feat: add operations field to mutation ApplyTo spec

Add granular operation control to Gatekeeper mutations by introducing
an 'operations' field in the ApplyTo specification. This allows users
to specify which Kubernetes admission operations (CREATE, UPDATE, DELETE)
should trigger mutations.

Key Changes:
- Add Operations []string field to ApplyTo struct
- Update mutation matching logic to check operation compatibility
- Add Operation field to Mutable type for context propagation
- Maintain backward compatibility (defaults to CREATE+UPDATE)
- Add comprehensive unit tests for operation matching
- Update documentation with usage examples and best practices
- Include practical examples demonstrating various operation patterns

Fixes: Resolves issues with mutations attempting to modify immutable
fields during UPDATE operations, such as Pod environment variables
in CronJob scenarios.

Backward Compatibility: Existing mutations without operations field
continue working unchanged with default CREATE+UPDATE behavior.

Testing: Added unit tests, live cluster validation, and comprehensive
examples covering all supported operation combinations.

Author: sai kiran pikili

config/crd/bases/expansion.gatekeeper.sh_expansiontemplate.yaml

@@ -56,6 +56,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string
@@ -173,6 +177,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string

config/crd/bases/mutations.gatekeeper.sh_assign.yaml

@@ -57,6 +57,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string
@@ -424,6 +428,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string
@@ -791,6 +799,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string

config/crd/bases/mutations.gatekeeper.sh_assignimage.yaml

@@ -57,6 +57,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string

config/crd/bases/mutations.gatekeeper.sh_modifyset.yaml

@@ -59,6 +59,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string
@@ -393,6 +397,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string
@@ -727,6 +735,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    operations:
+                      items:
+                        type: string
+                      type: array
                     versions:
                       items:
                         type: string

examples/README.md

@@ -0,0 +1,96 @@
+# Gatekeeper Mutation Examples
+
+This directory contains examples demonstrating Gatekeeper mutation capabilities, including the new `operations` field for granular operation control.
+
+## Operations Field Overview
+
+The `operations` field in the `applyTo` section allows you to specify which Kubernetes admission operations should trigger mutations:
+
+- **`CREATE`** - Apply mutation when resources are created
+- **`UPDATE`** - Apply mutation when resources are updated  
+- **`DELETE`** - Apply mutation when resources are deleted (advanced use cases)
+
+### Default Behavior (Backward Compatibility)
+
+If no `operations` field is specified, mutations default to `["CREATE", "UPDATE"]` to maintain compatibility with existing deployments.
+
+## Example Files
+
+### assign-with-operations.yaml
+
+Demonstrates various patterns for using the `operations` field:
+
+1. **CREATE-only mutation** - Solves immutable field issues during updates
+2. **Explicit CREATE+UPDATE** - Shows how to explicitly specify default behavior
+3. **Legacy compatibility** - Existing mutations without operations field
+4. **DELETE operations** - Advanced use cases (use with caution)
+5. **All operations** - Comprehensive mutation coverage
+
+## Common Use Cases
+
+### Solving Immutable Field Issues
+
+Many Kubernetes resources have immutable fields that cannot be changed after creation. Setting environment variables on Pods is a common example:
+
+```yaml
+operations: ["CREATE"]  # Only mutate during creation
+location: "spec.containers[name:*].env[name:MY_VAR].value"
+```
+
+### Default Value Setting
+
+For fields that should have defaults on creation but can be changed later:
+
+```yaml
+operations: ["CREATE"]
+location: "spec.containers[name:*].imagePullPolicy"
+parameters:
+  assign:
+    value: "IfNotPresent"
+```
+
+### Dynamic Updates
+
+For mutations that should apply whenever resources are modified:
+
+```yaml
+operations: ["UPDATE"]
+location: "metadata.labels.last-updated"
+parameters:
+  assign:
+    fromMetadata:
+      field: "timestamp"
+```
+
+### Legacy Compatibility
+
+Existing mutations continue to work without changes:
+
+```yaml
+# No operations field = ["CREATE", "UPDATE"] behavior
+applyTo:
+- groups: [""]
+  kinds: ["Pod"]
+  versions: ["v1"]
+```
+
+## Migration Guide
+
+### From Existing Mutations
+
+1. **No action required** - Existing mutations work unchanged
+2. **Gradual adoption** - Add operations field to new mutations as needed
+3. **Optional updates** - Update existing mutations only if you need different operation behavior
+
+### Best Practices
+
+1. **Start with CREATE-only** for immutable fields
+2. **Use explicit operations** for clarity in new mutations
+3. **Avoid DELETE operations** unless you have specific cleanup requirements
+4. **Test thoroughly** when changing operation behavior on existing mutations
+
+## Related Documentation
+
+- [Mutation Documentation](https://open-policy-agent.github.io/gatekeeper/website/docs/mutation/)
+- [Gatekeeper Installation](https://open-policy-agent.github.io/gatekeeper/website/docs/install/)
+- [Policy Library](https://open-policy-agent.github.io/gatekeeper-library/website/)

examples/assign-with-operations.yaml

@@ -0,0 +1,103 @@
+# Example 1: CREATE-only mutation
+# This addresses the common issue where mutations on UPDATE operations
+# fail due to immutable field constraints (e.g., Pod env variables)
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: assign-otel-protocol-create-only
+spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+    operations: ["CREATE"]  # Only apply on CREATE operations
+  match:
+    scope: Namespaced
+    namespaces:
+      - "*"
+    excludedNamespaces:
+      - "kube-system"
+  location: "spec.containers[name:*].env[name:OTEL_EXPORTER_OTLP_PROTOCOL].value"
+  parameters:
+    assign:
+      value: "grpc"
+
+---
+# Example 2: Explicit CREATE and UPDATE mutation
+# Shows how to explicitly specify the default behavior
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: assign-security-context-create-update
+spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+    operations: ["CREATE", "UPDATE"]  # Apply on both CREATE and UPDATE
+  match:
+    scope: Namespaced
+  location: "spec.securityContext.runAsNonRoot"
+  parameters:
+    assign:
+      value: true
+
+---
+# Example 3: Legacy mutation (backward compatibility)
+# Demonstrates that existing mutations without operations field continue to work
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: assign-legacy-without-operations
+spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+    # No operations field - defaults to CREATE and UPDATE for backward compatibility
+  match:
+    scope: Namespaced
+  location: "metadata.labels.legacy-mutator"
+  parameters:
+    assign:
+      value: "true"
+
+---
+# Example 4: DELETE operation mutation (advanced use case)
+# Use with caution - most mutations don't need to run on DELETE
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: assign-delete-example
+spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+    operations: ["DELETE"]  # Example: Apply only on DELETE operations (if you have a use case)
+  match:
+    scope: Namespaced
+  location: "metadata.labels.deletion-timestamp"
+  parameters:
+    assign:
+      value: "processing"
+
+---
+# Example 5: All operations mutation
+# Demonstrates applying mutations on all possible operations
+apiVersion: mutations.gatekeeper.sh/v1
+kind: Assign
+metadata:
+  name: assign-all-operations
+spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+    operations: ["CREATE", "UPDATE", "DELETE"]  # Apply on all operations
+  match:
+    scope: Namespaced
+  location: "metadata.labels.lifecycle-stage"
+  parameters:
+    assign:
+      value: "managed"

pkg/mutation/match/apply_to.go

@@ -12,13 +12,26 @@ func AppliesTo(applyTo []ApplyTo, gvk schema.GroupVersionKind) bool {
 	return false
 }
 
-// ApplyTo determines what GVKs items the mutation should apply to.
+// AppliesOperationTo checks if any item in the given slice of ApplyTo allows the given operation.
+func AppliesOperationTo(applyTo []ApplyTo, operation string) bool {
+	for _, apply := range applyTo {
+		if apply.MatchesOperation(operation) {
+			return true
+		}
+	}
+	return false
+}
+
+// ApplyTo determines what GVKs and operations the mutation should apply to.
 // Globs are not allowed.
 // +kubebuilder:object:generate=true
 type ApplyTo struct {
-	Groups   []string `json:"groups,omitempty"`
-	Kinds    []string `json:"kinds,omitempty"`
-	Versions []string `json:"versions,omitempty"`
+	Groups     []string `json:"groups,omitempty"`
+	Kinds      []string `json:"kinds,omitempty"`
+	Versions   []string `json:"versions,omitempty"`
+	// Operations specifies which admission operations (CREATE, UPDATE, DELETE) should trigger
+	// this mutation. If empty, defaults to ["CREATE", "UPDATE"] for backward compatibility.
+	Operations []string `json:"operations,omitempty"`
 }
 
 // Flatten returns the set of GroupVersionKinds this ApplyTo matches.
@@ -55,3 +68,17 @@ func (a ApplyTo) Matches(gvk schema.GroupVersionKind) bool {
 
 	return true
 }
+
+// MatchesOperation returns true if the operation is contained in the ApplyTo's
+// operations list. If no operations are specified, it defaults to allowing
+// CREATE and UPDATE for backward compatibility. Users can explicitly specify
+// DELETE operations if they have legitimate use cases.
+func (a ApplyTo) MatchesOperation(operation string) bool {
+	// If no operations specified, default to CREATE and UPDATE for backward compatibility
+	if len(a.Operations) == 0 {
+		return operation == "CREATE" || operation == "UPDATE"
+	}
+	
+	// Check if the operation is explicitly allowed by the user
+	return contains(a.Operations, operation)
+}