mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-31 03:45:17 +00:00
Deploy specific controllers (#8849)
* Initial changes for deploy specific controllers Signed-off-by: anushkamittal2001 <anushka@nirmata.com> * Include correct values in values.yaml Signed-off-by: anushkamittal2001 <anushka@nirmata.com> * Remove check for other controllers Signed-off-by: anushkamittal2001 <anushka@nirmata.com> * Sanity checks for other controllers Signed-off-by: anushkamittal2001 <anushka@nirmata.com> * resolve lint errors Signed-off-by: anushkamittal2001 <anushka@nirmata.com> * add separate flags for all crds; conditions for controller crd relation Signed-off-by: anushkamittal2001 <anushka@nirmata.com> * fix Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * rm global Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * rm global Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * values Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * codegen Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * codegen Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * codegen Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * codegen Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * codegen Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> --------- Signed-off-by: anushkamittal2001 <anushka@nirmata.com> Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Anushka Mittal
GitHub
parent
3a5e63de48
commit
ce0c704086
30 changed files with 49985 additions and 49879 deletions
59
Makefile
59
Makefile
|
|
@ -497,7 +497,7 @@ codegen-crds-policyreport: $(CONTROLLER_GEN) ## Generate policy reports CRDs
|
||||||
|
|
||||||
.PHONY: codegen-crds-reports
|
.PHONY: codegen-crds-reports
|
||||||
codegen-crds-reports: $(CONTROLLER_GEN) ## Generate reports CRDs
|
codegen-crds-reports: $(CONTROLLER_GEN) ## Generate reports CRDs
|
||||||
@echo Generate policy reports crds... >&2
|
@echo Generate reports crds... >&2
|
||||||
@rm -rf $(CRDS_PATH)/reports && mkdir -p $(CRDS_PATH)/reports
|
@rm -rf $(CRDS_PATH)/reports && mkdir -p $(CRDS_PATH)/reports
|
||||||
@$(CONTROLLER_GEN) crd paths=./api/reports/... crd:crdVersions=v1 output:dir=$(CRDS_PATH)/reports
|
@$(CONTROLLER_GEN) crd paths=./api/reports/... crd:crdVersions=v1 output:dir=$(CRDS_PATH)/reports
|
||||||
|
|
||||||
|
|
@ -566,37 +566,38 @@ codegen-fix-policies: $(CLI_BIN) ## Fix CLI policy files
|
||||||
.PHONY: codegen-cli-all
|
.PHONY: codegen-cli-all
|
||||||
codegen-cli-all: codegen-cli-crds codegen-cli-docs codegen-cli-api-docs codegen-fix-tests ## Generate all CLI related code and docs
|
codegen-cli-all: codegen-cli-crds codegen-cli-docs codegen-cli-api-docs codegen-fix-tests ## Generate all CLI related code and docs
|
||||||
|
|
||||||
|
define generate_crd
|
||||||
|
@echo "{{- if .Values.groups.$(4).$(5) }}" > ./charts/kyverno/charts/crds/templates/$(3)/$(1)
|
||||||
|
@cat $(CRDS_PATH)/$(2)/$(1) \
|
||||||
|
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- end }}' \
|
||||||
|
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- toYaml . | nindent 4 }}' \
|
||||||
|
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- with .Values.annotations }}' \
|
||||||
|
| $(SED) -e '/^ annotations:/i \ \ labels:' \
|
||||||
|
| $(SED) -e '/^ labels:/a \ \ \ \ {{- include "kyverno.crds.labels" . | nindent 4 }}' \
|
||||||
|
>> ./charts/kyverno/charts/crds/templates/$(3)/$(1)
|
||||||
|
@echo "{{- end }}" >> ./charts/kyverno/charts/crds/templates/$(3)/$(1)
|
||||||
|
endef
|
||||||
|
|
||||||
.PHONY: codegen-helm-crds
|
.PHONY: codegen-helm-crds
|
||||||
codegen-helm-crds: codegen-crds-all ## Generate helm CRDs
|
codegen-helm-crds: codegen-crds-all ## Generate helm CRDs
|
||||||
@echo Generate helm crds... >&2
|
@echo Generate helm crds... >&2
|
||||||
@rm -rf ./charts/kyverno/charts/crds/templates/*.yaml
|
@rm -rf ./charts/kyverno/charts/crds/templates/kyverno.io && mkdir -p ./charts/kyverno/charts/crds/templates/kyverno.io
|
||||||
@echo "{{- if .Values.groups.kyverno }}" > ./charts/kyverno/charts/crds/templates/kyverno.yaml
|
@rm -rf ./charts/kyverno/charts/crds/templates/reports.kyverno.io && mkdir -p ./charts/kyverno/charts/crds/templates/reports.kyverno.io
|
||||||
@cat $(CRDS_PATH)/kyverno/* \
|
@rm -rf ./charts/kyverno/charts/crds/templates/wgpolicyk8s.io && mkdir -p ./charts/kyverno/charts/crds/templates/wgpolicyk8s.io
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- end }}' \
|
$(call generate_crd,kyverno.io_admissionreports.yaml,kyverno,kyverno.io,kyverno,admissionreports)
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- toYaml . | nindent 4 }}' \
|
$(call generate_crd,kyverno.io_backgroundscanreports.yaml,kyverno,kyverno.io,kyverno,backgroundscanreports)
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- with .Values.annotations }}' \
|
$(call generate_crd,kyverno.io_cleanuppolicies.yaml,kyverno,kyverno.io,kyverno,cleanuppolicies)
|
||||||
| $(SED) -e '/^ annotations:/i \ \ labels:' \
|
$(call generate_crd,kyverno.io_clusteradmissionreports.yaml,kyverno,kyverno.io,kyverno,clusteradmissionreports)
|
||||||
| $(SED) -e '/^ labels:/a \ \ \ \ {{- include "kyverno.crds.labels" . | nindent 4 }}' \
|
$(call generate_crd,kyverno.io_clusterbackgroundscanreports.yaml,kyverno,kyverno.io,kyverno,clusterbackgroundscanreports)
|
||||||
>> ./charts/kyverno/charts/crds/templates/kyverno.yaml
|
$(call generate_crd,kyverno.io_clustercleanuppolicies.yaml,kyverno,kyverno.io,kyverno,clustercleanuppolicies)
|
||||||
@echo "{{- end }}" >> ./charts/kyverno/charts/crds/templates/kyverno.yaml
|
$(call generate_crd,kyverno.io_clusterpolicies.yaml,kyverno,kyverno.io,kyverno,clusterpolicies)
|
||||||
@echo "{{- if .Values.groups.reports }}" > ./charts/kyverno/charts/crds/templates/reports.yaml
|
$(call generate_crd,kyverno.io_policies.yaml,kyverno,kyverno.io,kyverno,policies)
|
||||||
@cat $(CRDS_PATH)/reports/* \
|
$(call generate_crd,kyverno.io_policyexceptions.yaml,kyverno,kyverno.io,kyverno,policyexceptions)
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- end }}' \
|
$(call generate_crd,kyverno.io_updaterequests.yaml,kyverno,kyverno.io,kyverno,updaterequests)
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- toYaml . | nindent 4 }}' \
|
$(call generate_crd,reports.kyverno.io_clusterephemeralreports.yaml,reports,reports.kyverno.io,reports,clusterephemeralreports)
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- with .Values.annotations }}' \
|
$(call generate_crd,reports.kyverno.io_ephemeralreports.yaml,reports,reports.kyverno.io,reports,ephemeralreports)
|
||||||
| $(SED) -e '/^ annotations:/i \ \ labels:' \
|
$(call generate_crd,wgpolicyk8s.io_clusterpolicyreports.yaml,policyreport,wgpolicyk8s.io,wgpolicyk8s,clusterpolicyreports)
|
||||||
| $(SED) -e '/^ labels:/a \ \ \ \ {{- include "kyverno.crds.labels" . | nindent 4 }}' \
|
$(call generate_crd,wgpolicyk8s.io_policyreports.yaml,policyreport,wgpolicyk8s.io,wgpolicyk8s,policyreports)
|
||||||
>> ./charts/kyverno/charts/crds/templates/reports.yaml
|
|
||||||
@echo "{{- end }}" >> ./charts/kyverno/charts/crds/templates/reports.yaml
|
|
||||||
@echo "{{- if .Values.groups.policyreport }}" > ./charts/kyverno/charts/crds/templates/policyreport.yaml
|
|
||||||
@cat $(CRDS_PATH)/policyreport/* \
|
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- end }}' \
|
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- toYaml . | nindent 4 }}' \
|
|
||||||
| $(SED) -e '/^ annotations:/a \ \ \ \ {{- with .Values.annotations }}' \
|
|
||||||
| $(SED) -e '/^ annotations:/i \ \ labels:' \
|
|
||||||
| $(SED) -e '/^ labels:/a \ \ \ \ {{- include "kyverno.crds.labels" . | nindent 4 }}' \
|
|
||||||
>> ./charts/kyverno/charts/crds/templates/policyreport.yaml
|
|
||||||
@echo "{{- end }}" >> ./charts/kyverno/charts/crds/templates/policyreport.yaml
|
|
||||||
|
|
||||||
.PHONY: codegen-helm-all
|
.PHONY: codegen-helm-all
|
||||||
codegen-helm-all: codegen-helm-crds codegen-helm-docs ## Generate helm docs and CRDs
|
codegen-helm-all: codegen-helm-crds codegen-helm-docs ## Generate helm docs and CRDs
|
||||||
|
|
|
||||||
|
|
@ -257,9 +257,9 @@ The chart values are organised per component.
|
||||||
| Key | Type | Default | Description |
|
| Key | Type | Default | Description |
|
||||||
|-----|------|---------|-------------|
|
|-----|------|---------|-------------|
|
||||||
| crds.install | bool | `true` | Whether to have Helm install the Kyverno CRDs, if the CRDs are not installed by Helm, they must be added before policies can be created |
|
| crds.install | bool | `true` | Whether to have Helm install the Kyverno CRDs, if the CRDs are not installed by Helm, they must be added before policies can be created |
|
||||||
| crds.groups.kyverno | bool | `true` | Install CRDs in group `kyverno.io` |
|
| crds.groups.kyverno | object | `{"admissionreports":true,"backgroundscanreports":true,"cleanuppolicies":true,"clusteradmissionreports":true,"clusterbackgroundscanreports":true,"clustercleanuppolicies":true,"clusterpolicies":true,"policies":true,"policyexceptions":true,"updaterequests":true}` | Install CRDs in group `kyverno.io` |
|
||||||
| crds.groups.policyreport | bool | `true` | Install CRDs in group `wgpolicyk8s.io` |
|
| crds.groups.reports | object | `{"clusterephemeralreports":true,"ephemeralreports":true}` | Install CRDs in group `reports.kyverno.io` |
|
||||||
| crds.groups.reports | bool | `true` | Install CRDs in group `reports.kyverno.io` |
|
| crds.groups.wgpolicyk8s | object | `{"clusterpolicyreports":true,"policyreports":true}` | Install CRDs in group `wgpolicyk8s.io` |
|
||||||
| crds.annotations | object | `{}` | Additional CRDs annotations |
|
| crds.annotations | object | `{}` | Additional CRDs annotations |
|
||||||
| crds.customLabels | object | `{}` | Additional CRDs labels |
|
| crds.customLabels | object | `{}` | Additional CRDs labels |
|
||||||
| crds.migration.enabled | bool | `true` | Enable CRDs migration using helm post upgrade hook |
|
| crds.migration.enabled | bool | `true` | Enable CRDs migration using helm post upgrade hook |
|
||||||
|
|
|
||||||
|
|
@ -6,9 +6,9 @@
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
| Key | Type | Default | Description |
|
||||||
|-----|------|---------|-------------|
|
|-----|------|---------|-------------|
|
||||||
| groups.kyverno | bool | `true` | This field can be overwritten by setting crds.labels in the parent chart |
|
| groups.kyverno | object | `{"admissionreports":true,"backgroundscanreports":true,"cleanuppolicies":true,"clusteradmissionreports":true,"clusterbackgroundscanreports":true,"clustercleanuppolicies":true,"clusterpolicies":true,"policies":true,"policyexceptions":true,"updaterequests":true}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||||
| groups.policyreport | bool | `true` | This field can be overwritten by setting crds.labels in the parent chart |
|
| groups.reports | object | `{"clusterephemeralreports":true,"ephemeralreports":true}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||||
| groups.reports | bool | `true` | This field can be overwritten by setting crds.labels in the parent chart |
|
| groups.wgpolicyk8s | object | `{"clusterpolicyreports":true,"policyreports":true}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||||
| annotations | object | `{}` | This field can be overwritten by setting crds.annotations in the parent chart |
|
| annotations | object | `{}` | This field can be overwritten by setting crds.annotations in the parent chart |
|
||||||
| customLabels | object | `{}` | This field can be overwritten by setting crds.labels in the parent chart |
|
| customLabels | object | `{}` | This field can be overwritten by setting crds.labels in the parent chart |
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,647 @@
|
||||||
|
{{- if .Values.groups.kyverno.admissionreports }}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
|
name: admissionreports.kyverno.io
|
||||||
|
spec:
|
||||||
|
group: kyverno.io
|
||||||
|
names:
|
||||||
|
categories:
|
||||||
|
- kyverno
|
||||||
|
kind: AdmissionReport
|
||||||
|
listKind: AdmissionReportList
|
||||||
|
plural: admissionreports
|
||||||
|
shortNames:
|
||||||
|
- admr
|
||||||
|
singular: admissionreport
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: AGE
|
||||||
|
type: date
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: PASS
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: FAIL
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: WARN
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: ERROR
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: SKIP
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||||
|
name: GVR
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||||
|
name: REF
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||||
|
name: AGGREGATE
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v1alpha2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: AdmissionReport is the Schema for the AdmissionReports API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
owner:
|
||||||
|
description: Owner is a reference to the report owner (e.g. a Deployment,
|
||||||
|
Namespace, or Node)
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
blockOwnerDeletion:
|
||||||
|
description: If true, AND if the owner has the "foregroundDeletion"
|
||||||
|
finalizer, then the owner cannot be deleted from the key-value
|
||||||
|
store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||||
|
for how the garbage collector interacts with this field and
|
||||||
|
enforces the foreground deletion. Defaults to false. To set
|
||||||
|
this field, a user needs "delete" permission of the owner, otherwise
|
||||||
|
422 (Unprocessable Entity) will be returned.
|
||||||
|
type: boolean
|
||||||
|
controller:
|
||||||
|
description: If true, this reference points to the managing controller.
|
||||||
|
type: boolean
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids'
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- apiVersion
|
||||||
|
- kind
|
||||||
|
- name
|
||||||
|
- uid
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- owner
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources: {}
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: AGE
|
||||||
|
type: date
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: PASS
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: FAIL
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: WARN
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: ERROR
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: SKIP
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||||
|
name: GVR
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||||
|
name: REF
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||||
|
name: AGGREGATE
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: AdmissionReport is the Schema for the AdmissionReports API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
owner:
|
||||||
|
description: Owner is a reference to the report owner (e.g. a Deployment,
|
||||||
|
Namespace, or Node)
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
blockOwnerDeletion:
|
||||||
|
description: If true, AND if the owner has the "foregroundDeletion"
|
||||||
|
finalizer, then the owner cannot be deleted from the key-value
|
||||||
|
store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||||
|
for how the garbage collector interacts with this field and
|
||||||
|
enforces the foreground deletion. Defaults to false. To set
|
||||||
|
this field, a user needs "delete" permission of the owner, otherwise
|
||||||
|
422 (Unprocessable Entity) will be returned.
|
||||||
|
type: boolean
|
||||||
|
controller:
|
||||||
|
description: If true, this reference points to the managing controller.
|
||||||
|
type: boolean
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids'
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- apiVersion
|
||||||
|
- kind
|
||||||
|
- name
|
||||||
|
- uid
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- owner
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
subresources: {}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,581 @@
|
||||||
|
{{- if .Values.groups.kyverno.backgroundscanreports }}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
|
name: backgroundscanreports.kyverno.io
|
||||||
|
spec:
|
||||||
|
group: kyverno.io
|
||||||
|
names:
|
||||||
|
categories:
|
||||||
|
- kyverno
|
||||||
|
kind: BackgroundScanReport
|
||||||
|
listKind: BackgroundScanReportList
|
||||||
|
plural: backgroundscanreports
|
||||||
|
shortNames:
|
||||||
|
- bgscanr
|
||||||
|
singular: backgroundscanreport
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].apiVersion
|
||||||
|
name: ApiVersion
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].kind
|
||||||
|
name: Kind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].name
|
||||||
|
name: Subject
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: Pass
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: Fail
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: Warn
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: Error
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: Skip
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||||
|
name: Hash
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v1alpha2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: BackgroundScanReport is the Schema for the BackgroundScanReports
|
||||||
|
API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources: {}
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].apiVersion
|
||||||
|
name: ApiVersion
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].kind
|
||||||
|
name: Kind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].name
|
||||||
|
name: Subject
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: Pass
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: Fail
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: Warn
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: Error
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: Skip
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||||
|
name: Hash
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: BackgroundScanReport is the Schema for the BackgroundScanReports
|
||||||
|
API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
subresources: {}
|
||||||
|
{{- end }}
|
||||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,4 +1,4 @@
|
||||||
{{- if .Values.groups.reports }}
|
{{- if .Values.groups.kyverno.clusteradmissionreports }}
|
||||||
---
|
---
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
kind: CustomResourceDefinition
|
kind: CustomResourceDefinition
|
||||||
|
|
@ -10,62 +10,53 @@ metadata:
|
||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
controller-gen.kubebuilder.io/version: v0.12.0
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
name: clusterephemeralreports.reports.kyverno.io
|
name: clusteradmissionreports.kyverno.io
|
||||||
spec:
|
spec:
|
||||||
group: reports.kyverno.io
|
group: kyverno.io
|
||||||
names:
|
names:
|
||||||
categories:
|
categories:
|
||||||
- kyverno
|
- kyverno
|
||||||
kind: ClusterEphemeralReport
|
kind: ClusterAdmissionReport
|
||||||
listKind: ClusterEphemeralReportList
|
listKind: ClusterAdmissionReportList
|
||||||
plural: clusterephemeralreports
|
plural: clusteradmissionreports
|
||||||
shortNames:
|
shortNames:
|
||||||
- cephr
|
- cadmr
|
||||||
singular: clusterephemeralreport
|
singular: clusteradmissionreport
|
||||||
scope: Cluster
|
scope: Cluster
|
||||||
versions:
|
versions:
|
||||||
- additionalPrinterColumns:
|
- additionalPrinterColumns:
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/source']
|
- jsonPath: .metadata.creationTimestamp
|
||||||
name: Source
|
name: AGE
|
||||||
type: string
|
type: date
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.group']
|
|
||||||
name: Group
|
|
||||||
type: string
|
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.kind']
|
|
||||||
name: Kind
|
|
||||||
type: string
|
|
||||||
- jsonPath: .metadata.annotations['audit\.kyverno\.io/resource\.name']
|
|
||||||
name: Owner
|
|
||||||
type: string
|
|
||||||
- jsonPath: .spec.summary.pass
|
- jsonPath: .spec.summary.pass
|
||||||
name: Pass
|
name: PASS
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.fail
|
- jsonPath: .spec.summary.fail
|
||||||
name: Fail
|
name: FAIL
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.warn
|
- jsonPath: .spec.summary.warn
|
||||||
name: Warn
|
name: WARN
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.error
|
- jsonPath: .spec.summary.error
|
||||||
name: Error
|
name: ERROR
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.skip
|
- jsonPath: .spec.summary.skip
|
||||||
name: Skip
|
name: SKIP
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .metadata.creationTimestamp
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||||
name: Age
|
name: GVR
|
||||||
type: date
|
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.uid']
|
|
||||||
name: Uid
|
|
||||||
type: string
|
type: string
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||||
name: Hash
|
name: REF
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||||
|
name: AGGREGATE
|
||||||
priority: 1
|
priority: 1
|
||||||
type: string
|
type: string
|
||||||
name: v1
|
name: v1alpha2
|
||||||
schema:
|
schema:
|
||||||
openAPIV3Schema:
|
openAPIV3Schema:
|
||||||
description: ClusterEphemeralReport is the Schema for the ClusterEphemeralReports
|
description: ClusterAdmissionReport is the Schema for the ClusterAdmissionReports
|
||||||
API
|
API
|
||||||
properties:
|
properties:
|
||||||
apiVersion:
|
apiVersion:
|
||||||
|
|
@ -344,74 +335,40 @@ spec:
|
||||||
served: true
|
served: true
|
||||||
storage: true
|
storage: true
|
||||||
subresources: {}
|
subresources: {}
|
||||||
---
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
{{- with .Values.annotations }}
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
controller-gen.kubebuilder.io/version: v0.12.0
|
|
||||||
name: ephemeralreports.reports.kyverno.io
|
|
||||||
spec:
|
|
||||||
group: reports.kyverno.io
|
|
||||||
names:
|
|
||||||
categories:
|
|
||||||
- kyverno
|
|
||||||
kind: EphemeralReport
|
|
||||||
listKind: EphemeralReportList
|
|
||||||
plural: ephemeralreports
|
|
||||||
shortNames:
|
|
||||||
- ephr
|
|
||||||
singular: ephemeralreport
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- additionalPrinterColumns:
|
- additionalPrinterColumns:
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/source']
|
- jsonPath: .metadata.creationTimestamp
|
||||||
name: Source
|
name: AGE
|
||||||
type: string
|
type: date
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.group']
|
|
||||||
name: Group
|
|
||||||
type: string
|
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.kind']
|
|
||||||
name: Kind
|
|
||||||
type: string
|
|
||||||
- jsonPath: .metadata.annotations['audit\.kyverno\.io/resource\.name']
|
|
||||||
name: Owner
|
|
||||||
type: string
|
|
||||||
- jsonPath: .spec.summary.pass
|
- jsonPath: .spec.summary.pass
|
||||||
name: Pass
|
name: PASS
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.fail
|
- jsonPath: .spec.summary.fail
|
||||||
name: Fail
|
name: FAIL
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.warn
|
- jsonPath: .spec.summary.warn
|
||||||
name: Warn
|
name: WARN
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.error
|
- jsonPath: .spec.summary.error
|
||||||
name: Error
|
name: ERROR
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .spec.summary.skip
|
- jsonPath: .spec.summary.skip
|
||||||
name: Skip
|
name: SKIP
|
||||||
type: integer
|
type: integer
|
||||||
- jsonPath: .metadata.creationTimestamp
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.gvr']
|
||||||
name: Age
|
name: GVR
|
||||||
type: date
|
type: string
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.uid']
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.name']
|
||||||
name: Uid
|
name: REF
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/report\.aggregate']
|
||||||
|
name: AGGREGATE
|
||||||
priority: 1
|
priority: 1
|
||||||
type: string
|
type: string
|
||||||
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
name: v2
|
||||||
name: Hash
|
|
||||||
priority: 1
|
|
||||||
type: string
|
|
||||||
name: v1
|
|
||||||
schema:
|
schema:
|
||||||
openAPIV3Schema:
|
openAPIV3Schema:
|
||||||
description: EphemeralReport is the Schema for the EphemeralReports API
|
description: ClusterAdmissionReport is the Schema for the ClusterAdmissionReports
|
||||||
|
API
|
||||||
properties:
|
properties:
|
||||||
apiVersion:
|
apiVersion:
|
||||||
description: 'APIVersion defines the versioned schema of this representation
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
|
@ -687,6 +644,6 @@ spec:
|
||||||
- spec
|
- spec
|
||||||
type: object
|
type: object
|
||||||
served: true
|
served: true
|
||||||
storage: true
|
storage: false
|
||||||
subresources: {}
|
subresources: {}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,581 @@
|
||||||
|
{{- if .Values.groups.kyverno.clusterbackgroundscanreports }}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
|
name: clusterbackgroundscanreports.kyverno.io
|
||||||
|
spec:
|
||||||
|
group: kyverno.io
|
||||||
|
names:
|
||||||
|
categories:
|
||||||
|
- kyverno
|
||||||
|
kind: ClusterBackgroundScanReport
|
||||||
|
listKind: ClusterBackgroundScanReportList
|
||||||
|
plural: clusterbackgroundscanreports
|
||||||
|
shortNames:
|
||||||
|
- cbgscanr
|
||||||
|
singular: clusterbackgroundscanreport
|
||||||
|
scope: Cluster
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].apiVersion
|
||||||
|
name: ApiVersion
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].kind
|
||||||
|
name: Kind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].name
|
||||||
|
name: Subject
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: Pass
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: Fail
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: Warn
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: Error
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: Skip
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||||
|
name: Hash
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v1alpha2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ClusterBackgroundScanReport is the Schema for the ClusterBackgroundScanReports
|
||||||
|
API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources: {}
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].apiVersion
|
||||||
|
name: ApiVersion
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].kind
|
||||||
|
name: Kind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.ownerReferences[0].name
|
||||||
|
name: Subject
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: Pass
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: Fail
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: Warn
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: Error
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: Skip
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||||
|
name: Hash
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ClusterBackgroundScanReport is the Schema for the ClusterBackgroundScanReports
|
||||||
|
API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
subresources: {}
|
||||||
|
{{- end }}
|
||||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
17980
charts/kyverno/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml
Normal file
17980
charts/kyverno/charts/crds/templates/kyverno.io/kyverno.io_policies.yaml
Normal file
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,798 @@
|
||||||
|
{{- if .Values.groups.kyverno.updaterequests }}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
|
name: updaterequests.kyverno.io
|
||||||
|
spec:
|
||||||
|
group: kyverno.io
|
||||||
|
names:
|
||||||
|
categories:
|
||||||
|
- kyverno
|
||||||
|
kind: UpdateRequest
|
||||||
|
listKind: UpdateRequestList
|
||||||
|
plural: updaterequests
|
||||||
|
shortNames:
|
||||||
|
- ur
|
||||||
|
singular: updaterequest
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .spec.policy
|
||||||
|
name: Policy
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.requestType
|
||||||
|
name: RuleType
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.resource.kind
|
||||||
|
name: ResourceKind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.resource.name
|
||||||
|
name: ResourceName
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.resource.namespace
|
||||||
|
name: ResourceNamespace
|
||||||
|
type: string
|
||||||
|
- jsonPath: .status.state
|
||||||
|
name: status
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
name: v1beta1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: UpdateRequest is a request to process mutate and generate rules
|
||||||
|
in background.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ResourceSpec is the information to identify the trigger resource.
|
||||||
|
properties:
|
||||||
|
context:
|
||||||
|
description: Context ...
|
||||||
|
properties:
|
||||||
|
admissionRequestInfo:
|
||||||
|
description: AdmissionRequestInfoObject stores the admission request
|
||||||
|
and operation details
|
||||||
|
properties:
|
||||||
|
admissionRequest:
|
||||||
|
description: AdmissionRequest describes the admission.Attributes
|
||||||
|
for the admission request.
|
||||||
|
properties:
|
||||||
|
dryRun:
|
||||||
|
description: DryRun indicates that modifications will
|
||||||
|
definitely not be persisted for this request. Defaults
|
||||||
|
to false.
|
||||||
|
type: boolean
|
||||||
|
kind:
|
||||||
|
description: Kind is the fully-qualified type of object
|
||||||
|
being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- kind
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
name:
|
||||||
|
description: Name is the name of the object as presented
|
||||||
|
in the request. On a CREATE operation, the client may
|
||||||
|
omit name and rely on the server to generate the name. If
|
||||||
|
that is the case, this field will contain an empty string.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: Namespace is the namespace associated with
|
||||||
|
the request (if any).
|
||||||
|
type: string
|
||||||
|
object:
|
||||||
|
description: Object is the object from the incoming request.
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
oldObject:
|
||||||
|
description: OldObject is the existing object. Only populated
|
||||||
|
for DELETE and UPDATE requests.
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
operation:
|
||||||
|
description: Operation is the operation being performed.
|
||||||
|
This may be different than the operation requested.
|
||||||
|
e.g. a patch can result in either a CREATE or UPDATE
|
||||||
|
Operation.
|
||||||
|
type: string
|
||||||
|
options:
|
||||||
|
description: Options is the operation option structure
|
||||||
|
of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions`
|
||||||
|
or `meta.k8s.io/v1.CreateOptions`. This may be different
|
||||||
|
than the options the caller provided. e.g. for a patch
|
||||||
|
request the performed Operation might be a CREATE, in
|
||||||
|
which case the Options will a `meta.k8s.io/v1.CreateOptions`
|
||||||
|
even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
requestKind:
|
||||||
|
description: "RequestKind is the fully-qualified type
|
||||||
|
of the original API request (for example, v1.Pod or
|
||||||
|
autoscaling.v1.Scale). If this is specified and differs
|
||||||
|
from the value in \"kind\", an equivalent match and
|
||||||
|
conversion was performed. \n For example, if deployments
|
||||||
|
can be modified via apps/v1 and apps/v1beta1, and a
|
||||||
|
webhook registered a rule of `apiGroups:[\"apps\"],
|
||||||
|
apiVersions:[\"v1\"], resources: [\"deployments\"]`
|
||||||
|
and `matchPolicy: Equivalent`, an API request to apps/v1beta1
|
||||||
|
deployments would be converted and sent to the webhook
|
||||||
|
with `kind: {group:\"apps\", version:\"v1\", kind:\"Deployment\"}`
|
||||||
|
(matching the rule the webhook registered for), and
|
||||||
|
`requestKind: {group:\"apps\", version:\"v1beta1\",
|
||||||
|
kind:\"Deployment\"}` (indicating the kind of the original
|
||||||
|
API request). \n See documentation for the \"matchPolicy\"
|
||||||
|
field in the webhook configuration type for more details."
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- kind
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
requestResource:
|
||||||
|
description: "RequestResource is the fully-qualified resource
|
||||||
|
of the original API request (for example, v1.pods).
|
||||||
|
If this is specified and differs from the value in \"resource\",
|
||||||
|
an equivalent match and conversion was performed. \n
|
||||||
|
For example, if deployments can be modified via apps/v1
|
||||||
|
and apps/v1beta1, and a webhook registered a rule of
|
||||||
|
`apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources:
|
||||||
|
[\"deployments\"]` and `matchPolicy: Equivalent`, an
|
||||||
|
API request to apps/v1beta1 deployments would be converted
|
||||||
|
and sent to the webhook with `resource: {group:\"apps\",
|
||||||
|
version:\"v1\", resource:\"deployments\"}` (matching
|
||||||
|
the resource the webhook registered for), and `requestResource:
|
||||||
|
{group:\"apps\", version:\"v1beta1\", resource:\"deployments\"}`
|
||||||
|
(indicating the resource of the original API request).
|
||||||
|
\n See documentation for the \"matchPolicy\" field in
|
||||||
|
the webhook configuration type."
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- resource
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
requestSubResource:
|
||||||
|
description: RequestSubResource is the name of the subresource
|
||||||
|
of the original API request, if any (for example, "status"
|
||||||
|
or "scale") If this is specified and differs from the
|
||||||
|
value in "subResource", an equivalent match and conversion
|
||||||
|
was performed. See documentation for the "matchPolicy"
|
||||||
|
field in the webhook configuration type.
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
description: Resource is the fully-qualified resource
|
||||||
|
being requested (for example, v1.pods)
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- resource
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
subResource:
|
||||||
|
description: SubResource is the subresource being requested,
|
||||||
|
if any (for example, "status" or "scale")
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: UID is an identifier for the individual request/response.
|
||||||
|
It allows us to distinguish instances of requests which
|
||||||
|
are otherwise identical (parallel requests, requests
|
||||||
|
when earlier requests did not modify etc) The UID is
|
||||||
|
meant to track the round trip (request/response) between
|
||||||
|
the KAS and the WebHook, not the user request. It is
|
||||||
|
suitable for correlating log entries between the webhook
|
||||||
|
and apiserver, for either auditing or debugging.
|
||||||
|
type: string
|
||||||
|
userInfo:
|
||||||
|
description: UserInfo is information about the requesting
|
||||||
|
user
|
||||||
|
properties:
|
||||||
|
extra:
|
||||||
|
additionalProperties:
|
||||||
|
description: ExtraValue masks the value so protobuf
|
||||||
|
can generate
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
description: Any additional information provided by
|
||||||
|
the authenticator.
|
||||||
|
type: object
|
||||||
|
groups:
|
||||||
|
description: The names of groups this user is a part
|
||||||
|
of.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
uid:
|
||||||
|
description: A unique value that identifies this user
|
||||||
|
across time. If this user is deleted and another
|
||||||
|
user by the same name is added, they will have different
|
||||||
|
UIDs.
|
||||||
|
type: string
|
||||||
|
username:
|
||||||
|
description: The name that uniquely identifies this
|
||||||
|
user among all active users.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- kind
|
||||||
|
- operation
|
||||||
|
- resource
|
||||||
|
- uid
|
||||||
|
- userInfo
|
||||||
|
type: object
|
||||||
|
operation:
|
||||||
|
description: Operation is the type of resource operation being
|
||||||
|
checked for admission control
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
userInfo:
|
||||||
|
description: RequestInfo contains permission info carried in an
|
||||||
|
admission request.
|
||||||
|
properties:
|
||||||
|
clusterRoles:
|
||||||
|
description: ClusterRoles is a list of possible clusterRoles
|
||||||
|
send the request.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
nullable: true
|
||||||
|
type: array
|
||||||
|
roles:
|
||||||
|
description: Roles is a list of possible role send the request.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
nullable: true
|
||||||
|
type: array
|
||||||
|
userInfo:
|
||||||
|
description: UserInfo is the userInfo carried in the admission
|
||||||
|
request.
|
||||||
|
properties:
|
||||||
|
extra:
|
||||||
|
additionalProperties:
|
||||||
|
description: ExtraValue masks the value so protobuf
|
||||||
|
can generate
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
description: Any additional information provided by the
|
||||||
|
authenticator.
|
||||||
|
type: object
|
||||||
|
groups:
|
||||||
|
description: The names of groups this user is a part of.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
uid:
|
||||||
|
description: A unique value that identifies this user
|
||||||
|
across time. If this user is deleted and another user
|
||||||
|
by the same name is added, they will have different
|
||||||
|
UIDs.
|
||||||
|
type: string
|
||||||
|
username:
|
||||||
|
description: The name that uniquely identifies this user
|
||||||
|
among all active users.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
deleteDownstream:
|
||||||
|
description: DeleteDownstream represents whether the downstream needs
|
||||||
|
to be deleted.
|
||||||
|
type: boolean
|
||||||
|
policy:
|
||||||
|
description: Specifies the name of the policy.
|
||||||
|
type: string
|
||||||
|
requestType:
|
||||||
|
description: Type represents request type for background processing
|
||||||
|
enum:
|
||||||
|
- mutate
|
||||||
|
- generate
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
description: ResourceSpec is the information to identify the trigger
|
||||||
|
resource.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: APIVersion specifies resource apiVersion.
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: Kind specifies resource kind.
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: Name specifies the resource name.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: Namespace specifies resource namespace.
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: UID specifies the resource uid.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
rule:
|
||||||
|
description: Rule is the associate rule name of the current UR.
|
||||||
|
type: string
|
||||||
|
synchronize:
|
||||||
|
description: Synchronize represents the sync behavior of the corresponding
|
||||||
|
rule Optional. Defaults to "false" if not specified.
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- context
|
||||||
|
- deleteDownstream
|
||||||
|
- policy
|
||||||
|
- resource
|
||||||
|
- rule
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: Status contains statistics related to update request.
|
||||||
|
properties:
|
||||||
|
generatedResources:
|
||||||
|
description: This will track the resources that are updated by the
|
||||||
|
generate Policy. Will be used during clean up resources.
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: APIVersion specifies resource apiVersion.
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: Kind specifies resource kind.
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: Name specifies the resource name.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: Namespace specifies resource namespace.
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: UID specifies the resource uid.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
handler:
|
||||||
|
description: Deprecated
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Specifies request status message.
|
||||||
|
type: string
|
||||||
|
retryCount:
|
||||||
|
type: integer
|
||||||
|
state:
|
||||||
|
description: State represents state of the update request.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- state
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .spec.policy
|
||||||
|
name: Policy
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.requestType
|
||||||
|
name: RuleType
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.resource.kind
|
||||||
|
name: ResourceKind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.resource.name
|
||||||
|
name: ResourceName
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.resource.namespace
|
||||||
|
name: ResourceNamespace
|
||||||
|
type: string
|
||||||
|
- jsonPath: .status.state
|
||||||
|
name: status
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
name: v2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: UpdateRequest is a request to process mutate and generate rules
|
||||||
|
in background.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ResourceSpec is the information to identify the trigger resource.
|
||||||
|
properties:
|
||||||
|
context:
|
||||||
|
description: Context ...
|
||||||
|
properties:
|
||||||
|
admissionRequestInfo:
|
||||||
|
description: AdmissionRequestInfoObject stores the admission request
|
||||||
|
and operation details
|
||||||
|
properties:
|
||||||
|
admissionRequest:
|
||||||
|
description: AdmissionRequest describes the admission.Attributes
|
||||||
|
for the admission request.
|
||||||
|
properties:
|
||||||
|
dryRun:
|
||||||
|
description: DryRun indicates that modifications will
|
||||||
|
definitely not be persisted for this request. Defaults
|
||||||
|
to false.
|
||||||
|
type: boolean
|
||||||
|
kind:
|
||||||
|
description: Kind is the fully-qualified type of object
|
||||||
|
being submitted (for example, v1.Pod or autoscaling.v1.Scale)
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- kind
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
name:
|
||||||
|
description: Name is the name of the object as presented
|
||||||
|
in the request. On a CREATE operation, the client may
|
||||||
|
omit name and rely on the server to generate the name. If
|
||||||
|
that is the case, this field will contain an empty string.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: Namespace is the namespace associated with
|
||||||
|
the request (if any).
|
||||||
|
type: string
|
||||||
|
object:
|
||||||
|
description: Object is the object from the incoming request.
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
oldObject:
|
||||||
|
description: OldObject is the existing object. Only populated
|
||||||
|
for DELETE and UPDATE requests.
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
operation:
|
||||||
|
description: Operation is the operation being performed.
|
||||||
|
This may be different than the operation requested.
|
||||||
|
e.g. a patch can result in either a CREATE or UPDATE
|
||||||
|
Operation.
|
||||||
|
type: string
|
||||||
|
options:
|
||||||
|
description: Options is the operation option structure
|
||||||
|
of the operation being performed. e.g. `meta.k8s.io/v1.DeleteOptions`
|
||||||
|
or `meta.k8s.io/v1.CreateOptions`. This may be different
|
||||||
|
than the options the caller provided. e.g. for a patch
|
||||||
|
request the performed Operation might be a CREATE, in
|
||||||
|
which case the Options will a `meta.k8s.io/v1.CreateOptions`
|
||||||
|
even though the caller provided `meta.k8s.io/v1.PatchOptions`.
|
||||||
|
type: object
|
||||||
|
x-kubernetes-preserve-unknown-fields: true
|
||||||
|
requestKind:
|
||||||
|
description: "RequestKind is the fully-qualified type
|
||||||
|
of the original API request (for example, v1.Pod or
|
||||||
|
autoscaling.v1.Scale). If this is specified and differs
|
||||||
|
from the value in \"kind\", an equivalent match and
|
||||||
|
conversion was performed. \n For example, if deployments
|
||||||
|
can be modified via apps/v1 and apps/v1beta1, and a
|
||||||
|
webhook registered a rule of `apiGroups:[\"apps\"],
|
||||||
|
apiVersions:[\"v1\"], resources: [\"deployments\"]`
|
||||||
|
and `matchPolicy: Equivalent`, an API request to apps/v1beta1
|
||||||
|
deployments would be converted and sent to the webhook
|
||||||
|
with `kind: {group:\"apps\", version:\"v1\", kind:\"Deployment\"}`
|
||||||
|
(matching the rule the webhook registered for), and
|
||||||
|
`requestKind: {group:\"apps\", version:\"v1beta1\",
|
||||||
|
kind:\"Deployment\"}` (indicating the kind of the original
|
||||||
|
API request). \n See documentation for the \"matchPolicy\"
|
||||||
|
field in the webhook configuration type for more details."
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- kind
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
requestResource:
|
||||||
|
description: "RequestResource is the fully-qualified resource
|
||||||
|
of the original API request (for example, v1.pods).
|
||||||
|
If this is specified and differs from the value in \"resource\",
|
||||||
|
an equivalent match and conversion was performed. \n
|
||||||
|
For example, if deployments can be modified via apps/v1
|
||||||
|
and apps/v1beta1, and a webhook registered a rule of
|
||||||
|
`apiGroups:[\"apps\"], apiVersions:[\"v1\"], resources:
|
||||||
|
[\"deployments\"]` and `matchPolicy: Equivalent`, an
|
||||||
|
API request to apps/v1beta1 deployments would be converted
|
||||||
|
and sent to the webhook with `resource: {group:\"apps\",
|
||||||
|
version:\"v1\", resource:\"deployments\"}` (matching
|
||||||
|
the resource the webhook registered for), and `requestResource:
|
||||||
|
{group:\"apps\", version:\"v1beta1\", resource:\"deployments\"}`
|
||||||
|
(indicating the resource of the original API request).
|
||||||
|
\n See documentation for the \"matchPolicy\" field in
|
||||||
|
the webhook configuration type."
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- resource
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
requestSubResource:
|
||||||
|
description: RequestSubResource is the name of the subresource
|
||||||
|
of the original API request, if any (for example, "status"
|
||||||
|
or "scale") If this is specified and differs from the
|
||||||
|
value in "subResource", an equivalent match and conversion
|
||||||
|
was performed. See documentation for the "matchPolicy"
|
||||||
|
field in the webhook configuration type.
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
description: Resource is the fully-qualified resource
|
||||||
|
being requested (for example, v1.pods)
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
type: string
|
||||||
|
version:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- group
|
||||||
|
- resource
|
||||||
|
- version
|
||||||
|
type: object
|
||||||
|
subResource:
|
||||||
|
description: SubResource is the subresource being requested,
|
||||||
|
if any (for example, "status" or "scale")
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: UID is an identifier for the individual request/response.
|
||||||
|
It allows us to distinguish instances of requests which
|
||||||
|
are otherwise identical (parallel requests, requests
|
||||||
|
when earlier requests did not modify etc) The UID is
|
||||||
|
meant to track the round trip (request/response) between
|
||||||
|
the KAS and the WebHook, not the user request. It is
|
||||||
|
suitable for correlating log entries between the webhook
|
||||||
|
and apiserver, for either auditing or debugging.
|
||||||
|
type: string
|
||||||
|
userInfo:
|
||||||
|
description: UserInfo is information about the requesting
|
||||||
|
user
|
||||||
|
properties:
|
||||||
|
extra:
|
||||||
|
additionalProperties:
|
||||||
|
description: ExtraValue masks the value so protobuf
|
||||||
|
can generate
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
description: Any additional information provided by
|
||||||
|
the authenticator.
|
||||||
|
type: object
|
||||||
|
groups:
|
||||||
|
description: The names of groups this user is a part
|
||||||
|
of.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
uid:
|
||||||
|
description: A unique value that identifies this user
|
||||||
|
across time. If this user is deleted and another
|
||||||
|
user by the same name is added, they will have different
|
||||||
|
UIDs.
|
||||||
|
type: string
|
||||||
|
username:
|
||||||
|
description: The name that uniquely identifies this
|
||||||
|
user among all active users.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- kind
|
||||||
|
- operation
|
||||||
|
- resource
|
||||||
|
- uid
|
||||||
|
- userInfo
|
||||||
|
type: object
|
||||||
|
operation:
|
||||||
|
description: Operation is the type of resource operation being
|
||||||
|
checked for admission control
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
userInfo:
|
||||||
|
description: RequestInfo contains permission info carried in an
|
||||||
|
admission request.
|
||||||
|
properties:
|
||||||
|
clusterRoles:
|
||||||
|
description: ClusterRoles is a list of possible clusterRoles
|
||||||
|
send the request.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
nullable: true
|
||||||
|
type: array
|
||||||
|
roles:
|
||||||
|
description: Roles is a list of possible role send the request.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
nullable: true
|
||||||
|
type: array
|
||||||
|
userInfo:
|
||||||
|
description: UserInfo is the userInfo carried in the admission
|
||||||
|
request.
|
||||||
|
properties:
|
||||||
|
extra:
|
||||||
|
additionalProperties:
|
||||||
|
description: ExtraValue masks the value so protobuf
|
||||||
|
can generate
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
description: Any additional information provided by the
|
||||||
|
authenticator.
|
||||||
|
type: object
|
||||||
|
groups:
|
||||||
|
description: The names of groups this user is a part of.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
uid:
|
||||||
|
description: A unique value that identifies this user
|
||||||
|
across time. If this user is deleted and another user
|
||||||
|
by the same name is added, they will have different
|
||||||
|
UIDs.
|
||||||
|
type: string
|
||||||
|
username:
|
||||||
|
description: The name that uniquely identifies this user
|
||||||
|
among all active users.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
deleteDownstream:
|
||||||
|
description: DeleteDownstream represents whether the downstream needs
|
||||||
|
to be deleted.
|
||||||
|
type: boolean
|
||||||
|
policy:
|
||||||
|
description: Specifies the name of the policy.
|
||||||
|
type: string
|
||||||
|
requestType:
|
||||||
|
description: Type represents request type for background processing
|
||||||
|
enum:
|
||||||
|
- mutate
|
||||||
|
- generate
|
||||||
|
type: string
|
||||||
|
resource:
|
||||||
|
description: ResourceSpec is the information to identify the trigger
|
||||||
|
resource.
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: APIVersion specifies resource apiVersion.
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: Kind specifies resource kind.
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: Name specifies the resource name.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: Namespace specifies resource namespace.
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: UID specifies the resource uid.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
rule:
|
||||||
|
description: Rule is the associate rule name of the current UR.
|
||||||
|
type: string
|
||||||
|
synchronize:
|
||||||
|
description: Synchronize represents the sync behavior of the corresponding
|
||||||
|
rule Optional. Defaults to "false" if not specified.
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- context
|
||||||
|
- deleteDownstream
|
||||||
|
- policy
|
||||||
|
- resource
|
||||||
|
- rule
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: Status contains statistics related to update request.
|
||||||
|
properties:
|
||||||
|
generatedResources:
|
||||||
|
description: This will track the resources that are updated by the
|
||||||
|
generate Policy. Will be used during clean up resources.
|
||||||
|
items:
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: APIVersion specifies resource apiVersion.
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: Kind specifies resource kind.
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: Name specifies the resource name.
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: Namespace specifies resource namespace.
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: UID specifies the resource uid.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
message:
|
||||||
|
description: Specifies request status message.
|
||||||
|
type: string
|
||||||
|
retryCount:
|
||||||
|
type: integer
|
||||||
|
state:
|
||||||
|
description: State represents state of the update request.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- state
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
{{- end }}
|
||||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,347 @@
|
||||||
|
{{- if .Values.groups.reports.clusterephemeralreports }}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
|
name: clusterephemeralreports.reports.kyverno.io
|
||||||
|
spec:
|
||||||
|
group: reports.kyverno.io
|
||||||
|
names:
|
||||||
|
categories:
|
||||||
|
- kyverno
|
||||||
|
kind: ClusterEphemeralReport
|
||||||
|
listKind: ClusterEphemeralReportList
|
||||||
|
plural: clusterephemeralreports
|
||||||
|
shortNames:
|
||||||
|
- cephr
|
||||||
|
singular: clusterephemeralreport
|
||||||
|
scope: Cluster
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/source']
|
||||||
|
name: Source
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.group']
|
||||||
|
name: Group
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.kind']
|
||||||
|
name: Kind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.annotations['audit\.kyverno\.io/resource\.name']
|
||||||
|
name: Owner
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: Pass
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: Fail
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: Warn
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: Error
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: Skip
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.uid']
|
||||||
|
name: Uid
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||||
|
name: Hash
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ClusterEphemeralReport is the Schema for the ClusterEphemeralReports
|
||||||
|
API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
owner:
|
||||||
|
description: Owner is a reference to the report owner (e.g. a Deployment,
|
||||||
|
Namespace, or Node)
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
blockOwnerDeletion:
|
||||||
|
description: If true, AND if the owner has the "foregroundDeletion"
|
||||||
|
finalizer, then the owner cannot be deleted from the key-value
|
||||||
|
store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||||
|
for how the garbage collector interacts with this field and
|
||||||
|
enforces the foreground deletion. Defaults to false. To set
|
||||||
|
this field, a user needs "delete" permission of the owner, otherwise
|
||||||
|
422 (Unprocessable Entity) will be returned.
|
||||||
|
type: boolean
|
||||||
|
controller:
|
||||||
|
description: If true, this reference points to the managing controller.
|
||||||
|
type: boolean
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids'
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- apiVersion
|
||||||
|
- kind
|
||||||
|
- name
|
||||||
|
- uid
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- owner
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources: {}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,347 @@
|
||||||
|
{{- if .Values.groups.reports.ephemeralreports }}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
|
name: ephemeralreports.reports.kyverno.io
|
||||||
|
spec:
|
||||||
|
group: reports.kyverno.io
|
||||||
|
names:
|
||||||
|
categories:
|
||||||
|
- kyverno
|
||||||
|
kind: EphemeralReport
|
||||||
|
listKind: EphemeralReportList
|
||||||
|
plural: ephemeralreports
|
||||||
|
shortNames:
|
||||||
|
- ephr
|
||||||
|
singular: ephemeralreport
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/source']
|
||||||
|
name: Source
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.group']
|
||||||
|
name: Group
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.kind']
|
||||||
|
name: Kind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.annotations['audit\.kyverno\.io/resource\.name']
|
||||||
|
name: Owner
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.summary.pass
|
||||||
|
name: Pass
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.fail
|
||||||
|
name: Fail
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.warn
|
||||||
|
name: Warn
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.error
|
||||||
|
name: Error
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .spec.summary.skip
|
||||||
|
name: Skip
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.uid']
|
||||||
|
name: Uid
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.labels['audit\.kyverno\.io/resource\.hash']
|
||||||
|
name: Hash
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
name: v1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: EphemeralReport is the Schema for the EphemeralReports API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
owner:
|
||||||
|
description: Owner is a reference to the report owner (e.g. a Deployment,
|
||||||
|
Namespace, or Node)
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
blockOwnerDeletion:
|
||||||
|
description: If true, AND if the owner has the "foregroundDeletion"
|
||||||
|
finalizer, then the owner cannot be deleted from the key-value
|
||||||
|
store until this reference is removed. See https://kubernetes.io/docs/concepts/architecture/garbage-collection/#foreground-deletion
|
||||||
|
for how the garbage collector interacts with this field and
|
||||||
|
enforces the foreground deletion. Defaults to false. To set
|
||||||
|
this field, a user needs "delete" permission of the owner, otherwise
|
||||||
|
422 (Unprocessable Entity) will be returned.
|
||||||
|
type: boolean
|
||||||
|
controller:
|
||||||
|
description: If true, this reference points to the managing controller.
|
||||||
|
type: boolean
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids'
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- apiVersion
|
||||||
|
- kind
|
||||||
|
- name
|
||||||
|
- uid
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for
|
||||||
|
the policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for
|
||||||
|
the policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for
|
||||||
|
checked Kubernetes resources. For example, a policy result
|
||||||
|
may apply to all pods that match a label. Either a Subject
|
||||||
|
or a SubjectSelector can be specified. If neither are provided,
|
||||||
|
the result is assumed to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector
|
||||||
|
requirements. The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector
|
||||||
|
that contains values, a key, and an operator that relates
|
||||||
|
the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector
|
||||||
|
applies to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn,
|
||||||
|
Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values.
|
||||||
|
If the operator is In or NotIn, the values array
|
||||||
|
must be non-empty. If the operator is Exists or
|
||||||
|
DoesNotExist, the values array must be empty. This
|
||||||
|
array is replaced during a strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs.
|
||||||
|
A single {key,value} in the matchLabels map is equivalent
|
||||||
|
to an element of matchExpressions, whose key field is
|
||||||
|
"key", the operator is "In", and the values array contains
|
||||||
|
only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked
|
||||||
|
Kubernetes resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information
|
||||||
|
to let you inspect or modify the referred object. --- New
|
||||||
|
uses of this type are discouraged because of difficulty
|
||||||
|
describing its usage when embedded in APIs. 1. Ignored fields.
|
||||||
|
\ It includes many fields which are not generally honored.
|
||||||
|
\ For instance, ResourceVersion and FieldPath are both very
|
||||||
|
rarely valid in actual usage. 2. Invalid usage help. It
|
||||||
|
is impossible to add specific help for individual usage.
|
||||||
|
\ In most embedded usages, there are particular restrictions
|
||||||
|
like, \"must refer only to types A and B\" or \"UID not
|
||||||
|
honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation.
|
||||||
|
\ Because the usages are different, the validation rules
|
||||||
|
are different by usage, which makes it hard for users to
|
||||||
|
predict what will happen. 4. The fields are both imprecise
|
||||||
|
and overly precise. Kind is not a precise mapping to a
|
||||||
|
URL. This can produce ambiguity during interpretation and
|
||||||
|
require a REST mapping. In most cases, the dependency is
|
||||||
|
on the group,resource tuple and the version of the actual
|
||||||
|
struct is irrelevant. 5. We cannot easily change it. Because
|
||||||
|
this type is embedded in many locations, updates to this
|
||||||
|
type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n
|
||||||
|
Instead of using this type, create a locally provided and
|
||||||
|
used type that is well-focused on your reference. For example,
|
||||||
|
ServiceReferences for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container
|
||||||
|
within a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that
|
||||||
|
triggered the event) or if no container name is specified
|
||||||
|
"spec.containers[2]" (container with index 2 in this
|
||||||
|
pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design
|
||||||
|
is not final and this field is subject to change in
|
||||||
|
the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule
|
||||||
|
execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within
|
||||||
|
the policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must
|
||||||
|
still have non-negative nanos values that count forward
|
||||||
|
in time. Must be from 0 to 999,999,999 inclusive. This
|
||||||
|
field may be limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z
|
||||||
|
to 9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not
|
||||||
|
be evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not
|
||||||
|
selected for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- owner
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- spec
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources: {}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
{{- if .Values.groups.policyreport }}
|
{{- if .Values.groups.wgpolicyk8s.clusterpolicyreports }}
|
||||||
---
|
---
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
kind: CustomResourceDefinition
|
kind: CustomResourceDefinition
|
||||||
|
|
@ -364,368 +364,4 @@ spec:
|
||||||
served: true
|
served: true
|
||||||
storage: true
|
storage: true
|
||||||
subresources: {}
|
subresources: {}
|
||||||
---
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
{{- with .Values.annotations }}
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
controller-gen.kubebuilder.io/version: v0.12.0
|
|
||||||
name: policyreports.wgpolicyk8s.io
|
|
||||||
spec:
|
|
||||||
group: wgpolicyk8s.io
|
|
||||||
names:
|
|
||||||
kind: PolicyReport
|
|
||||||
listKind: PolicyReportList
|
|
||||||
plural: policyreports
|
|
||||||
shortNames:
|
|
||||||
- polr
|
|
||||||
singular: policyreport
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- additionalPrinterColumns:
|
|
||||||
- jsonPath: .scope.kind
|
|
||||||
name: Kind
|
|
||||||
type: string
|
|
||||||
- jsonPath: .scope.name
|
|
||||||
name: Name
|
|
||||||
type: string
|
|
||||||
- jsonPath: .summary.pass
|
|
||||||
name: Pass
|
|
||||||
type: integer
|
|
||||||
- jsonPath: .summary.fail
|
|
||||||
name: Fail
|
|
||||||
type: integer
|
|
||||||
- jsonPath: .summary.warn
|
|
||||||
name: Warn
|
|
||||||
type: integer
|
|
||||||
- jsonPath: .summary.error
|
|
||||||
name: Error
|
|
||||||
type: integer
|
|
||||||
- jsonPath: .summary.skip
|
|
||||||
name: Skip
|
|
||||||
type: integer
|
|
||||||
- jsonPath: .metadata.creationTimestamp
|
|
||||||
name: Age
|
|
||||||
type: date
|
|
||||||
name: v1alpha2
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
description: PolicyReport is the Schema for the policyreports API
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
description: 'APIVersion defines the versioned schema of this representation
|
|
||||||
of an object. Servers should convert recognized schemas to the latest
|
|
||||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
||||||
type: string
|
|
||||||
kind:
|
|
||||||
description: 'Kind is a string value representing the REST resource this
|
|
||||||
object represents. Servers may infer this from the endpoint the client
|
|
||||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
||||||
type: string
|
|
||||||
metadata:
|
|
||||||
type: object
|
|
||||||
results:
|
|
||||||
description: PolicyReportResult provides result details
|
|
||||||
items:
|
|
||||||
description: PolicyReportResult provides the result for an individual
|
|
||||||
policy
|
|
||||||
properties:
|
|
||||||
category:
|
|
||||||
description: Category indicates policy category
|
|
||||||
type: string
|
|
||||||
message:
|
|
||||||
description: Description is a short user friendly message for the
|
|
||||||
policy rule
|
|
||||||
type: string
|
|
||||||
policy:
|
|
||||||
description: Policy is the name or identifier of the policy
|
|
||||||
type: string
|
|
||||||
properties:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: Properties provides additional information for the
|
|
||||||
policy rule
|
|
||||||
type: object
|
|
||||||
resourceSelector:
|
|
||||||
description: SubjectSelector is an optional label selector for checked
|
|
||||||
Kubernetes resources. For example, a policy result may apply to
|
|
||||||
all pods that match a label. Either a Subject or a SubjectSelector
|
|
||||||
can be specified. If neither are provided, the result is assumed
|
|
||||||
to be for the policy report scope.
|
|
||||||
properties:
|
|
||||||
matchExpressions:
|
|
||||||
description: matchExpressions is a list of label selector requirements.
|
|
||||||
The requirements are ANDed.
|
|
||||||
items:
|
|
||||||
description: A label selector requirement is a selector that
|
|
||||||
contains values, a key, and an operator that relates the
|
|
||||||
key and values.
|
|
||||||
properties:
|
|
||||||
key:
|
|
||||||
description: key is the label key that the selector applies
|
|
||||||
to.
|
|
||||||
type: string
|
|
||||||
operator:
|
|
||||||
description: operator represents a key's relationship
|
|
||||||
to a set of values. Valid operators are In, NotIn, Exists
|
|
||||||
and DoesNotExist.
|
|
||||||
type: string
|
|
||||||
values:
|
|
||||||
description: values is an array of string values. If the
|
|
||||||
operator is In or NotIn, the values array must be non-empty.
|
|
||||||
If the operator is Exists or DoesNotExist, the values
|
|
||||||
array must be empty. This array is replaced during a
|
|
||||||
strategic merge patch.
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- key
|
|
||||||
- operator
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
matchLabels:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: matchLabels is a map of {key,value} pairs. A single
|
|
||||||
{key,value} in the matchLabels map is equivalent to an element
|
|
||||||
of matchExpressions, whose key field is "key", the operator
|
|
||||||
is "In", and the values array contains only "value". The requirements
|
|
||||||
are ANDed.
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
x-kubernetes-map-type: atomic
|
|
||||||
resources:
|
|
||||||
description: Subjects is an optional reference to the checked Kubernetes
|
|
||||||
resources
|
|
||||||
items:
|
|
||||||
description: "ObjectReference contains enough information to let
|
|
||||||
you inspect or modify the referred object. --- New uses of this
|
|
||||||
type are discouraged because of difficulty describing its usage
|
|
||||||
when embedded in APIs. 1. Ignored fields. It includes many
|
|
||||||
fields which are not generally honored. For instance, ResourceVersion
|
|
||||||
and FieldPath are both very rarely valid in actual usage. 2.
|
|
||||||
Invalid usage help. It is impossible to add specific help for
|
|
||||||
individual usage. In most embedded usages, there are particular
|
|
||||||
restrictions like, \"must refer only to types A and B\" or \"UID
|
|
||||||
not honored\" or \"name must be restricted\". Those cannot be
|
|
||||||
well described when embedded. 3. Inconsistent validation. Because
|
|
||||||
the usages are different, the validation rules are different
|
|
||||||
by usage, which makes it hard for users to predict what will
|
|
||||||
happen. 4. The fields are both imprecise and overly precise.
|
|
||||||
\ Kind is not a precise mapping to a URL. This can produce ambiguity
|
|
||||||
during interpretation and require a REST mapping. In most cases,
|
|
||||||
the dependency is on the group,resource tuple and the version
|
|
||||||
of the actual struct is irrelevant. 5. We cannot easily change
|
|
||||||
it. Because this type is embedded in many locations, updates
|
|
||||||
to this type will affect numerous schemas. Don't make new APIs
|
|
||||||
embed an underspecified API type they do not control. \n Instead
|
|
||||||
of using this type, create a locally provided and used type
|
|
||||||
that is well-focused on your reference. For example, ServiceReferences
|
|
||||||
for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
|
||||||
."
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
description: API version of the referent.
|
|
||||||
type: string
|
|
||||||
fieldPath:
|
|
||||||
description: 'If referring to a piece of an object instead
|
|
||||||
of an entire object, this string should contain a valid
|
|
||||||
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
|
||||||
For example, if the object reference is to a container within
|
|
||||||
a pod, this would take on a value like: "spec.containers{name}"
|
|
||||||
(where "name" refers to the name of the container that triggered
|
|
||||||
the event) or if no container name is specified "spec.containers[2]"
|
|
||||||
(container with index 2 in this pod). This syntax is chosen
|
|
||||||
only to have some well-defined way of referencing a part
|
|
||||||
of an object. TODO: this design is not final and this field
|
|
||||||
is subject to change in the future.'
|
|
||||||
type: string
|
|
||||||
kind:
|
|
||||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
||||||
type: string
|
|
||||||
namespace:
|
|
||||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
|
||||||
type: string
|
|
||||||
resourceVersion:
|
|
||||||
description: 'Specific resourceVersion to which this reference
|
|
||||||
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
|
||||||
type: string
|
|
||||||
uid:
|
|
||||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
x-kubernetes-map-type: atomic
|
|
||||||
type: array
|
|
||||||
result:
|
|
||||||
description: Result indicates the outcome of the policy rule execution
|
|
||||||
enum:
|
|
||||||
- pass
|
|
||||||
- fail
|
|
||||||
- warn
|
|
||||||
- error
|
|
||||||
- skip
|
|
||||||
type: string
|
|
||||||
rule:
|
|
||||||
description: Rule is the name or identifier of the rule within the
|
|
||||||
policy
|
|
||||||
type: string
|
|
||||||
scored:
|
|
||||||
description: Scored indicates if this result is scored
|
|
||||||
type: boolean
|
|
||||||
severity:
|
|
||||||
description: Severity indicates policy check result criticality
|
|
||||||
enum:
|
|
||||||
- critical
|
|
||||||
- high
|
|
||||||
- low
|
|
||||||
- medium
|
|
||||||
- info
|
|
||||||
type: string
|
|
||||||
source:
|
|
||||||
description: Source is an identifier for the policy engine that
|
|
||||||
manages this report
|
|
||||||
type: string
|
|
||||||
timestamp:
|
|
||||||
description: Timestamp indicates the time the result was found
|
|
||||||
properties:
|
|
||||||
nanos:
|
|
||||||
description: Non-negative fractions of a second at nanosecond
|
|
||||||
resolution. Negative second values with fractions must still
|
|
||||||
have non-negative nanos values that count forward in time.
|
|
||||||
Must be from 0 to 999,999,999 inclusive. This field may be
|
|
||||||
limited in precision depending on context.
|
|
||||||
format: int32
|
|
||||||
type: integer
|
|
||||||
seconds:
|
|
||||||
description: Represents seconds of UTC time since Unix epoch
|
|
||||||
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
|
||||||
9999-12-31T23:59:59Z inclusive.
|
|
||||||
format: int64
|
|
||||||
type: integer
|
|
||||||
required:
|
|
||||||
- nanos
|
|
||||||
- seconds
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- policy
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
scope:
|
|
||||||
description: Scope is an optional reference to the report scope (e.g.
|
|
||||||
a Deployment, Namespace, or Node)
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
description: API version of the referent.
|
|
||||||
type: string
|
|
||||||
fieldPath:
|
|
||||||
description: 'If referring to a piece of an object instead of an entire
|
|
||||||
object, this string should contain a valid JSON/Go field access
|
|
||||||
statement, such as desiredState.manifest.containers[2]. For example,
|
|
||||||
if the object reference is to a container within a pod, this would
|
|
||||||
take on a value like: "spec.containers{name}" (where "name" refers
|
|
||||||
to the name of the container that triggered the event) or if no
|
|
||||||
container name is specified "spec.containers[2]" (container with
|
|
||||||
index 2 in this pod). This syntax is chosen only to have some well-defined
|
|
||||||
way of referencing a part of an object. TODO: this design is not
|
|
||||||
final and this field is subject to change in the future.'
|
|
||||||
type: string
|
|
||||||
kind:
|
|
||||||
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
|
||||||
type: string
|
|
||||||
namespace:
|
|
||||||
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
|
||||||
type: string
|
|
||||||
resourceVersion:
|
|
||||||
description: 'Specific resourceVersion to which this reference is
|
|
||||||
made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
|
||||||
type: string
|
|
||||||
uid:
|
|
||||||
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
x-kubernetes-map-type: atomic
|
|
||||||
scopeSelector:
|
|
||||||
description: ScopeSelector is an optional selector for multiple scopes
|
|
||||||
(e.g. Pods). Either one of, or none of, but not both of, Scope or ScopeSelector
|
|
||||||
should be specified.
|
|
||||||
properties:
|
|
||||||
matchExpressions:
|
|
||||||
description: matchExpressions is a list of label selector requirements.
|
|
||||||
The requirements are ANDed.
|
|
||||||
items:
|
|
||||||
description: A label selector requirement is a selector that contains
|
|
||||||
values, a key, and an operator that relates the key and values.
|
|
||||||
properties:
|
|
||||||
key:
|
|
||||||
description: key is the label key that the selector applies
|
|
||||||
to.
|
|
||||||
type: string
|
|
||||||
operator:
|
|
||||||
description: operator represents a key's relationship to a set
|
|
||||||
of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
|
||||||
type: string
|
|
||||||
values:
|
|
||||||
description: values is an array of string values. If the operator
|
|
||||||
is In or NotIn, the values array must be non-empty. If the
|
|
||||||
operator is Exists or DoesNotExist, the values array must
|
|
||||||
be empty. This array is replaced during a strategic merge
|
|
||||||
patch.
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- key
|
|
||||||
- operator
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
matchLabels:
|
|
||||||
additionalProperties:
|
|
||||||
type: string
|
|
||||||
description: matchLabels is a map of {key,value} pairs. A single {key,value}
|
|
||||||
in the matchLabels map is equivalent to an element of matchExpressions,
|
|
||||||
whose key field is "key", the operator is "In", and the values array
|
|
||||||
contains only "value". The requirements are ANDed.
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
x-kubernetes-map-type: atomic
|
|
||||||
summary:
|
|
||||||
description: PolicyReportSummary provides a summary of results
|
|
||||||
properties:
|
|
||||||
error:
|
|
||||||
description: Error provides the count of policies that could not be
|
|
||||||
evaluated
|
|
||||||
type: integer
|
|
||||||
fail:
|
|
||||||
description: Fail provides the count of policies whose requirements
|
|
||||||
were not met
|
|
||||||
type: integer
|
|
||||||
pass:
|
|
||||||
description: Pass provides the count of policies whose requirements
|
|
||||||
were met
|
|
||||||
type: integer
|
|
||||||
skip:
|
|
||||||
description: Skip indicates the count of policies that were not selected
|
|
||||||
for evaluation
|
|
||||||
type: integer
|
|
||||||
warn:
|
|
||||||
description: Warn provides the count of non-scored policies whose
|
|
||||||
requirements were not met
|
|
||||||
type: integer
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
subresources: {}
|
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
@ -0,0 +1,366 @@
|
||||||
|
{{- if .Values.groups.wgpolicyk8s.policyreports }}
|
||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
{{- include "kyverno.crds.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
controller-gen.kubebuilder.io/version: v0.12.0
|
||||||
|
name: policyreports.wgpolicyk8s.io
|
||||||
|
spec:
|
||||||
|
group: wgpolicyk8s.io
|
||||||
|
names:
|
||||||
|
kind: PolicyReport
|
||||||
|
listKind: PolicyReportList
|
||||||
|
plural: policyreports
|
||||||
|
shortNames:
|
||||||
|
- polr
|
||||||
|
singular: policyreport
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .scope.kind
|
||||||
|
name: Kind
|
||||||
|
type: string
|
||||||
|
- jsonPath: .scope.name
|
||||||
|
name: Name
|
||||||
|
type: string
|
||||||
|
- jsonPath: .summary.pass
|
||||||
|
name: Pass
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .summary.fail
|
||||||
|
name: Fail
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .summary.warn
|
||||||
|
name: Warn
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .summary.error
|
||||||
|
name: Error
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .summary.skip
|
||||||
|
name: Skip
|
||||||
|
type: integer
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
name: v1alpha2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: PolicyReport is the Schema for the policyreports API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
results:
|
||||||
|
description: PolicyReportResult provides result details
|
||||||
|
items:
|
||||||
|
description: PolicyReportResult provides the result for an individual
|
||||||
|
policy
|
||||||
|
properties:
|
||||||
|
category:
|
||||||
|
description: Category indicates policy category
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Description is a short user friendly message for the
|
||||||
|
policy rule
|
||||||
|
type: string
|
||||||
|
policy:
|
||||||
|
description: Policy is the name or identifier of the policy
|
||||||
|
type: string
|
||||||
|
properties:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Properties provides additional information for the
|
||||||
|
policy rule
|
||||||
|
type: object
|
||||||
|
resourceSelector:
|
||||||
|
description: SubjectSelector is an optional label selector for checked
|
||||||
|
Kubernetes resources. For example, a policy result may apply to
|
||||||
|
all pods that match a label. Either a Subject or a SubjectSelector
|
||||||
|
can be specified. If neither are provided, the result is assumed
|
||||||
|
to be for the policy report scope.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector requirements.
|
||||||
|
The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector that
|
||||||
|
contains values, a key, and an operator that relates the
|
||||||
|
key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship
|
||||||
|
to a set of values. Valid operators are In, NotIn, Exists
|
||||||
|
and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values. If the
|
||||||
|
operator is In or NotIn, the values array must be non-empty.
|
||||||
|
If the operator is Exists or DoesNotExist, the values
|
||||||
|
array must be empty. This array is replaced during a
|
||||||
|
strategic merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs. A single
|
||||||
|
{key,value} in the matchLabels map is equivalent to an element
|
||||||
|
of matchExpressions, whose key field is "key", the operator
|
||||||
|
is "In", and the values array contains only "value". The requirements
|
||||||
|
are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
resources:
|
||||||
|
description: Subjects is an optional reference to the checked Kubernetes
|
||||||
|
resources
|
||||||
|
items:
|
||||||
|
description: "ObjectReference contains enough information to let
|
||||||
|
you inspect or modify the referred object. --- New uses of this
|
||||||
|
type are discouraged because of difficulty describing its usage
|
||||||
|
when embedded in APIs. 1. Ignored fields. It includes many
|
||||||
|
fields which are not generally honored. For instance, ResourceVersion
|
||||||
|
and FieldPath are both very rarely valid in actual usage. 2.
|
||||||
|
Invalid usage help. It is impossible to add specific help for
|
||||||
|
individual usage. In most embedded usages, there are particular
|
||||||
|
restrictions like, \"must refer only to types A and B\" or \"UID
|
||||||
|
not honored\" or \"name must be restricted\". Those cannot be
|
||||||
|
well described when embedded. 3. Inconsistent validation. Because
|
||||||
|
the usages are different, the validation rules are different
|
||||||
|
by usage, which makes it hard for users to predict what will
|
||||||
|
happen. 4. The fields are both imprecise and overly precise.
|
||||||
|
\ Kind is not a precise mapping to a URL. This can produce ambiguity
|
||||||
|
during interpretation and require a REST mapping. In most cases,
|
||||||
|
the dependency is on the group,resource tuple and the version
|
||||||
|
of the actual struct is irrelevant. 5. We cannot easily change
|
||||||
|
it. Because this type is embedded in many locations, updates
|
||||||
|
to this type will affect numerous schemas. Don't make new APIs
|
||||||
|
embed an underspecified API type they do not control. \n Instead
|
||||||
|
of using this type, create a locally provided and used type
|
||||||
|
that is well-focused on your reference. For example, ServiceReferences
|
||||||
|
for admission registration: https://github.com/kubernetes/api/blob/release-1.17/admissionregistration/v1/types.go#L533
|
||||||
|
."
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead
|
||||||
|
of an entire object, this string should contain a valid
|
||||||
|
JSON/Go field access statement, such as desiredState.manifest.containers[2].
|
||||||
|
For example, if the object reference is to a container within
|
||||||
|
a pod, this would take on a value like: "spec.containers{name}"
|
||||||
|
(where "name" refers to the name of the container that triggered
|
||||||
|
the event) or if no container name is specified "spec.containers[2]"
|
||||||
|
(container with index 2 in this pod). This syntax is chosen
|
||||||
|
only to have some well-defined way of referencing a part
|
||||||
|
of an object. TODO: this design is not final and this field
|
||||||
|
is subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference
|
||||||
|
is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
type: array
|
||||||
|
result:
|
||||||
|
description: Result indicates the outcome of the policy rule execution
|
||||||
|
enum:
|
||||||
|
- pass
|
||||||
|
- fail
|
||||||
|
- warn
|
||||||
|
- error
|
||||||
|
- skip
|
||||||
|
type: string
|
||||||
|
rule:
|
||||||
|
description: Rule is the name or identifier of the rule within the
|
||||||
|
policy
|
||||||
|
type: string
|
||||||
|
scored:
|
||||||
|
description: Scored indicates if this result is scored
|
||||||
|
type: boolean
|
||||||
|
severity:
|
||||||
|
description: Severity indicates policy check result criticality
|
||||||
|
enum:
|
||||||
|
- critical
|
||||||
|
- high
|
||||||
|
- low
|
||||||
|
- medium
|
||||||
|
- info
|
||||||
|
type: string
|
||||||
|
source:
|
||||||
|
description: Source is an identifier for the policy engine that
|
||||||
|
manages this report
|
||||||
|
type: string
|
||||||
|
timestamp:
|
||||||
|
description: Timestamp indicates the time the result was found
|
||||||
|
properties:
|
||||||
|
nanos:
|
||||||
|
description: Non-negative fractions of a second at nanosecond
|
||||||
|
resolution. Negative second values with fractions must still
|
||||||
|
have non-negative nanos values that count forward in time.
|
||||||
|
Must be from 0 to 999,999,999 inclusive. This field may be
|
||||||
|
limited in precision depending on context.
|
||||||
|
format: int32
|
||||||
|
type: integer
|
||||||
|
seconds:
|
||||||
|
description: Represents seconds of UTC time since Unix epoch
|
||||||
|
1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
|
||||||
|
9999-12-31T23:59:59Z inclusive.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
required:
|
||||||
|
- nanos
|
||||||
|
- seconds
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- policy
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
scope:
|
||||||
|
description: Scope is an optional reference to the report scope (e.g.
|
||||||
|
a Deployment, Namespace, or Node)
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: API version of the referent.
|
||||||
|
type: string
|
||||||
|
fieldPath:
|
||||||
|
description: 'If referring to a piece of an object instead of an entire
|
||||||
|
object, this string should contain a valid JSON/Go field access
|
||||||
|
statement, such as desiredState.manifest.containers[2]. For example,
|
||||||
|
if the object reference is to a container within a pod, this would
|
||||||
|
take on a value like: "spec.containers{name}" (where "name" refers
|
||||||
|
to the name of the container that triggered the event) or if no
|
||||||
|
container name is specified "spec.containers[2]" (container with
|
||||||
|
index 2 in this pod). This syntax is chosen only to have some well-defined
|
||||||
|
way of referencing a part of an object. TODO: this design is not
|
||||||
|
final and this field is subject to change in the future.'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
|
||||||
|
type: string
|
||||||
|
namespace:
|
||||||
|
description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
|
||||||
|
type: string
|
||||||
|
resourceVersion:
|
||||||
|
description: 'Specific resourceVersion to which this reference is
|
||||||
|
made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency'
|
||||||
|
type: string
|
||||||
|
uid:
|
||||||
|
description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids'
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
scopeSelector:
|
||||||
|
description: ScopeSelector is an optional selector for multiple scopes
|
||||||
|
(e.g. Pods). Either one of, or none of, but not both of, Scope or ScopeSelector
|
||||||
|
should be specified.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector requirements.
|
||||||
|
The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector that contains
|
||||||
|
values, a key, and an operator that relates the key and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship to a set
|
||||||
|
of values. Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values. If the operator
|
||||||
|
is In or NotIn, the values array must be non-empty. If the
|
||||||
|
operator is Exists or DoesNotExist, the values array must
|
||||||
|
be empty. This array is replaced during a strategic merge
|
||||||
|
patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs. A single {key,value}
|
||||||
|
in the matchLabels map is equivalent to an element of matchExpressions,
|
||||||
|
whose key field is "key", the operator is "In", and the values array
|
||||||
|
contains only "value". The requirements are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
x-kubernetes-map-type: atomic
|
||||||
|
summary:
|
||||||
|
description: PolicyReportSummary provides a summary of results
|
||||||
|
properties:
|
||||||
|
error:
|
||||||
|
description: Error provides the count of policies that could not be
|
||||||
|
evaluated
|
||||||
|
type: integer
|
||||||
|
fail:
|
||||||
|
description: Fail provides the count of policies whose requirements
|
||||||
|
were not met
|
||||||
|
type: integer
|
||||||
|
pass:
|
||||||
|
description: Pass provides the count of policies whose requirements
|
||||||
|
were met
|
||||||
|
type: integer
|
||||||
|
skip:
|
||||||
|
description: Skip indicates the count of policies that were not selected
|
||||||
|
for evaluation
|
||||||
|
type: integer
|
||||||
|
warn:
|
||||||
|
description: Warn provides the count of non-scored policies whose
|
||||||
|
requirements were not met
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources: {}
|
||||||
|
{{- end }}
|
||||||
|
|
@ -9,15 +9,29 @@ groups:
|
||||||
|
|
||||||
# -- Install CRDs in group `kyverno.io`
|
# -- Install CRDs in group `kyverno.io`
|
||||||
# -- This field can be overwritten by setting crds.labels in the parent chart
|
# -- This field can be overwritten by setting crds.labels in the parent chart
|
||||||
kyverno: true
|
kyverno:
|
||||||
|
admissionreports: true
|
||||||
# -- Install CRDs in group `wgpolicyk8s.io`
|
backgroundscanreports: true
|
||||||
# -- This field can be overwritten by setting crds.labels in the parent chart
|
cleanuppolicies: true
|
||||||
policyreport: true
|
clusteradmissionreports: true
|
||||||
|
clusterbackgroundscanreports: true
|
||||||
|
clustercleanuppolicies: true
|
||||||
|
clusterpolicies: true
|
||||||
|
policies: true
|
||||||
|
policyexceptions: true
|
||||||
|
updaterequests: true
|
||||||
|
|
||||||
# -- Install CRDs in group `reports.kyverno.io`
|
# -- Install CRDs in group `reports.kyverno.io`
|
||||||
# -- This field can be overwritten by setting crds.labels in the parent chart
|
# -- This field can be overwritten by setting crds.labels in the parent chart
|
||||||
reports: true
|
reports:
|
||||||
|
clusterephemeralreports: true
|
||||||
|
ephemeralreports: true
|
||||||
|
|
||||||
|
# -- Install CRDs in group `wgpolicyk8s.io`
|
||||||
|
# -- This field can be overwritten by setting crds.labels in the parent chart
|
||||||
|
wgpolicyk8s:
|
||||||
|
clusterpolicyreports: true
|
||||||
|
policyreports: true
|
||||||
|
|
||||||
# -- Additional CRDs annotations
|
# -- Additional CRDs annotations
|
||||||
# -- This field can be overwritten by setting crds.annotations in the parent chart
|
# -- This field can be overwritten by setting crds.annotations in the parent chart
|
||||||
|
|
|
||||||
|
|
@ -17,6 +17,12 @@ metadata:
|
||||||
labels:
|
labels:
|
||||||
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
||||||
rules:
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- apiextensions.k8s.io
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- admissionregistration.k8s.io
|
- admissionregistration.k8s.io
|
||||||
resources:
|
resources:
|
||||||
|
|
@ -113,14 +119,6 @@ rules:
|
||||||
- subjectaccessreviews
|
- subjectaccessreviews
|
||||||
verbs:
|
verbs:
|
||||||
- create
|
- create
|
||||||
- apiGroups:
|
|
||||||
- apiextensions.k8s.io
|
|
||||||
resources:
|
|
||||||
- customresourcedefinitions
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- ''
|
- ''
|
||||||
resources:
|
resources:
|
||||||
|
|
|
||||||
|
|
@ -18,6 +18,12 @@ metadata:
|
||||||
labels:
|
labels:
|
||||||
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
{{- include "kyverno.background-controller.labels" . | nindent 4 }}
|
||||||
rules:
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- apiextensions.k8s.io
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- kyverno.io
|
- kyverno.io
|
||||||
resources:
|
resources:
|
||||||
|
|
|
||||||
|
|
@ -18,6 +18,12 @@ metadata:
|
||||||
labels:
|
labels:
|
||||||
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
||||||
rules:
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- apiextensions.k8s.io
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- admissionregistration.k8s.io
|
- admissionregistration.k8s.io
|
||||||
resources:
|
resources:
|
||||||
|
|
|
||||||
|
|
@ -18,6 +18,12 @@ metadata:
|
||||||
labels:
|
labels:
|
||||||
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
{{- include "kyverno.reports-controller.labels" . | nindent 4 }}
|
||||||
rules:
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- apiextensions.k8s.io
|
||||||
|
resources:
|
||||||
|
- customresourcedefinitions
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- ''
|
- ''
|
||||||
resources:
|
resources:
|
||||||
|
|
|
||||||
|
|
@ -6,6 +6,7 @@ templating:
|
||||||
version: ~
|
version: ~
|
||||||
|
|
||||||
global:
|
global:
|
||||||
|
|
||||||
image:
|
image:
|
||||||
# -- (string) Global value that allows to set a single image registry across all deployments.
|
# -- (string) Global value that allows to set a single image registry across all deployments.
|
||||||
# When set, it will override any values set under `.image.registry` across the chart.
|
# When set, it will override any values set under `.image.registry` across the chart.
|
||||||
|
|
@ -64,13 +65,27 @@ crds:
|
||||||
groups:
|
groups:
|
||||||
|
|
||||||
# -- Install CRDs in group `kyverno.io`
|
# -- Install CRDs in group `kyverno.io`
|
||||||
kyverno: true
|
kyverno:
|
||||||
|
admissionreports: true
|
||||||
# -- Install CRDs in group `wgpolicyk8s.io`
|
backgroundscanreports: true
|
||||||
policyreport: true
|
cleanuppolicies: true
|
||||||
|
clusteradmissionreports: true
|
||||||
|
clusterbackgroundscanreports: true
|
||||||
|
clustercleanuppolicies: true
|
||||||
|
clusterpolicies: true
|
||||||
|
policies: true
|
||||||
|
policyexceptions: true
|
||||||
|
updaterequests: true
|
||||||
|
|
||||||
# -- Install CRDs in group `reports.kyverno.io`
|
# -- Install CRDs in group `reports.kyverno.io`
|
||||||
reports: true
|
reports:
|
||||||
|
clusterephemeralreports: true
|
||||||
|
ephemeralreports: true
|
||||||
|
|
||||||
|
# -- Install CRDs in group `wgpolicyk8s.io`
|
||||||
|
wgpolicyk8s:
|
||||||
|
clusterpolicyreports: true
|
||||||
|
policyreports: true
|
||||||
|
|
||||||
# -- Additional CRDs annotations
|
# -- Additional CRDs annotations
|
||||||
annotations: {}
|
annotations: {}
|
||||||
|
|
|
||||||
|
|
@ -24,6 +24,8 @@ import (
|
||||||
"github.com/kyverno/kyverno/pkg/logging"
|
"github.com/kyverno/kyverno/pkg/logging"
|
||||||
"github.com/kyverno/kyverno/pkg/metrics"
|
"github.com/kyverno/kyverno/pkg/metrics"
|
||||||
"github.com/kyverno/kyverno/pkg/policy"
|
"github.com/kyverno/kyverno/pkg/policy"
|
||||||
|
kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
|
||||||
|
apiserver "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
|
||||||
kubeinformers "k8s.io/client-go/informers"
|
kubeinformers "k8s.io/client-go/informers"
|
||||||
kyamlopenapi "sigs.k8s.io/kustomize/kyaml/openapi"
|
kyamlopenapi "sigs.k8s.io/kustomize/kyaml/openapi"
|
||||||
)
|
)
|
||||||
|
|
@ -32,6 +34,10 @@ const (
|
||||||
resyncPeriod = 15 * time.Minute
|
resyncPeriod = 15 * time.Minute
|
||||||
)
|
)
|
||||||
|
|
||||||
|
func sanityChecks(apiserverClient apiserver.Interface) error {
|
||||||
|
return kubeutils.CRDsInstalled(apiserverClient, "updaterequests.kyverno.io")
|
||||||
|
}
|
||||||
|
|
||||||
func createrLeaderControllers(
|
func createrLeaderControllers(
|
||||||
eng engineapi.Engine,
|
eng engineapi.Engine,
|
||||||
genWorkers int,
|
genWorkers int,
|
||||||
|
|
@ -108,6 +114,7 @@ func main() {
|
||||||
internal.WithDynamicClient(),
|
internal.WithDynamicClient(),
|
||||||
internal.WithKyvernoDynamicClient(),
|
internal.WithKyvernoDynamicClient(),
|
||||||
internal.WithEventsClient(),
|
internal.WithEventsClient(),
|
||||||
|
internal.WithApiServerClient(),
|
||||||
internal.WithFlagSets(flagset),
|
internal.WithFlagSets(flagset),
|
||||||
)
|
)
|
||||||
// parse flags
|
// parse flags
|
||||||
|
|
@ -128,6 +135,10 @@ func main() {
|
||||||
// THIS IS AN UGLY FIX
|
// THIS IS AN UGLY FIX
|
||||||
// ELSE KYAML IS NOT THREAD SAFE
|
// ELSE KYAML IS NOT THREAD SAFE
|
||||||
kyamlopenapi.Schema()
|
kyamlopenapi.Schema()
|
||||||
|
if err := sanityChecks(setup.ApiServerClient); err != nil {
|
||||||
|
setup.Logger.Error(err, "sanity checks failed")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
// informer factories
|
// informer factories
|
||||||
kyvernoInformer := kyvernoinformer.NewSharedInformerFactory(setup.KyvernoClient, resyncPeriod)
|
kyvernoInformer := kyvernoinformer.NewSharedInformerFactory(setup.KyvernoClient, resyncPeriod)
|
||||||
var wg sync.WaitGroup
|
var wg sync.WaitGroup
|
||||||
|
|
|
||||||
|
|
@ -26,9 +26,11 @@ import (
|
||||||
"github.com/kyverno/kyverno/pkg/logging"
|
"github.com/kyverno/kyverno/pkg/logging"
|
||||||
"github.com/kyverno/kyverno/pkg/tls"
|
"github.com/kyverno/kyverno/pkg/tls"
|
||||||
"github.com/kyverno/kyverno/pkg/toggle"
|
"github.com/kyverno/kyverno/pkg/toggle"
|
||||||
|
kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
|
||||||
"github.com/kyverno/kyverno/pkg/webhooks"
|
"github.com/kyverno/kyverno/pkg/webhooks"
|
||||||
admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
|
admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
|
||||||
corev1 "k8s.io/api/core/v1"
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
apiserver "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
|
||||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
kubeinformers "k8s.io/client-go/informers"
|
kubeinformers "k8s.io/client-go/informers"
|
||||||
)
|
)
|
||||||
|
|
@ -60,6 +62,10 @@ func (probes) IsLive(context.Context) bool {
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func sanityChecks(apiserverClient apiserver.Interface) error {
|
||||||
|
return kubeutils.CRDsInstalled(apiserverClient, "cleanuppolicies.kyverno.io", "clustercleanuppolicies.kyverno.io")
|
||||||
|
}
|
||||||
|
|
||||||
func main() {
|
func main() {
|
||||||
var (
|
var (
|
||||||
dumpPayload bool
|
dumpPayload bool
|
||||||
|
|
@ -94,6 +100,7 @@ func main() {
|
||||||
internal.WithConfigMapCaching(),
|
internal.WithConfigMapCaching(),
|
||||||
internal.WithDeferredLoading(),
|
internal.WithDeferredLoading(),
|
||||||
internal.WithMetadataClient(),
|
internal.WithMetadataClient(),
|
||||||
|
internal.WithApiServerClient(),
|
||||||
internal.WithFlagSets(flagset),
|
internal.WithFlagSets(flagset),
|
||||||
)
|
)
|
||||||
// parse flags
|
// parse flags
|
||||||
|
|
@ -109,6 +116,10 @@ func main() {
|
||||||
setup.Logger.Error(errors.New("exiting... tlsSecretName is a required flag"), "exiting... tlsSecretName is a required flag")
|
setup.Logger.Error(errors.New("exiting... tlsSecretName is a required flag"), "exiting... tlsSecretName is a required flag")
|
||||||
os.Exit(1)
|
os.Exit(1)
|
||||||
}
|
}
|
||||||
|
if err := sanityChecks(setup.ApiServerClient); err != nil {
|
||||||
|
setup.Logger.Error(err, "sanity checks failed")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
// certificates informers
|
// certificates informers
|
||||||
caSecret := informers.NewSecretInformer(setup.KubeClient, config.KyvernoNamespace(), caSecretName, resyncPeriod)
|
caSecret := informers.NewSecretInformer(setup.KubeClient, config.KyvernoNamespace(), caSecretName, resyncPeriod)
|
||||||
tlsSecret := informers.NewSecretInformer(setup.KubeClient, config.KyvernoNamespace(), tlsSecretName, resyncPeriod)
|
tlsSecret := informers.NewSecretInformer(setup.KubeClient, config.KyvernoNamespace(), tlsSecretName, resyncPeriod)
|
||||||
|
|
|
||||||
|
|
@ -70,7 +70,7 @@ func showWarnings(ctx context.Context, logger logr.Logger) {
|
||||||
}
|
}
|
||||||
|
|
||||||
func sanityChecks(apiserverClient apiserver.Interface) error {
|
func sanityChecks(apiserverClient apiserver.Interface) error {
|
||||||
return kubeutils.CRDsInstalled(apiserverClient)
|
return kubeutils.CRDsInstalled(apiserverClient, "clusterpolicies.kyverno.io", "policies.kyverno.io")
|
||||||
}
|
}
|
||||||
|
|
||||||
func createNonLeaderControllers(
|
func createNonLeaderControllers(
|
||||||
|
|
|
||||||
|
|
@ -24,6 +24,8 @@ import (
|
||||||
"github.com/kyverno/kyverno/pkg/event"
|
"github.com/kyverno/kyverno/pkg/event"
|
||||||
"github.com/kyverno/kyverno/pkg/leaderelection"
|
"github.com/kyverno/kyverno/pkg/leaderelection"
|
||||||
"github.com/kyverno/kyverno/pkg/logging"
|
"github.com/kyverno/kyverno/pkg/logging"
|
||||||
|
kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
|
||||||
|
apiserver "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
|
||||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||||
kubeinformers "k8s.io/client-go/informers"
|
kubeinformers "k8s.io/client-go/informers"
|
||||||
admissionregistrationv1alpha1informers "k8s.io/client-go/informers/admissionregistration/v1alpha1"
|
admissionregistrationv1alpha1informers "k8s.io/client-go/informers/admissionregistration/v1alpha1"
|
||||||
|
|
@ -35,6 +37,15 @@ const (
|
||||||
resyncPeriod = 15 * time.Minute
|
resyncPeriod = 15 * time.Minute
|
||||||
)
|
)
|
||||||
|
|
||||||
|
func sanityChecks(apiserverClient apiserver.Interface) error {
|
||||||
|
return kubeutils.CRDsInstalled(apiserverClient,
|
||||||
|
"clusterpolicyreports.wgpolicyk8s.io",
|
||||||
|
"policyreports.wgpolicyk8s.io",
|
||||||
|
"clusterbackgroundscanreports.kyverno.io",
|
||||||
|
"backgroundscanreports.kyverno.io",
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
func createReportControllers(
|
func createReportControllers(
|
||||||
eng engineapi.Engine,
|
eng engineapi.Engine,
|
||||||
backgroundScan bool,
|
backgroundScan bool,
|
||||||
|
|
@ -230,6 +241,7 @@ func main() {
|
||||||
internal.WithMetadataClient(),
|
internal.WithMetadataClient(),
|
||||||
internal.WithKyvernoDynamicClient(),
|
internal.WithKyvernoDynamicClient(),
|
||||||
internal.WithEventsClient(),
|
internal.WithEventsClient(),
|
||||||
|
internal.WithApiServerClient(),
|
||||||
internal.WithFlagSets(flagset),
|
internal.WithFlagSets(flagset),
|
||||||
)
|
)
|
||||||
// parse flags
|
// parse flags
|
||||||
|
|
@ -244,6 +256,10 @@ func main() {
|
||||||
// THIS IS AN UGLY FIX
|
// THIS IS AN UGLY FIX
|
||||||
// ELSE KYAML IS NOT THREAD SAFE
|
// ELSE KYAML IS NOT THREAD SAFE
|
||||||
kyamlopenapi.Schema()
|
kyamlopenapi.Schema()
|
||||||
|
if err := sanityChecks(setup.ApiServerClient); err != nil {
|
||||||
|
setup.Logger.Error(err, "sanity checks failed")
|
||||||
|
os.Exit(1)
|
||||||
|
}
|
||||||
setup.Logger.Info("background scan interval", "duration", backgroundScanInterval.String())
|
setup.Logger.Info("background scan interval", "duration", backgroundScanInterval.String())
|
||||||
// check if validating admission policies are registered in the API server
|
// check if validating admission policies are registered in the API server
|
||||||
if validatingAdmissionPolicyReports {
|
if validatingAdmissionPolicyReports {
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load diff
|
|
@ -10,25 +10,9 @@ import (
|
||||||
)
|
)
|
||||||
|
|
||||||
// CRDsInstalled checks if the Kyverno CRDs are installed or not
|
// CRDsInstalled checks if the Kyverno CRDs are installed or not
|
||||||
func CRDsInstalled(apiserverClient apiserver.Interface) error {
|
func CRDsInstalled(apiserverClient apiserver.Interface, names ...string) error {
|
||||||
kyvernoCRDs := []string{
|
|
||||||
"admissionreports.kyverno.io",
|
|
||||||
"backgroundscanreports.kyverno.io",
|
|
||||||
"cleanuppolicies.kyverno.io",
|
|
||||||
"clusteradmissionreports.kyverno.io",
|
|
||||||
"clusterbackgroundscanreports.kyverno.io",
|
|
||||||
"clustercleanuppolicies.kyverno.io",
|
|
||||||
"clusterpolicies.kyverno.io",
|
|
||||||
"clusterpolicyreports.wgpolicyk8s.io",
|
|
||||||
"policies.kyverno.io",
|
|
||||||
"policyexceptions.kyverno.io",
|
|
||||||
"policyreports.wgpolicyk8s.io",
|
|
||||||
"updaterequests.kyverno.io",
|
|
||||||
"ephemeralreports.reports.kyverno.io",
|
|
||||||
"clusterephemeralreports.reports.kyverno.io",
|
|
||||||
}
|
|
||||||
var errs []error
|
var errs []error
|
||||||
for _, crd := range kyvernoCRDs {
|
for _, crd := range names {
|
||||||
err := isCRDInstalled(apiserverClient, crd)
|
err := isCRDInstalled(apiserverClient, crd)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
errs = append(errs, fmt.Errorf("failed to check CRD %s is installed: %s", crd, err))
|
errs = append(errs, fmt.Errorf("failed to check CRD %s is installed: %s", crd, err))
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue