feat: add status subresource to ConstraintTemplatePodStatus CRD#4655
Open
a7i wants to merge 1 commit into
Open
feat: add status subresource to ConstraintTemplatePodStatus CRD#4655a7i wants to merge 1 commit into
a7i wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR converts the ConstraintTemplatePodStatus CRD to use the conventional Kubernetes status subresource and updates the ConstraintTemplate reconciler to write per-pod status through Status().Update instead of a full-object Update. It is a precursor to #4596 (which addresses the stale-cache 409 conflicts) and does not by itself change the stale-cache retry behavior.
Changes:
- Adds
+kubebuilder:subresource:statusto theConstraintTemplatePodStatustype and regenerates the CRD manifests (subresources.status: {}). - Switches the three PodStatus write call sites in
constrainttemplate_controller.go(Reconcile,reportErrorOnCTStatus,handleUpdate) fromr.Updatetor.Status().Update. - Updates several CRD manifest copies (including root
deploy/andcharts/artifacts).
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| apis/status/v1beta1/constrainttemplatepodstatus_types.go | Adds the +kubebuilder:subresource:status marker enabling the status subresource. |
| pkg/controller/constrainttemplate/constrainttemplate_controller.go | Switches 3 pod-status writes to Status().Update; create path in getOrCreatePodStatus still uses r.Create, which no longer persists the initial Status.ID/Operations. |
| config/crd/bases/status.gatekeeper.sh_constrainttemplatepodstatuses.yaml | Regenerated CRD base adding the status subresource. |
| manifest_staging/deploy/gatekeeper.yaml | Staging deploy manifest updated with the status subresource (correct location). |
| manifest_staging/charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml | Staging chart CRD updated (correct location). |
| deploy/gatekeeper.yaml | Root/promoted manifest edited manually — deviates from the manifest_staging promotion workflow. |
| charts/gatekeeper/crds/constrainttemplatepodstatus-customresourcedefinition.yaml | Root/promoted chart CRD edited manually — deviates from the manifest_staging promotion workflow. |
a7i
force-pushed
the
feat/ct-podstatus-status-subresource
branch
from
2df38d0 to
6aae81c
Compare
a7i
force-pushed
the
feat/ct-podstatus-status-subresource
branch
from
6aae81c to
fd11c6f
Compare
Declare a Kubernetes status subresource on ConstraintTemplatePodStatus and switch the ConstraintTemplate reconciler to write pod status via Status().Update instead of a full-object Update. Persist initial pod status fields (ID, Operations) with a follow-up Status().Update after Create, since the apiserver strips .status on create once the subresource is enabled. Grant the manager ClusterRole explicit patch/update on constrainttemplatepodstatuses/status so Status().Update is authorized. Add envtest integration tests verifying initial status persists after create and is returned on subsequent getOrCreatePodStatus calls. Manifest changes are limited to config/crd/bases and manifest_staging; root deploy/ and charts/ are promoted at release time. This aligns the write path with other Gatekeeper status subresources. It does not replace the stale-cache conflict retry in open-policy-agent#4596; Status().Update still requires a current resourceVersion. Signed-off-by: Amir Alavi <amiralavi7@gmail.com>
a7i
force-pushed
the
feat/ct-podstatus-status-subresource
branch
from
fd11c6f to
113dd59
Compare
Author
|
Addressed all review feedback in
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
+kubebuilder:subresource:statustoConstraintTemplatePodStatusand updates CRD/manifests inconfig/crd/basesandmanifest_stagingonly.Status().Updateinstead of full-objectUpdate.ID,Operations) with a follow-upStatus().UpdateafterCreate, since the apiserver strips.statuson create once the subresource is enabled.patch/updateonconstrainttemplatepodstatuses/status(inconfig/rbacandmanifest_stagingonly).podstatus_subresource_test.go) verifying initial status persists after create and is returned on subsequentgetOrCreatePodStatuscalls.Separate from #4596: this changes the write API path to the conventional status subresource. It does not address stale informer cache conflicts on its own; that still needs the retry/refetch logic in #4596.
Which issue(s) this PR fixes:
Related to #4595
Special notes for your reviewer:
subresources.status: {}); existing stored objects are unchanged.deploy/andcharts/are not edited; those are promoted frommanifest_stagingat release time. Helm installs from the rootcharts/directory pick up the CRD/RBAC subresource changes at the next release promotion.Status().Updateinstead ofUpdate.