2019-11-18 19:41:37 +00:00
|
|
|
/*
|
|
|
|
Cleans up stale webhookconfigurations created by kyverno that were not cleanedup
|
|
|
|
*/
|
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
2021-10-06 18:25:38 +00:00
|
|
|
"context"
|
2019-11-18 19:41:37 +00:00
|
|
|
"flag"
|
2022-01-11 08:47:24 +00:00
|
|
|
"fmt"
|
2019-11-18 19:41:37 +00:00
|
|
|
"os"
|
|
|
|
"sync"
|
2019-12-16 20:55:44 +00:00
|
|
|
"time"
|
2019-11-18 19:41:37 +00:00
|
|
|
|
2021-10-06 18:25:38 +00:00
|
|
|
"github.com/kyverno/kyverno/pkg/config"
|
2020-10-07 18:12:31 +00:00
|
|
|
client "github.com/kyverno/kyverno/pkg/dclient"
|
2021-10-06 23:12:07 +00:00
|
|
|
"github.com/kyverno/kyverno/pkg/leaderelection"
|
2021-12-17 05:03:52 +00:00
|
|
|
"github.com/kyverno/kyverno/pkg/policyreport"
|
2020-10-07 18:12:31 +00:00
|
|
|
"github.com/kyverno/kyverno/pkg/signal"
|
2022-01-11 08:47:24 +00:00
|
|
|
"github.com/kyverno/kyverno/pkg/tls"
|
2020-10-07 18:12:31 +00:00
|
|
|
"github.com/kyverno/kyverno/pkg/utils"
|
2021-10-06 23:12:07 +00:00
|
|
|
coord "k8s.io/api/coordination/v1"
|
2019-11-18 19:41:37 +00:00
|
|
|
"k8s.io/apimachinery/pkg/api/errors"
|
2022-04-26 20:18:14 +00:00
|
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
2021-12-17 05:03:52 +00:00
|
|
|
"k8s.io/apimachinery/pkg/labels"
|
2021-02-08 04:26:56 +00:00
|
|
|
"k8s.io/klog/v2"
|
|
|
|
"k8s.io/klog/v2/klogr"
|
2020-03-17 23:25:34 +00:00
|
|
|
"sigs.k8s.io/controller-runtime/pkg/log"
|
2019-11-18 19:41:37 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
2021-12-08 13:03:07 +00:00
|
|
|
kubeconfig string
|
|
|
|
setupLog = log.Log.WithName("setup")
|
|
|
|
clientRateLimitQPS float64
|
|
|
|
clientRateLimitBurst int
|
2021-12-17 05:03:52 +00:00
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
updateLabelSelector = &metav1.LabelSelector{
|
|
|
|
MatchExpressions: []metav1.LabelSelectorRequirement{
|
2021-12-17 05:03:52 +00:00
|
|
|
{
|
|
|
|
Key: policyreport.LabelSelectorKey,
|
2022-04-26 20:18:14 +00:00
|
|
|
Operator: metav1.LabelSelectorOpDoesNotExist,
|
2021-12-17 05:03:52 +00:00
|
|
|
Values: []string{},
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
2019-11-18 19:41:37 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
2020-12-04 03:19:36 +00:00
|
|
|
policyReportKind string = "PolicyReport"
|
|
|
|
clusterPolicyReportKind string = "ClusterPolicyReport"
|
|
|
|
reportChangeRequestKind string = "ReportChangeRequest"
|
|
|
|
clusterReportChangeRequestKind string = "ClusterReportChangeRequest"
|
|
|
|
policyViolation string = "PolicyViolation"
|
|
|
|
clusterPolicyViolation string = "ClusterPolicyViolation"
|
2019-11-18 19:41:37 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func main() {
|
2020-03-17 23:25:34 +00:00
|
|
|
klog.InitFlags(nil)
|
|
|
|
log.SetLogger(klogr.New())
|
|
|
|
// arguments
|
|
|
|
flag.StringVar(&kubeconfig, "kubeconfig", "", "Path to a kubeconfig. Only required if out-of-cluster.")
|
2021-12-08 13:03:07 +00:00
|
|
|
flag.Float64Var(&clientRateLimitQPS, "clientRateLimitQPS", 0, "Configure the maximum QPS to the master from Kyverno. Uses the client default if zero.")
|
|
|
|
flag.IntVar(&clientRateLimitBurst, "clientRateLimitBurst", 0, "Configure the maximum burst for throttle. Uses the client default if zero.")
|
2020-03-17 23:25:34 +00:00
|
|
|
if err := flag.Set("v", "2"); err != nil {
|
|
|
|
klog.Fatalf("failed to set log level: %v", err)
|
|
|
|
}
|
2021-01-24 19:34:02 +00:00
|
|
|
|
2020-03-17 23:25:34 +00:00
|
|
|
flag.Parse()
|
|
|
|
|
2019-11-18 19:41:37 +00:00
|
|
|
// os signal handler
|
|
|
|
stopCh := signal.SetupSignalHandler()
|
|
|
|
// create client config
|
2022-04-26 19:55:24 +00:00
|
|
|
clientConfig, err := config.CreateClientConfig(kubeconfig, clientRateLimitQPS, clientRateLimitBurst)
|
2019-11-18 19:41:37 +00:00
|
|
|
if err != nil {
|
2020-03-17 18:05:20 +00:00
|
|
|
setupLog.Error(err, "Failed to build kubeconfig")
|
|
|
|
os.Exit(1)
|
2019-11-18 19:41:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// DYNAMIC CLIENT
|
|
|
|
// - client for all registered resources
|
2020-05-28 02:51:34 +00:00
|
|
|
client, err := client.NewClient(clientConfig, 15*time.Minute, stopCh, log.Log)
|
2019-11-18 19:41:37 +00:00
|
|
|
if err != nil {
|
2020-03-17 18:05:20 +00:00
|
|
|
setupLog.Error(err, "Failed to create client")
|
|
|
|
os.Exit(1)
|
2019-11-18 19:41:37 +00:00
|
|
|
}
|
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
kubeClient, err := utils.NewKubeClient(clientConfig)
|
|
|
|
if err != nil {
|
|
|
|
setupLog.Error(err, "Failed to create kubernetes client")
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
|
|
|
|
2020-02-15 02:12:28 +00:00
|
|
|
// Exit for unsupported version of kubernetes cluster
|
2022-04-26 20:18:14 +00:00
|
|
|
if !utils.HigherThanKubernetesVersion(kubeClient.Discovery(), log.Log, 1, 16, 0) {
|
2020-05-19 00:00:52 +00:00
|
|
|
os.Exit(1)
|
|
|
|
}
|
2020-02-15 02:12:28 +00:00
|
|
|
|
2019-11-18 19:41:37 +00:00
|
|
|
requests := []request{
|
2020-11-09 19:26:12 +00:00
|
|
|
{policyReportKind, ""},
|
|
|
|
{clusterPolicyReportKind, ""},
|
2020-12-04 03:19:36 +00:00
|
|
|
|
|
|
|
{reportChangeRequestKind, ""},
|
|
|
|
{clusterReportChangeRequestKind, ""},
|
|
|
|
|
|
|
|
// clean up policy violation CRD
|
2020-11-09 19:26:12 +00:00
|
|
|
{policyViolation, ""},
|
|
|
|
{clusterPolicyViolation, ""},
|
2019-11-18 19:41:37 +00:00
|
|
|
}
|
|
|
|
|
2021-10-06 23:12:07 +00:00
|
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
|
|
|
|
|
|
go func() {
|
|
|
|
<-stopCh
|
|
|
|
cancel()
|
|
|
|
}()
|
|
|
|
|
2021-12-17 05:03:52 +00:00
|
|
|
addPolicyReportSelectorLabel(client)
|
|
|
|
addClusterPolicyReportSelectorLabel(client)
|
|
|
|
|
2019-11-18 19:41:37 +00:00
|
|
|
done := make(chan struct{})
|
|
|
|
defer close(done)
|
|
|
|
failure := false
|
2021-10-06 23:12:07 +00:00
|
|
|
|
|
|
|
run := func() {
|
2022-01-11 08:47:24 +00:00
|
|
|
certProps, err := tls.GetTLSCertProps(clientConfig)
|
|
|
|
if err != nil {
|
|
|
|
log.Log.Info("failed to get cert properties: %v", err.Error())
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
depl, err := kubeClient.AppsV1().Deployments(config.KyvernoNamespace).Get(context.TODO(), config.KyvernoDeploymentName, metav1.GetOptions{})
|
2022-01-11 08:47:24 +00:00
|
|
|
deplHash := ""
|
|
|
|
if err != nil {
|
|
|
|
log.Log.Info("failed to fetch deployment '%v': %v", config.KyvernoDeploymentName, err.Error())
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
|
|
|
deplHash = fmt.Sprintf("%v", depl.GetUID())
|
|
|
|
|
|
|
|
name := tls.GenerateRootCASecretName(certProps)
|
2022-04-26 20:18:14 +00:00
|
|
|
secret, err := kubeClient.CoreV1().Secrets(config.KyvernoNamespace).Get(context.TODO(), name, metav1.GetOptions{})
|
2022-01-11 08:47:24 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Log.Info("failed to fetch secret '%v': %v", name, err.Error())
|
|
|
|
|
|
|
|
if !errors.IsNotFound(err) {
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
2022-04-26 20:18:14 +00:00
|
|
|
} else if tls.CanAddAnnotationToSecret(deplHash, secret) {
|
|
|
|
secret.SetAnnotations(map[string]string{tls.MasterDeploymentUID: deplHash})
|
|
|
|
_, err = kubeClient.CoreV1().Secrets(config.KyvernoNamespace).Update(context.TODO(), secret, metav1.UpdateOptions{})
|
2022-01-11 08:47:24 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Log.Info("failed to update cert: %v", err.Error())
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
name = tls.GenerateTLSPairSecretName(certProps)
|
2022-04-26 20:18:14 +00:00
|
|
|
secret, err = kubeClient.CoreV1().Secrets(config.KyvernoNamespace).Get(context.TODO(), name, metav1.GetOptions{})
|
2022-01-11 08:47:24 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Log.Info("failed to fetch secret '%v': %v", name, err.Error())
|
|
|
|
|
|
|
|
if !errors.IsNotFound(err) {
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
2022-04-26 20:18:14 +00:00
|
|
|
} else if tls.CanAddAnnotationToSecret(deplHash, secret) {
|
|
|
|
secret.SetAnnotations(map[string]string{tls.MasterDeploymentUID: deplHash})
|
|
|
|
_, err = kubeClient.CoreV1().Secrets(certProps.Namespace).Update(context.TODO(), secret, metav1.UpdateOptions{})
|
2022-01-11 08:47:24 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Log.Info("failed to update cert: %v", err.Error())
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
|
|
|
}
|
2021-10-06 23:12:07 +00:00
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
_, err = kubeClient.CoordinationV1().Leases(config.KyvernoNamespace).Get(ctx, "kyvernopre-lock", metav1.GetOptions{})
|
2021-10-06 23:12:07 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Log.Info("Lease 'kyvernopre-lock' not found. Starting clean-up...")
|
|
|
|
} else {
|
|
|
|
log.Log.Info("Clean-up complete. Leader exiting...")
|
|
|
|
os.Exit(0)
|
|
|
|
}
|
|
|
|
|
|
|
|
// use pipline to pass request to cleanup resources
|
|
|
|
// generate requests
|
|
|
|
in := gen(done, stopCh, requests...)
|
|
|
|
// process requests
|
|
|
|
// processing routine count : 2
|
2021-12-17 05:03:52 +00:00
|
|
|
p1 := process(client, done, stopCh, in)
|
|
|
|
p2 := process(client, done, stopCh, in)
|
2021-10-06 23:12:07 +00:00
|
|
|
// merge results from processing routines
|
|
|
|
for err := range merge(done, stopCh, p1, p2) {
|
|
|
|
if err != nil {
|
|
|
|
failure = true
|
|
|
|
log.Log.Error(err, "failed to cleanup resource")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// if there is any failure then we fail process
|
|
|
|
if failure {
|
|
|
|
log.Log.Info("failed to cleanup prior configurations")
|
|
|
|
os.Exit(1)
|
|
|
|
}
|
|
|
|
|
2022-03-21 09:18:54 +00:00
|
|
|
lease := coord.Lease{
|
2022-04-26 20:18:14 +00:00
|
|
|
ObjectMeta: metav1.ObjectMeta{
|
2022-03-21 09:18:54 +00:00
|
|
|
Name: "kyvernopre-lock",
|
|
|
|
},
|
|
|
|
}
|
2022-04-26 20:18:14 +00:00
|
|
|
_, err = kubeClient.CoordinationV1().Leases(config.KyvernoNamespace).Create(ctx, &lease, metav1.CreateOptions{})
|
2019-11-18 19:41:37 +00:00
|
|
|
if err != nil {
|
2021-10-06 23:12:07 +00:00
|
|
|
log.Log.Info("Failed to create lease 'kyvernopre-lock'")
|
2019-11-18 19:41:37 +00:00
|
|
|
}
|
2021-10-06 23:12:07 +00:00
|
|
|
|
|
|
|
log.Log.Info("Clean-up complete. Leader exiting...")
|
|
|
|
|
|
|
|
os.Exit(0)
|
2019-11-18 19:41:37 +00:00
|
|
|
}
|
2021-01-24 19:34:02 +00:00
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
le, err := leaderelection.New("kyvernopre", config.KyvernoNamespace, kubeClient, run, nil, log.Log.WithName("kyvernopre/LeaderElection"))
|
2021-10-06 23:12:07 +00:00
|
|
|
if err != nil {
|
|
|
|
setupLog.Error(err, "failed to elect a leader")
|
2019-11-18 19:41:37 +00:00
|
|
|
os.Exit(1)
|
|
|
|
}
|
2021-10-06 23:12:07 +00:00
|
|
|
|
|
|
|
le.Run(ctx)
|
2019-11-18 19:41:37 +00:00
|
|
|
}
|
|
|
|
|
2021-12-17 05:03:52 +00:00
|
|
|
func executeRequest(client *client.Client, req request) error {
|
2020-11-09 19:26:12 +00:00
|
|
|
switch req.kind {
|
|
|
|
case policyReportKind:
|
2021-12-17 05:03:52 +00:00
|
|
|
return removePolicyReport(client, req.kind)
|
2020-11-09 19:26:12 +00:00
|
|
|
case clusterPolicyReportKind:
|
|
|
|
return removeClusterPolicyReport(client, req.kind)
|
2020-12-04 03:19:36 +00:00
|
|
|
case reportChangeRequestKind:
|
|
|
|
return removeReportChangeRequest(client, req.kind)
|
|
|
|
case clusterReportChangeRequestKind:
|
|
|
|
return removeClusterReportChangeRequest(client, req.kind)
|
2020-11-09 19:26:12 +00:00
|
|
|
case policyViolation, clusterPolicyViolation:
|
|
|
|
return removeViolationCRD(client)
|
2019-11-18 19:41:37 +00:00
|
|
|
}
|
2021-01-24 19:34:02 +00:00
|
|
|
|
2019-11-18 19:41:37 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
type request struct {
|
|
|
|
kind string
|
|
|
|
name string
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Processing Pipeline
|
|
|
|
-> Process Requests
|
|
|
|
Generate Requests -> Process Requests -> Merge Results
|
|
|
|
-> Process Requests
|
|
|
|
- number of processes can be controlled
|
|
|
|
- stop processing on SIGTERM OR SIGNKILL signal
|
|
|
|
- stop processing if any process fails(supported)
|
|
|
|
*/
|
|
|
|
// Generates requests to be processed
|
|
|
|
func gen(done <-chan struct{}, stopCh <-chan struct{}, requests ...request) <-chan request {
|
|
|
|
out := make(chan request)
|
|
|
|
go func() {
|
|
|
|
defer close(out)
|
|
|
|
for _, req := range requests {
|
|
|
|
select {
|
|
|
|
case out <- req:
|
|
|
|
case <-done:
|
|
|
|
println("done generate")
|
|
|
|
return
|
|
|
|
case <-stopCh:
|
|
|
|
println("shutting down generate")
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
|
|
|
// processes the requests
|
2021-12-17 05:03:52 +00:00
|
|
|
func process(client *client.Client, done <-chan struct{}, stopCh <-chan struct{}, requests <-chan request) <-chan error {
|
2020-03-17 18:05:20 +00:00
|
|
|
logger := log.Log.WithName("process")
|
2019-11-18 19:41:37 +00:00
|
|
|
out := make(chan error)
|
|
|
|
go func() {
|
|
|
|
defer close(out)
|
|
|
|
for req := range requests {
|
|
|
|
select {
|
2021-12-17 05:03:52 +00:00
|
|
|
case out <- executeRequest(client, req):
|
2019-11-18 19:41:37 +00:00
|
|
|
case <-done:
|
2020-03-17 18:05:20 +00:00
|
|
|
logger.Info("done")
|
2019-11-18 19:41:37 +00:00
|
|
|
return
|
|
|
|
case <-stopCh:
|
2020-03-17 18:05:20 +00:00
|
|
|
logger.Info("shutting down")
|
2019-11-18 19:41:37 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}()
|
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
|
|
|
// waits for all processes to be complete and merges result
|
|
|
|
func merge(done <-chan struct{}, stopCh <-chan struct{}, processes ...<-chan error) <-chan error {
|
2020-03-17 18:05:20 +00:00
|
|
|
logger := log.Log.WithName("merge")
|
2019-11-18 19:41:37 +00:00
|
|
|
var wg sync.WaitGroup
|
|
|
|
out := make(chan error)
|
|
|
|
// gets the output from each process
|
|
|
|
output := func(ch <-chan error) {
|
|
|
|
defer wg.Done()
|
|
|
|
for err := range ch {
|
|
|
|
select {
|
|
|
|
case out <- err:
|
|
|
|
case <-done:
|
2020-03-17 18:05:20 +00:00
|
|
|
logger.Info("done")
|
2019-11-18 19:41:37 +00:00
|
|
|
return
|
|
|
|
case <-stopCh:
|
2020-03-17 18:05:20 +00:00
|
|
|
logger.Info("shutting down")
|
2019-11-18 19:41:37 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
wg.Add(len(processes))
|
|
|
|
for _, process := range processes {
|
|
|
|
go output(process)
|
|
|
|
}
|
|
|
|
|
|
|
|
// close when all the process goroutines are done
|
|
|
|
go func() {
|
|
|
|
wg.Wait()
|
|
|
|
close(out)
|
|
|
|
}()
|
|
|
|
return out
|
|
|
|
}
|
2020-11-09 19:26:12 +00:00
|
|
|
|
|
|
|
func removeClusterPolicyReport(client *client.Client, kind string) error {
|
|
|
|
logger := log.Log.WithName("removeClusterPolicyReport")
|
|
|
|
|
2021-12-17 05:03:52 +00:00
|
|
|
cpolrs, err := client.ListResource("", kind, "", policyreport.LabelSelector)
|
2021-01-22 02:58:53 +00:00
|
|
|
if err != nil {
|
2020-11-09 19:26:12 +00:00
|
|
|
logger.Error(err, "failed to list clusterPolicyReport")
|
2020-12-04 03:19:36 +00:00
|
|
|
return nil
|
2020-11-09 19:26:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
for _, cpolr := range cpolrs.Items {
|
2021-10-06 18:25:38 +00:00
|
|
|
deleteResource(client, cpolr.GetAPIVersion(), cpolr.GetKind(), "", cpolr.GetName())
|
2020-11-09 19:26:12 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-12-17 05:03:52 +00:00
|
|
|
func removePolicyReport(client *client.Client, kind string) error {
|
2020-11-09 19:26:12 +00:00
|
|
|
logger := log.Log.WithName("removePolicyReport")
|
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
polrs, err := client.ListResource("", kind, metav1.NamespaceAll, policyreport.LabelSelector)
|
2020-11-09 19:26:12 +00:00
|
|
|
if err != nil {
|
2021-12-17 05:03:52 +00:00
|
|
|
logger.Error(err, "failed to list policyReport")
|
|
|
|
return nil
|
2020-11-09 19:26:12 +00:00
|
|
|
}
|
|
|
|
|
2021-12-17 05:03:52 +00:00
|
|
|
for _, polr := range polrs.Items {
|
|
|
|
deleteResource(client, polr.GetAPIVersion(), polr.GetKind(), polr.GetNamespace(), polr.GetName())
|
2020-12-04 03:19:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-12-17 05:03:52 +00:00
|
|
|
func addClusterPolicyReportSelectorLabel(client *client.Client) {
|
|
|
|
logger := log.Log.WithName("addClusterPolicyReportSelectorLabel")
|
|
|
|
|
|
|
|
cpolrs, err := client.ListResource("", clusterPolicyReportKind, "", updateLabelSelector)
|
|
|
|
if err != nil {
|
|
|
|
logger.Error(err, "failed to list clusterPolicyReport")
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, cpolr := range cpolrs.Items {
|
|
|
|
if cpolr.GetName() == policyreport.GeneratePolicyReportName("") {
|
|
|
|
addSelectorLabel(client, cpolr.GetAPIVersion(), cpolr.GetKind(), "", cpolr.GetName())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func addPolicyReportSelectorLabel(client *client.Client) {
|
|
|
|
logger := log.Log.WithName("addPolicyReportSelectorLabel")
|
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
polrs, err := client.ListResource("", policyReportKind, metav1.NamespaceAll, updateLabelSelector)
|
2021-12-17 05:03:52 +00:00
|
|
|
if err != nil {
|
|
|
|
logger.Error(err, "failed to list policyReport")
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, polr := range polrs.Items {
|
|
|
|
if polr.GetName() == policyreport.GeneratePolicyReportName(polr.GetNamespace()) {
|
|
|
|
addSelectorLabel(client, polr.GetAPIVersion(), polr.GetKind(), polr.GetNamespace(), polr.GetName())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-04 03:19:36 +00:00
|
|
|
func removeReportChangeRequest(client *client.Client, kind string) error {
|
|
|
|
logger := log.Log.WithName("removeReportChangeRequest")
|
|
|
|
|
2022-04-01 06:59:44 +00:00
|
|
|
ns := config.KyvernoNamespace
|
2020-12-04 03:19:36 +00:00
|
|
|
rcrList, err := client.ListResource("", kind, ns, nil)
|
2021-01-22 02:58:53 +00:00
|
|
|
if err != nil {
|
2020-12-04 03:19:36 +00:00
|
|
|
logger.Error(err, "failed to list reportChangeRequest")
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, rcr := range rcrList.Items {
|
2021-10-06 18:25:38 +00:00
|
|
|
deleteResource(client, rcr.GetAPIVersion(), rcr.GetKind(), rcr.GetNamespace(), rcr.GetName())
|
2020-11-09 19:26:12 +00:00
|
|
|
}
|
2020-12-21 19:04:19 +00:00
|
|
|
|
2020-12-04 03:19:36 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func removeClusterReportChangeRequest(client *client.Client, kind string) error {
|
|
|
|
crcrList, err := client.ListResource("", kind, "", nil)
|
2021-01-22 02:58:53 +00:00
|
|
|
if err != nil {
|
2020-12-09 17:29:52 +00:00
|
|
|
log.Log.Error(err, "failed to list clusterReportChangeRequest")
|
2020-12-04 03:19:36 +00:00
|
|
|
return nil
|
|
|
|
}
|
2020-11-09 19:26:12 +00:00
|
|
|
|
2020-12-04 03:19:36 +00:00
|
|
|
for _, crcr := range crcrList.Items {
|
2021-10-06 18:25:38 +00:00
|
|
|
deleteResource(client, crcr.GetAPIVersion(), crcr.GetKind(), "", crcr.GetName())
|
2020-12-04 03:19:36 +00:00
|
|
|
}
|
2020-11-09 19:26:12 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func removeViolationCRD(client *client.Client) error {
|
|
|
|
if err := client.DeleteResource("", "CustomResourceDefinition", "", "policyviolations.kyverno.io", false); err != nil {
|
|
|
|
if !errors.IsNotFound(err) {
|
2020-12-09 17:29:52 +00:00
|
|
|
log.Log.Error(err, "failed to delete CRD policyViolation")
|
2020-11-09 19:26:12 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := client.DeleteResource("", "CustomResourceDefinition", "", "clusterpolicyviolations.kyverno.io", false); err != nil {
|
|
|
|
if !errors.IsNotFound(err) {
|
2020-12-09 17:29:52 +00:00
|
|
|
log.Log.Error(err, "failed to delete CRD clusterPolicyViolation")
|
2020-11-09 19:26:12 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
2020-12-04 03:19:36 +00:00
|
|
|
|
2021-10-06 18:25:38 +00:00
|
|
|
func deleteResource(client *client.Client, apiversion, kind, ns, name string) {
|
2020-12-09 07:04:16 +00:00
|
|
|
err := client.DeleteResource(apiversion, kind, ns, name, false)
|
|
|
|
if err != nil && !errors.IsNotFound(err) {
|
2020-12-09 17:29:52 +00:00
|
|
|
log.Log.Error(err, "failed to delete resource", "kind", kind, "name", name)
|
2020-12-09 07:04:16 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2020-12-09 17:29:52 +00:00
|
|
|
log.Log.Info("successfully cleaned up resource", "kind", kind, "name", name)
|
2020-12-09 07:04:16 +00:00
|
|
|
}
|
2021-12-17 05:03:52 +00:00
|
|
|
|
|
|
|
func addSelectorLabel(client *client.Client, apiversion, kind, ns, name string) {
|
|
|
|
res, err := client.GetResource(apiversion, kind, ns, name)
|
|
|
|
if err != nil && !errors.IsNotFound(err) {
|
|
|
|
log.Log.Error(err, "failed to get resource", "kind", kind, "name", name)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2022-04-26 20:18:14 +00:00
|
|
|
l, err := metav1.LabelSelectorAsMap(policyreport.LabelSelector)
|
2021-12-17 05:03:52 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Log.Error(err, "failed to convert labels", "labels", policyreport.LabelSelector)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
res.SetLabels(labels.Merge(res.GetLabels(), l))
|
|
|
|
|
|
|
|
_, err = client.UpdateResource(apiversion, kind, ns, res, false)
|
|
|
|
if err != nil {
|
|
|
|
log.Log.Error(err, "failed to update resource", "kind", kind, "name", name)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
log.Log.Info("successfully updated resource labels", "kind", kind, "name", name)
|
|
|
|
}
|