feat: adding driver to export to disk #3832

JaydipGabani · 2025-03-01T03:22:24Z

What this PR does / why we need it: Adding driver to export violation on disk.

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):
Fixes ##1037

Special notes for your reviewer:

JaydipGabani · 2025-03-01T03:22:45Z

Working on docs still.

codecov-commenter · 2025-03-01T03:45:03Z

Codecov Report

Attention: Patch coverage is 64.25532% with 84 lines in your changes missing coverage. Please review.

Project coverage is 48.04%. Comparing base (3350319) to head (f5d9bdc).
Report is 334 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/export/disk/disk.go	71.90%	39 Missing and 20 partials ⚠️
pkg/audit/manager.go	0.00%	22 Missing ⚠️
pkg/export/util/util.go	0.00%	2 Missing ⚠️
pkg/controller/export/export_config_controller.go	0.00%	1 Missing ⚠️

❗ There is a different number of reports uploaded between BASE (3350319) and HEAD (f5d9bdc). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (3350319) HEAD (f5d9bdc)

unittests 2 1

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3832      +/-   ##
==========================================
- Coverage   54.49%   48.04%   -6.46%     
==========================================
  Files         134      236     +102     
  Lines       12329    20124    +7795     
==========================================
+ Hits         6719     9669    +2950     
- Misses       5116     9544    +4428     
- Partials      494      911     +417

Flag	Coverage Δ
unittests	`48.04% <64.25%> (-6.46%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

JaydipGabani · 2025-03-02T04:36:53Z

pkg/export/disk/diskwriter.go

+	if path, ok := cfg["path"].(string); ok {
+		if conn.Path != path {
+			if err := os.RemoveAll(conn.Path); err != nil {
+				cleanUpErr = fmt.Errorf("connection updated but failed to remove content form old path: %w", err)


Should this be an error or log?

JaydipGabani · 2025-03-02T04:57:09Z

pkg/audit/manager.go

@@ -280,17 +259,28 @@ func (am *Manager) audit(ctx context.Context) error {
 	timestamp := startTime.UTC().Format(time.RFC3339)
 	am.log = log.WithValues(logging.AuditID, timestamp)
 	logStart(am.log)
+	exportErrorMap := make(map[string]error)
+	if err := am.exportSystem.Publish(context.Background(), *auditConnection, *auditChannel, exportutil.ExportMsg{Message: "audit is started", ID: timestamp}); err != nil {
+		exportErrorMap[err.Error()] = err


This can lead to memory consumption if by any chance driver returns unique error for all violations instead of returning one. Instead, we can modify returned error type to ExportError and use error type as keys to limit the number of errors we are storing in map. Do folks think this is a way to go about limiting the number of errors stored? I am open to other suggestions.

I will make the change if we agree to use ExportError because that may need updating interface.

agreed, your suggestion make sense. if we want to avoid interface changes, another idea might be to extract error category by checking with regex or before : for example

Parsing the error message and using the string before : as key to store errors.

Copilot

PR Overview

This PR adds a new disk export driver for persisting audit violations to the file system and updates related configuration, tests, and documentation.

Introduces a new disk driver under pkg/export/disk.
Adds GitHub workflow and test configuration to exercise the disk export.
Updates documentation to guide users through configuring and using the disk export driver.

Reviewed Changes

File	Description
.github/workflows/disk-export.yaml	Workflow definition to run disk export tests
test/export/fake-reader/.yaml,.go	Test configuration and a fake-reader to simulate exports
website/docs/export.md	Documentation updates for the disk export driver
pkg/export/disk/disk.go	New disk export driver implementation
pkg/export/util/util.go	Utility types updated for export messages
pkg/audit/manager.go	Audit manager updates to integrate disk export; error map
pkg/export/system.go	Updated export system to include the disk driver

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (2)

pkg/export/disk/disk.go:69

The variable 'err' is never updated in CreateConnection; consider returning 'nil' explicitly to avoid confusion.

return err

pkg/audit/manager.go:263

[nitpick] Consider defining and using constants for the audit trigger messages ("audit is started" and "audit is completed") to avoid typos and ensure consistency across the codebase.

am.exportSystem.Publish(context.Background(), *auditConnection, *auditChannel, exportutil.ExportMsg{Message: "audit is started", ID: timestamp})

nreisch · 2025-03-06T19:27:57Z

pkg/export/disk/disk.go

+		return fmt.Errorf("missing or invalid values in config for connection: %s", connectionName)
+	}
+	var err error
+	maxResults, maxResultsOk := cfg["maxAuditResults"].(float64)


Because the inherent value is stored in float64 when the object is getting unpacked, so checking and converting to int64 does not work here.

pkg/export/disk/disk.go

test/export/fake-reader/export_config.yaml

pkg/audit/manager.go

sozercan · 2025-03-05T23:50:58Z

.github/workflows/disk-export.yaml

+        egress-policy: audit
+
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683


Suggested change

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

sozercan · 2025-03-05T23:54:47Z

pkg/export/disk/disk.go

+	maxAllowedAuditRuns = 5
+)
+
+const (


nit: merge these

test/export/fake-subscriber/Dockerfile

sozercan · 2025-03-06T00:00:15Z

test/export/fake-reader/Dockerfile

+ARG BUILDERIMAGE="golang:1.22-bookworm"
+ARG BASEIMAGE="gcr.io/distroless/static-debian12:nonroot"
+
+FROM --platform=$BUILDPLATFORM $BUILDERIMAGE as builder


let's add it here instead of using an arg, and dependabot can bump it. please make sure its covered in dependabot config

sozercan · 2025-03-06T00:00:34Z

test/export/fake-reader/Dockerfile

+
+RUN go build -o main
+
+FROM $BASEIMAGE


sozercan · 2025-03-06T00:06:03Z

pkg/export/disk/disk.go

+		return fmt.Errorf("invalid data type, cannot convert data to exportMsg")
+	}
+
+	if violation.Message == "audit is started" {


can we use a const for these to avoid issues?

sozercan · 2025-03-06T00:06:26Z

pkg/export/disk/disk.go

+		return fmt.Errorf("error writing message to disk: %w", err)
+	}
+
+	if violation.Message == "audit is completed" {


pkg/export/disk/disk.go

sozercan · 2025-03-11T23:06:27Z

pkg/export/disk/disk.go

+		return fmt.Errorf("missing or invalid 'path' for connection: %s", connectionName)
+	}
+
+	if maxResults, ok := cfg["maxAuditResults"].(float64); ok {


const these?

sozercan · 2025-03-11T23:06:50Z

pkg/export/disk/disk.go

+	}
+
+	var cleanUpErr error
+	if path, ok := cfg["path"].(string); ok {


sozercan · 2025-03-11T23:27:39Z

website/docs/export.md

+2. Update `gatekeeper-audit` deployment to add `emptyDir` volume.
+
+    ```yaml
+    volumes:


do we want to add this to helm chart with conditional?

I found it to be more complecated to add a whole sidecar container and its config because unlike adding dapr annotation which adds a container with specification required for dapr sidecar to run. A sidecar reader for purposes beyond just reading and logging would require specific customizations. We can add it but the chart will get more complicated and I do not see the value since we might not be able to make it completly customizable.

Updated to add helm variables for volume, volumeMount and sidecar as well.

sozercan · 2025-03-11T23:28:30Z

website/docs/export.md

+
+    ```yaml
+    ...
+    - --enable-violation-export=true


same for these?

same as above comment.

sozercan · 2025-03-24T04:13:54Z

website/docs/export.md

+    You can use below command that uses a rule defined in [Makefile](https://github.com/open-policy-agent/gatekeeper/blob/master/Makefile) to deploy gatekeeper that mounts emptyDir with sidecar reader container.
+
+
+    make deploy IMG=gatekeeper-e2e:latest IMG=<gatekeeper_image> EXPORT_BACKEND=disk FAKE_READER_IMAGE=<your_reader_image>


i am confused, isn't this going to add the sidecar to audit automatically? instructions in the prereqs are saying to do this manually

Made it more clear a bit.

website/docs/export.md

sozercan · 2025-03-24T04:18:56Z

website/docs/export.md

+3. Create connection config to establish a connection.
+
+    ```shell
+    kubectl apply -f - <<EOF


this might be okay on the website, but copy pasting this have some formatting issues

yeah this is happening due to indentation. I tested copying from website and I am not seeing any formatting issues.

test/export/fake-reader/main.go

sozercan · 2025-03-24T04:26:27Z

website/docs/export.md

+
+    ```log
+    kubectl logs -l gatekeeper.sh/operation=audit -c go-sub -n gatekeeper-system 
+    2025/03/05 00:37:16 {"id":"2025-03-05T00:37:13Z","details":{"missing_labels":["test"]},"eventType":"violation_audited","group":"constraints.gatekeeper.sh","version":"v1beta1","kind":"K8sRequiredLabels","name":"pod-must-have-test","message":"you must provide labels: {\"test\"}","enforcementAction":"deny","resourceAPIVersion":"v1","resourceKind":"Pod","resourceNamespace":"nginx","resourceName":"nginx-deployment-2-79479fc6db-7qbnm","resourceLabels":{"app":"nginx-ingress","app.kubernetes.io/component":"controller","pod-template-hash":"79479fc6db"}}


I am seeing this \u003, not sure if this is something on my side

2025/03/24 04:25:27 {"id":"2025-03-24T04:24:27Z","details":{},"eventType":"violation_audited","group":"constraints.gatekeeper.sh","version":"v1beta1","kind":"K8sAllowedRepos","name":"repo-is-mcr","message":"container \u003ccoredns\u003e has an invalid image repo \u003cregistry.k8s.io/coredns/coredns:v1.11.3\u003e, allowed repos are [\"quay.io/\"]","enforcementAction":"dryrun","resourceAPIVersion":"v1","resourceKind":"Pod","resourceNamespace":"kube-system","resourceName":"coredns-668d6bf9bc-57xm9","resourceLabels":{"k8s-app":"kube-dns","pod-template-hash":"668d6bf9bc"}}

Hmm, I have not run into similar issues. How are you testing this?

using the instructions here on a kind cluster. might be on my side, unless @ritazh can repro too

pkg/export/disk/disk_test.go

sozercan · 2025-03-24T05:11:48Z

pkg/audit/manager.go

@@ -280,17 +259,28 @@ func (am *Manager) audit(ctx context.Context) error {
 	timestamp := startTime.UTC().Format(time.RFC3339)
 	am.log = log.WithValues(logging.AuditID, timestamp)
 	logStart(am.log)
+	exportErrorMap := make(map[string]error)
+	if err := am.exportSystem.Publish(context.Background(), *auditConnection, *auditChannel, exportutil.ExportMsg{Message: "audit is started", ID: timestamp}); err != nil {
+		exportErrorMap[err.Error()] = err


agreed, your suggestion make sense. if we want to avoid interface changes, another idea might be to extract error category by checking with regex or before : for example

test/export/fake-reader/main.go

sozercan

LGTM with a few more suggestions

sozercan · 2025-03-25T07:54:04Z

website/docs/export.md

+
+    ```yaml
+    audit: 
+    exportVolume: 


indent issue i think?

+1, fixed it.

sozercan · 2025-03-25T07:55:19Z

website/docs/export.md

+
+    ```log
+    kubectl logs -l gatekeeper.sh/operation=audit -c go-sub -n gatekeeper-system 
+    2025/03/05 00:37:16 {"id":"2025-03-05T00:37:13Z","details":{"missing_labels":["test"]},"eventType":"violation_audited","group":"constraints.gatekeeper.sh","version":"v1beta1","kind":"K8sRequiredLabels","name":"pod-must-have-test","message":"you must provide labels: {\"test\"}","enforcementAction":"deny","resourceAPIVersion":"v1","resourceKind":"Pod","resourceNamespace":"nginx","resourceName":"nginx-deployment-2-79479fc6db-7qbnm","resourceLabels":{"app":"nginx-ingress","app.kubernetes.io/component":"controller","pod-template-hash":"79479fc6db"}}


using the instructions here on a kind cluster. might be on my side, unless @ritazh can repro too

sozercan · 2025-03-25T07:58:02Z

pkg/export/disk/disk.go

+	if err != nil {
+		return fmt.Errorf("failed to acquire lock: %w", err)
+	}
+	log.Info("Writing latest violations at ")


is this missing something?

Fixed the log statement,

nreisch · 2025-03-25T16:01:45Z

pkg/export/disk/disk.go

+	dir := path.Join(conn.Path, topic)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return fmt.Errorf("failed to create directories: %w", err)
+	}
+
+	file, err := os.OpenFile(path.Join(dir, appendExtension(conn.currentAuditRun, "txt")), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
+	if err != nil {
+		return fmt.Errorf("failed to open file: %w", err)
+	}


Readers might want to truncate and remove files after processing, but this seems to only grant write if the sidecar container runs as the same user id of the main container. But sidecars might need to run as root or other users. How can we support if sidecar needs to run as root, should we handle this in the permissions?

Fixed the permissions issue by setting file and dir permissions to allow reader to modify the same if needed.

test/export/fake-reader/Dockerfile

ritazh · 2025-03-26T00:53:30Z

website/docs/export.md

+
+    ```shell
+    helm upgrade --install gatekeeper gatekeeper/gatekeeper --namespace gatekeeper-system \
+    ...


remove this ...

ritazh · 2025-03-26T01:50:31Z

website/docs/export.md

+
+#### Configure Gatekeeper with Export enabled to Disk
+
+1. Build `fake-reader` image from [gatekeeper/test/export/fake-reader](https://github.com/open-policy-agent/gatekeeper/tree/master/test/export/fake-reader)


instead of having users do this, can this image be published as one of the Gatekeeper images? built/released/tagged like other GK images.

To clarify, I'm suggesting to add this as part of the makefile and publish it to the registry so we can use it as a default value in the values.yaml. this is to ensure users have an easy way to test things. they can always replace with their own image.

Published fake-reader image on ghcr - https://github.com/open-policy-agent/gatekeeper/pkgs/container/fake-reader. This should improve experience trying out this feature with defaults for the first time.

ritazh · 2025-03-26T01:51:17Z

website/docs/export.md

+1. Build `fake-reader` image from [gatekeeper/test/export/fake-reader](https://github.com/open-policy-agent/gatekeeper/tree/master/test/export/fake-reader)
+
+    ```bash
+    docker buildx build -t <your_img_name:tag> --load -f test/export/fake-reader/Dockerfile test/export/fake-reader


this can be part of the makefile like docker-buildx-crds

ritazh · 2025-03-26T01:53:22Z

website/docs/export.md

+        <your-side-car>
+    ```
+
+    Here is the default `values.yaml` that you can use.


can this be deployed as part of the chart but conditional on a field in values.yaml? e.g. audit.enableExportToDisk

ritazh · 2025-03-26T01:54:19Z

website/docs/export.md

+    --values /path/to/values.yaml
+    ```
+
+4. Create connection config to establish a connection.


same, can this be part of the chart but conditionally install only if the feature is enabled.

Added this to helm charts.

website/docs/export.md

ritazh · 2025-03-26T20:36:28Z

pkg/audit/manager.go

@@ -905,7 +902,7 @@ func (am *Manager) addAuditResponsesToUpdateLists(
 		if *exportController.ExportEnabled {
 			err := am.exportSystem.Publish(context.Background(), *auditConnection, *auditChannel, violationMsg(constraint, ea, r.ScopedEnforcementActions, gvk, namespace, name, msg, details, labels, timestamp))
 			if err != nil {
-				am.log.Error(err, "error exporting audit violation")


this should still be logged in the audit pod log

This was removed to prevent flood of logs with the same error for each violation in favor of only logging unique errors - https://github.com/open-policy-agent/gatekeeper/pull/3832/files#diff-2a233457fc5c89cf0dd91c044d7582aa1cc0c835feabf4638882ac54ba3ca63aR286.

pkg/controller/export/export_config_controller.go

pkg/export/disk/disk.go

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

sozercan

lgtm

ritazh · 2025-04-24T01:10:26Z

.github/workflows/disk-export.yaml

+    timeout-minutes: 15
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4


please double check these GitHub action versions to ensure they are the latest

ritazh · 2025-04-24T01:31:13Z

manifest_staging/charts/gatekeeper/README.md

 | audit.connection                                           | (alpha) Connection name for exporting audit violation messages                                                                                                                                                                                                                                | `audit-connection`                                                                                                                                                    |
 | audit.channel                                              | (alpha) Channel name for exporting audit violation messages                                                                                                                                                                                                                                   | `audit-channel`                                                                                                                                                       |
+| audit.exportVolume                                         | (alpha) Volume for audit pod to export violations.                                                                                                                                                                                                                                   | `{"name":"tmp-violations","emptyDir":{}}`                                                                                                                                                       |
+| audit.exportVolumeMount.path                                         | (alpha) VolumeMount for audit pod manager container to export violations and sidecar container to read from.                                                                                                                                                                                                                                   | `/tmp/violations`                                                                                                                                                       |
+| audit.exportSidecar                                        | (alpha) Sidecar container to read violations from disk.                                                                                                                                                                                                                                   | `{"name":"reader","image":"ghcr.io/open-policy-agent/fake-reader:latest","imagePullPolicy":"Always","securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":1000,"seccompProfile":{"type":"RuntimeDefault"}},"volumeMounts":[{"mountPath":"/tmp/violations","name":"tmp-violations"}]}`                                                                                                                                                       |


where is the code that pushes ghcr.io/open-policy-agent/fake-reader

For now I have pushed them manually before building a CI for that.

As a follow up, please add this to CI. I can see maybe it could have CVEs in the future that we may need to patch.

+1 This should be added for all sample images as follow up.

ritazh · 2025-04-24T01:35:28Z

test/export/fake-reader/Dockerfile

@@ -0,0 +1,31 @@
+FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c AS builder


Please check this is the latest

ritazh · 2025-04-24T01:35:38Z

test/export/fake-reader/Dockerfile

+
+RUN go build -o main
+
+FROM gcr.io/distroless/static-debian12@sha256:8dd8d3ca2cf283383304fd45a5c9c74d5f2cd9da8d3b077d720e264880077c65


ritazh · 2025-04-24T01:39:27Z

website/docs/export.md

+1. Deploy Gatekeeper with disk export configurations.
+
+    ```shell
+    helm upgrade --install gatekeeper gatekeeper/gatekeeper --namespace gatekeeper-system \


should we move this step after user has updated their values yaml?

I am not sure, in quickstart steps user doesnt need to create values.yaml to try it out. So the yaml of variables in values is just a guide and not a requirement for users to try this. By that flow I think this is fine 🤔

We shouldnt encourage users to use the fake-reader container image in production. IMO we should move this up and then add a warning to replace fake-reader for any production use since its just for demo purpose. WDYT?

Oh yeah from that point of view moving it down makes sense. I am updating docs.

Updated docs to move up default values before installing Gk with added warning about production use.

ritazh · 2025-04-24T01:40:55Z

website/docs/export.md

+    --set audit.channel=audit-channel \
+    --set audit.exportConfig.maxAuditResults=3 \
+    --set exportBackend=disk \
+    --set audit.exportSidecar.image=ghcr.io/open-policy-agent/fake-reader:latest \


since this is the default value, should this be removed assuming users have updated their values.yaml or add a comment here to --set audit.exportSidecar.image to override the default?

+1, removed these values.

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

Copilot

Pull Request Overview

This PR introduces a new disk driver for exporting audit violations to disk and integrates it into the existing export system. Key changes include:

A new disk driver implementation (pkg/export/disk/disk.go) with connection, publishing, and file handling logic.
Integration of the disk driver into the supported drivers map and updates to export configuration and audit manager.
Updates to Helm charts and documentation to support configuration of the disk export backend.

Reviewed Changes

Copilot reviewed 20 out of 26 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/export/util/util.go	Added export message and error types used by both drivers and audit manager.
pkg/export/system.go	Included the disk driver into the SupportedDrivers map.
pkg/export/disk/disk.go	New implementation of the disk driver with file and connection management.
pkg/controller/export/export_config_controller.go	Updated to lower-case the driver value for consistency.
pkg/audit/manager.go	Propagated export error mapping and adjusted audit response handling.
manifest_staging/charts/gatekeeper/*.yaml and README.md	Updated configuration values and documentation for the disk export backend.
cmd/build/helmify/*	Adjusted templating to support the export disk configuration.
.github/workflows/*.yaml	Added CI jobs to run tests for the disk export functionality.
.github/dependabot.yml	Added updates for docker package ecosystems related to export testing.

Files not reviewed (6)

Makefile: Language not supported
cmd/build/helmify/static/templates/gatekeeper-audit-violation-export-config.yaml: Language not supported
cmd/build/helmify/static/values.yaml: Language not supported
test/bats/helpers.bash: Language not supported
test/bats/test.bats: Language not supported
test/export/fake-reader/Dockerfile: Language not supported

Comments suppressed due to low confidence (1)

pkg/export/disk/disk.go:160

There is a stray backtick in the error message format string; remove it to correctly format the error message.

if err := os.MkdirAll(dir, 0o777); err != nil { return fmt.Errorf("failed to create directories:` %w", err) }

ritazh · 2025-04-28T03:42:43Z

pkg/export/disk/disk.go

+
+	dir := path.Join(conn.Path, topic)
+	if err := os.MkdirAll(dir, 0o777); err != nil {
+		return fmt.Errorf("failed to create directories:` %w", err)


Remove ` before %w

pkg/audit/manager.go

ritazh · 2025-04-28T04:11:58Z

test/export/fake-subscriber/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.24-bookworm@sha256:fa1a01d362a7b9df68b021d59a124d28cae6d99ebd1a876e3557c4dd092f1b1d AS builder


this will prob get bumped by dependabot to use the latest and to avoid CVEs. hence my question that maybe we would need to publish these in the future like all other GK images.

+1. I will raise a PR as follow up.

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

ritazh

LGTM

JaydipGabani requested a review from a team as a code owner March 1, 2025 03:22

JaydipGabani commented Mar 2, 2025

View reviewed changes

JaydipGabani self-assigned this Mar 3, 2025

JaydipGabani changed the title ~~chore: adding driver to export to disk~~ feat: adding driver to export to disk Mar 5, 2025

sozercan requested a review from Copilot March 5, 2025 23:58

Copilot AI reviewed Mar 5, 2025

View reviewed changes

sozercan self-requested a review March 6, 2025 00:01

nreisch reviewed Mar 6, 2025

View reviewed changes

sozercan reviewed Mar 11, 2025

View reviewed changes

JaydipGabani force-pushed the disk-driver branch from c99e491 to 68a0110 Compare March 14, 2025 19:28

JaydipGabani requested review from sozercan and nreisch March 17, 2025 18:30

ritazh added this to the v3.19.0 milestone Mar 17, 2025

sozercan requested changes Mar 24, 2025

View reviewed changes

sozercan approved these changes Mar 25, 2025

View reviewed changes

nreisch reviewed Mar 25, 2025

View reviewed changes

ritazh reviewed Mar 26, 2025

View reviewed changes

pkg/controller/export/export_config_controller.go Show resolved Hide resolved

ritazh reviewed Mar 26, 2025

View reviewed changes

pkg/export/disk/disk.go Outdated Show resolved Hide resolved

ritazh reviewed Mar 26, 2025

View reviewed changes

pkg/export/disk/disk.go Show resolved Hide resolved

JaydipGabani modified the milestones: v3.19.0, v3.20.0 Mar 27, 2025

JaydipGabani added 3 commits April 2, 2025 17:09

adding driver to export to disk

a64a5f1

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

fixing lint

6178055

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

fixing disk export workflow name

eeac8e8

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

JaydipGabani added 2 commits April 3, 2025 01:02

fixing export test ci

2aae258

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

updating docs to use published fake-reader image

3041793

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

sozercan approved these changes Apr 5, 2025

View reviewed changes

JaydipGabani added 2 commits April 4, 2025 21:32

Merge branch 'master' into disk-driver

d367c32

Merge branch 'master' into disk-driver

02a6fc1

ritazh reviewed Apr 24, 2025

View reviewed changes

JaydipGabani added 2 commits April 25, 2025 16:37

Merge branch 'master' into disk-driver

6e58ee2

updating actions to latest versions, updating docs

19ffcd6

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

JaydipGabani requested review from ritazh, nreisch and Copilot April 25, 2025 23:58

Copilot AI reviewed Apr 25, 2025

View reviewed changes

ritazh reviewed Apr 28, 2025

View reviewed changes

pkg/audit/manager.go Show resolved Hide resolved

ritazh reviewed Apr 28, 2025

View reviewed changes

JaydipGabani mentioned this pull request Apr 28, 2025

Add CI to publish sample images in ghcr #3941

Open

addressing feedbacks

ad3c19d

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

JaydipGabani requested a review from ritazh April 28, 2025 21:04

JaydipGabani and others added 4 commits April 28, 2025 16:17

Merge branch 'master' into disk-driver

86059e9

updating docs

ab3d310

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

Merge branch 'master' into disk-driver

584c249

Merge branch 'master' into disk-driver

f5d9bdc

ritazh approved these changes May 6, 2025

View reviewed changes

JaydipGabani merged commit 5cb924f into open-policy-agent:master May 6, 2025
25 checks passed

JaydipGabani deleted the disk-driver branch May 6, 2025 20:25

	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

		You can use below command that uses a rule defined in [Makefile](https://github.com/open-policy-agent/gatekeeper/blob/master/Makefile) to deploy gatekeeper that mounts emptyDir with sidecar reader container.


		make deploy IMG=gatekeeper-e2e:latest IMG=<gatekeeper_image> EXPORT_BACKEND=disk FAKE_READER_IMAGE=<your_reader_image>


		#### Configure Gatekeeper with Export enabled to Disk

		1. Build `fake-reader` image from [gatekeeper/test/export/fake-reader](https://github.com/open-policy-agent/gatekeeper/tree/master/test/export/fake-reader)

		@@ -0,0 +1,31 @@
		FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c AS builder


		RUN go build -o main

		FROM gcr.io/distroless/static-debian12@sha256:8dd8d3ca2cf283383304fd45a5c9c74d5f2cd9da8d3b077d720e264880077c65

		@@ -1,4 +1,4 @@
		FROM --platform=$BUILDPLATFORM golang:1.24-bookworm@sha256:fa1a01d362a7b9df68b021d59a124d28cae6d99ebd1a876e3557c4dd092f1b1d AS builder

feat: adding driver to export to disk #3832

feat: adding driver to export to disk #3832

Conversation

JaydipGabani commented Mar 1, 2025

JaydipGabani commented Mar 1, 2025

codecov-commenter commented Mar 1, 2025 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

PR Overview

Reviewed Changes

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sozercan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nreisch Mar 25, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sozercan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

JaydipGabani May 5, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ritazh Apr 24, 2025 • edited Loading

Choose a reason for hiding this comment

JaydipGabani Apr 25, 2025 • edited Loading

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

codecov-commenter commented Mar 1, 2025 •

edited

Loading

nreisch Mar 25, 2025 •

edited

Loading

JaydipGabani May 5, 2025 •

edited

Loading

ritazh Apr 24, 2025 •

edited

Loading

JaydipGabani Apr 25, 2025 •

edited

Loading

JaydipGabani Apr 28, 2025 •

edited

Loading