mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-14 11:57:48 +00:00
refactor: admission reports aggregation (#6568)
* refactor: addmission reports aggregation Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix kuttl Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> --------- Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché
GitHub
parent
0b56613d59
commit
3c16c60912
12 changed files with 335 additions and 289 deletions
|
|
@ -39,16 +39,14 @@ type AdmissionReportSpec struct {
|
|||
// +kubebuilder:object:root=true
|
||||
// +kubebuilder:storageversion
|
||||
// +kubebuilder:resource:shortName=admr,categories=kyverno
|
||||
// +kubebuilder:printcolumn:name="ApiVersion",type=string,JSONPath=".spec.owner.apiVersion",priority=1
|
||||
// +kubebuilder:printcolumn:name="Kind",type=string,JSONPath=".spec.owner.kind",priority=1
|
||||
// +kubebuilder:printcolumn:name="Subject",type=string,JSONPath=".spec.owner.name",priority=1
|
||||
// +kubebuilder:printcolumn:name="Pass",type=integer,JSONPath=".spec.summary.pass"
|
||||
// +kubebuilder:printcolumn:name="Fail",type=integer,JSONPath=".spec.summary.fail"
|
||||
// +kubebuilder:printcolumn:name="Warn",type=integer,JSONPath=".spec.summary.warn"
|
||||
// +kubebuilder:printcolumn:name="Error",type=integer,JSONPath=".spec.summary.error"
|
||||
// +kubebuilder:printcolumn:name="Skip",type=integer,JSONPath=".spec.summary.skip"
|
||||
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
|
||||
// +kubebuilder:printcolumn:name="Hash",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/resource\\.hash']",priority=1
|
||||
// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
|
||||
// +kubebuilder:printcolumn:name="PASS",type=integer,JSONPath=".spec.summary.pass"
|
||||
// +kubebuilder:printcolumn:name="FAIL",type=integer,JSONPath=".spec.summary.fail"
|
||||
// +kubebuilder:printcolumn:name="WARN",type=integer,JSONPath=".spec.summary.warn"
|
||||
// +kubebuilder:printcolumn:name="ERROR",type=integer,JSONPath=".spec.summary.error"
|
||||
// +kubebuilder:printcolumn:name="SKIP",type=integer,JSONPath=".spec.summary.skip"
|
||||
// +kubebuilder:printcolumn:name="GVR",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/resource\\.gvr']",priority=1
|
||||
// +kubebuilder:printcolumn:name="REF",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/resource\\.name']",priority=1
|
||||
// +kubebuilder:printcolumn:name="AGGREGATE",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/report\\.aggregate']",priority=1
|
||||
|
||||
// AdmissionReport is the Schema for the AdmissionReports API
|
||||
|
|
@ -76,16 +74,14 @@ func (r *AdmissionReport) SetSummary(summary policyreportv1alpha2.PolicyReportSu
|
|||
// +kubebuilder:object:root=true
|
||||
// +kubebuilder:storageversion
|
||||
// +kubebuilder:resource:scope=Cluster,shortName=cadmr,categories=kyverno
|
||||
// +kubebuilder:printcolumn:name="ApiVersion",type=string,JSONPath=".spec.owner.apiVersion",priority=1
|
||||
// +kubebuilder:printcolumn:name="Kind",type=string,JSONPath=".spec.owner.kind",priority=1
|
||||
// +kubebuilder:printcolumn:name="Subject",type=string,JSONPath=".spec.owner.name",priority=1
|
||||
// +kubebuilder:printcolumn:name="Pass",type=integer,JSONPath=".spec.summary.pass"
|
||||
// +kubebuilder:printcolumn:name="Fail",type=integer,JSONPath=".spec.summary.fail"
|
||||
// +kubebuilder:printcolumn:name="Warn",type=integer,JSONPath=".spec.summary.warn"
|
||||
// +kubebuilder:printcolumn:name="Error",type=integer,JSONPath=".spec.summary.error"
|
||||
// +kubebuilder:printcolumn:name="Skip",type=integer,JSONPath=".spec.summary.skip"
|
||||
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
|
||||
// +kubebuilder:printcolumn:name="Hash",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/resource\\.hash']",priority=1
|
||||
// +kubebuilder:printcolumn:name="AGE",type="date",JSONPath=".metadata.creationTimestamp"
|
||||
// +kubebuilder:printcolumn:name="PASS",type=integer,JSONPath=".spec.summary.pass"
|
||||
// +kubebuilder:printcolumn:name="FAIL",type=integer,JSONPath=".spec.summary.fail"
|
||||
// +kubebuilder:printcolumn:name="WARN",type=integer,JSONPath=".spec.summary.warn"
|
||||
// +kubebuilder:printcolumn:name="ERROR",type=integer,JSONPath=".spec.summary.error"
|
||||
// +kubebuilder:printcolumn:name="SKIP",type=integer,JSONPath=".spec.summary.skip"
|
||||
// +kubebuilder:printcolumn:name="GVR",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/resource\\.gvr']",priority=1
|
||||
// +kubebuilder:printcolumn:name="REF",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/resource\\.name']",priority=1
|
||||
// +kubebuilder:printcolumn:name="AGGREGATE",type=string,JSONPath=".metadata.labels['audit\\.kyverno\\.io/report\\.aggregate']",priority=1
|
||||
|
||||
// ClusterAdmissionReport is the Schema for the ClusterAdmissionReports API
|
||||
|
|
|
|||
|
|
@ -25,38 +25,30 @@ spec:
|
|||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.owner.apiVersion
|
||||
name: ApiVersion
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.kind
|
||||
name: Kind
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.name
|
||||
name: Subject
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .spec.summary.pass
|
||||
name: Pass
|
||||
name: PASS
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.fail
|
||||
name: Fail
|
||||
name: FAIL
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.warn
|
||||
name: Warn
|
||||
name: WARN
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.error
|
||||
name: Error
|
||||
name: ERROR
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.skip
|
||||
name: Skip
|
||||
name: SKIP
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||
name: Hash
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||
name: GVR
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||
name: REF
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||
|
|
@ -1723,38 +1715,30 @@ spec:
|
|||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.owner.apiVersion
|
||||
name: ApiVersion
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.kind
|
||||
name: Kind
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.name
|
||||
name: Subject
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .spec.summary.pass
|
||||
name: Pass
|
||||
name: PASS
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.fail
|
||||
name: Fail
|
||||
name: FAIL
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.warn
|
||||
name: Warn
|
||||
name: WARN
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.error
|
||||
name: Error
|
||||
name: ERROR
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.skip
|
||||
name: Skip
|
||||
name: SKIP
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||
name: Hash
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||
name: GVR
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||
name: REF
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||
|
|
|
|||
|
|
@ -117,8 +117,8 @@ func createReportControllers(
|
|||
admissionreportcontroller.ControllerName,
|
||||
admissionreportcontroller.NewController(
|
||||
kyvernoClient,
|
||||
client,
|
||||
metadataFactory,
|
||||
resourceReportController,
|
||||
),
|
||||
admissionreportcontroller.Workers,
|
||||
))
|
||||
|
|
|
|||
|
|
@ -20,38 +20,30 @@ spec:
|
|||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.owner.apiVersion
|
||||
name: ApiVersion
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.kind
|
||||
name: Kind
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.name
|
||||
name: Subject
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .spec.summary.pass
|
||||
name: Pass
|
||||
name: PASS
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.fail
|
||||
name: Fail
|
||||
name: FAIL
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.warn
|
||||
name: Warn
|
||||
name: WARN
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.error
|
||||
name: Error
|
||||
name: ERROR
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.skip
|
||||
name: Skip
|
||||
name: SKIP
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||
name: Hash
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||
name: GVR
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||
name: REF
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||
|
|
|
|||
|
|
@ -20,38 +20,30 @@ spec:
|
|||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.owner.apiVersion
|
||||
name: ApiVersion
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.kind
|
||||
name: Kind
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .spec.owner.name
|
||||
name: Subject
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .spec.summary.pass
|
||||
name: Pass
|
||||
name: PASS
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.fail
|
||||
name: Fail
|
||||
name: FAIL
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.warn
|
||||
name: Warn
|
||||
name: WARN
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.error
|
||||
name: Error
|
||||
name: ERROR
|
||||
type: integer
|
||||
- jsonPath: .spec.summary.skip
|
||||
name: Skip
|
||||
name: SKIP
|
||||
type: integer
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||
name: Hash
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||
name: GVR
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||
name: REF
|
||||
priority: 1
|
||||
type: string
|
||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||
|
|
|
|||
|
|
@ -8,17 +8,19 @@ import (
|
|||
kyvernov1alpha2 "github.com/kyverno/kyverno/api/kyverno/v1alpha2"
|
||||
policyreportv1alpha2 "github.com/kyverno/kyverno/api/policyreport/v1alpha2"
|
||||
"github.com/kyverno/kyverno/pkg/client/clientset/versioned"
|
||||
"github.com/kyverno/kyverno/pkg/clients/dclient"
|
||||
"github.com/kyverno/kyverno/pkg/controllers"
|
||||
"github.com/kyverno/kyverno/pkg/controllers/report/resource"
|
||||
"github.com/kyverno/kyverno/pkg/controllers/report/utils"
|
||||
controllerutils "github.com/kyverno/kyverno/pkg/utils/controller"
|
||||
reportutils "github.com/kyverno/kyverno/pkg/utils/report"
|
||||
"go.uber.org/multierr"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"k8s.io/apimachinery/pkg/util/sets"
|
||||
"k8s.io/client-go/dynamic"
|
||||
metadatainformers "k8s.io/client-go/metadata/metadatainformer"
|
||||
"k8s.io/client-go/tools/cache"
|
||||
"k8s.io/client-go/util/workqueue"
|
||||
|
|
@ -34,7 +36,8 @@ const (
|
|||
|
||||
type controller struct {
|
||||
// clients
|
||||
client versioned.Interface
|
||||
client versioned.Interface
|
||||
dclient dclient.Interface
|
||||
|
||||
// listers
|
||||
admrLister cache.GenericLister
|
||||
|
|
@ -42,34 +45,23 @@ type controller struct {
|
|||
|
||||
// queue
|
||||
queue workqueue.RateLimitingInterface
|
||||
|
||||
// cache
|
||||
metadataCache resource.MetadataCache
|
||||
}
|
||||
|
||||
func NewController(
|
||||
client versioned.Interface,
|
||||
dclient dclient.Interface,
|
||||
metadataFactory metadatainformers.SharedInformerFactory,
|
||||
metadataCache resource.MetadataCache,
|
||||
) controllers.Controller {
|
||||
admrInformer := metadataFactory.ForResource(kyvernov1alpha2.SchemeGroupVersion.WithResource("admissionreports"))
|
||||
cadmrInformer := metadataFactory.ForResource(kyvernov1alpha2.SchemeGroupVersion.WithResource("clusteradmissionreports"))
|
||||
queue := workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), ControllerName)
|
||||
c := controller{
|
||||
client: client,
|
||||
admrLister: admrInformer.Lister(),
|
||||
cadmrLister: cadmrInformer.Lister(),
|
||||
queue: queue,
|
||||
metadataCache: metadataCache,
|
||||
client: client,
|
||||
dclient: dclient,
|
||||
admrLister: admrInformer.Lister(),
|
||||
cadmrLister: cadmrInformer.Lister(),
|
||||
queue: queue,
|
||||
}
|
||||
c.metadataCache.AddEventHandler(func(eventType resource.EventType, uid types.UID, _ schema.GroupVersionKind, _ resource.Resource) {
|
||||
// if it's a deletion, give some time to native garbage collection
|
||||
if eventType == resource.Deleted {
|
||||
queue.AddAfter(cache.ExplicitKey(uid), time.Minute)
|
||||
} else {
|
||||
queue.Add(cache.ExplicitKey(uid))
|
||||
}
|
||||
})
|
||||
controllerutils.AddEventHandlersT(
|
||||
admrInformer.Informer(),
|
||||
func(obj metav1.Object) { queue.Add(cache.ExplicitKey(reportutils.GetResourceUid(obj))) },
|
||||
|
|
@ -89,22 +81,6 @@ func (c *controller) Run(ctx context.Context, workers int) {
|
|||
controllerutils.Run(ctx, logger, ControllerName, time.Second, c.queue, workers, maxRetries, c.reconcile)
|
||||
}
|
||||
|
||||
func (c *controller) deleteReport(ctx context.Context, namespace, name string) error {
|
||||
if namespace == "" {
|
||||
return c.client.KyvernoV1alpha2().ClusterAdmissionReports().Delete(ctx, name, metav1.DeleteOptions{})
|
||||
} else {
|
||||
return c.client.KyvernoV1alpha2().AdmissionReports(namespace).Delete(ctx, name, metav1.DeleteOptions{})
|
||||
}
|
||||
}
|
||||
|
||||
func (c *controller) fetchReport(ctx context.Context, namespace, name string) (kyvernov1alpha2.ReportInterface, error) {
|
||||
if namespace == "" {
|
||||
return c.client.KyvernoV1alpha2().ClusterAdmissionReports().Get(ctx, name, metav1.GetOptions{})
|
||||
} else {
|
||||
return c.client.KyvernoV1alpha2().AdmissionReports(namespace).Get(ctx, name, metav1.GetOptions{})
|
||||
}
|
||||
}
|
||||
|
||||
func (c *controller) getReports(uid types.UID) ([]metav1.Object, error) {
|
||||
selector, err := reportutils.SelectorResourceUidEquals(uid)
|
||||
if err != nil {
|
||||
|
|
@ -128,138 +104,220 @@ func (c *controller) getReports(uid types.UID) ([]metav1.Object, error) {
|
|||
return results, nil
|
||||
}
|
||||
|
||||
func mergeReports(accumulator map[string]policyreportv1alpha2.PolicyReportResult, reports ...kyvernov1alpha2.ReportInterface) {
|
||||
for _, report := range reports {
|
||||
if len(report.GetOwnerReferences()) == 1 {
|
||||
ownerRef := report.GetOwnerReferences()[0]
|
||||
objectRefs := []corev1.ObjectReference{{
|
||||
APIVersion: ownerRef.APIVersion,
|
||||
Kind: ownerRef.Kind,
|
||||
Namespace: report.GetNamespace(),
|
||||
Name: ownerRef.Name,
|
||||
UID: ownerRef.UID,
|
||||
}}
|
||||
for _, result := range report.GetResults() {
|
||||
key := result.Policy + "/" + result.Rule + "/" + string(ownerRef.UID)
|
||||
result.Resources = objectRefs
|
||||
if rule, exists := accumulator[key]; !exists {
|
||||
accumulator[key] = result
|
||||
} else if rule.Timestamp.Seconds < result.Timestamp.Seconds {
|
||||
accumulator[key] = result
|
||||
func (c *controller) fetchReport(ctx context.Context, namespace, name string) (kyvernov1alpha2.ReportInterface, error) {
|
||||
if namespace == "" {
|
||||
return c.client.KyvernoV1alpha2().ClusterAdmissionReports().Get(ctx, name, metav1.GetOptions{})
|
||||
} else {
|
||||
return c.client.KyvernoV1alpha2().AdmissionReports(namespace).Get(ctx, name, metav1.GetOptions{})
|
||||
}
|
||||
}
|
||||
|
||||
func (c *controller) fetchReports(ctx context.Context, uid types.UID) ([]kyvernov1alpha2.ReportInterface, error) {
|
||||
var results []kyvernov1alpha2.ReportInterface
|
||||
ns := sets.New[string]()
|
||||
if reports, err := c.getReports(uid); err != nil {
|
||||
return nil, err
|
||||
} else {
|
||||
// TODO: threshold here ?
|
||||
if len(reports) < 5 {
|
||||
for _, report := range reports {
|
||||
if result, err := c.fetchReport(ctx, report.GetNamespace(), report.GetName()); err != nil {
|
||||
return nil, err
|
||||
} else {
|
||||
results = append(results, result)
|
||||
}
|
||||
}
|
||||
return results, nil
|
||||
}
|
||||
for _, report := range reports {
|
||||
ns.Insert(report.GetNamespace())
|
||||
}
|
||||
}
|
||||
if selector, err := reportutils.SelectorResourceUidEquals(uid); err != nil {
|
||||
return nil, err
|
||||
} else {
|
||||
for n := range ns {
|
||||
if n == "" {
|
||||
cadmrs, err := c.client.KyvernoV1alpha2().ClusterAdmissionReports().List(ctx, metav1.ListOptions{LabelSelector: selector.String()})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for i := range cadmrs.Items {
|
||||
results = append(results, &cadmrs.Items[i])
|
||||
}
|
||||
} else {
|
||||
admrs, err := c.client.KyvernoV1alpha2().AdmissionReports(n).List(ctx, metav1.ListOptions{LabelSelector: selector.String()})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for i := range admrs.Items {
|
||||
results = append(results, &admrs.Items[i])
|
||||
}
|
||||
}
|
||||
}
|
||||
return results, nil
|
||||
}
|
||||
}
|
||||
|
||||
func (c *controller) deleteReport(ctx context.Context, namespace, name string) error {
|
||||
if namespace == "" {
|
||||
return c.client.KyvernoV1alpha2().ClusterAdmissionReports().Delete(ctx, name, metav1.DeleteOptions{})
|
||||
} else {
|
||||
return c.client.KyvernoV1alpha2().AdmissionReports(namespace).Delete(ctx, name, metav1.DeleteOptions{})
|
||||
}
|
||||
}
|
||||
|
||||
func mergeReports(resource corev1.ObjectReference, accumulator map[string]policyreportv1alpha2.PolicyReportResult, reports ...kyvernov1alpha2.ReportInterface) {
|
||||
for _, report := range reports {
|
||||
for _, result := range report.GetResults() {
|
||||
key := result.Policy + "/" + result.Rule
|
||||
result.Resources = []corev1.ObjectReference{resource}
|
||||
if rule, exists := accumulator[key]; !exists {
|
||||
accumulator[key] = result
|
||||
} else if rule.Timestamp.Seconds < result.Timestamp.Seconds {
|
||||
accumulator[key] = result
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (c *controller) aggregateReports(ctx context.Context, uid types.UID, gvk schema.GroupVersionKind, res resource.Resource, reports ...metav1.Object) error {
|
||||
before, err := c.fetchReport(ctx, res.Namespace, string(uid))
|
||||
func (c *controller) aggregateReports(ctx context.Context, uid types.UID) (kyvernov1alpha2.ReportInterface, []kyvernov1alpha2.ReportInterface, error) {
|
||||
reports, err := c.fetchReports(ctx, uid)
|
||||
if err != nil {
|
||||
if !apierrors.IsNotFound(err) {
|
||||
return err
|
||||
}
|
||||
before = reportutils.NewAdmissionReport(res.Namespace, string(uid), res.Name, uid, metav1.GroupVersionKind(gvk))
|
||||
return nil, nil, err
|
||||
}
|
||||
merged := map[string]policyreportv1alpha2.PolicyReportResult{}
|
||||
if len(reports) == 0 {
|
||||
return nil, nil, nil
|
||||
}
|
||||
// do we have an aggregated report ?
|
||||
var aggregated kyvernov1alpha2.ReportInterface
|
||||
for _, report := range reports {
|
||||
if reportutils.GetResourceHash(report) == res.Hash {
|
||||
if report.GetName() == string(uid) {
|
||||
mergeReports(merged, before)
|
||||
if report.GetName() == string(uid) {
|
||||
aggregated = report
|
||||
break
|
||||
}
|
||||
}
|
||||
// if we dont, try to fetch the associated resource
|
||||
if aggregated == nil || len(aggregated.GetOwnerReferences()) == 0 {
|
||||
var res *unstructured.Unstructured
|
||||
var gvr schema.GroupVersionResource
|
||||
for _, report := range reports {
|
||||
// fetch resource using labels recorded on individual reports
|
||||
gvr = reportutils.GetResourceGVR(report)
|
||||
dyn := c.dclient.GetDynamicInterface().Resource(gvr)
|
||||
namespace, name := reportutils.GetResourceNamespaceAndName(report)
|
||||
var iface dynamic.ResourceInterface
|
||||
if namespace == "" {
|
||||
iface = dyn
|
||||
} else {
|
||||
// TODO: see if we can use List instead of fetching reports one by one
|
||||
report, err := c.fetchReport(ctx, report.GetNamespace(), report.GetName())
|
||||
if err != nil {
|
||||
return err
|
||||
iface = dyn.Namespace(namespace)
|
||||
}
|
||||
if got, err := iface.Get(ctx, name, metav1.GetOptions{}); err == nil {
|
||||
res = got
|
||||
break
|
||||
}
|
||||
}
|
||||
// if we found the resource, build an aggregated report for it
|
||||
if res != nil {
|
||||
if aggregated == nil {
|
||||
aggregated = reportutils.NewAdmissionReport(res.GetNamespace(), string(uid), gvr, *res)
|
||||
controllerutils.SetOwner(aggregated, res.GetAPIVersion(), res.GetKind(), res.GetName(), uid)
|
||||
controllerutils.SetLabel(aggregated, reportutils.LabelAggregatedReport, string(uid))
|
||||
}
|
||||
}
|
||||
}
|
||||
// if we have an aggregated report available, compute results
|
||||
var errs []error
|
||||
if aggregated != nil {
|
||||
owner := aggregated.GetOwnerReferences()[0]
|
||||
resource := corev1.ObjectReference{
|
||||
APIVersion: owner.APIVersion,
|
||||
Kind: owner.Kind,
|
||||
Namespace: aggregated.GetNamespace(),
|
||||
Name: owner.Name,
|
||||
UID: owner.UID,
|
||||
}
|
||||
merged := map[string]policyreportv1alpha2.PolicyReportResult{}
|
||||
for _, report := range reports {
|
||||
mergeReports(resource, merged, report)
|
||||
}
|
||||
var results []policyreportv1alpha2.PolicyReportResult
|
||||
for _, result := range merged {
|
||||
results = append(results, result)
|
||||
}
|
||||
after := aggregated
|
||||
if aggregated.GetResourceVersion() != "" {
|
||||
after = reportutils.DeepCopy(aggregated)
|
||||
}
|
||||
reportutils.SetResults(aggregated, results...)
|
||||
if after.GetResourceVersion() == "" {
|
||||
if len(results) > 0 {
|
||||
if _, err := reportutils.CreateReport(ctx, after, c.client); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
mergeReports(merged, report)
|
||||
}
|
||||
}
|
||||
}
|
||||
var results []policyreportv1alpha2.PolicyReportResult
|
||||
for _, result := range merged {
|
||||
results = append(results, result)
|
||||
}
|
||||
after := before
|
||||
if before.GetResourceVersion() != "" {
|
||||
after = reportutils.DeepCopy(before)
|
||||
}
|
||||
controllerutils.SetOwner(after, gvk.GroupVersion().String(), gvk.Kind, res.Name, uid)
|
||||
controllerutils.SetLabel(after, reportutils.LabelResourceHash, res.Hash)
|
||||
controllerutils.SetLabel(after, reportutils.LabelAggregatedReport, res.Hash)
|
||||
reportutils.SetResults(after, results...)
|
||||
if after.GetResourceVersion() == "" {
|
||||
if len(results) > 0 {
|
||||
if _, err := reportutils.CreateReport(ctx, after, c.client); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
} else {
|
||||
if len(results) == 0 {
|
||||
if err := c.deleteReport(ctx, after.GetNamespace(), after.GetName()); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
if !utils.ReportsAreIdentical(before, after) {
|
||||
if _, err = reportutils.UpdateReport(ctx, after, c.client); err != nil {
|
||||
return err
|
||||
if len(results) == 0 {
|
||||
if err := c.deleteReport(ctx, after.GetNamespace(), after.GetName()); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
} else {
|
||||
if !utils.ReportsAreIdentical(aggregated, after) {
|
||||
if _, err = reportutils.UpdateReport(ctx, after, c.client); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return c.cleanupReports(ctx, uid, res.Hash, reports...)
|
||||
}
|
||||
|
||||
func (c *controller) cleanupReports(ctx context.Context, uid types.UID, hash string, reports ...metav1.Object) error {
|
||||
var toDelete []metav1.Object
|
||||
for _, report := range reports {
|
||||
if report.GetName() != string(uid) {
|
||||
if reportutils.GetResourceHash(report) == hash || report.GetCreationTimestamp().Add(deletionGrace).Before(time.Now()) {
|
||||
toDelete = append(toDelete, report)
|
||||
} else {
|
||||
c.queue.AddAfter(cache.ExplicitKey(uid), deletionGrace)
|
||||
}
|
||||
}
|
||||
}
|
||||
var errs []error
|
||||
for _, report := range toDelete {
|
||||
if err := c.deleteReport(ctx, report.GetNamespace(), report.GetName()); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
return multierr.Combine(errs...)
|
||||
return aggregated, reports, multierr.Combine(errs...)
|
||||
}
|
||||
|
||||
func (c *controller) reconcile(ctx context.Context, logger logr.Logger, key, _, _ string) error {
|
||||
uid := types.UID(key)
|
||||
// find related reports
|
||||
reports, err := c.getReports(uid)
|
||||
// catch invalid reports case
|
||||
if uid == "" {
|
||||
// find related reports
|
||||
objs, err := c.getReports(uid)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
var errs []error
|
||||
for _, report := range objs {
|
||||
if err := c.deleteReport(ctx, report.GetNamespace(), report.GetName()); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
return multierr.Combine(errs...)
|
||||
}
|
||||
// try to aggregate reports for the given uid
|
||||
aggregate, reports, err := c.aggregateReports(ctx, uid)
|
||||
var errs []error
|
||||
if err != nil {
|
||||
return err
|
||||
errs = append(errs, err)
|
||||
}
|
||||
// is the resource known
|
||||
resource, gvk, found := c.metadataCache.GetResourceHash(uid)
|
||||
if !found {
|
||||
return c.cleanupReports(ctx, "", "", reports...)
|
||||
}
|
||||
quit := false
|
||||
// set orphan reports an owner
|
||||
for _, report := range reports {
|
||||
if len(report.GetOwnerReferences()) == 0 {
|
||||
report, err := c.fetchReport(ctx, report.GetNamespace(), report.GetName())
|
||||
if err != nil {
|
||||
return err
|
||||
// if we created an aggregated report, delete individual ones
|
||||
if aggregate != nil {
|
||||
for _, report := range reports {
|
||||
if aggregate != report {
|
||||
if err := c.deleteReport(ctx, report.GetNamespace(), report.GetName()); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
controllerutils.SetOwner(report, gvk.GroupVersion().String(), gvk.Kind, resource.Name, uid)
|
||||
if _, err = reportutils.UpdateReport(ctx, report, c.client); err != nil {
|
||||
return err
|
||||
}
|
||||
} else {
|
||||
// we didn't create an aggregated report, still we had some individual reports, let's requeue
|
||||
if reports != nil {
|
||||
c.queue.AddAfter(cache.ExplicitKey(uid), time.Second*15)
|
||||
}
|
||||
// delete outdated reports
|
||||
for _, report := range reports {
|
||||
if report.GetCreationTimestamp().Add(deletionGrace).Before(time.Now()) {
|
||||
if err := c.deleteReport(ctx, report.GetNamespace(), report.GetName()); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
quit = true
|
||||
}
|
||||
}
|
||||
// if one report was updated we can quit, reconcile will be triggered again because uid was queued
|
||||
if quit {
|
||||
return nil
|
||||
}
|
||||
// build an aggregated report
|
||||
return c.aggregateReports(ctx, uid, gvk, resource, reports...)
|
||||
return multierr.Combine(errs...)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -24,6 +24,14 @@ func CheckLabel(obj metav1.Object, key, value string) bool {
|
|||
return labels[key] == value
|
||||
}
|
||||
|
||||
func GetLabel(obj metav1.Object, key string) string {
|
||||
labels := obj.GetLabels()
|
||||
if labels == nil {
|
||||
return ""
|
||||
}
|
||||
return labels[key]
|
||||
}
|
||||
|
||||
func SetManagedByKyvernoLabel(obj metav1.Object) {
|
||||
SetLabel(obj, kyvernov1.LabelAppManagedBy, kyvernov1.ValueKyvernoApp)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,13 +12,17 @@ import (
|
|||
controllerutils "github.com/kyverno/kyverno/pkg/utils/controller"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
const (
|
||||
// resource labels
|
||||
LabelResourceHash = "audit.kyverno.io/resource.hash"
|
||||
LabelResourceUid = "audit.kyverno.io/resource.uid"
|
||||
LabelResourceHash = "audit.kyverno.io/resource.hash"
|
||||
LabelResourceUid = "audit.kyverno.io/resource.uid"
|
||||
LabelResourceGVR = "audit.kyverno.io/resource.gvr"
|
||||
LabelResourceNamespace = "audit.kyverno.io/resource.namespace"
|
||||
LabelResourceName = "audit.kyverno.io/resource.name"
|
||||
// policy labels
|
||||
LabelDomainClusterPolicy = "cpol.kyverno.io"
|
||||
LabelDomainPolicy = "pol.kyverno.io"
|
||||
|
|
@ -66,10 +70,23 @@ func SetManagedByKyvernoLabel(obj metav1.Object) {
|
|||
controllerutils.SetLabel(obj, kyvernov1.LabelAppManagedBy, kyvernov1.ValueKyvernoApp)
|
||||
}
|
||||
|
||||
func SetResourceLabels(report kyvernov1alpha2.ReportInterface, uid types.UID) {
|
||||
func SetResourceUid(report kyvernov1alpha2.ReportInterface, uid types.UID) {
|
||||
controllerutils.SetLabel(report, LabelResourceUid, string(uid))
|
||||
}
|
||||
|
||||
func SetResourceGVR(report kyvernov1alpha2.ReportInterface, gvr schema.GroupVersionResource) {
|
||||
if gvr.Group != "" {
|
||||
controllerutils.SetLabel(report, LabelResourceGVR, gvr.Resource+"."+gvr.Version+"."+gvr.Group)
|
||||
} else {
|
||||
controllerutils.SetLabel(report, LabelResourceGVR, gvr.Resource+"."+gvr.Version)
|
||||
}
|
||||
}
|
||||
|
||||
func SetResourceNamespaceAndName(report kyvernov1alpha2.ReportInterface, namespace, name string) {
|
||||
controllerutils.SetLabel(report, LabelResourceNamespace, namespace)
|
||||
controllerutils.SetLabel(report, LabelResourceName, name)
|
||||
}
|
||||
|
||||
func CalculateResourceHash(resource unstructured.Unstructured) string {
|
||||
copy := resource.DeepCopy()
|
||||
obj := copy.Object
|
||||
|
|
@ -102,7 +119,24 @@ func SetPolicyLabel(report kyvernov1alpha2.ReportInterface, policy kyvernov1.Pol
|
|||
}
|
||||
|
||||
func GetResourceUid(report metav1.Object) types.UID {
|
||||
return types.UID(report.GetLabels()[LabelResourceUid])
|
||||
return types.UID(controllerutils.GetLabel(report, LabelResourceUid))
|
||||
}
|
||||
|
||||
func GetResourceGVR(report metav1.Object) schema.GroupVersionResource {
|
||||
arg := controllerutils.GetLabel(report, LabelResourceGVR)
|
||||
dots := strings.Count(arg, ".")
|
||||
if dots >= 2 {
|
||||
s := strings.SplitN(arg, ".", 3)
|
||||
return schema.GroupVersionResource{Group: s[2], Version: s[1], Resource: s[0]}
|
||||
} else if dots == 1 {
|
||||
s := strings.SplitN(arg, ".", 2)
|
||||
return schema.GroupVersionResource{Version: s[1], Resource: s[0]}
|
||||
}
|
||||
return schema.GroupVersionResource{Resource: arg}
|
||||
}
|
||||
|
||||
func GetResourceNamespaceAndName(report kyvernov1alpha2.ReportInterface) (string, string) {
|
||||
return controllerutils.GetLabel(report, LabelResourceNamespace), controllerutils.GetLabel(report, LabelResourceName)
|
||||
}
|
||||
|
||||
func GetResourceHash(report metav1.Object) string {
|
||||
|
|
|
|||
|
|
@ -6,35 +6,29 @@ import (
|
|||
engineapi "github.com/kyverno/kyverno/pkg/engine/api"
|
||||
controllerutils "github.com/kyverno/kyverno/pkg/utils/controller"
|
||||
admissionv1 "k8s.io/api/admission/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
)
|
||||
|
||||
func NewAdmissionReport(namespace, name, owner string, uid types.UID, gvk metav1.GroupVersionKind) kyvernov1alpha2.ReportInterface {
|
||||
ownerRef := metav1.OwnerReference{
|
||||
APIVersion: metav1.GroupVersion{Group: gvk.Group, Version: gvk.Version}.String(),
|
||||
Kind: gvk.Kind,
|
||||
Name: owner,
|
||||
UID: uid,
|
||||
}
|
||||
func NewAdmissionReport(namespace, name string, gvr schema.GroupVersionResource, resource unstructured.Unstructured) kyvernov1alpha2.ReportInterface {
|
||||
var report kyvernov1alpha2.ReportInterface
|
||||
if namespace == "" {
|
||||
report = &kyvernov1alpha2.ClusterAdmissionReport{Spec: kyvernov1alpha2.AdmissionReportSpec{Owner: ownerRef}}
|
||||
report = &kyvernov1alpha2.ClusterAdmissionReport{Spec: kyvernov1alpha2.AdmissionReportSpec{}}
|
||||
} else {
|
||||
report = &kyvernov1alpha2.AdmissionReport{Spec: kyvernov1alpha2.AdmissionReportSpec{Owner: ownerRef}}
|
||||
report = &kyvernov1alpha2.AdmissionReport{Spec: kyvernov1alpha2.AdmissionReportSpec{}}
|
||||
}
|
||||
report.SetName(name)
|
||||
report.SetNamespace(namespace)
|
||||
SetResourceLabels(report, uid)
|
||||
SetResourceUid(report, resource.GetUID())
|
||||
SetResourceGVR(report, gvr)
|
||||
SetResourceNamespaceAndName(report, resource.GetNamespace(), resource.GetName())
|
||||
SetManagedByKyvernoLabel(report)
|
||||
return report
|
||||
}
|
||||
|
||||
func BuildAdmissionReport(resource unstructured.Unstructured, request *admissionv1.AdmissionRequest, gvk metav1.GroupVersionKind, responses ...*engineapi.EngineResponse) kyvernov1alpha2.ReportInterface {
|
||||
report := NewAdmissionReport(resource.GetNamespace(), string(request.UID), resource.GetName(), resource.GetUID(), gvk)
|
||||
SetResourceVersionLabels(report, &resource)
|
||||
func BuildAdmissionReport(resource unstructured.Unstructured, request *admissionv1.AdmissionRequest, responses ...*engineapi.EngineResponse) kyvernov1alpha2.ReportInterface {
|
||||
report := NewAdmissionReport(resource.GetNamespace(), string(request.UID), schema.GroupVersionResource(request.Resource), resource)
|
||||
SetResponses(report, responses...)
|
||||
return report
|
||||
}
|
||||
|
|
@ -49,7 +43,7 @@ func NewBackgroundScanReport(namespace, name string, gvk schema.GroupVersionKind
|
|||
report.SetName(name)
|
||||
report.SetNamespace(namespace)
|
||||
controllerutils.SetOwner(report, gvk.GroupVersion().String(), gvk.Kind, owner, uid)
|
||||
SetResourceLabels(report, uid)
|
||||
SetResourceUid(report, uid)
|
||||
SetManagedByKyvernoLabel(report)
|
||||
return report
|
||||
}
|
||||
|
|
|
|||
|
|
@ -14,7 +14,6 @@ import (
|
|||
engineapi "github.com/kyverno/kyverno/pkg/engine/api"
|
||||
"github.com/kyverno/kyverno/pkg/event"
|
||||
"github.com/kyverno/kyverno/pkg/tracing"
|
||||
controllerutils "github.com/kyverno/kyverno/pkg/utils/controller"
|
||||
jsonutils "github.com/kyverno/kyverno/pkg/utils/json"
|
||||
reportutils "github.com/kyverno/kyverno/pkg/utils/report"
|
||||
webhookutils "github.com/kyverno/kyverno/pkg/webhooks/utils"
|
||||
|
|
@ -172,12 +171,7 @@ func (v *imageVerificationHandler) handleAudit(
|
|||
"",
|
||||
fmt.Sprintf("AUDIT %s %s", request.Operation, request.Kind),
|
||||
func(ctx context.Context, span trace.Span) {
|
||||
report := reportutils.BuildAdmissionReport(resource, request, request.Kind, engineResponses...)
|
||||
// if it's not a creation, the resource already exists, we can set the owner
|
||||
if request.Operation != admissionv1.Create {
|
||||
gv := metav1.GroupVersion{Group: request.Kind.Group, Version: request.Kind.Version}
|
||||
controllerutils.SetOwner(report, gv.String(), request.Kind.Kind, resource.GetName(), resource.GetUID())
|
||||
}
|
||||
report := reportutils.BuildAdmissionReport(resource, request, engineResponses...)
|
||||
if len(report.GetResults()) > 0 {
|
||||
_, err := reportutils.CreateReport(context.Background(), report, v.kyvernoClient)
|
||||
if err != nil {
|
||||
|
|
|
|||
|
|
@ -18,7 +18,6 @@ import (
|
|||
"github.com/kyverno/kyverno/pkg/policycache"
|
||||
"github.com/kyverno/kyverno/pkg/tracing"
|
||||
admissionutils "github.com/kyverno/kyverno/pkg/utils/admission"
|
||||
controllerutils "github.com/kyverno/kyverno/pkg/utils/controller"
|
||||
reportutils "github.com/kyverno/kyverno/pkg/utils/report"
|
||||
webhookutils "github.com/kyverno/kyverno/pkg/webhooks/utils"
|
||||
"go.opentelemetry.io/otel/trace"
|
||||
|
|
@ -199,6 +198,10 @@ func (v *validationHandler) handleAudit(
|
|||
if !reportutils.IsGvkSupported(schema.GroupVersionKind(request.Kind)) {
|
||||
createReport = false
|
||||
}
|
||||
// if the underlying resource has no UID don't create a report
|
||||
if resource.GetUID() == "" {
|
||||
createReport = false
|
||||
}
|
||||
tracing.Span(
|
||||
context.Background(),
|
||||
"",
|
||||
|
|
@ -212,12 +215,7 @@ func (v *validationHandler) handleAudit(
|
|||
v.eventGen.Add(events...)
|
||||
if createReport {
|
||||
responses = append(responses, engineResponses...)
|
||||
report := reportutils.BuildAdmissionReport(resource, request, request.Kind, responses...)
|
||||
// if it's not a creation, the resource already exists, we can set the owner
|
||||
if request.Operation != admissionv1.Create {
|
||||
gv := metav1.GroupVersion{Group: request.Kind.Group, Version: request.Kind.Version}
|
||||
controllerutils.SetOwner(report, gv.String(), request.Kind.Kind, resource.GetName(), resource.GetUID())
|
||||
}
|
||||
report := reportutils.BuildAdmissionReport(resource, request, responses...)
|
||||
if len(report.GetResults()) > 0 {
|
||||
_, err = reportutils.CreateReport(ctx, report, v.kyvernoClient)
|
||||
if err != nil {
|
||||
|
|
|
|||
|
|
@ -6,10 +6,6 @@ metadata:
|
|||
kind: ConfigMap
|
||||
name: emergency
|
||||
spec:
|
||||
owner:
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
name: emergency
|
||||
results:
|
||||
- policy: require-labels
|
||||
resources:
|
||||
|
|
|
|||
Loading…
Reference in a new issue