Problem with creating a mutation for deployments about gatekeeper-library

[AleixoLucas42]

Hi @AleixoLucas42 - In addition to @maxsmythe change to versions: ["v1"], I believe groups: [""] -> groups: ["apps"]

Unlike Pod which is part of core [""], Deployment is part of ["apps"]: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#deployment-v1-apps

I can't belive! I swear i tried this before...... Thanks a lot, you guys saved me a lot of time creating a script to patch more than 800 deployments (:

I tried these two and worked:

apiVersion: mutations.gatekeeper.sh/v1
kind: Assign
metadata:
  name: gk-set-privileged-false-deployment
spec:
  applyTo:
  - groups: ["apps"]
    kinds: ["Deployment"]
    versions: ["v1"]
  match:
    scope: Namespaced
    kinds:
    - apiGroups: ["*"]
      kinds: ["Deployment"]
    namespaces: ["test"]
  location: "spec.template.spec.containers[name:*].securityContext.allowPrivilegeEscalation"
  parameters:
    pathTests:
    - subPath: "spec.template.spec.containers[name:*].securityContext.allowPrivilegeEscalation"
      condition: MustNotExist
    assign:
      value: false
---
apiVersion: mutations.gatekeeper.sh/v1
kind: Assign
metadata:
  name: gk-set-seccomp-profile-deployment
spec:
  applyTo:
  - groups: ["apps"]
    kinds: ["Deployment"]
    versions: ["v1"]
  match:
    scope: Namespaced
    kinds:
    - apiGroups: ["*"]
      kinds: ["Deployment"]
    namespaces: ["test"]
  location: "spec.template.spec.securityContext.seccompProfile"
  parameters:
    pathTests:
    - subPath: "spec.template.spec.securityContext.seccompProfile"
      condition: MustNotExist
    assign:
      value: 
        type: RuntimeDefault

[maxsmythe]

Does the replacement versions: ["apps/v1"] -> versions: ["v1"] fix things?

[AleixoLucas42]

Does the replacement versions: ["apps/v1"] -> versions: ["v1"] fix things?

Nope, I've probably tried this before, but I did rn and does not work anyways (I've tried so many things that for sure somebody will think i'm crazy lol)

[apeabody]

Hi @AleixoLucas42 - In addition to @maxsmythe change to versions: ["v1"], I believe groups: [""] -> groups: ["apps"]

Unlike Pod which is part of core [""], Deployment is part of ["apps"]: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#deployment-v1-apps