search

rancher / rancher

Complete container management platform
http://rancher.com
Apache License 2.0
23.24k stars 2.95k forks source link

[OPA Gatekeeper] Edit of constraint fails if user takes more than audit time interval to edit it. #25816

Open khushboo-rancher opened 4 years ago

khushboo-rancher commented 4 years ago

What kind of request is this (question/bug/enhancement/feature request): Bug

Steps to reproduce (least amount of steps as possible):

  1. Enable OPA gatekeeper, by default audit time interval is 60 secs.
  2. Create a constraint using kubectl command or using v1 API.
  3. Edit a constraint and wait for at least 60 secs before hitting edit v1 API/kubectl apply.

Result: Saving of constraint fails with error Operation cannot be fulfilled on k8sallowedrepos.constraints.gatekeeper.sh \"constraint"\": the object has been modified; please apply your changes to the latest version and try again

prachidamle commented 4 years ago

This is an upstream issue https://github.com/open-policy-agent/gatekeeper/issues/502 We need to test when this gets released/ or against gatekeeper master. Also we can test by increasing the audit interval meanwhile.

deniseschannon commented 4 years ago

Looks like this is fixed in upstream and will be made available in the next gatekeeper release.

deniseschannon commented 4 years ago

@prachidamle are any of these fixed in the latest beta (beta8)?