Utsab Sapkota
982b3fdcdc
Autogenv2 rule evaluation logic ( #11434 )
...
* Autogenv2 rule evaluation logic
Signed-off-by: utsab818 <utsabsapkota4231@gmail.com>
* Fixed lint error
Signed-off-by: utsab818 <utsabsapkota4231@gmail.com>
* resolve: comments
Signed-off-by: utsab818 <utsabsapkota4231@gmail.com>
* Updated resource reference in extractPodSpec
Signed-off-by: utsab818 <utsabsapkota4231@gmail.com>
---------
Signed-off-by: utsab818 <utsabsapkota4231@gmail.com>
2024-11-05 09:14:24 +00:00
Mariam Fahmy
646267b229
fix: add celPreconditions in autogen rules ( #11503 )
2024-10-31 14:12:22 +00:00
Charles-Edouard Brétéché
a5e082303d
refactor: introduce autogen interface ( #11418 )
...
* refactor: introduce autogen interface
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix linter
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-16 15:24:37 +02:00
Charles-Edouard Brétéché
4d1683d167
refactor: move autogen v1 and v2 packages ( #11416 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-16 08:51:38 +00:00
Charles-Edouard Brétéché
bd3a6f066b
chore: use ptr package ( #11346 )
...
* chore: use ptr package
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* nit
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-07 14:10:20 +00:00
Charles-Edouard Brétéché
82f4ca9034
fix: policy status updates not stabilising ( #11236 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-09-25 13:44:39 +00:00
Khaled Emara
9541608182
fix(status): status comparison is wrong ( #11203 )
...
* fix(status): status comparison is wrong
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* fix(status): retry status update after first failure
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
---------
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-09-24 15:17:38 +00:00
Charles-Edouard Brétéché
b463ee40d2
feat: use pointer in rule (validate field) ( #11095 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-09-11 09:12:53 +00:00
Charles-Edouard Brétéché
e7e2f0a07f
feat: use pointer in rule (mutation field) ( #11078 )
...
* feat: use pointer in rule (mutation field)
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-09-11 04:32:10 +03:00
Charles-Edouard Brétéché
b5e1c97913
feat: use pointer in rule (exclude field) ( #11050 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-09-10 11:14:49 +00:00
Charles-Edouard Brétéché
bc0f83b175
feat: remove yaml markers ( #11015 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-09-05 11:13:16 +00:00
Mariam Fahmy
2140a0239b
chore: rename validationFailureAction to failureAction under the rule ( #10893 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2024-08-27 20:07:57 +00:00
Mariam Fahmy
c796bb765c
fix: return policies with either audit or enforce rules from the cache ( #10667 )
...
* fix: return policies with either audit or enforce rules from the cache
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* feat: introduce validationFailureAction under verifyImage rules
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* feat: add chainsaw tests
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-08-06 18:24:28 +00:00
Khaled Emara
c0cf6c5bf1
feat(json): unmarshal at decode time ( #10700 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-05 15:46:50 +03:00
Frank Jogeleit
91ffbb6758
feat: assert rule autogen ( #10780 )
...
* Support autogen for assert validation rules
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* simplify assert autogen logic
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* add chainsaw test
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
---------
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
2024-08-05 10:59:55 +00:00
Khaled Emara
0aeb32df3b
feat(autogen): use static bytes instead of string ( #10723 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-07-29 13:46:11 +00:00
shuting
fb9c66f455
feat(perf): add new linter prealloc to enforce slice declarations best practice ( #10250 )
...
* feat(perf): add new linter prealloc to enforce slice declarations best practice
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix(linter): prealloac slices
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2024-05-20 14:46:35 +05:30
shuting
96ffbadd77
fix: sort pod controllers for autogen rule ( #10140 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2024-04-30 12:26:12 +00:00
Khaled Emara
c9055ac2ff
fix(autogen): only generate rule for request kind ( #9984 )
...
* fix(autogen): only generate rule for request kind
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* feat(autogen): use jsoniter instead of std for json
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* chore(atogen): use sets instead of manipulating strings
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* fix(autogen): formatting linter
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* fix(autogen): backwards compatability
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* revert(autogen): old behavior
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* fix: builds error
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2024-04-04 08:09:30 +00:00
Mariam Fahmy
d47684c0d9
feat: support validatingadmissionpolicybindings in CLI apply command ( #9468 )
...
* feat: support validatingadmissionpolicybindings in CLI apply command
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix linter issue
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-01-23 11:47:38 +00:00
Gurmannat Sohal
6902a2b092
Unit tests for Pod Security Admission Integrations ( #8585 )
...
* feat: enable field-restricted exclusions using the psa
Signed-off-by: Liang Deng <283304489@qq.com>
* fix ci error
Signed-off-by: Liang Deng <283304489@qq.com>
* fix ci error
Signed-off-by: Liang Deng <283304489@qq.com>
* initial unit tests
* Add all remaining unit tests
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* fine grain unit tests by adding fields and values
* add detailed pod level exclusion and related tests
* add tests for init & ephemeral containers
* add kuttl tests for the new advanced support
* add kuttl tests for the new advanced support
* add readme for kuttl tests
* add replacement in go.mod
* resolving CI errors
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* fix ci errors
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* fix ci errors
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* updating pod-security-admissio
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* resolving null pointer panic
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* resolved conformance error
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* chainsaw
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* chainsaw
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* remove duplication
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* fix linting
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* remove over computation
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* added field checks, pss skip condition
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* correcting chainsaw tests
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* merge branch 'main' into unit-tests
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
* fix builds
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: Liang Deng <283304489@qq.com>
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
Signed-off-by: shuting <shuting@nirmata.com>
Signed-off-by: Gurmannat Sohal <95538438+itsgurmannatsohal@users.noreply.github.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Liang Deng <283304489@qq.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-12-26 22:28:08 +08:00
Charles-Edouard Brétéché
fb90d0935d
fix: use go 1.21 new packages ( #8452 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-09-19 12:06:53 +00:00
Charles-Edouard Brétéché
b6251c9894
chore: organize constants better ( #7941 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-07-31 11:53:57 +00:00
Mariam Fahmy
35e368730b
feat: add auto-gen rules for CEL ( #7859 )
...
* feat: add auto-gen rules for CEL
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* clean up
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2023-07-21 09:19:47 +00:00
Charles-Edouard Brétéché
03702476fa
refactor: move kyverno constants out of v1 package ( #7760 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-07-06 08:00:36 +00:00
Charles-Edouard Brétéché
8a62aaa6eb
fix: autogen not working correctly with cronjob conditions ( #7571 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-06-19 06:06:30 +00:00
Charles-Edouard Brétéché
ea98b08951
fix: autogen not generating the correct kind ( #7455 )
...
* fix: autogen not generating the correct kind
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix kuttl tests
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* add kuttl test
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-06-07 20:32:35 +02:00
Mariam Fahmy
bb628e1fe6
Supporting ValidatingAdmissionPolicy in kyverno cli (apply and test command) ( #6656 )
...
* feat: add policy reporter to the dev lab
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* refactor: remove obsolete structs from CLI
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* more
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* codegen
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* Supporting ValidatingAdmissionPolicy in kyverno apply
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* chore: bump k8s from v0.26.3 to v0.27.0-rc.0
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* Support validating admission policy in kyverno apply
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* Support validating admission policy in kyverno test
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* refactoring
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* Adding kyverno apply tests for validating admission policy
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* fix
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* fix
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* running codegen-all
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* fix
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* Adding IsVap field in TestResults
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* chore: bump k8s from v0.27.0-rc.0 to v0.27.1
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* fix
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* fix
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* Fix vap in engine response
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
* codegen
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2023-05-10 08:12:53 +00:00
Charles-Edouard Brétéché
f2cd3791ea
fix: disable autogen in foreach mutation with json patches ( #6996 )
...
* fix: disable autogen in foreach mutation with json patches
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* kuttl
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-04-25 16:32:19 +08:00
Charles-Edouard Brétéché
1e30aacbd9
fix: replace more refect.DeepEqual ( #6674 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-03-24 10:01:49 +00:00
Ankit Kurmi
1271784918
fix: adding verbosity to the ./pkg/autogen unit tests ( #6566 )
...
Signed-off-by: Ankit152 <ankitkurmi152@gmail.com>
2023-03-14 11:40:34 +00:00
Abhishek Kumar
7d4ea1dcdc
oldObject translation solved in autogen ( #6305 )
...
* OldObject translation solved in autogen
Signed-off-by: Abhishek Kumar <abhishek22512@gmail.com>
* CronJob fixed in autogen
Signed-off-by: Abhishek Kumar <abhishek22512@gmail.com>
* tests added
Signed-off-by: Abhishek Kumar <abhishek22512@gmail.com>
---------
Signed-off-by: Abhishek Kumar <abhishek22512@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2023-02-21 09:06:29 +00:00
Charles-Edouard Brétéché
baacf60156
refactor: move utils into sub packages ( #5828 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2023-01-03 09:33:09 +00:00
Charles-Edouard Brétéché
3975323362
chore: bump deps including k8s ones ( #5751 )
...
* chore: bump deps including k8s ones
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix linter
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-12-21 22:33:51 +00:00
Charles-Edouard Brétéché
84a5b0d0bc
fix: bump log level for autogen debug logs ( #5687 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-12-14 13:06:24 +00:00
Jim Bugwadia
af4c8ed886
use camel case for ForEach naming ( #5660 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-12-12 19:24:13 +00:00
Charles-Edouard Brétéché
6f1bd5fff2
chore: replace utils.ContainsString with builtin slices.Contains ( #5496 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-11-29 08:04:49 +00:00
Charles-Edouard Brétéché
3970f2556c
fix: typo in autogen package ( #5480 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-11-25 22:51:26 +00:00
Charles-Edouard Brétéché
ce21ac50b3
feat: add replicaset and replicationcontroller to autogen ( #4975 )
...
* fix: missing autogen rules in status
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* feat: add replicaset and replicationcontroller to autogen
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* merge main
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix tests
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix tests
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-11-14 10:18:45 +00:00
Charles-Edouard Brétéché
e4bf66e756
feat: remove policy mutation for auto-gen rules ( #5123 )
...
* feat: remove policy mutation code
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* Fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* changelog
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-10-25 23:43:46 +00:00
Charles-Edouard Brétéché
7d897016e9
fix: auto gen enabled when using names ( #4863 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-10-12 06:09:02 +00:00
yinka
688b4fb8e3
add package logger in files ( #4766 )
...
* add package logger in files
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* add package logger to initContainer and other files
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* helm docs
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* helm default values
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* release notes
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-02 19:45:03 +00:00
Eng Zer Jun
f40a3bc8f5
refactor: move from io/ioutil to io and os packages ( #4752 )
...
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit
replaces the existing io/ioutil functions with their new definitions in
io and os packages.
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-09-30 12:55:19 +05:30
shuting
34c6920129
Support PSa integration by controlName only ( #4710 )
...
* Remove "restrictedField" and "values" from podSecurity.exclude
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Remove commented code
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Add unit tests for restricted_runAsNonRoot
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Add baseline unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Add unit tests for restricted controls
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Removes PSa tests at the engine level
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - Update API docs; - Add unit tests for wildcard images
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Remove autogen conversion for PSa policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* copy pod with DeepCopy()
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-28 10:03:53 +00:00
Jim Bugwadia
ed6d9b9624
enable autogen for validate.podsecurity with no exclude ( #4594 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-09-12 12:33:35 +05:30
Charles-Edouard Brétéché
1947dafed6
fix: load policy and add tests ( #4515 )
...
* fix: load policy and add tests
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix callers
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-09-06 15:16:44 +00:00
ToLToL
1b9a2fca21
Extend Pod Security Admission ( #4364 )
...
* init commit for pss
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add test for Volume Type control
* add test for App Armor control except ExemptProfile. Fix PSS profile check in EvaluatePSS()
* remove unused code, still a JMESPATH problem with app armor ExemptProfile()
* test for Host Process / Host Namespaces controls
* test for Privileged containers controls
* test for HostPathVolume control
* test for HostPorts control
* test for HostPorts control
* test for SELinux control
* test for Proc mount type control
* Set to baseline
* test for Seccomp control
* test for Sysctl control
* test for Privilege escalation control
* test for Run as non root control
* test for Restricted Seccomp control
* Add problems to address
* add solutions to problems
* Add validate rule for PSA
* api.Version --> string. latest by default
* Exclude all values for a restrictedField
* add tests for kyverno engine
* code to be used to match kyverno rule's namespace
* Refacto pkg/pss
* fix multiple problems: not matching containers, add contains methods, select the right container when we have the same exclude.RestrictedField for multiple containers:
* EvaluatePod
* Use EvaluatePod in kyverno engine
* Set pod instead of container in context to use full Jmespath. e.g.: securityContext.capabilities.add --> spec.containers[*].securityContext.capabilities.add
* Check if PSSCheckResult matched at least one exclude value
* add tests for engine
* fix engine validation test
* config
* update go.mod and go.sum
* crds
* Check validate value: add PodSecurity
* exclude all restrictedFields when we only specify the controlName
* ExemptProfile(): check if exclud.RestrictedField matches at least one restrictedField.path
* handle containers, initContainers, ephemeralContainers when we only specify the controlName (all restrictedFields are excluded)
* refacto pks/pss/evaluate.go and add pkg/engine/validation_test.go
* add all controls with containers in restrictedFields as comments
* add tests for capabilities and privileged containers and fix some errors
* add tests for host ports control
* add tests for proc mount control
* add tests for privilege escalation control
* add tests for capabilities control
* remove comments
* new algo
* refacto algo, working. Add test for hostProcess control
* remove unused code
* fix getPodWithNotMatchingContainers(), add tests for host namespaces control
* refacto ExemptProfile()
* get values for a specific container. add test for SELinuxOptions control
* fix allowedValues for SELinuxOptions
* add tests for seccompProfile_baseline control
* refacto checkContainers(), add test for seccomp control
* add test for running as non root control
* add some tests for runAsUser control, have to update current PSA version
* add sysctls control
* add allowed values for restrictedVolumes control
* add some tests for appArmor, volume types controls
* add tests for volume types control
* add tests for hostPath volume control
* finish merge conflicts and add tests for runAsUser
* update charts and crds
* exclude.images optional
* change volume types control exclude values
* add appAmor control
* fix: did not match any exclude value for pod-level restrictedFields
* create autogen for validate.PodSecurity
* clean code, remove logs
* fix sonatype lift errors
* fix sonatype lift errors: duplication
* fix crash in pkg/policy/validate/ tests and unmarshall errors for pkg/engine tests
* beginning of autogen implement for validate.exclude
* Autogen for validation.PodSecurity
* working autogen with simple tests
* change validate.PodSecurity failure response format
* make codegen
* fix lint errors, remove debug prints
* fix tags
* fix tags
* fix crash when deleting pods matching validate.podSecurity rule. Only check validatePodSecurity() when it's not a delete request
* Changes requested
* Changes requested 2
* Changes requested 3
* Changes requested 4
* Changes requested and make codegen
* fix host namespaces control
* fix lint
* fix codegen error
* update docs/crd/v1/index.html
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix path
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update crd schema
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update charts/kyverno/templates/crds.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
2022-08-31 09:16:31 +00:00
Charles-Edouard Brétéché
f243a7dd84
refactor: make toggles easier to define and use ( #4456 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-31 06:41:14 +00:00
Charles-Edouard Brétéché
144985ee5a
chore: fix golangcilint timeout ( #4388 )
...
* chore: fix golangcilint timeout
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix commit sha
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* add .gitattributes
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-08-24 21:08:24 +08:00
Charles-Edouard Brétéché
fb93595397
fix: exclude autogen rules when autogen internals is enabled ( #4370 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-08-23 14:42:46 +08:00
