mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-05 07:26:55 +00:00
Code Activity

refactor: add a couple of constants in api (#4640)

Browse source 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
This commit is contained in:
Charles-Edouard Brétéché 2022-09-19 11:11:12 +02:00 • committed by GitHub
parent 634dff5639
commit 42a2df56c1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 29 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
api/kyverno/v1/constants.go
View file

@ -3,4 +3,8 @@ package v1
const (
// PodControllersAnnotation defines the annotation key for Pod-Controllers
PodControllersAnnotation = "pod-policies.kyverno.io/autogen-controllers"
// LabelAppManagedBy defines the label key for managed-by label
LabelAppManagedBy = "app.kubernetes.io/managed-by"
// ValueKyvernoApp defines the kyverno application value
ValueKyvernoApp = "kyverno"
)

5
pkg/background/common/labels.go
View file

@ -5,6 +5,7 @@ import (
"reflect"
"strings"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
kyvernov1beta1 "github.com/kyverno/kyverno/api/kyverno/v1beta1"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
pkglabels "k8s.io/apimachinery/pkg/labels"
@ -70,8 +71,8 @@ func GenerateLabelsSet(policyKey string, trigger Object) pkglabels.Set {
func managedBy(labels map[string]string) {
// ManagedBy label
key := "app.kubernetes.io/managed-by"
value := "kyverno"
key := kyvernov1.LabelAppManagedBy
value := kyvernov1.ValueKyvernoApp
val, ok := labels[key]
if ok {
if val != value {

3
pkg/policyreport/policyreport.go
View file

@ -8,6 +8,7 @@ import (
"strings"
"github.com/cornelk/hashmap"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
kyvernov1alpha2 "github.com/kyverno/kyverno/api/kyverno/v1alpha2"
policyreportv1alpha2 "github.com/kyverno/kyverno/api/policyreport/v1alpha2"
"github.com/kyverno/kyverno/pkg/client/clientset/versioned"
@ -230,7 +231,7 @@ func CleanupPolicyReport(client versioned.Interface) error {
var gracePeriod int64 = 0
deleteOptions := metav1.DeleteOptions{GracePeriodSeconds: &gracePeriod}
selector := labels.SelectorFromSet(labels.Set(map[string]string{LabelSelectorKey: LabelSelectorValue}))
selector := labels.SelectorFromSet(labels.Set(map[string]string{LabelSelectorKey: kyvernov1.ValueKyvernoApp}))
err := client.KyvernoV1alpha2().ClusterReportChangeRequests().DeleteCollection(context.TODO(), deleteOptions, metav1.ListOptions{})
if err != nil {

6
pkg/policyreport/reportcontroller.go
View file

@ -8,6 +8,7 @@ import (
"time"
"github.com/go-logr/logr"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
kyvernov1alpha2 "github.com/kyverno/kyverno/api/kyverno/v1alpha2"
policyreportv1alpha2 "github.com/kyverno/kyverno/api/policyreport/v1alpha2"
"github.com/kyverno/kyverno/pkg/client/clientset/versioned"
@ -38,8 +39,7 @@ const (
prWorkQueueName = "policy-report-controller"
clusterpolicyreport = "clusterpolicyreport"
LabelSelectorKey = "managed-by"
LabelSelectorValue = "kyverno"
LabelSelectorKey = "managed-by"
deletedPolicyKey = "deletedpolicy"
@ -48,7 +48,7 @@ const (
var LabelSelector = &metav1.LabelSelector{
MatchLabels: map[string]string{
LabelSelectorKey: LabelSelectorValue,
LabelSelectorKey: kyvernov1.ValueKyvernoApp,
},
}

3
pkg/tls/renewer.go
View file

@ -8,6 +8,7 @@ import (
"time"
"github.com/go-logr/logr"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/config"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
@ -213,7 +214,7 @@ func (c *CertRenewer) writeSecret(name string, key *rsa.PrivateKey, certs ...*x5
Name: name,
Namespace: config.KyvernoNamespace(),
Labels: map[string]string{
ManagedByLabel: "kyverno",
ManagedByLabel: kyvernov1.ValueKyvernoApp,
},
},
Type: corev1.SecretTypeTLS,

3
pkg/tls/utils.go
View file

@ -6,6 +6,7 @@ import (
"encoding/pem"
"time"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/config"
appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
@ -103,7 +104,7 @@ func IsSecretManagedByKyverno(secret *corev1.Secret) bool {
if labels == nil {
return false
}
if labels[ManagedByLabel] != "kyverno" {
if labels[ManagedByLabel] != kyvernov1.ValueKyvernoApp {
return false
}
}

8
pkg/webhookconfig/common.go
View file

@ -7,6 +7,7 @@ import (
"reflect"
"strings"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/config"
"github.com/kyverno/kyverno/pkg/metrics"
"github.com/kyverno/kyverno/pkg/tls"
@ -19,7 +20,6 @@ import (
const (
managedByLabel string = "webhook.kyverno.io/managed-by"
kyvernoValue string = "kyverno"
)
var (
@ -38,7 +38,7 @@ var (
}
vertifyObjectSelector = &metav1.LabelSelector{
MatchLabels: map[string]string{
"app.kubernetes.io/name": kyvernoValue,
"app.kubernetes.io/name": kyvernov1.ValueKyvernoApp,
},
}
update = []admissionregistrationv1.OperationType{admissionregistrationv1.Update}
@ -75,7 +75,7 @@ func getHealthyPodsIP(pods []corev1.Pod) []string {
func (wrc *Register) GetKubePolicyClusterRoleName() (*rbacv1.ClusterRole, error) {
selector := &metav1.LabelSelector{
MatchLabels: map[string]string{
"app.kubernetes.io/name": kyvernoValue,
"app.kubernetes.io/name": kyvernov1.ValueKyvernoApp,
},
}
clusterRoles, err := wrc.kubeClient.RbacV1().ClusterRoles().List(context.TODO(), metav1.ListOptions{LabelSelector: metav1.FormatLabelSelector(selector)})
@ -199,7 +199,7 @@ func generateObjectMeta(name string, owner ...metav1.OwnerReference) metav1.Obje
return metav1.ObjectMeta{
Name: name,
Labels: map[string]string{
managedByLabel: kyvernoValue,
managedByLabel: kyvernov1.ValueKyvernoApp,
},
OwnerReferences: owner,
}

5
pkg/webhookconfig/registration.go
View file

@ -10,6 +10,7 @@ import (
"time"
"github.com/go-logr/logr"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/client/clientset/versioned"
kyvernov1informers "github.com/kyverno/kyverno/pkg/client/informers/externalversions/kyverno/v1"
"github.com/kyverno/kyverno/pkg/clients/dclient"
@ -223,7 +224,7 @@ func (wrc *Register) GetWebhookTimeOut() time.Duration {
func (wrc *Register) UpdateWebhooksCaBundle() error {
selector := &metav1.LabelSelector{
MatchLabels: map[string]string{
managedByLabel: kyvernoValue,
managedByLabel: kyvernov1.ValueKyvernoApp,
},
}
caData := wrc.readCaData()
@ -419,7 +420,7 @@ func (wrc *Register) checkEndpoint() error {
}
selector := &metav1.LabelSelector{
MatchLabels: map[string]string{
"app.kubernetes.io/name": "kyverno",
"app.kubernetes.io/name": kyvernov1.ValueKyvernoApp,
},
}
pods, err := wrc.kubeClient.CoreV1().Pods(config.KyvernoNamespace()).List(context.TODO(), metav1.ListOptions{LabelSelector: metav1.FormatLabelSelector(selector)})

3
pkg/webhookconfig/status.go
View file

@ -6,6 +6,7 @@ import (
"time"
"github.com/go-logr/logr"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/config"
"github.com/kyverno/kyverno/pkg/event"
"github.com/pkg/errors"
@ -106,7 +107,7 @@ func (vc statusControl) UpdateLastRequestTimestmap(new time.Time) error {
label := lease.GetLabels()
if len(label) == 0 {
label = make(map[string]string)
label["app.kubernetes.io/name"] = "kyverno"
label["app.kubernetes.io/name"] = kyvernov1.ValueKyvernoApp
}
lease.SetLabels(label)

2
pkg/webhooks/resource/generation/generation.go
View file

@ -156,7 +156,7 @@ func (h *generationHandler) HandleUpdatesForGenerateRules(request *admissionv1.A
h.handleUpdateGenerateSourceResource(resLabels)
}
if resLabels["app.kubernetes.io/managed-by"] == "kyverno" && resLabels["policy.kyverno.io/synchronize"] == "enable" && request.Operation == admissionv1.Update {
if resLabels[kyvernov1.LabelAppManagedBy] == kyvernov1.ValueKyvernoApp && resLabels["policy.kyverno.io/synchronize"] == "enable" && request.Operation == admissionv1.Update {
h.handleUpdateGenerateTargetResource(request, policies, resLabels)
}
}

2
pkg/webhooks/resource/handlers.go
View file

@ -211,7 +211,7 @@ func (h *handlers) handleDelete(logger logr.Logger, request *admissionv1.Admissi
}
resLabels := resource.GetLabels()
if resLabels["app.kubernetes.io/managed-by"] == "kyverno" {
if resLabels[kyvernov1.LabelAppManagedBy] == kyvernov1.ValueKyvernoApp {
urName := resLabels["policy.kyverno.io/gr-name"]
ur, err := h.urLister.Get(urName)
if err != nil {

3
pkg/webhooks/server.go
View file

@ -10,6 +10,7 @@ import (
"github.com/go-logr/logr"
"github.com/julienschmidt/httprouter"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/config"
"github.com/kyverno/kyverno/pkg/toggle"
"github.com/kyverno/kyverno/pkg/utils"
@ -133,7 +134,7 @@ func protect(inner handlers.AdmissionHandler) handlers.AdmissionHandler {
}
for _, resource := range []unstructured.Unstructured{newResource, oldResource} {
resLabels := resource.GetLabels()
if resLabels["app.kubernetes.io/managed-by"] == "kyverno" {
if resLabels[kyvernov1.LabelAppManagedBy] == kyvernov1.ValueKyvernoApp {
if request.UserInfo.Username != fmt.Sprintf("system:serviceaccount:%s:%s", config.KyvernoNamespace(), config.KyvernoServiceAccountName()) {
logger.Info("Access to the resource not authorized, this is a kyverno managed resource and should be altered only by kyverno")
return admissionutils.ResponseFailure("A kyverno managed resource can only be modified by kyverno")