Mariam Fahmy
2ea7e7ce76
feat: add new field to control VAP generation per policy ( #12242 )
...
* feat: add new field to control VAP generation per policy
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* chore: remove 1.28 and 1.29 from tests
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-28 13:35:13 +00:00
Mariam Fahmy
5dd6ebd04b
fix chainsaw test ( #12272 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-28 18:51:36 +08:00
Frank Jogeleit
5f42a0bad8
feat: context function to request resources from api server ( #12181 )
...
* feat: context function to request resources from api server
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* add chainsaw test
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* replace dclient with dynamic client
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* update test case
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
---------
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-27 13:31:03 +00:00
Mariam Fahmy
b8a1731d49
feat: generate VAPs given celexceptions ( #12255 )
...
* feat: generate VAPs given celexceptions
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* chore: modify chainsaw tests
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix linter
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-27 13:08:35 +00:00
刘旭
8b4f222860
fix(gctx): fix gctx projection cache ( #12226 )
...
Signed-off-by: liuxu <liuxu623@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-27 08:23:23 +00:00
Mariam Fahmy
6359fd4a1a
feat: generate VAPs from VPs ( #12222 )
...
* feat: generate VAPs from VPs
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix codegen
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix chainsaw tests
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-25 20:27:29 +08:00
Mariam Fahmy
bbe2b838af
chore: add resource manifests in autogen tests ( #12205 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-19 13:59:07 +00:00
Frank Jogeleit
fef88ab433
Validating policy audit annotations ( #12115 )
...
* feat: return single result from validating policy evaluation
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* feat: support audit annotations for validating policies
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* fix error message
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* feat: return single result from validating policy evaluation
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* feat: support audit annotations for validating policies
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* fix error message
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* fix testcase
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* rebase with main
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
---------
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-19 13:10:01 +00:00
Mariam Fahmy
e01e57355a
fix: modify celexception flake test ( #12192 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-19 10:51:37 +00:00
Khaled Emara
2b28538bd3
feat(gctx): add jmespath caching through projections ( #11833 )
...
feat(gctx): move ready check to runtime
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-18 15:51:14 +00:00
Mariam Fahmy
0625302c3d
fix: modify the client URL for finegrained validatingpolicies ( #12171 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-14 21:35:41 +08:00
Mariam Fahmy
829ab94b11
fix CEL autogen ( #12165 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-14 09:45:10 +00:00
shuting
ce2c27c2d2
fix: sort autogen resources list ( #12162 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2025-02-13 12:49:39 +00:00
shuting
7ef2764365
feat: aggregate vpol.status.conditions ( #12133 )
...
* feat: add vpol status controller
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update ready API struct
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: printer coloum
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: update status cmp func
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: support status.RBACPermissionsGranted
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2025-02-12 11:04:18 +00:00
shuting
813b80d3d9
fix: update match conditions for autogen rules ( #12146 )
...
* fix: update match conditions for autogen rules
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: autogen match condition prefix
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: merge main
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: shuting <shuting@nirmata.com>
2025-02-12 08:34:19 +00:00
Mariam Fahmy
7d5750a717
chore: move celexceptions to the new group ( #12143 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-11 19:05:22 +02:00
Mariam Fahmy
f012241a82
feat: add cel-autogen chainsaw tests ( #12135 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-10 22:30:12 +00:00
Mariam Fahmy
a4c10f6bb4
feat: compile and evaluate polex's match conditions ( #12113 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-06 15:30:59 +02:00
Mariam Fahmy
04efe351a7
chore: remove polex match constraints ( #12103 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-05 17:56:58 +00:00
Mariam Fahmy
970c255765
feat: validate CELPolicyExceptions ( #12083 )
...
* feat: validate CELPolicyExceptions
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* chore: add cel-policy-exceptions tests in the CI
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-05 15:01:11 +00:00
Charles-Edouard Brétéché
8fc6e78c16
feat: add validating policies to reports aggregation ( #12096 )
...
* feat: add validating policies to reports aggregation
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* chainsaw test
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* unit tests
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-05 13:21:28 +00:00
Charles-Edouard Brétéché
c78ab6654c
tests: add chainsaw test for image data loading ( #12077 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-04 09:22:43 +00:00
Charles-Edouard Brétéché
b908b1037a
feat: consider validation actions ( #12072 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-04 06:29:40 +02:00
Charles-Edouard Brétéché
e55a90cc4b
feat: implement match conditions failure policy ( #12071 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-04 00:04:26 +02:00
Charles-Edouard Brétéché
884a77a044
feat: add context provider in admission handling ( #12070 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-03 19:11:31 +02:00
Charles-Edouard Brétéché
0c5b74b122
chore: add validating policies chainsaw tests ( #12062 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-03 20:53:57 +08:00
Mariam Fahmy
4c950dcb32
feat: use v1 of ValidatingAdmissionPolicies ( #12050 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-01-31 14:21:43 +00:00
Mohd Kamaal
e771896541
distributed labels in group, version, and resource so it doesn't exceed ( #11620 )
...
* change label to hash if exceed 63 limit char
Signed-off-by: Mohd Kamaal <mohdkamaal2019@gmail.com>
* Distribute GVR labels into 'group', 'version', and 'resource' to avoid exceeding character limits
Signed-off-by: Mohd Kamaal <mohdkamaal2019@gmail.com>
---------
Signed-off-by: Mohd Kamaal <mohdkamaal2019@gmail.com>
Co-authored-by: Kamaal <kamaal@macs-MacBook-Air.local>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-12-16 10:36:34 +05:30
Vishal Choudhary
174534b518
fix: properly verify precondition in old object validation ( #11644 )
...
* fix: properly verify precondition in old object validation
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: tests
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: assert bug
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: properly update the values
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-12-04 06:32:12 +00:00
Vishal Choudhary
ec658b7abf
fix: api call chainsaw tests ( #11682 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-12-02 15:46:37 +00:00
Nishanth Reddy
95baeaa4e9
fix: return nil error when trigger resource not found for a subresouces ( #11594 )
...
* fix: return nil error when trigger resource not found for a subresource kind
Signed-off-by: Nishanth Reddy <nishanth.reddy@doordash.com>
* chore(deps): bump codecov/codecov-action from 4.6.0 to 5.0.0 (#11597 )
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action ) from 4.6.0 to 5.0.0.
- [Release notes](https://github.com/codecov/codecov-action/releases )
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md )
- [Commits](b9fd7d16f6...968872560f#11596 )
Bumps [sigs.k8s.io/structured-merge-diff/v4](https://github.com/kubernetes-sigs/structured-merge-diff ) from 4.4.1 to 4.4.3.
- [Release notes](https://github.com/kubernetes-sigs/structured-merge-diff/releases )
- [Changelog](https://github.com/kubernetes-sigs/structured-merge-diff/blob/master/RELEASE.md )
- [Commits](https://github.com/kubernetes-sigs/structured-merge-diff/compare/v4.4.1...v4.4.3 )
---
updated-dependencies:
- dependency-name: sigs.k8s.io/structured-merge-diff/v4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix: use generate name for background scan reports (#11586 )
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
* chore(deps): bump github/codeql-action from 3.27.3 to 3.27.4 (#11598 )
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.3 to 3.27.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](396bb3e453...ea9e4e3799#11498 )
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
* add chainsaw tests
* add kubectl-evict to githubpath
* add readme
---------
Signed-off-by: Nishanth Reddy <nishanth.reddy@doordash.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Khaled Emara <khaled.emara@nirmata.com>
2024-11-20 15:41:06 +08:00
Vishal Choudhary
b35aaab898
fix: match failure action case insensitively for validating old object ( #11486 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-11-07 00:10:56 +08:00
Khaled Emara
f07007f864
fix(validate): custom match conditions errors ( #11461 )
...
* fix(validate): custom match conditions errors
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* test(webhook): failing match conditions
---------
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-11-05 11:59:09 +00:00
Mariam Fahmy
646267b229
fix: add celPreconditions in autogen rules ( #11503 )
2024-10-31 14:12:22 +00:00
Vishal Choudhary
34dc0e52a2
fix: use digest instead of tag for custom-sigstore-tuf conformance test ( #11492 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-10-30 14:42:20 +00:00
Ammar Yasser
9a8e35d787
Selector with mutate target ( #11208 )
...
* feature: Add LabelSelector as a field of resource spec to allow fetching by labels
Signed-off-by: aerosouund <aerosound161@gmail.com>
* chore: Generate CRDs
Signed-off-by: aerosouund <aerosound161@gmail.com>
* feat: Add the capability to fetch with label selector
- Add the label selector as a parameter to GetResources of the engine api client and the dclient.
- Use the label selector with list options in the dclient.
- convert a metav1.LabelSelector to a labels.Selector before fetching to be able to convert it to a string to be used with ListOptions.
Signed-off-by: aerosouund <aerosound161@gmail.com>
* feat: Pass label selector to the GetResources method
Signed-off-by: aerosouund <aerosound161@gmail.com>
* feat: Return the resource selector when resolving spec
Signed-off-by: aerosouund <aerosound161@gmail.com>
* fix: Instantiate the fake client schema using the passed gvrToListKind map and by inferring schema from passed resources
All tests that use List will fail because the fake client doesn't infer the schema from the passed resources.
gvrToListKind can't be fully deprecated as some parts of kyverno use the fake client without passing resources to it (resource generation). And so both approaches have to be supported.
References:
- https://github.com/kubernetes/client-go/issues/983
- 46c1ad3baa
2024-10-16 11:17:08 +00:00
Vishal Choudhary
a7dd02a6d1
feat: update engine response.generatedResources to support multiple resource ( #11398 )
...
* fix: manually add generated_resources property
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: update engine response
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: nil check before deferences
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: outdated errors
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-10-15 14:59:18 +08:00
Charles-Edouard Brétéché
6dc328fb0c
chore: add delay after policy gets ready ( #11344 )
...
* chore: add delay after policy gets ready
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* Update test/conformance/chainsaw/_step-templates/policy-ready.yaml
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-14 11:39:43 +00:00
Shivam Kumar
1114f0af36
Added chainsaw test for the ttl based cleanup poliy ( #11328 )
...
* Added chainsaw test for the ttl based cleanup poliy
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
* Updated the ttl/propagation-policy chainsaw test structure
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
* Enhanced the chainsaw tests for the ttl/propagation-policy
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
* orphan
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* Update test/conformance/chainsaw/ttl/propagation-policy/orphan/chainsaw-test.yaml
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* Improved chainsaw tests for foreground and background propagation policies
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
* Fix background policy test: assert pod is deleted after job removal
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
* Fix: changed pod-deleted-assert.yaml to pod-assert.yaml in the foreground
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
* Change assert to error check for pod deletion in foreground test
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
* Removed the pod-deleted-assert.yaml file
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
---------
Signed-off-by: ShivamJha2436 <shivamkumar87148@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-07 19:25:33 +00:00
Vishal Choudhary
00fd6d47f8
fix: transfer image verify iamges to kyverno ( #11340 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2024-10-07 15:56:12 +00:00
Charles-Edouard Brétéché
4abdbff74a
chore: use more chainsaw step templates ( #11324 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-07 11:44:33 +00:00
Vishal Choudhary
026791d117
fix: add permission for mutate existing report test ( #11339 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-10-07 11:07:14 +00:00
Charles-Edouard Brétéché
db7584c417
chore: use more chainsaw step templates ( #11317 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-04 12:54:39 +03:00
Charles-Edouard Brétéché
9914675674
chore: use more chainsaw step templates ( #11313 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 15:08:36 +00:00
Charles-Edouard Brétéché
f9724778b1
chore: bump chainsaw ( #11280 )
...
* chore: bump chainsaw
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* policy lib
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* more changes
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* 2.11
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* shards
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 19:08:02 +05:30
Charles-Edouard Brétéché
df267dd829
chore: use more chainsaw step templates ( #11311 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 11:56:30 +00:00
Charles-Edouard Brétéché
decb7524eb
chore: use more chainsaw step templates ( #11308 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 13:53:14 +03:00
Charles-Edouard Brétéché
12d5223d56
chore: use more chainsaw step templates ( #11303 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 09:57:40 +00:00
Charles-Edouard Brétéché
6870d8fdf8
chore: use more chainsaw step templates ( #11300 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 08:36:30 +00:00
Charles-Edouard Brétéché
97f2d25aaa
chore: use more chainsaw step templates ( #11296 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-10-03 09:10:11 +03:00
