mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-15 17:51:20 +00:00
Code Activity
4091 commits 15 branches 540 tags 276 MiB
Commit graph

464 commits

Author SHA1 Message Date
Charles-Edouard Brétéché
1fe203732f
refactor: separate json utils package (#3523) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 16:34:52 +00:00
Charles-Edouard Brétéché
9fc65fa5a7
refactor: use policy interface and introduce admission utils package (#3512) 
* refactor: use more policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: migrate to policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 20:25:54 +08:00
Charles-Edouard Brétéché
04d094f775
fix: reduce dependency to ns lister (#3509) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-03-31 12:48:36 +05:30
Charles-Edouard Brétéché
04740c52fa
refactor: use more policy interface (#3510) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 12:14:00 +05:30
Charles-Edouard Brétéché
83343697b9
refactor: make use of policy interface (#3499) 
- refactor: make use of policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-30 18:34:30 +05:30
Charles-Edouard Brétéché
20069c13c3
feat: stop mutating rules (#3410) 
* feat: stop adding autogen annotation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* feat: stop mutating rules

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* feat: stop mutating rules

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: use toggle

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: review comments

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-28 22:01:27 +08:00
shuting
d1bf3d4742
clean up dependencies (#3469) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-03-25 08:40:25 +00:00
Charles-Edouard Brétéché
3cf83bc77f
refactor: match and exclude conflict validation (#3454) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-23 17:04:17 +05:30
Charles-Edouard Brétéché
06fc472f52
refactor: add IsNamespaced() method to API policy types (#3450) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-23 13:03:15 +05:30
Charles-Edouard Brétéché
f263cbedca
fix: use PodControllersAnnotation constant (#3448) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-22 20:43:19 +00:00
Vyankatesh Kudtarkar
e268be9e88
support for deprecated API's (#3439) 
* support for deprecated API's

* add testcase

* update condition

* fix logic
 2022-03-22 18:25:35 +00:00
Charles-Edouard Brétéché
d129b7a4c7
refactor: ExcludeResources validation (#3445) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-03-22 15:21:44 +00:00
Charles-Edouard Brétéché
11bbb4f83e
refactor: replace ExcludeResources by MatchResources (#3444) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-22 14:24:40 +00:00
Charles-Edouard Brétéché
51254b2d5a
refactor: ResourceDescription validation (#3446) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-22 21:17:51 +08:00
Charles-Edouard Brétéché
c8c631d4a7
refactor: MatchResources validation (#3422) 
* refactor: ValidationFailureActionOverrides validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: MatchResources validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-21 19:51:12 +08:00
Charles-Edouard Brétéché
bdcecf9882
refactor: ValidationFailureActionOverrides validation (#3421) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-21 16:53:12 +08:00
Charles-Edouard Brétéché
4136566bd9
feat: add toggle package for feature flags (#3419) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-18 16:16:42 +00:00
Charles-Edouard Brétéché
0c8e8c1212
feat: move GetRules() at the policy level (#3420) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-18 15:18:32 +00:00
Charles-Edouard Brétéché
865eef248d
feat: stop adding autogen annotation (#3379) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-18 11:30:49 +00:00
Charles-Edouard Brétéché
4ce5c972ee
refactor: Policy name validation (#3409) 
* refactor: UserInfo validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: Rule type validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: Rule names validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: Policy name validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-18 01:02:35 +08:00
Charles-Edouard Brétéché
cc212ac766
refactor: Rule names validation (#3406) 
* refactor: UserInfo validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: Rule type validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: Rule names validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-03-17 11:36:21 +08:00
Charles-Edouard Brétéché
adcb71f1d6
refactor: Rule type validation (#3400) 
* refactor: UserInfo validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: Rule type validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-16 21:57:31 +00:00
Charles-Edouard Brétéché
5541189c6c
refactor: UserInfo validation (#3399) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-16 16:15:46 +00:00
Abhi Kapoor
ac8dea1cba
Return warning on admission response when mutating pods (#3272) 
- Return the warning as part of the validate response
- Warn when autogen annotation is being used to exclude pod controllers
- Reutrn admission response based on the autogen annotation value
- Update the existing log message to align with admission response warning

Co-authored-by: abhinav454 <43758739+abhinav454@users.noreply.github.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
 2022-03-16 04:50:33 +00:00
Charles-Edouard Brétéché
8602e63f23
refactor: ImageVerification validation (#3372) 
* fix: configmap resource filters generated by helm does not account for namespace

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: ImageVerification validation

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-15 08:48:58 +00:00
Vyankatesh Kudtarkar
154cea21c3
fix for gvk not working for existing resources policy (#3384) 2022-03-14 16:03:13 +05:30
Vyankatesh Kudtarkar
b3a53f0658
fix PodExecOptions issue (#3373) 
* fix PodExecOptions issue

* add note

* update comment
 2022-03-11 15:09:32 +05:30
Charles-Edouard Brétéché
ce5f648f30
refactor: introduce rules getters and setters (#3350) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
 2022-03-09 15:28:31 +00:00
Charles-Edouard Brétéché
ea977b259c
refactor: move controller autogen annotation in api package (#3364) 
* fix: configmap resource filters generated by helm does not account for namespace

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refator: move controller autogen annotation in api package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-09 21:48:04 +08:00
Vyankatesh Kudtarkar
148a892277
Fix any_all wildcard issue (#3352) 2022-03-08 12:59:33 +00:00
Charles-Edouard Brétéché
90d0badda4
fix: CRD generation (#3334) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-06 11:07:51 -08:00
Charles-Edouard Brétéché
7232de45c6
refactor: introduce autogen package (#3316) 
* refactor: pass only spec instead of whole policy when possible

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: introduce autogen package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-03-01 23:19:31 +00:00
Charles-Edouard Brétéché
1154612489
refactor: pass only spec instead of whole policy when possible (#3315) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-03-01 22:42:19 +00:00
Prateek Pandey
66969d35ea
validate and block policy based on the matched kind cache (#3283) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Co-authored-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-02-23 22:27:18 +05:30
Vyankatesh Kudtarkar
373f421b07
Fix panic for provides a set to the key of a precondition and deny condition (#3162) 2022-02-03 14:46:58 +00:00
Sambhav Kothari
98284114f5
Relax rule context validation to follow JMESPath grammar (#3129) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-31 18:23:59 +00:00
Kumar Mallikarjuna
5ad0d15240
Namespace Specific ValidationFailureAction (#2794) 
* Implement ValidationFailureActionOverride

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Update CRDs

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Update getEnforceFailureErrorMsg()

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Allow validate policies to be checked

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Fix linting issues

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Added tests for ValidationFailureActionOverrides

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Added schema validation

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Added description for ValidationFailureActionOverrides

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Policy validation

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Update CRDs

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Replace literals with constants

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Updated Policy Cache

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Refactor

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-21 12:36:44 +00:00
Liu Shaohui
25722366f0
Fix: namespace quota policy failed to be applied for two resources named ResourceQuota with different APIVersions (#2612) 
Signed-off-by: Shaohui Liu <liushaohui@xiaomi.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-20 12:48:52 +05:30
shuting
ad56087b91
list resources once per policy in the background reconcilliation (#3026) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-19 16:42:01 +00:00
shuting
b6447e0649
Remove resourceCache from engine (#3013) 
* update log messages

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove resourceCache from the background controller when:
- register resource scope
- list resources per namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - use client call for configmap lookup;
- remove resourceCache from policy controller, webhook server and generate controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-18 12:59:35 +00:00
Sambhav Kothari
1af9e48b0d
Add image data to validate image configs (#2946) 
* Add image data to validate image configs

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add tests for image context

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add e2e test cases for image size policy

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-17 04:06:44 +00:00
Kumar Mallikarjuna
3f61e2dd3a
Added report generation for verifyImage rules (#2782) 
* Add report generation for verifyImage rules

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Add flag comment

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Mutation: handleDelete()

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Remove redundant delete

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Test validation failure

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Validation force rules test

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Default validation behaviour

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Manual rules

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Update Config Manager

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Move Delete check

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-05 07:07:44 +00:00
Jim Bugwadia
a9fef256c7
updates for foreach and mutate (#2891) 
* updates for foreach and mutate

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* allow tests to pass on Windows

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix linter check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add elementIndex variable

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix jsonResult usage

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add mutate validation and fix error in validate.foreach

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update message

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* do not skip validation for all array entries when one is skipped

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add foreach tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix format errors

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove unused declarations

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* revert namespaceWithLabelYaml

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix mutate of element list

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update CRDs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* Update api/kyverno/v1/policy_types.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/forceMutate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/forceMutate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/forceMutate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/mutation.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/mutation.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/mutation.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/validate/validate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update pkg/engine/validate/validate.go

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update test/cli/test/custom-functions/policy.yaml

Co-authored-by: Steven E. Harris <seh@panix.com>

* Update test/cli/test/foreach/policies.yaml

Co-authored-by: Steven E. Harris <seh@panix.com>

* accept review comments and format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add comments to strategicMergePatch buffer

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* load context and evaluate preconditions foreach element

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add test for foreach mutate context and precondition

* precondition testcase

* address review comments

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update message

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Steven E. Harris <seh@panix.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-05 09:36:33 +08:00
Vyankatesh Kudtarkar
0a92a2fed8
2460: Add wildcard support for match label selector (#2832) 
* add wildcard support for match label selector

* fix comment

* update cluster role label

* fix comment

* fix comment

* add support for key label selector

* update  method name

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
 2021-12-27 22:59:38 -08:00
Frank Jogeleit
abb5bd2947
Add SelectorLabel to (Cluster)PolicyReporter resources (#2841) 
Signed-off-by: Frank Jogeleit <frank.jogeleit@lovoo.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2021-12-17 05:03:52 +00:00
Bricktop
962f4de8d8
Only report on intended errors when checking JSONPatch path for variables (#2710) 
* Only report on intended errors

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>

* Change error text to be more fitting

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>

* Replace vars for checks

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>

* Remove more checks for testing

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>

* Disable schema validation

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>

* Remove unneeded fmt prints

Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>
 2021-11-30 17:14:58 +00:00
Jose Armesto
1ff16ba5d4
Do not log error when resource is not namespaced (#2730) 
Signed-off-by: Jose Armesto <github@armesto.net>
 2021-11-17 15:09:00 +01:00
Anushka Mittal
7d423f97c4
added check for misspelled fields in condition (#2707) 
* added check for misspelled fields in condition

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* corrections in error message

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
 2021-11-11 17:57:18 +01:00
Jim Bugwadia
50cb1859c3
add keyless verification (#2677) 
* add keyless verification

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* run make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix linter warning

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* wrap error with details

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2021-11-04 23:26:22 -07:00
Jim Bugwadia
5c16ee738a
redo variable validation (#2647) 
* redo variable validation

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle quotes for JMESPath - escaping

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests and linter issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2021-11-03 11:16:55 -07:00