gatekeeper
gatekeeper copied to clipboard
feat: add support for emit k8s events for allowed requests
What this PR does / why we need it:
[ v ] Emit K8s events in gatekeeper namespace (or involved namespace if corresponding flag is on).
[ v ] Update helm flag name of emitAdmissionEvents
to emitDenyAdmissionEvents
[ v ] Update e2e to get events with the AllowedAdmission
reason
[ v ] Update deployment yaml and chart default emit-allow-admission-events
and emit-deny-admission-events
to false
[ v ] Update Makefile to enable emit-allow-admission-events
and updated emit-admission-events
to emit-deny-admission-events
[ v ] Update docs with a new AllowedAdmission
reason
Which issue this PR fixes: This is functionality I want as someone deploying GK with Helm. This helps me monitor the admissions and validate my policies in a similar manner to how OPA decision-logs work.
Special notes for your reviewer:
The idea for the PR derived from https://github.com/open-policy-agent/gatekeeper/pull/739 and plenty of issues asking about decision logs (such as #1037 )
Sample event outputs for reason AllowedAdmission
kubectl get event -n gatekeeper-system
LAST SEEN TYPE REASON OBJECT MESSAGE
7m41s Normal AllowedAdmission pod/privileged-nginx Admission webhook "validation.gatekeeper.sh" allowed request, Resource Namespace: default