1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-01-20 18:52:16 +00:00
Commit graph

88 commits

Author SHA1 Message Date
Prateek Pandey
2078f0dfd2
fix: allow delete of target resource with synchronize false (#5081)
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-10-20 19:41:57 +00:00
Pratik Shah
caab013a86
Fixed issue-4530: Added separate attestor type for secrets and KMS (#4733)
Signed-off-by: Pratik Shah <pratik@infracloud.io>

Signed-off-by: Vyankatesh <vyankateshkd@gmail.com>
2022-10-14 09:40:46 +00:00
Pratik Shah
8a0083105d
Added support to specify key signature algorithm in verifyImages (#4855)
Signed-off-by: Pratik Shah <pratik@infracloud.io>

Signed-off-by: Pratik Shah <pratik@infracloud.io>
2022-10-14 05:39:57 +00:00
Sachin Maurya
bec5632344
e2e test for mutate policy (#3383)
Signed-off-by: slayer321 <sachin.maurya7666@gmail.com>

Signed-off-by: slayer321 <sachin.maurya7666@gmail.com>
2022-10-08 10:57:41 -04:00
yinka
688b4fb8e3
add package logger in files (#4766)
* add package logger in files

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* add package logger to initContainer and other files

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* helm docs

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* helm default values

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* release notes

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-02 19:45:03 +00:00
Abhinav Sinha
a1182859ad
Added x509_decode JMESPath function (#4664)
* Added `x509_decode` JMESPath function

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Use `crypto/x509` stdlib

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Return result as `map[string]interface{}`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Made minor fixes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Fixed error with unmarshalling decoded certificate

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Added e2e test for decoding X.509 certs

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Reverted to using `smallstep/zcrypto` for X.509

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Minor fix

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Addressed reviews

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Removed redundant dependency on `pkg/errors`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-09-28 18:15:39 +00:00
Prateek Pandey
9cc1e6b2b3
fix: handle auth permission for cloneList validation (#4684)
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-09-26 13:23:00 +05:30
Prateek Pandey
1cacd0173d
feat: allow cloning multiple resource from a namespace (#4384) 2022-09-08 04:47:09 +00:00
Riko Kudo
5f5cda9fee
Yaml signing and verification (#4235)
* enable YAML verification using k8s-manifest-sigstore

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

comment out role and rolebinding for dryrun

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update k8s-manifest-sigstore version

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix pubkey setting

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix pubkey setting

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix log message

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

change default value of dryrun option

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update crd

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

support gpg signature

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* upgrade manifest sigstore version and support multi sigs

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix validate.manifest rule

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update crd and add small fix

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix manifest verify policy

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

set cosign experimental env when keyless verification

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* improve default ignoreFields

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* fix manifest verify policy

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix manifest verify policy

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix manifest verify policy

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* add unit-test for k8smanifest

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update install yaml

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* update k8s-manifest-sigstore version and support one or more signatures

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

add unit-test for k8smanifest multi-signature

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix verifyManifest result message

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix verifyManifest result message

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* fix manifest verify policy and move dryrun rbac to dryrun dir

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* update k8s-manifest-sigstore version

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update k8s-manifest-sigstore version

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update k8s-manifest-sigstore version and resolve conflict

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

enable YAML verification using k8s-manifest-sigstore

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

comment out role and rolebinding for dryrun

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix pubkey setting

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix pubkey setting

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update crd

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

upgrade manifest sigstore version and support multi sigs

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix validate.manifest rule

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update crd and add small fix

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix manifest verify policy

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

update k8s-manifest-sigstore version and support one or more signatures

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix verifyManifest result message

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix verifyManifest result message

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

fix manifest verify policy and move dryrun rbac to dryrun dir

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

add small fix

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* remove generic name

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* fix sonatype-lift issue and unit-test error

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* fix gofumpt error

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>

* update manifest rule to use attestor

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* remove unused value

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* resolve conflict

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix install.yaml

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix to set COSIGN_EXPERIMENTAL env variable when keyless verification

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix misspell

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* enable kyverno cli in validate.manifests rule (#3)

* enable kyverno cli in validate.manifests rule

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* update k8s-manifest-sigstore version and improve error handling for better result output

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* update crds and deepcopy

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* update unit test

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* update k8s-manifest-sigstore version

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* change to use spec.rules.exclude.subjects instead of skipUsers (#4)

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* update k8s-manifest-sigstore version

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix yaml signing sigstore (#5)

* update k8s-manifest-sigstore version

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* add a comment for dryrun option field

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* enable to include ClusterPolicy/Policy in match resource

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix log style and env variable settings

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* simplify manifest verify func

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix func name

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix sonatype warning

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix default ignoreFields

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix yaml signing sigstore rbac (#6)

* fix dryrun rbac to have minimal permissions

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix lint error

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix unit-test error

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix gofumpt error

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* fix log style

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* updated CRD documentation

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* resolve go.mod conflicts

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

* updated helm stuff

Signed-off-by: Riko Kudo <rurikudo@ibm.com>

Signed-off-by: Ruriko Kudo <rurikudo@ibm.com>
Signed-off-by: Riko Kudo <rurikudo@ibm.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-08-30 10:14:54 -07:00
Charles-Edouard Brétéché
144985ee5a
chore: fix golangcilint timeout (#4388)
* chore: fix golangcilint timeout

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix commit sha

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* add .gitattributes

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-08-24 21:08:24 +08:00
Charles-Edouard Brétéché
24e96884c5
refactor: finish refactoring generate e2e tests (#4090)
* refactor: generate e2e GeneratePolicyDeletionforCloneTests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: generate e2e test GenerateNetworkPolicyOnNamespaceWithoutLabelTests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* chore: cleanup

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* finish refactoring tests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: is not found

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor expectations part 1

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: repeat update on conflict

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-07-05 23:34:09 +08:00
Charles-Edouard Brétéché
27e5772986
fix: add more verify images e2e test for bool fields (#4172)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-06-30 21:36:28 +02:00
Charles-Edouard Brétéché
e1db7c9814
feat: add e2e framework and verify image new test (#4094)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-06-09 21:58:07 +08:00
Charles-Edouard Brétéché
e3c39f1da1
refactor: generate e2e GeneratePolicyDeletionforCloneTests (#4071)
* refactor: generate e2e GeneratePolicyDeletionforCloneTests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: unit test

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* chore: remove resourceExpectation type

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-06-07 23:35:44 +08:00
Charles-Edouard Brétéché
0b7b2458eb
refactor: generate e2e tests (#4068)
* refactor: use t.Cleanup in e2e tests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: generate e2e tests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* helpers

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-06-03 21:08:27 +02:00
Charles-Edouard Brétéché
fe3c12628c
refactor: use t.Cleanup in e2e tests (#4067)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
2022-06-03 19:08:33 +05:30
Charles-Edouard Brétéché
1936d86623
fix: move ur controller filtering in reconciler (#3964)
* fix: move ur controller filtering in reconciler

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: mark ur retry on conflict

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: test data

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: add filter back in update ur handler

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: added some logs about attempts and increased backoff

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: reconciliation logic

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: Test_Generate_Synchronize_Flag

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: small nits

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-20 00:06:56 +08:00
Charles-Edouard Brétéché
0099ef54ad
chore: enable gofmt and gofumpt linters (#3931)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 06:19:03 +00:00
Charles-Edouard Brétéché
747f4128ef
chore: enable noctx linter (#3888)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-11 17:34:40 +05:30
Charles-Edouard Brétéché
f508e9a0b8
chore: add unconvert linter (#3867)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-10 20:28:45 +01:00
Charles-Edouard Brétéché
97e5e64fd4
chore: enable whitespace linter (#3864)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-10 17:01:29 +00:00
Jim Bugwadia
bc07943c81
handle subresources (#3841)
* handle subresources

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix logger name

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix webhook and logs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-09 18:50:50 -07:00
Afzal Ansari
3845225db1
refactor: imported pkg redeclared and a few other unused func (#3827)
* Removes paths redeclared

Signed-off-by: afzal442 <afzal442@gmail.com>

* fixes v1 redeclared

Signed-off-by: afzal442 <afzal442@gmail.com>

* fixes mergeSucceededResults func never used

Signed-off-by: afzal442 <afzal442@gmail.com>

* fixes func unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors unused func

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors unused func

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors getNamespacesForRule unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors policyNamespace unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors replacing loop with ...

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors func buildPolicyLabel unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* removes unused func

Signed-off-by: afzal442 <afzal442@gmail.com>

* removes unused comment

Signed-off-by: afzal442 <afzal442@gmail.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-07 16:44:57 +00:00
shuting
b4f2b63f53
Load mutate.targets via dclient (#3797)
* Load mutate.targets via dclient

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Do not fail on namespace cleanup for e2e generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Fix wildcard name listing for a certain namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Rename onPolicyUpdate to mutateExistingOnPolicyUpdate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Enable "mutateExistingOnPolicyUpdate" on policy events

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
2022-05-06 05:46:36 +00:00
shuting
8a9a98d8b5
Add handler to UR.status (#3791)
* - Add "handler" to "ur.status"
- Mark / Unmark handler upon UR reconciliation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add field onPolicyUpdate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Update API docs

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add delay in generate e2e tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove duplicate logic for cleaning up the cloned resource

Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-05-05 16:26:27 +05:30
Sambhav Kothari
655e2a74d7
Add tests for required checks for image verify (#3755) 2022-05-01 18:00:44 -07:00
Sambhav Kothari
8342d86a9e
Retry policy creation to avoid flaky CRD readiness (#3752)
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-05-01 22:42:14 +00:00
Sambhav Kothari
dd0f6baa7d
Enable tests in makefile (#3699) 2022-05-01 14:20:22 -07:00
shuting
a4815f77c4
Convert GenerateRequest to UpdateRequest for backward compatibility (#3730)
- Remove GenerateRequest Informer
 - Rename GenerateRequest to UpdateRequest in logs and vars
 - Fix initContainer leader election
 - Convert GenerateRequest to UpdateRequest in initContainer
 - Remove unused methods
 - Add printer column ruleType to UR


Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-04-29 16:35:49 +05:30
shuting
e248308cb3
Create UR for both mutate and generate policies (#3717)
* remove mutateExisting field

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update policy controller to create UR for generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove debug log

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - Update api docs
- Ignore e2e tests cleanup failure

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add back index to helm template

Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-04-29 11:01:02 +05:30
shuting
b740e84f06
add e2e tests for mutate existing policies (#3703)
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-04-27 21:44:52 +02:00
Sambhav Kothari
9d13e89697
Enable verifyImages and CLI registry tests (#3684)
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
2022-04-27 17:29:54 +08:00
shuting
d5f6167e56
Fix flaky e2e tests for generate policies (#3681)
* fix flaky generate e2e tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* enable validate, verifyimage e2e tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* set policy names different within a single test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* do not delete cloned resource when sync generate policy is deleted

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* replace grLister by urLister

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* re-queue pending URs only to fix clone policy deletion

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove duplicate import

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-26 19:18:24 +00:00
Ioannis Bouloumpasis
a205bc3e2e
fix: webhooks are not configured correctly (#3660)
* Fix webhook rules equality when internal is empty

The current implementation of the 'webhookRulesEqual' didn't check for
the corner case were both the internal representation and the API have
length of one, but the internal representation has 1 rule with no
selectors.
In this case the 'webhookRulesEqual' should return false, as the 2
configurations are not the same.

Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>

* Fix tests

Add a small time delay when checking if a Policy is ready in tests to
ensure that the Policy is actually ready.

Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
2022-04-25 15:19:39 +00:00
Sambhav Kothari
ec4e4ba452
Add support for custom image extractors (#3596)
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
2022-04-14 09:08:30 -07:00
vivek kumar sahu
c456b541af
e2e test for mutate global anchor Policy (#2574)
* Added e2e test for mutate-global-anchor-policy

Signed-off-by: vivek kumar sahu <vivekkumarsahu650@gmail.com>

* Updated config.go for mutate globar anchor policy

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* Added resources for mutate global anchor policy

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
2022-03-14 09:15:06 +00:00
Sambhav Kothari
e9e96e7b1c
Run E2E tests on all supported k8s versions (#3256) 2022-02-23 15:52:08 +00:00
Afzal Ansari
fc658da1e3
Added e2e test for JSON patch mutate policy (#2966)
* Adds e2e test for JSON patch mutate policy

Signed-off-by: afzal442 <afzal442@gmail.com>

* modifies the config to use the optimal version of that policy

Signed-off-by: afzal442 <afzal442@gmail.com>

* Fixes the lint issuue

Signed-off-by: afzal442 <afzal442@gmail.com>

* modifies test to pass

Signed-off-by: afzal442 <afzal442@gmail.com>

* adds changes to resources

Signed-off-by: afzal442 <afzal442@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-02-10 05:18:26 +00:00
Sambhav Kothari
1af9e48b0d
Add image data to validate image configs (#2946)
* Add image data to validate image configs

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add tests for image context

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add e2e test cases for image size policy

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-17 04:06:44 +00:00
Sambhav Kothari
f42092208f
Fix variable substitution for foreach preconditions (#2993)
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-01-16 05:33:34 +00:00
Jim Bugwadia
b17e76493e
tighten and clarify Kyverno roles and permissions (#2799)
* update roles and rolebindings

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* revert label and fix perms

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update role

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* restrict role

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix whitespace

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests and roles

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove ingress extensions/v1beta1

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix chart

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix role

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* tighten and clarify Kyverno roles and permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fake commit to trigger workflows

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* revert tests and update test role

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add newlines

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove update role

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove invalid param

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* cleanup roles in Helm templates

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove `mutate` cluster role binding

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-12-10 04:34:06 +00:00
vivek kumar sahu
7d65ebbd87
E2e test for global anchor validate policy (#2479)
* Added test-e2e-local in the Makefile

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* Added a proper Indentation

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* Added e2e test case for global-anchor validate policy

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* Added resources

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
2021-10-20 16:55:55 -07:00
Bricktop
3f15ec5a1e
Remove dead code and unused variables (#2537)
* Remove dead code and unused variables

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>

* Remove unnecessary definitions

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>
2021-10-13 22:45:23 +02:00
Sachin
787d6de696
unnecessary use of fmt.Sprintf (#2531)
Signed-off-by: slayer321 <sachin.maurya7666@gmail.com>
2021-10-13 11:00:04 -07:00
Sachin
e16d773957
Remove unused function (#2517) 2021-10-11 12:46:28 -07:00
ShutingZhao
5f9be9bf36 add delay in e2e test
Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-10 20:22:36 -07:00
ShutingZhao
a5c399bb15 e2e test - add retry when getting generated configmap
Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-06 22:36:43 -07:00
shuting
b10947b975
Dynamic webhooks (#2425)
* support k8s 1.22, update admissionregistration.k8s.io/v1beta1  to admissionregistration.k8s.io/v1

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - add failurePolicy to policy spec; - fix typo

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - add schema validation for failurePolicy; - add a printer column

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* set default failure policy to fail if not defined

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* resolve conflicts

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix missing type for printerColumn

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* refactor policy controller

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add webhook config manager

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - build webhook objects per policy update; - add fail webhook to default webhook configurations

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix panic on policy update

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* build default webhook: match empty if autoUpdateWebhooks is enabled, otherwise match all

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - set default webhook configs rule to empty; - handle policy deletion

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* reset webhook config if policies with a specific failurePolicy are cleaned up

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* handle wildcard pocliy

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* update default webhook timeout to 10s

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* cleanups

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* added webhook informer to re-create it immediately if missing

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* update tag webhookTimeoutSeconds description

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix e2e tests

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix linter issue

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* correct metric endpoint

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add pol.generate.kind to webhooks

Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-05 00:15:09 -07:00
Jim Bugwadia
731ffde0e7 fix messages and tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-03 03:15:22 -07:00
Jim Bugwadia
67660647d9 update tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-09-26 18:30:53 -07:00