1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-09 01:16:55 +00:00
Commit graph

2522 commits

Author SHA1 Message Date
shuting
ad56087b91
list resources once per policy in the background reconcilliation (#3026)
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-19 16:42:01 +00:00
Kumar Mallikarjuna
e39489f838
SharedInformers for WebhookConfigurations (#3007)
* SharedInformers for WebhookConfigurations

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Add GVK to typed resources

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Remove ToUnstructured()

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Remove default informers from Resource Cache

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Formatted files

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
2022-01-19 15:57:32 +00:00
Abhinav Sinha
f0359f8272
Fixed error handling for negation anchors (#2986)
* Fixed error handling for negation anchors

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-01-19 15:39:07 +05:30
Abhinav Sinha
b5341b685d
Support namespaceSelector with dynamic webhook enabled (#2953)
* Support `namespaceSelector` with dynamic webhook enabled

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Implemented suggested changes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Implemented suggest changes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
2022-01-19 07:59:08 +00:00
Vyankatesh Kudtarkar
e22e9499b6
CLI fix for foreach policies (#2997)
* CLI fix for foreach policies

* add test-case for foreach container and initcontainer

* fix comments

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-01-18 23:38:49 +00:00
shuting
cde1d0f2b2
clean up managed resources when cannot find kyverno deployment (#3018)
Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
2022-01-18 16:45:24 +00:00
Kumar Mallikarjuna
771d62b735
Added Kyverno specific SharedInformerFactory (#2987)
* Added Kyverno specific SharedInformerFactory

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Replace ToUnstructured()

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Add GVK to returned resource

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
2022-01-18 15:52:48 +00:00
Prateek Pandey
421e6d9622
fix(generate): use JSON patch for GenerateRequests status updates (#3000)
Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
2022-01-18 14:53:48 +00:00
shuting
b6447e0649
Remove resourceCache from engine (#3013)
* update log messages

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove resourceCache from the background controller when:
- register resource scope
- list resources per namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - use client call for configmap lookup;
- remove resourceCache from policy controller, webhook server and generate controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-18 12:59:35 +00:00
Vyankatesh Kudtarkar
c2de92d8c6
Support mutation of variables in validate.deny (#2947)
* Support mutation of variables in validate.deny

* remove comment

* fix e2e test
2022-01-18 10:53:30 +00:00
Sambhav Kothari
f5e00ee034
Add a parse_yaml function (#2999)
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
2022-01-17 13:41:08 +00:00
Sambhav Kothari
1af9e48b0d
Add image data to validate image configs (#2946)
* Add image data to validate image configs

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add tests for image context

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add e2e test cases for image size policy

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-17 04:06:44 +00:00
Sambhav Kothari
f42092208f
Fix variable substitution for foreach preconditions (#2993)
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-01-16 05:33:34 +00:00
Sambhav Kothari
0c11af2d9a
Fix autogen issue with cronjob generator and foreach pod generator (#2989)
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-15 12:28:28 -08:00
Jim Bugwadia
1fec430249
handle CRDs with no props (#2975)
* handle CRDs with no props

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-01-14 21:08:04 +01:00
Tathagata Paul
1f3e625b99
Renamed test.yaml to kyverno-test.yaml (#2898)
Signed-off-by: 4molybdenum2 <tathagatapaul7@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-01-14 08:45:59 +00:00
Jim Bugwadia
59d4cf8c0b
check for issuer and subject only when declared in policy. fix log levels (#2973)
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-01-13 12:49:52 +08:00
Aarush Bhat
c202fb0f15
kyverno/test: print test summary of kyverno test results (#2944)
Signed-off-by: sloorush <aarush.bhatt@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-01-12 18:52:22 +05:30
Sambhav Kothari
baf4fa335b
Remove spurious prints and fix line endings (#2963)
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-11 14:15:26 +00:00
Kumar Mallikarjuna
037a320fba
Added TLS annotation check in the initContainer (#2956)
* Added TLS annotation check in the initContainer

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Error checks

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Refactor annotation addition code

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Strict error reporting

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Error handling for Secrets

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Updated error conditions

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Update for nil error

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
2022-01-11 08:47:24 +00:00
Sambhav Kothari
6b9798f76f
Add parse_json function the decode json strings (#2941)
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-10 13:42:02 -08:00
Kumar Mallikarjuna
9e16e763a0
ValidCert Secret Annotation Check (#2933)
* Annotation check for Secrets

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Fix inconsistent errors

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Fix linting error

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
2022-01-07 20:15:00 +00:00
Kumar Mallikarjuna
4410b6adc3
Fix condition for rolling update (#2930) 2022-01-07 17:33:01 +00:00
Abhinav Sinha
7ceba594b2
Corrected the value of INIT_CONFIG env in deployment (#2927)
Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
2022-01-07 10:52:34 +00:00
Mritunjay Kumar Sharma
15495a472e
adds ephemeralContainers to the image variable (#2662)
* adds ephemeralContainers to the image variable

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes unit tests

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
2022-01-07 16:55:52 +08:00
Kumar Mallikarjuna
214f338ec3
Fix TLS inconsitency in HA (#2910)
* Fix TLS inconsitency in HA

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Add error checks

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Remove rendundant err definitions

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Handle all Secret errors

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
2022-01-06 09:11:16 +00:00
Anushka Mittal
e9826e103d
added check for any/all (#2907)
* added check for any/all

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* minor corrections

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
2022-01-05 17:08:24 +00:00
shuting
df105ff596
Improve endpoint check (#2902)
* improve endpoint checks

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update make target for the local build

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove debug log

Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-05 07:47:42 +00:00
Kumar Mallikarjuna
3f61e2dd3a
Added report generation for verifyImage rules (#2782)
* Add report generation for verifyImage rules

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Add flag comment

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Mutation: handleDelete()

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Remove redundant delete

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Test validation failure

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Validation force rules test

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Default validation behaviour

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Manual rules

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Update Config Manager

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Move Delete check

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-01-05 07:07:44 +00:00
Jim Bugwadia
a9fef256c7
updates for foreach and mutate (#2891)
* updates for foreach and mutate

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* allow tests to pass on Windows

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix linter check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add elementIndex variable

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix jsonResult usage

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add mutate validation and fix error in validate.foreach

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update message

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* do not skip validation for all array entries when one is skipped

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add foreach tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix format errors

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove unused declarations

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* revert namespaceWithLabelYaml

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix mutate of element list

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update CRDs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* Update api/kyverno/v1/policy_types.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/forceMutate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/forceMutate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/forceMutate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/mutation.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/mutation.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/mutation.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/validate/validate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/validate/validate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update test/cli/test/custom-functions/policy.yaml

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update test/cli/test/foreach/policies.yaml

Co-authored-by: Steven E. Harris <seh@panix.com>

* accept review comments and format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add comments to strategicMergePatch buffer

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* load context and evaluate preconditions foreach element

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add test for foreach mutate context and precondition

* precondition testcase

* address review comments

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update message

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Steven E. Harris <seh@panix.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-01-05 09:36:33 +08:00
Anushka Mittal
3089edafa4
Extend new operators (#2788)
* extending new operators

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* Changes in file names

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* tests added

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* removed print statements

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* Changes to reduce code redundancy

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* Minor corrections in anyin and allin

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* added correction for anynotin and allnotin

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
2022-01-04 17:37:00 +00:00
shuting
045a58e2ef
Don't create ReportChangeRequest on managed pods/jobs deletion (#2890)
* don't generate policy report on managed pod/job

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - don't generate rcr for managed pods/jobs; - add debug info

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address linter issues

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-01-03 15:43:38 +00:00
shuting
2c9319ea87
don't generate policy report on managed pod/job (#2889)
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2021-12-30 00:34:43 +08:00
Anushka Mittal
a9fd8b86fd
Rules length check (#2884)
* len check

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* explicitly adding RuleStatusSkip

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* added log message

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
2021-12-28 16:37:41 +00:00
Abhinav Sinha
2cd988a153
Added validation for Condition Operators (#2864)
* Added validation for Condition Operators

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

* Updated description of `Condition.Operator` with all current valid condition operators`

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

* Added `ConditionOperators` map and updated existing `ConditionOperator` type references

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>
2021-12-28 15:12:31 +00:00
Prateek Pandey
f6e40b5dd1
feat(validation): support for ephemeral containers (#2875)
Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>
2021-12-28 14:22:52 +00:00
Vyankatesh Kudtarkar
0a92a2fed8
2460: Add wildcard support for match label selector (#2832)
* add wildcard support for match label selector

* fix comment

* update cluster role label

* fix comment

* fix comment

* add support for key label selector

* update  method name

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
2021-12-27 22:59:38 -08:00
Vyankatesh Kudtarkar
2be70a5074
Fix foreach precondition isssue (#2871) 2021-12-22 22:20:40 +08:00
Naman Lakhwani
898520b7cf
add semver_compare JMESPath function (#2846)
* add semver_compare JMESPath function

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* adding tests for semver_compare

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* enabling version compaision via regular operators

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* adding tests for version compaision via regular operators

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* removing unnecessary switch cases

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2021-12-21 08:12:35 -08:00
Vyankatesh Kudtarkar
6a942683b0
Fix foreach jmespath issue (#2867) 2021-12-21 20:55:27 +08:00
Danny Kulchinsky
ff99d92f80
jmespath truncate - handle negative input value (#2856)
Signed-off-by: Danny Kulchinsky <dkulchinsky@fastly.com>
2021-12-20 06:50:46 +00:00
Abhinav Sinha
2076f07b9f
added support for --git-branch flag and directory in git path for kyverno test cmd (#2763)
* added support for --git-branch flag and directory in git path for kyverno test cmd

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

* added cli tests

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

* replaced hard-coded Makefile test-cmd branch names with var GIT_BRANCH

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

* moved `test-cmd` job from Makefile to github workflow

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

* added `release*` branch to `e2e` workflow

Signed-off-by: Abhinav Sinha <zeborg3@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
2021-12-20 14:09:53 +08:00
Kushal Beniwal
b961bb479e
Fix typos (#2860)
* fix typo in README

Signed-off-by: Kushal Beniwal <kbeniwal2305@gmail.com>

* fix typo in CODE_OF_CONDUCT

Signed-off-by: Kushal Beniwal <kbeniwal2305@gmail.com>

* fix typo in CONTRIBUTING

Signed-off-by: Kushal Beniwal <kbeniwal2305@gmail.com>

* fix typo in comment

Signed-off-by: Kushal Beniwal <kbeniwal2305@gmail.com>

* fix typo in comment

Signed-off-by: Kushal Beniwal <kbeniwal2305@gmail.com>
2021-12-18 20:03:16 +00:00
Danny Kulchinsky
f6982760fc
truncate custom jmespath function (#2836)
* [feature] custom jmespath truncate function

Signed-off-by: Danny Kulchinsky <dkulchinsky@fastly.com>

* formatting

Signed-off-by: Danny Kulchinsky <dkulchinsky@fastly.com>

* simplify naming a bit

Signed-off-by: Danny Kulchinsky <dkulchinsky@fastly.com>

Co-authored-by: shuting <shutting06@gmail.com>
2021-12-17 15:52:52 +08:00
Vyankatesh Kudtarkar
bbdfc21d73
Kyverno CLI test default manifest should use a less generic name (#2715)
* Kyverno CLI test default manifest should use a less generic name

* fix Note

Co-authored-by: shuting <shutting06@gmail.com>
2021-12-17 06:31:34 +00:00
Frank Jogeleit
abb5bd2947
Add SelectorLabel to (Cluster)PolicyReporter resources (#2841)
Signed-off-by: Frank Jogeleit <frank.jogeleit@lovoo.com>

Co-authored-by: shuting <shutting06@gmail.com>
2021-12-17 05:03:52 +00:00
Vyankatesh Kudtarkar
39a299f317
Update labels to fetch cluster role (#2842) 2021-12-16 07:55:58 +00:00
Naman Lakhwani
59a460b31e
adding support for Cosign key-value annotations (#2824)
* adding annotation check

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* adding tests

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* updating manifests

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* changing map val type to string form interface{}

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* passing args to opts

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2021-12-16 06:19:44 +00:00
Naman Lakhwani
edafffd2bd
added issuer check (#2804)
* added issuer check

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* switch to using SimpleContainerImage

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* added subject check and required test cases

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* small nits

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

* correcting tests

Signed-off-by: Namanl2001 <namanlakhwani@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2021-12-10 19:46:22 +00:00
Danny__Wei
8da64cb5cf
fix: add Windows testcases for path_canonicalize (#2803)
Signed-off-by: weiwei.danny <weiwei.danny@bytedance.com>

Co-authored-by: weiwei.danny <weiwei.danny@bytedance.com>
Co-authored-by: Bricktop <marcel.mueller1@rwth-aachen.de>
2021-12-08 15:14:49 +00:00