().Update(ctx, status); err2 != nil { return errorpkg.Wrap(err, fmt.Sprintf("Could not update status: %s", err2)) } return err @@ -522,7 +522,7 @@ func (r *ReconcileConstraintTemplate) handleUpdate( if err != nil { return reconcile.Result{}, err } - if err := r.Update(ctx, status); err != nil { + if err := r.Status().Update(ctx, status); err != nil { logger.Error(err, "update ct pod status error") return reconcile.Result{Requeue: true}, nil }