Allow image builder from prod repo

[dekiel]

Description

Changes proposed in this pull request:

• Added image-builder and buildkit-image-builder images from production reqistry to the list of trusted images accessing sa-kyma-push-images secret.

[kyma-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[kyma-bot]

Keywords which can automatically close issues and at(@) or hashtag(#) mentions are not allowed in commit messages.

The list of commits with invalid commit messages:

• 9973d73 gomod(deps): bump google.golang.org/api from 0.152.0 to 0.153.0 (gomod(deps): bump google.golang.org/api from 0.152.0 to 0.153.0 #9474)
• bc2bed7 actions(deps): bump actions/setup-go from 4 to 5 (actions(deps): bump actions/setup-go from 4 to 5 #9476)
• bc92b09 docker-rotate-sa(deps): bump golang (docker-rotate-sa(deps): bump golang from 1.21.4-alpine3.17 to 1.21.5-alpine3.17 in /cmd/cloud-run/rotate-service-account #9477)
• 66405ff move-gcs-bucket(deps): bump golang in /cmd/cloud-run/move-gcs-bucket (move-gcs-bucket(deps): bump golang from 1.21.4-alpine3.17 to 1.21.5-alpine3.17 in /cmd/cloud-run/move-gcs-bucket #9480)
• 89b8b0b gomod(deps): bump github.com/spf13/viper from 1.17.0 to 1.18.0 (gomod(deps): bump github.com/spf13/viper from 1.17.0 to 1.18.0 #9475)
• 94693f9 ginkgo(deps): bump golang in /prow/images/ginkgo (ginkgo(deps): bump golang from 1.21.4-alpine3.17 to 1.21.5-alpine3.17 in /prow/images/ginkgo #9478)
• d2d58e9 docker-rotate-sa(deps): bump alpine (docker-rotate-sa(deps): bump alpine from 3.18.5 to 3.19.0 in /cmd/cloud-run/rotate-service-account #9500)
• 1154d0f gomod(deps): bump github.com/spf13/viper from 1.18.0 to 1.18.1 (gomod(deps): bump github.com/spf13/viper from 1.18.0 to 1.18.1 #9501)
• 114206b move-gcs-bucket(deps): bump alpine in /cmd/cloud-run/move-gcs-bucket (move-gcs-bucket(deps): bump alpine from 3.18.5 to 3.19.0 in /cmd/cloud-run/move-gcs-bucket #9502)
• 3779f97 slack-msg-sender(deps): bump python (slack-msg-sender(deps): bump python from 3.12.0-alpine3.18 to 3.12.1-alpine3.18 in /cmd/cloud-run/slack-message-sender #9513)
• ff9c38b tf(deps): bump hashicorp/google in /configs/terraform/core (tf(deps): bump hashicorp/google from 5.8.0 to 5.9.0 in /configs/terraform/core #9512)
• 5811e4f gomod(deps): bump github.com/spf13/viper from 1.18.1 to 1.18.2 (gomod(deps): bump github.com/spf13/viper from 1.18.1 to 1.18.2 #9546)
• 1563ad7 gomod(deps): bump google.golang.org/api from 0.153.0 to 0.154.0 (gomod(deps): bump google.golang.org/api from 0.153.0 to 0.154.0 #9522)
• 0fdc511 gomod(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 (gomod(deps): bump github.com/google/uuid from 1.4.0 to 1.5.0 #9523)
• 42cf428 gomod(deps): bump cloud.google.com/go/logging from 1.8.1 to 1.9.0 (gomod(deps): bump cloud.google.com/go/logging from 1.8.1 to 1.9.0 #9527)
• 53ccbb8 gomod(deps): bump cloud.google.com/go/storage from 1.35.1 to 1.36.0 (gomod(deps): bump cloud.google.com/go/storage from 1.35.1 to 1.36.0 #9528)
• 4f1f2ed gomod(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 (gomod(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 #9547)
• 0266076 tf(deps): bump hashicorp/google in /configs/terraform/core (tf(deps): bump hashicorp/google from 5.9.0 to 5.10.0 in /configs/terraform/core #9561)
• 9be28ee Build image-builder in ado. (Build image-builder in ado. #9538)
• 6944b40 Build buildkit version of image-builder in ado (Build buildkit version of image-builder in ado #9581)
• e1317db tf(deps): bump hashicorp/google in /configs/terraform/core (tf(deps): bump hashicorp/google from 5.10.0 to 5.11.0 in /configs/terraform/core #9620)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[github-actions]

Plan Result

CI link

⚠️ Resource Deletion will happen ⚠️

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 2 to add, 2 to change, 2 to destroy.

• Create
  • module.trusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: sa-kyma-push-images\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-sa-kyma-push-images\n - sa-kyma-push-images\n trustedImages:\n - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n - image: "europe-docker.pkg.dev/kyma-project/prod/buildkit-image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.}$'\n #serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*"\n command: [ ]\n args: [ ]"]
  • module.untrusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: sa-kyma-push-images\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-sa-kyma-push-images\n - sa-kyma-push-images\n trustedImages:\n - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n - image: "europe-docker.pkg.dev/kyma-project/prod/buildkit-image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.}$'\n #serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*"\n command: [ ]\n args: [ ]"]
• Update
  • module.artifact_registry["modules-internal"].google_artifact_registry_repository.artifact_registry
  • module.service_account_keys_cleaner.google_cloud_scheduler_job.service_account_keys_cleaner
• Delete
  • module.trusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: sa-kyma-push-images\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-sa-kyma-push-images\n - sa-kyma-push-images\n trustedImages:\n - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.}$'\n #serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*"\n command: [ ]\n args: [ ]"]
  • module.untrusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: sa-kyma-push-images\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-sa-kyma-push-images\n - sa-kyma-push-images\n trustedImages:\n - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\[."\/image-builder".,"--config=/config/kaniko-build-config.yaml".\],"container_name":"test",.}$'\n #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.}$'\n #serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: [ ]\n entrypoint_options: '^{."args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*"\n command: [ ]\n args: [ ]"]

Change Result (Click me)

  # module.artifact_registry["modules-internal"].google_artifact_registry_repository.artifact_registry will be updated in-place
  ~ resource "google_artifact_registry_repository" "artifact_registry" {
        id               = "projects/kyma-project/locations/europe/repositories/modules-internal"
        name             = "modules-internal"
        # (11 unchanged attributes hidden)

      + docker_config {
          + immutable_tags = false
        }
    }

  # module.service_account_keys_cleaner.google_cloud_scheduler_job.service_account_keys_cleaner will be updated in-place
  ~ resource "google_cloud_scheduler_job" "service_account_keys_cleaner" {
        id               = "projects/sap-kyma-prow/locations/europe-west3/jobs/service-account-keys-cleaner"
        name             = "service-account-keys-cleaner"
        # (8 unchanged attributes hidden)

      ~ http_target {
          ~ uri         = "https://service-account-keys-cleaner-q25ja7ch3q-ez.a.run.app/?project=sap-kyma-prow&age=24" -> "https://service-account-keys-cleaner-q25ja7ch3q-ez.a.run.app?project=sap-kyma-prow&age=24"
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }
    }

  # module.trusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: sa-kyma-push-images\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-sa-kyma-push-images\n      - sa-kyma-push-images\n    trustedImages:\n      - image: \"eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n        #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"\\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev\"\\],\"container_name\":\"test\",.*}$'\n        #serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"make\",\"-C\",\"components/operator/hack/ci\",\"module-build\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: [ ]\n        args: [ ]"] will be destroyed
  # (because key ["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: sa-kyma-push-images\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-sa-kyma-push-images\n      - sa-kyma-push-images\n    trustedImages:\n      - image: \"eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n        #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"\\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev\"\\],\"container_name\":\"test\",.*}$'\n        #serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"make\",\"-C\",\"components/operator/hack/ci\",\"module-build\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: [ ]\n        args: [ ]"] is not in for_each map)
  - resource "kubectl_manifest" "constraints" {
      - api_version             = "constraints.gatekeeper.sh/v1beta1" -> null
      - apply_only              = false -> null
      - field_manager           = "kubectl" -> null
      - force_conflicts         = false -> null
      - force_new               = false -> null
      - id                      = "/apis/constraints.gatekeeper.sh/v1beta1/secrettrustedusages/sa-kyma-push-images" -> null
      - kind                    = "SecretTrustedUsage" -> null
      - live_manifest_incluster = (sensitive value) -> null
      - live_uid                = "4bc764f8-32c4-4824-b45d-3ec03b8dc627" -> null
      - name                    = "sa-kyma-push-images" -> null
      - server_side_apply       = false -> null
      - uid                     = "4bc764f8-32c4-4824-b45d-3ec03b8dc627" -> null
      - validate_schema         = true -> null
      - wait_for_rollout        = true -> null
      - yaml_body               = (sensitive value) -> null
      - yaml_body_parsed        = <<-EOT
            apiVersion: constraints.gatekeeper.sh/v1beta1
            kind: SecretTrustedUsage
            metadata:
              name: sa-kyma-push-images
            spec:
              enforcementAction: deny
              match:
                kinds:
                - apiGroups:
                  - ""
                  kinds:
                  - Pod
                namespaces:
                - default
              parameters:
                restrictedSecrets:
                - sa-kyma-push-images
                trustedImages:
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
                - args: []
                  command: []
                  image: europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*
        EOT -> null
      - yaml_incluster          = (sensitive value) -> null
    }

  # module.trusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: sa-kyma-push-images\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-sa-kyma-push-images\n      - sa-kyma-push-images\n    trustedImages:\n      - image: \"eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/buildkit-image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n        #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"\\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev\"\\],\"container_name\":\"test\",.*}$'\n        #serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"make\",\"-C\",\"components/operator/hack/ci\",\"module-build\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: [ ]\n        args: [ ]"] will be created
  + resource "kubectl_manifest" "constraints" {
      + api_version             = "constraints.gatekeeper.sh/v1beta1"
      + apply_only              = false
      + field_manager           = "kubectl"
      + force_conflicts         = false
      + force_new               = false
      + id                      = (known after apply)
      + kind                    = "SecretTrustedUsage"
      + live_manifest_incluster = (sensitive value)
      + live_uid                = (known after apply)
      + name                    = "sa-kyma-push-images"
      + namespace               = (known after apply)
      + server_side_apply       = false
      + uid                     = (known after apply)
      + validate_schema         = true
      + wait_for_rollout        = true
      + yaml_body               = (sensitive value)
      + yaml_body_parsed        = <<-EOT
            apiVersion: constraints.gatekeeper.sh/v1beta1
            kind: SecretTrustedUsage
            metadata:
              name: sa-kyma-push-images
            spec:
              enforcementAction: deny
              match:
                kinds:
                - apiGroups:
                  - ""
                  kinds:
                  - Pod
                namespaces:
                - default
              parameters:
                restrictedSecrets:
                - sa-kyma-push-images
                trustedImages:
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/buildkit-image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
                - args: []
                  command: []
                  image: europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*
        EOT
      + yaml_incluster          = (sensitive value)
    }

  # module.untrusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: sa-kyma-push-images\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-sa-kyma-push-images\n      - sa-kyma-push-images\n    trustedImages:\n      - image: \"eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n        #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"\\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev\"\\],\"container_name\":\"test\",.*}$'\n        #serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"make\",\"-C\",\"components/operator/hack/ci\",\"module-build\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: [ ]\n        args: [ ]"] will be destroyed
  # (because key ["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: sa-kyma-push-images\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-sa-kyma-push-images\n      - sa-kyma-push-images\n    trustedImages:\n      - image: \"eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n        #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"\\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev\"\\],\"container_name\":\"test\",.*}$'\n        #serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"make\",\"-C\",\"components/operator/hack/ci\",\"module-build\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: [ ]\n        args: [ ]"] is not in for_each map)
  - resource "kubectl_manifest" "constraints" {
      - api_version             = "constraints.gatekeeper.sh/v1beta1" -> null
      - apply_only              = false -> null
      - field_manager           = "kubectl" -> null
      - force_conflicts         = false -> null
      - force_new               = false -> null
      - id                      = "/apis/constraints.gatekeeper.sh/v1beta1/secrettrustedusages/sa-kyma-push-images" -> null
      - kind                    = "SecretTrustedUsage" -> null
      - live_manifest_incluster = (sensitive value) -> null
      - live_uid                = "b4542658-10d8-4388-b9b1-a7da99beaabd" -> null
      - name                    = "sa-kyma-push-images" -> null
      - server_side_apply       = false -> null
      - uid                     = "b4542658-10d8-4388-b9b1-a7da99beaabd" -> null
      - validate_schema         = true -> null
      - wait_for_rollout        = true -> null
      - yaml_body               = (sensitive value) -> null
      - yaml_body_parsed        = <<-EOT
            apiVersion: constraints.gatekeeper.sh/v1beta1
            kind: SecretTrustedUsage
            metadata:
              name: sa-kyma-push-images
            spec:
              enforcementAction: deny
              match:
                kinds:
                - apiGroups:
                  - ""
                  kinds:
                  - Pod
                namespaces:
                - default
              parameters:
                restrictedSecrets:
                - sa-kyma-push-images
                trustedImages:
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
                - args: []
                  command: []
                  image: europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*
        EOT -> null
      - yaml_incluster          = (sensitive value) -> null
    }

  # module.untrusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only trusted usage of sa-kyma-push-images gcp service account which has permissions to write images in kyma production oci registry.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: sa-kyma-push-images\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-sa-kyma-push-images\n      - sa-kyma-push-images\n    trustedImages:\n      - image: \"eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/buildkit-image-builder:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[.*\"\\/image-builder\".*,\"--config=/config/kaniko-build-config.yaml\".*\\],\"container_name\":\"test\",.*}$'\n        #kyma-dashboard-dev, kyma-dashboard-stage, kyma-dashboard-prod and post-k8s-prow-build-release\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"\\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev\"\\],\"container_name\":\"test\",.*}$'\n        #serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: [ ]\n        entrypoint_options: '^{.*\"args\":\\[\"make\",\"-C\",\"components/operator/hack/ci\",\"module-build\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: [ ]\n        args: [ ]"] will be created
  + resource "kubectl_manifest" "constraints" {
      + api_version             = "constraints.gatekeeper.sh/v1beta1"
      + apply_only              = false
      + field_manager           = "kubectl"
      + force_conflicts         = false
      + force_new               = false
      + id                      = (known after apply)
      + kind                    = "SecretTrustedUsage"
      + live_manifest_incluster = (sensitive value)
      + live_uid                = (known after apply)
      + name                    = "sa-kyma-push-images"
      + namespace               = (known after apply)
      + server_side_apply       = false
      + uid                     = (known after apply)
      + validate_schema         = true
      + wait_for_rollout        = true
      + yaml_body               = (sensitive value)
      + yaml_body_parsed        = <<-EOT
            apiVersion: constraints.gatekeeper.sh/v1beta1
            kind: SecretTrustedUsage
            metadata:
              name: sa-kyma-push-images
            spec:
              enforcementAction: deny
              match:
                kinds:
                - apiGroups:
                  - ""
                  kinds:
                  - Pod
                namespaces:
                - default
              parameters:
                restrictedSecrets:
                - sa-kyma-push-images
                trustedImages:
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\[.*"\/image-builder".*,"--config=/config/kaniko-build-config.yaml".*\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/buildkit-image-builder:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\/docker-credential-gcr configure-docker --registries=europe-docker.pkg.dev"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-k3d:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["make","-C","components/operator/hack/ci","module-build"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
                - args: []
                  command: []
                  image: europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*
        EOT
      + yaml_incluster          = (sensitive value)
    }

Plan: 2 to add, 2 to change, 2 to destroy.

Changes to Outputs:
  ~ artifact_registry                                   = {
      ~ modules-internal = {
          ~ artifact_registry_collection = {
                id                        = "projects/kyma-project/locations/europe/repositories/modules-internal"
                name                      = "modules-internal"
              ~ update_time               = "2024-01-12T14:20:44.646313Z" -> "2024-01-12T15:40:11.731385Z"
                # (16 unchanged attributes hidden)
            }
        }
    }

ℹ️ Objects have changed outside of Terraform

This feature was introduced from Terraform v0.15.4.

OpenTofu detected the following changes made outside of OpenTofu since the
last "tofu apply" which may have affected this plan:

  # module.artifact_registry["modules-internal"].google_artifact_registry_repository.artifact_registry has changed
  ~ resource "google_artifact_registry_repository" "artifact_registry" {
        id               = "projects/kyma-project/locations/europe/repositories/modules-internal"
        name             = "modules-internal"
      ~ update_time      = "2024-01-12T14:31:12.309573Z" -> "2024-01-12T15:40:11.731385Z"
        # (10 unchanged attributes hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the