apiVersion: v1 items: - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:15:39Z" generateName: gatekeeper-audit-65579cd9f9- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper name: gatekeeper-audit-65579cd9f9-dnssq namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-audit-65579cd9f9 uid: 8f595dd8-baae-4f8e-8239-2068527a30fe resourceVersion: "639" uid: 6217f42d-d2b1-4dc2-93f4-03ea1e2dee90 spec: affinity: {} automountServiceAccountToken: true containers: - args: - --audit-interval=10 - --log-level=INFO - --constraint-violations-limit=20 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --audit-from-cache=false - --audit-chunk-size=500 - --audit-match-kind-only=false - --emit-audit-events=false - --audit-events-involved-namespace=false - --operation=audit - --operation=status - --operation=mutation-status - --logtostderr - --health-addr=:9090 - --prometheus-port=8888 - --enable-external-data=false - --enable-generator-resource-expansion=true - --metrics-backend=prometheus - --disable-cert-rotation=false - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /tmp/audit name: tmp-volume - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-xq7tn readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-81-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - emptyDir: {} name: tmp-volume - name: kube-api-access-xq7tn projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:42Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:42Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:42Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://8b2ba09b8e672ad233741efb1774b4ee2c2f7908ea7679fca027021d4abadaa3 image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:15:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.6 podIPs: - ip: 10.244.0.6 qosClass: Burstable startTime: "2026-06-09T14:15:39Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:15:39Z" generateName: gatekeeper-controller-manager-64bbbfbdbb- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb-5hqnl namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-controller-manager-64bbbfbdbb uid: ec639369-39dc-4cce-8353-f822f3cc257c resourceVersion: "671" uid: 395a5199-cb88-47b0-a95f-8131c643b79e spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-8f7lw readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-81-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - name: kube-api-access-8f7lw projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:43Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:44Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:44Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://07f2dabe39a74e4d4362993c29ab87effcfff1ec9d7f646674bd6e673eec36aa image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:15:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.8 podIPs: - ip: 10.244.0.8 qosClass: Burstable startTime: "2026-06-09T14:15:39Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:15:39Z" generateName: gatekeeper-controller-manager-64bbbfbdbb- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb-5mxdj namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-controller-manager-64bbbfbdbb uid: ec639369-39dc-4cce-8353-f822f3cc257c resourceVersion: "663" uid: 0ef8c4d5-9a6d-44f8-9832-d9bb03a65a2a spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-f9hp4 readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-81-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - name: kube-api-access-f9hp4 projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:43Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:43Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:43Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://b0fad564eb235c7fd3c2fc229a7526337360a585f8715794e5a7a2ca1c28cbcc image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:15:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.9 podIPs: - ip: 10.244.0.9 qosClass: Burstable startTime: "2026-06-09T14:15:39Z" - apiVersion: v1 kind: Pod metadata: creationTimestamp: "2026-06-09T14:15:39Z" generateName: gatekeeper-controller-manager-64bbbfbdbb- labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb-ztk6x namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: ReplicaSet name: gatekeeper-controller-manager-64bbbfbdbb uid: ec639369-39dc-4cce-8353-f822f3cc257c resourceVersion: "641" uid: a9b84136-2f98-4d17-ae42-f385c29c798c spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /var/run/secrets/kubernetes.io/serviceaccount name: kube-api-access-29fqz readOnly: true dnsPolicy: ClusterFirst enableServiceLinks: true nodeName: chart-test-swarm-run-81-control-plane nodeSelector: kubernetes.io/os: linux preemptionPolicy: PreemptLowerPriority priority: 2000000000 priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 tolerations: - effect: NoExecute key: node.kubernetes.io/not-ready operator: Exists tolerationSeconds: 300 - effect: NoExecute key: node.kubernetes.io/unreachable operator: Exists tolerationSeconds: 300 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - name: kube-api-access-29fqz projected: defaultMode: 420 sources: - serviceAccountToken: expirationSeconds: 3607 path: token - configMap: items: - key: ca.crt path: ca.crt name: kube-root-ca.crt - downwardAPI: items: - fieldRef: apiVersion: v1 fieldPath: metadata.namespace path: namespace status: conditions: - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:42Z" status: "True" type: PodReadyToStartContainers - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: Initialized - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:42Z" status: "True" type: Ready - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:42Z" status: "True" type: ContainersReady - lastProbeTime: null lastTransitionTime: "2026-06-09T14:15:39Z" status: "True" type: PodScheduled containerStatuses: - containerID: containerd://4b18ccff2447a6532b03bbabfb150924039d4ea6a22c68bd0ebe5006a6f53057 image: docker.io/openpolicyagent/gatekeeper:v3.17.1 imageID: docker.io/openpolicyagent/gatekeeper@sha256:b7b4d7cfdd52c877267dac0824977eaf289fd4640b9bd530e7fc742c6d6e5cc0 lastState: {} name: manager ready: true restartCount: 0 started: true state: running: startedAt: "2026-06-09T14:15:42Z" hostIP: 172.20.0.2 hostIPs: - ip: 172.20.0.2 phase: Running podIP: 10.244.0.7 podIPs: - ip: 10.244.0.7 qosClass: Burstable startTime: "2026-06-09T14:15:39Z" - apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:15:39Z" labels: app: gatekeeper app.kubernetes.io/managed-by: Helm chart: gatekeeper gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper name: gatekeeper-webhook-service namespace: gatekeeper-system resourceVersion: "570" uid: b716c6cf-a7fa-4159-b746-c51df95388ef spec: clusterIP: 10.96.98.120 clusterIPs: - 10.96.98.120 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: https-webhook-server port: 443 protocol: TCP targetPort: webhook-server selector: app: gatekeeper chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper sessionAffinity: None type: ClusterIP status: loadBalancer: {} - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:15:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/managed-by: Helm chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper name: gatekeeper-audit namespace: gatekeeper-system resourceVersion: "642" uid: 0fec0e88-3901-4416-8e1b-e8ed4188bb67 spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm release: gatekeeper spec: affinity: {} automountServiceAccountToken: true containers: - args: - --audit-interval=10 - --log-level=INFO - --constraint-violations-limit=20 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --audit-from-cache=false - --audit-chunk-size=500 - --audit-match-kind-only=false - --emit-audit-events=false - --audit-events-involved-namespace=false - --operation=audit - --operation=status - --operation=mutation-status - --logtostderr - --health-addr=:9090 - --prometheus-port=8888 - --enable-external-data=false - --enable-generator-resource-expansion=true - --metrics-backend=prometheus - --disable-cert-rotation=false - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /tmp/audit name: tmp-volume dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - emptyDir: {} name: tmp-volume status: availableReplicas: 1 conditions: - lastTransitionTime: "2026-06-09T14:15:42Z" lastUpdateTime: "2026-06-09T14:15:42Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:15:39Z" lastUpdateTime: "2026-06-09T14:15:42Z" message: ReplicaSet "gatekeeper-audit-65579cd9f9" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 1 replicas: 1 updatedReplicas: 1 - apiVersion: apps/v1 kind: Deployment metadata: annotations: deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:15:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/managed-by: Helm chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper name: gatekeeper-controller-manager namespace: gatekeeper-system resourceVersion: "676" uid: 679ddde2-6781-4288-8ab6-b0a16bf3b2a8 spec: progressDeadlineSeconds: 600 replicas: 3 revisionHistoryLimit: 10 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm release: gatekeeper strategy: rollingUpdate: maxSurge: 25% maxUnavailable: 25% type: RollingUpdate template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm release: gatekeeper spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert status: availableReplicas: 3 conditions: - lastTransitionTime: "2026-06-09T14:15:44Z" lastUpdateTime: "2026-06-09T14:15:44Z" message: Deployment has minimum availability. reason: MinimumReplicasAvailable status: "True" type: Available - lastTransitionTime: "2026-06-09T14:15:39Z" lastUpdateTime: "2026-06-09T14:15:44Z" message: ReplicaSet "gatekeeper-controller-manager-64bbbfbdbb" has successfully progressed. reason: NewReplicaSetAvailable status: "True" type: Progressing observedGeneration: 1 readyReplicas: 3 replicas: 3 updatedReplicas: 3 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "1" deployment.kubernetes.io/max-replicas: "2" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:15:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper name: gatekeeper-audit-65579cd9f9 namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: gatekeeper-audit uid: 0fec0e88-3901-4416-8e1b-e8ed4188bb67 resourceVersion: "640" uid: 8f595dd8-baae-4f8e-8239-2068527a30fe spec: replicas: 1 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: audit-controller gatekeeper.sh/operation: audit gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 65579cd9f9 release: gatekeeper spec: affinity: {} automountServiceAccountToken: true containers: - args: - --audit-interval=10 - --log-level=INFO - --constraint-violations-limit=20 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --audit-from-cache=false - --audit-chunk-size=500 - --audit-match-kind-only=false - --emit-audit-events=false - --audit-events-involved-namespace=false - --operation=audit - --operation=status - --operation=mutation-status - --logtostderr - --health-addr=:9090 - --prometheus-port=8888 - --enable-external-data=false - --enable-generator-resource-expansion=true - --metrics-backend=prometheus - --disable-cert-rotation=false - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true - mountPath: /tmp/audit name: tmp-volume dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert - emptyDir: {} name: tmp-volume status: availableReplicas: 1 fullyLabeledReplicas: 1 observedGeneration: 1 readyReplicas: 1 replicas: 1 - apiVersion: apps/v1 kind: ReplicaSet metadata: annotations: deployment.kubernetes.io/desired-replicas: "3" deployment.kubernetes.io/max-replicas: "4" deployment.kubernetes.io/revision: "1" meta.helm.sh/release-name: gatekeeper meta.helm.sh/release-namespace: gatekeeper-system creationTimestamp: "2026-06-09T14:15:39Z" generation: 1 labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper name: gatekeeper-controller-manager-64bbbfbdbb namespace: gatekeeper-system ownerReferences: - apiVersion: apps/v1 blockOwnerDeletion: true controller: true kind: Deployment name: gatekeeper-controller-manager uid: 679ddde2-6781-4288-8ab6-b0a16bf3b2a8 resourceVersion: "675" uid: ec639369-39dc-4cce-8353-f822f3cc257c spec: replicas: 3 selector: matchLabels: app: gatekeeper chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper template: metadata: creationTimestamp: null labels: app: gatekeeper app.kubernetes.io/instance: gatekeeper app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: gatekeeper app.kubernetes.io/version: 3.17.1 chart: gatekeeper control-plane: controller-manager gatekeeper.sh/operation: webhook gatekeeper.sh/system: "yes" helm.sh/chart: gatekeeper-3.17.1 heritage: Helm pod-template-hash: 64bbbfbdbb release: gatekeeper spec: affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - podAffinityTerm: labelSelector: matchExpressions: - key: gatekeeper.sh/operation operator: In values: - webhook topologyKey: kubernetes.io/hostname weight: 100 automountServiceAccountToken: true containers: - args: - --port=8443 - --health-addr=:9090 - --prometheus-port=8888 - --logtostderr - --log-denies=false - --emit-admission-events=false - --admission-events-involved-namespace=false - --log-level=INFO - --exempt-namespace=gatekeeper-system - --operation=webhook - --enable-external-data=false - --enable-generator-resource-expansion=true - --log-mutations=false - --mutation-annotations=false - --disable-cert-rotation=false - --max-serving-threads=-1 - --tls-min-version=1.3 - --validating-webhook-configuration-name=gatekeeper-validating-webhook-configuration - --mutating-webhook-configuration-name=gatekeeper-mutating-webhook-configuration - --external-data-provider-response-cache-ttl=3m - --enable-k8s-native-validation=true - --metrics-backend=prometheus - --operation=mutation-webhook - --disable-opa-builtin={http.send} command: - /manager env: - name: POD_NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name - name: NAMESPACE valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.namespace - name: CONTAINER_NAME value: manager - name: OTEL_RESOURCE_ATTRIBUTES value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME) image: openpolicyagent/gatekeeper:v3.17.1 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: /healthz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: manager ports: - containerPort: 8443 name: webhook-server protocol: TCP - containerPort: 8888 name: metrics protocol: TCP - containerPort: 9090 name: healthz protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: /readyz port: 9090 scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: limits: memory: 512Mi requests: cpu: 100m memory: 512Mi securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL readOnlyRootFilesystem: true runAsGroup: 999 runAsNonRoot: true runAsUser: 1000 seccompProfile: type: RuntimeDefault terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /certs name: cert readOnly: true dnsPolicy: ClusterFirst nodeSelector: kubernetes.io/os: linux priorityClassName: system-cluster-critical restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 999 supplementalGroups: - 999 serviceAccount: gatekeeper-admin serviceAccountName: gatekeeper-admin terminationGracePeriodSeconds: 60 volumes: - name: cert secret: defaultMode: 420 secretName: gatekeeper-webhook-server-cert status: availableReplicas: 3 fullyLabeledReplicas: 3 observedGeneration: 1 readyReplicas: 3 replicas: 3 kind: List metadata: resourceVersion: ""