apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:14:39Z" generateName: gatekeeper-audit-65579cd9f9- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper name: gatekeeper-audit-65579cd9f9-bjpft namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-audit-65579cd9f9 uid: a8a3e60f-c15f-4c5a-be00-14400fdb1052 resourceVersion: "682" uid: 1dd83fe0-15e9-42ce-a7e0-3c66bef7e325 spec: affinity: {} automountServiceAccountToken: true containers: - args: - --audit-interval=10 - --log-level=INFO - --constraint-violations-limit=20 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --audit-from-cache=false - --audit-chunk-size=500 - --audit-match-kind-only=false - --emit-audit-events=false - --audit-events-involved-namespace=false - --operation=audit - --operation=status - --operation=mutation-status - --logtostderr - --health-addr=:9090 - --prometheus-port=8888 - --enable-external-data=false - --enable-generator-resource-expansion=true - --metrics-backend=prometheus - --disable-cert-rotation=false - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /tmp/audit name: tmp-volume - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-m54h2 readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-80-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - emptyDir: {} name: tmp-volume - name: kube-api-access-m54h2 projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://4ecaea69cb14476310e3b0cb4d402b84fb594f2c707dc442cbcfef17378f90b5 image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:14:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.7 podIPs: - ip: 10.244.0.7 qosClass: Burstable startTime: "2026-06-09T14:14:39Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:14:39Z" generateName: gatekeeper-controller-manager-64bbbfbdbb- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb-68frj namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-controller-manager-64bbbfbdbb uid: 026929a0-00be-488f-914f-315f4cfaf90b resourceVersion: "695" uid: cfb21254-9ab6-445e-9812-42a9176ee76d spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-9v7rp readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-80-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - name: kube-api-access-9v7rp projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:43Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:43Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://57a8564bdb94a3de0521378dc5ec66848bef6f2ac2b32f58dd8769215dbe488b image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:14:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.9 podIPs: - ip: 10.244.0.9 qosClass: Burstable startTime: "2026-06-09T14:14:39Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:14:39Z" generateName: gatekeeper-controller-manager-64bbbfbdbb- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb-nn72s namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-controller-manager-64bbbfbdbb uid: 026929a0-00be-488f-914f-315f4cfaf90b resourceVersion: "685" uid: 72e0f00c-5072-4cf7-8abb-ce785d327e24 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-ph8mw readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-80-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - name: kube-api-access-ph8mw projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://740b7575bf9490e6c23c353513104cdbb32e96682252bc6c256b697fcfb95084 image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:14:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: Burstable startTime: "2026-06-09T14:14:39Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:14:39Z" generateName: gatekeeper-controller-manager-64bbbfbdbb- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb-wvggv namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-controller-manager-64bbbfbdbb uid: 026929a0-00be-488f-914f-315f4cfaf90b resourceVersion: "677" uid: 7b473506-8c66-4319-aec6-08fced49b846 spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-wtt8x readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-80-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - name: kube-api-access-wtt8x projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:42Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:14:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://4c1dd297d64b4dc58d92a66f8070ad1fd9b2a7db268eb0eda6ca19abe0650d45 image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:14:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.8 podIPs: - ip: 10.244.0.8 qosClass: Burstable startTime: "2026-06-09T14:14:39Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:14:39Z" labels: app: gatekeeper app.kubernetes.io/managed-by: Helm chart: gatekeeper gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper name: gatekeeper-webhook-service namespace: gatekeeper-system resourceVersion: "606" uid: 1e90ca57-e733-4bcf-8501-578bfa6f1328 spec: clusterIP: 10.96.177.25 clusterIPs: - 10.96.177.25 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: https-webhook-server port: 443 protocol: TCP targetPort: webhook-server selector: app: gatekeeper chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:14:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/managed-by: Helm chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper name: gatekeeper-audit namespace: gatekeeper-system resourceVersion: "686" uid: f6b41d50-8c8b-4c3f-971f-163df55af394 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm release: gatekeeper spec: affinity: {} automountServiceAccountToken: true containers: - args: - --audit-interval=10 - --log-level=INFO - --constraint-violations-limit=20 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --audit-from-cache=false - --audit-chunk-size=500 - --audit-match-kind-only=false - --emit-audit-events=false - --audit-events-involved-namespace=false - --operation=audit - --operation=status - --operation=mutation-status - --logtostderr - --health-addr=:9090 - --prometheus-port=8888 - --enable-external-data=false - --enable-generator-resource-expansion=true - --metrics-backend=prometheus - --disable-cert-rotation=false - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /tmp/audit name: tmp-volume dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - emptyDir: {} name: tmp-volume status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:14:42Z" lastUpdateTime: "2026-06-09T14:14:42Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:14:39Z" lastUpdateTime: "2026-06-09T14:14:42Z" message: ReplicaSet "gatekeeper-audit-65579cd9f9" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:14:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/managed-by: Helm chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper name: gatekeeper-controller-manager namespace: gatekeeper-system resourceVersion: "700" uid: 2f54affb-2f73-41cc-8a0f-85ca5a075deb spec: progressDeadlineSeconds: 600 replicas: 3 revisionHistoryLimit: 10 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm release: gatekeeper spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert status: availableReplicas: 3 conditions: - lastTransitionTime: "2026-06-09T14:14:43Z" lastUpdateTime: "2026-06-09T14:14:43Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:14:39Z" lastUpdateTime: "2026-06-09T14:14:43Z" message: ReplicaSet "gatekeeper-controller-manager-64bbbfbdbb" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 3 replicas: 3 updatedReplicas: 3 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:14:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper name: gatekeeper-audit-65579cd9f9 namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: gatekeeper-audit uid: f6b41d50-8c8b-4c3f-971f-163df55af394 resourceVersion: "684" uid: a8a3e60f-c15f-4c5a-be00-14400fdb1052 spec: replicas: 1 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper spec: affinity: {} automountServiceAccountToken: true containers: - args: - --audit-interval=10 - --log-level=INFO - --constraint-violations-limit=20 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --audit-from-cache=false - --audit-chunk-size=500 - --audit-match-kind-only=false - --emit-audit-events=false - --audit-events-involved-namespace=false - --operation=audit - --operation=status - --operation=mutation-status - --logtostderr - --health-addr=:9090 - --prometheus-port=8888 - --enable-external-data=false - --enable-generator-resource-expansion=true - --metrics-backend=prometheus - --disable-cert-rotation=false - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /tmp/audit name: tmp-volume dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - emptyDir: {} name: tmp-volume status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "3" deployment.kubernetes.io/max-replicas: "4" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:14:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: gatekeeper-controller-manager uid: 2f54affb-2f73-41cc-8a0f-85ca5a075deb resourceVersion: "699" uid: 026929a0-00be-488f-914f-315f4cfaf90b spec: replicas: 3 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert status: availableReplicas: 3 fullyLabeledReplicas: 3 observedGeneration: 1 readyReplicas: 3 replicas: 3 kind: List metadata: resourceVersion: ""