1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 16:06:56 +00:00
Commit graph

1986 commits

Author SHA1 Message Date
Jim Bugwadia
7e053cccd7 Merge branch 'main' of https://github.com/kyverno/kyverno into main 2021-07-20 21:49:53 -07:00
shuting
b2515fa9eb
Add default image registry to patched resource (#2166) 2021-07-20 21:20:37 -07:00
Jim Bugwadia
e4a311211b fmt and improve error messages
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-20 20:28:11 -07:00
Jim Bugwadia
30567be782 check for changes
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-20 09:36:12 -07:00
Jim Bugwadia
e18e7fc443 fix typo
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-20 09:31:52 -07:00
Max Goncharenko
0fdd349849
Changed error to info for NotFoundError in jsonContext (#2140)
* changed error to info for NotFoundError in jsonContext

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>

* raise log level for NotFoundError in jsonContext

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>
2021-07-14 14:50:28 -07:00
Jim Bugwadia
003c865ab9
deprecate policy status (#2136)
* deprecate policy status

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove policy status tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix generate metrics

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-14 12:18:59 -07:00
Vyankatesh Kudtarkar
b1861081be
support for Disallow pod exec operation (#2138) 2021-07-14 11:42:10 -07:00
Vyankatesh Kudtarkar
081cca8f23
Fix wildcards issue for match/exclude kind block (#2137)
* Fix wildcards issue for match/exclude kind block

* fix typo
2021-07-14 11:19:15 -07:00
shuting
104cd310e8
Cleanup Report Change Requests (#2134)
* clean up RCRs if retry fails

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* cleanup report change request when background scan starts

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* add verb deletecollection to ClusterRole kyverno:customresources

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-07-14 09:57:16 -07:00
Jim Bugwadia
13caaed8b7
Feature/cosign (#2078)
* add image verification

* inline policy list

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* cosign version and dependencies updates

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add registry initialization

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add build tag to exclude k8schain for cloud providers

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add build tag to exclude k8schain for cloud providers

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* generate deep copy and other fixtures

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix deep copy issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* mutate images to add digest

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add certificates to Kyverno container for HTTPS lookups

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align flag syntax

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update docs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update dependencies

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update dependencies

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* patch image with digest and fix checks

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* hardcode image for demos

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add default registry (docker.io) before calling reference.Parse

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix definition

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* increase webhook timeout

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix args

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* run gofmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* rename for clarity

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix HasImageVerify check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align make test commands

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align make test commands

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align make test commands

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix linter error

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle API conflict and retry

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix reviewdog issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix make for unit tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* improve error message

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix durations

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle errors in tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* print policy name

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add retries and duration to error log

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix time check in tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* round creation times in test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix retry loop

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove timing check for policy creation

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix e2e error - policy not found

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* update string comparison method

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix test Generate_Namespace_Label_Actions

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* add debug info for e2e tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix error

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix generate bug

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add check for update operations

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* increase time for deleteing a resource

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Shuting Zhao <shutting06@gmail.com>
2021-07-09 18:01:46 -07:00
Pooja Singh
20ac2a6556
Merge pull request #2112 from realshuting/bugfixes/inconsistent-polr
Fix inconsistent polr for audit policy
2021-07-09 18:12:46 +05:30
shuting
6afe86c54e
Apply pod's rules if the owner is not k8s pod-controllers (#2107)
* apply pod's rules if the owner is not k8s pod-controllers

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* add unit tests

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-07-09 14:44:38 +05:30
Shuting Zhao
5fdec77c6c fix inconsistent polr for audit policy
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-07-08 18:51:31 -07:00
Vineeth Reddy
eeb4e4ff0f
turn preconditions error to info log (#1926)
* turn preconditions error to info log

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>

* minor change

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>

* further changes

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>

* resolve conflicts

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>

* add precondition flag

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>

* NotFoundError -> Info

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>
2021-07-07 17:37:44 +05:30
Arsh Sharma
e74a5c803c
adding a note to deprecate name in favour of names (#2096)
Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
2021-07-06 11:34:06 -07:00
Vyankatesh Kudtarkar
4595f2cf30
Add autogen-support for test command (#2093)
* Add autogen-support for test command

* Fix e2e test issue

* Add test cases for autogen-support

* Fix testcase issue

* add testcases for cronjob
2021-07-06 10:44:43 +05:30
Max Goncharenko
fdaa73b175
Forbid variables in match/exclude/patchesJson6902.path sections (#1940)
* forbid variables in match/exclude/patchesJson6902.path sections

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* fix e2e test

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* edits related to the PR comments

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>
2021-07-02 19:17:40 +05:30
Max Goncharenko
6d0ad5598e
Jmespath notfound error (#1907)
* return err, if variable path could not be resolved

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* fixed {{@}} behavior

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* fix json merge logic

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* add e2e tests for Flux use case

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>
2021-07-01 22:56:50 -07:00
NoSkillGirl
2025fd0f70 fixing clone source replication
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-07-01 15:44:15 +05:30
Vyankatesh Kudtarkar
07910edd15
2074 : Fix Policy cache returns the duplicated policies (#2082)
* Fix Policy cache returns the duplicated policies

* Add testcases
2021-06-30 12:20:21 -07:00
Pooja Singh
cd9e596e7e
[Improvement] Kyverno should not delete downstream resources when a generate policy using the clone behavior has synchronize: true (#1880)
* debuging issue

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* issue fixed

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* remove policy name in source resource

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* fixed deletion of GR on source updation

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* added function in common

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* removing comments

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* added generated resource list to the log

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* small improvement

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-06-30 12:00:02 -07:00
Valentin Velkov
63f4c9a884
Configurable success events on policies & resources. Generating failure events on policies by default. (#1939)
* Remove unused event.Reason const

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Generate failure events on policies

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Generate success events on policy

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Introduce 'generateSuccessEvents' flag

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Unit tests & chart fix

Signed-off-by: Velkov <valentin.velkov@sap.com>
2021-06-29 14:43:11 -07:00
Arsh Sharma
fbc80cdfae
adding support for multiple names in match and exclude blocks (#2010)
* add names in rd struct

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added checking logic

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* updated yamls

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* wip: fix empty set problem

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* working with exclude

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* fixing name and names

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added error if both name and names are specified

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added tests

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* changed empty set logic, fixed whitespaces and comments

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* fix match and exclude bug

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
2021-06-28 22:31:22 -07:00
shuting
0a13ce9c73
Revert "Fix Helm deployment name issue" (#2070) 2021-06-24 14:22:34 -07:00
Pooja Singh
54a85c5da1
Merge pull request #2045 from vyankyGH/fix_deployment_name
Fix Helm deployment name issue - install kyverno with helm release name != kyverno
2021-06-24 19:19:19 +05:30
treydock
3b1fd912cb
Move log to debug for wildcard pattern matching (#2064)
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
2021-06-23 16:48:09 -07:00
Vyankatesh Kudtarkar
09909a56f2
Merge pull request #2054 from DarthBenro008/fix/2031
add: http/https regex to kyverno CLI
2021-06-23 10:10:25 +05:30
DarthBenro008
e82e7e7596
refactor: fix minor typos
Signed-off-by: DarthBenro008 <hkpdev008@gmail.com>
2021-06-23 00:37:41 +05:30
vivek kumar sahu
faa88699af
fix typo in policy struct (#1992)
* Updates L-30  Signed-off-by: viveksahu26  vivekkumarsahu650@gmail.com

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* compile the code using

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
2021-06-22 10:03:15 -07:00
DarthBenro008
c32526f109
fix: add http/https regex to kyverno CLI
Signed-off-by: DarthBenro008 <hkpdev008@gmail.com>
2021-06-22 18:48:23 +05:30
Arsh Sharma
86045fc02c
adding support for policies.kyverno.io/scored annotation (#1976)
* initial commit

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added debug statements

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* fixed report

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* removed code for debugging

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* newline fix

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* fix default case

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
2021-06-21 18:37:20 -07:00
Pooja Singh
e677e91679
Merge pull request #2024 from NoSkillGirl/2023/CLI_should_validate_all_resources
added loop for namespace to validate all the resources
2021-06-19 12:55:13 +05:30
vyankatesh
4f3a780cc4 fix issue 2021-06-17 20:49:28 +05:30
shuting
65975a8b65
Enable webhooks configuration via Helm (#2032)
* helm - enable configurations of webhooks

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* retry on update failure

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* update Readme

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* address lint errors

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-06-16 23:29:07 -07:00
Pooja Singh
fec236c365
Merge pull request #3 from NoSkillGirl/master
sync with master
2021-06-16 09:40:04 +05:30
NoSkillGirl
e40cd614de fixing reviewdog error
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-06-16 09:19:58 +05:30
NoSkillGirl
3c1cb89249 seperating code for get resources
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-06-16 08:17:31 +05:30
NoSkillGirl
4d574a7846 removed cluster function
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-06-16 08:12:03 +05:30
NoSkillGirl
f42aff1a42 code optimization
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-06-16 07:56:08 +05:30
shuting
6d5e988ebe
BugFix - update the annotation lastRequestTimestamp from active instances (#2019)
* fix webhook monitor - inactive instance did not get latest request timestamp

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* add checks for registered webhook configs

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* update veridy_deployment.sh

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* add debug steps in e2d workflow

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix CI errors

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-06-15 18:39:22 -07:00
NoSkillGirl
b8ada99d50 trying to change the way resource is stored in map
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-06-15 23:35:22 +05:30
NoSkillGirl
09b1592f11 added loop for namespace
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-06-15 18:14:51 +05:30
shuting
fa419439ec
fix merge eror (#2016)
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-06-14 15:50:34 -07:00
Shuting Zhao
2abeb9dda7 fix prometheus panics
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-06-14 13:42:57 -07:00
shuting
6f07ea407f
Customize namespaceSelector of Webhookconfigurations (#2003)
* customize namespaceSelector of webhook configurations from configMap

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* update webhook configurations base on UPDATEs of Kyverno ConfigMap

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* register webhook configurations with the namespaceSelector from ConfigMap

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* address golint comment

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* validate webhooks config format

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix NotDefined scenario

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-06-14 13:01:40 -07:00
Vineeth Reddy
34cf44a857
improve log message for generate policies (#1993)
Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>
2021-06-10 12:48:26 -07:00
Arsh Sharma
7e9be24d90
updating minio verison (#1956) 2021-06-09 19:16:26 -07:00
Vyankatesh Kudtarkar
9d00348a52
Fix: mutate policies kept applying to these terminating Pods (#1978)
* Fix Dev setup

* Fix mutate policies kept applying to these terminating Pods

* fix patch resource issue

Co-authored-by: vyankatesh <vyankatesh@neualto.com>
2021-06-09 18:34:10 -07:00
Vineeth Reddy
6d2cb87370
change min support kubernetes version to 1.16 for kyverno 1.4 (#1935)
* change min support kubernetes version to 1.16 for kyverno 1.4

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>

* migrate deployment to apps/v1

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>
2021-06-08 13:14:28 -07:00