mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 16:06:56 +00:00
Code Activity
4669 commits 16 branches 550 tags 288 MiB
Commit graph

2675 commits

Author SHA1 Message Date
yinka
688b4fb8e3
add package logger in files (#4766) 
* add package logger in files

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* add package logger to initContainer and other files

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* helm docs

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* helm default values

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* release notes

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-10-02 19:45:03 +00:00
Charles-Edouard Brétéché
ac8f4ba59c
refactor: make server owner of the cleanup chan (#4765) 
* refactor: make server owner of the cleanup chan

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* gofumpt

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-30 16:13:29 +02:00
Charles-Edouard Brétéché
9aca37fe9f
refactor: use context in openapi controller (#4760) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-30 11:56:47 +00:00
Charles-Edouard Brétéché
287eb84d07
refactor: use context in controllers instead of chan (#4761) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-30 16:54:47 +05:30
Charles-Edouard Brétéché
c42851a37a
refactor: use context in dynamic client instead of chan (#4756) 
* refactor: use context in dynamic client instead of chan

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-30 10:12:21 +02:00
Eng Zer Jun
f40a3bc8f5
refactor: move from io/ioutil to io and os packages (#4752) 
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit
replaces the existing io/ioutil functions with their new definitions in
io and os packages.

Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
 2022-09-30 12:55:19 +05:30
Charles-Edouard Brétéché
8784f95cc7
refactor: split main in a couple of funcs and use local loggers (#4754) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-30 08:13:13 +02:00
yinka
528bcbad6b
add and use package level logger (#4750) 
* add and use package level logger

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* small fixes

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* fix comments

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* add Info and Error functions

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* small fixes

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* move function calls

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* replace init function

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-29 19:43:20 +00:00
Charles-Edouard Brétéché
7fa796e24a
fix: watch error in resource controller (#4751) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-29 23:39:34 +05:30
Charles-Edouard Brétéché
5a3532da91
chore: use constant in cert manager controller (#4747) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-29 17:50:19 +02:00
Charles-Edouard Brétéché
205bb28b52
feat: add typed client support and metrics wrapper (#4724) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-29 17:12:50 +05:30
shuting
1d83e86c12
Add PSa policy validations (#4735) 
* Validate PSa control names

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add validation checks for the PSa rule

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-29 12:03:13 +08:00
Abhinav Sinha
a1182859ad
Added x509_decode JMESPath function (#4664) 
* Added `x509_decode` JMESPath function

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Use `crypto/x509` stdlib

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Return result as `map[string]interface{}`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Made minor fixes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Fixed error with unmarshalling decoded certificate

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Added e2e test for decoding X.509 certs

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Reverted to using `smallstep/zcrypto` for X.509

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Minor fix

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Addressed reviews

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Removed redundant dependency on `pkg/errors`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-09-28 18:15:39 +00:00
Prateek Pandey
38c252952d
feat: add matchlabel selector support with multiple clone (#4713) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-28 17:44:38 +02:00
Charles-Edouard Brétéché
e0ab72bb9a
feat: reports v2 implementation (#4608) 
This PR refactors the reports generation code.
It removes RCR and CRCR crds and replaces them with AdmissionReport, ClusterAdmissionReport, BackgroundScanReport and ClusterBackgroundScanReport crds.

The new reports system is based on 4 controllers:

Admission reports controller is responsible for cleaning up admission reports and attaching admission reports to their corresponding resource in case of a creation
Background scan reports controller is responsible for creating background scan reports when a resource and/or policy changes
Aggregation controller takes care of aggregation per resource reports into higher level reports (per namespace)
Resources controller is responsible for watching reports that need background scan reports
I added two new flags to disable admission reports and/or background scan reports, the whole reporting system can be disabled if something goes wrong.

I also added a flag to split reports in chunks to avoid creating too large resources.

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Co-authored-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-28 17:15:16 +05:30
shuting
34c6920129
Support PSa integration by controlName only (#4710) 
* Remove "restrictedField" and "values" from podSecurity.exclude

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove commented code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add unit tests for restricted_runAsNonRoot

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add baseline unit tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add unit tests for restricted controls

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Removes PSa tests at the engine level

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - Update API docs; - Add unit tests for wildcard images

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove autogen conversion for PSa policies

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* copy pod with DeepCopy()

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-28 10:03:53 +00:00
Charles-Edouard Brétéché
56c74272bb
chore: update client code generator (#4711) 
* chore: update client code generator

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix inconsistency on my mac

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-28 09:31:06 +00:00
Charles-Edouard Brétéché
073ff38cc9
fix: change key used in test (#4718) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-27 17:18:14 +00:00
Charles-Edouard Brétéché
160259d954
fix: missing client wrapper (#4703) 
* fix: missing client wrapper

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* v1beta1

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* v1alpha2

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* policy report

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-26 16:54:29 +00:00
Charles-Edouard Brétéché
481a09823f
refactor: use pod name as leader id (#4680) 
* refactor: use pod name as leader id

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix manifests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* makefile

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* leader client

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-26 16:25:27 +00:00
Charles-Edouard Brétéché
665e513c5e
fix: split webhook handlers per failure policy (#4650) 
* fix: split webhook handlers per failure policy

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix handlers

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* rolling update

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* better error message

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-09-26 15:55:46 +00:00
Charles-Edouard Brétéché
8741c34081
fix: shutdown controllers workers gracefully (#4681) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-09-26 15:24:57 +00:00
Pradeep Lakshmi Narasimha
e305aea95c
fix: namespaced policy targets namespace validation and scoping them to the policy's namespace (#4671) 
Signed-off-by: praddy26 <pradeep.vaishnav4@gmail.com>

Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-26 14:54:13 +00:00
Charles-Edouard Brétéché
79bff1c19c
refactor: replace signal package by signal.NotifyContext (#4691) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-09-26 14:24:32 +00:00
Charles-Edouard Brétéché
6a8085522a
fix: jmespath random error handling (#4697) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-26 13:33:52 +00:00
Prateek Pandey
9cc1e6b2b3
fix: handle auth permission for cloneList validation (#4684) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-26 13:23:00 +05:30
Charles-Edouard Brétéché
4d7e1281de
fix: namespaced policy not validated in engine (#4653) 
* fix: namespaced policy not validated in engine

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix test

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-26 12:47:37 +08:00
Vyankatesh Kudtarkar
23269b7f5c
Fix issue for wildcard versions (#4670) 
* Fix wildcard issue

Co-Authored-By: vyankd <51167361+vyankd@users.noreply.github.com>

* Delete res.yaml

Co-Authored-By: vyankd <51167361+vyankd@users.noreply.github.com>

Co-authored-by: vyankd <51167361+vyankd@users.noreply.github.com>
 2022-09-23 22:04:39 +08:00
Sandesh More
01b1ece704
added kubeconfig and context flag to kyverno apply (#4524) 
Signed-off-by: Sandesh More <sandesh.more@infracloud.io>
 2022-09-20 19:05:18 +05:30
Charles-Edouard Brétéché
328fdc8b3d
feat: add feature flag to disable background scan (#4638) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-19 12:00:36 +00:00
Charles-Edouard Brétéché
6eea7c45f7
feat: add explicit key support to controller utils (#4628) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 11:25:03 +00:00
Prateek Pandey
71404df826
refactor: update log based on the policy types (#4646) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 10:56:55 +00:00
Charles-Edouard Brétéché
42a2df56c1
refactor: add a couple of constants in api (#4640) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 09:11:12 +00:00
Charles-Edouard Brétéché
b9baae9746
fix: incorrect namespace in report controller (#4637) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-19 07:33:34 +00:00
Charles-Edouard Brétéché
316640c72b
fix: remove RCR from mutation webhook (#4636) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 09:04:50 +02:00
Charles-Edouard Brétéché
d256735399
feat: add controller utils tools (#4639) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-18 10:12:29 +01:00
Anurag
cadf577e4b
enhance jmespath random-filter (#4591) 
Signed-off-by: Anurag <contact.anurag7@gmail.com>

Signed-off-by: Anurag <contact.anurag7@gmail.com>
 2022-09-14 06:27:32 +00:00
Charles-Edouard Brétéché
e516fb868e
fix: lock in policy report mapper (#4601) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-13 16:30:14 +08:00
Charles-Edouard Brétéché
da5312c177
refactor: simplify RCR creator queue (#4578) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-12 14:48:27 +00:00
Charles-Edouard Brétéché
7c74e40b86
refactor: info in policyreport package (#4598) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-09-12 09:00:56 +00:00
Vyankatesh Kudtarkar
c7bcd5fadf
Fix multiple crd slowness issue (#4275) 
Signed-off-by: Vyankatesh vyankateshkd@gmail.com

* fix multiple crd issue
 2022-09-12 16:14:28 +08:00
Jim Bugwadia
ed6d9b9624
enable autogen for validate.podsecurity with no exclude (#4594) 
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-09-12 12:33:35 +05:30
Charles-Edouard Brétéché
bc4bf5ee27
chore: switch to github.com/IGLOU-EU/go-wildcard (#4563) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-09-10 17:30:13 +00:00
Jim Bugwadia
c2b4a9434b
allow PSa validation with no exceptions (#4558) 
Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-10 16:58:10 +00:00
Charles-Edouard Brétéché
6a0fff7c9f
fix: split policy report flag (#4576) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-10 15:29:48 +00:00
Charles-Edouard Brétéché
f4fe017ede
chore: add toggle package unit tests (#4577) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-10 13:00:20 +00:00
Charles-Edouard Brétéché
d558c12470
refactor: move generation handler out of webhooks package (#4570) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 19:49:38 +05:30
Charles-Edouard Brétéché
10638362dc
refactor: move image verification handler out of webhooks package (#4569) 
* refactor: move mutation handler out of webhooks package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: move image verification handler out of webhooks package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 15:05:57 +02:00
Charles-Edouard Brétéché
20b8697ad8
refactor: move mutation handler out of webhooks package (#4567) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 12:48:29 +02:00
Charles-Edouard Brétéché
3e5af370a5
refactor: move validation audit out of webhooks package (#4562) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 09:27:07 +00:00