mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-09 01:16:55 +00:00
Code Activity
7959 commits 19 branches 550 tags 290 MiB
Commit graph

75 commits

Author SHA1 Message Date
Ammar Yasser
739e6a21c4
Mutate existing CLI support (#11453) 
* feat: Add flags for target resources and add fake client initialization

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add fake discovery client and cluster bool in the policy processor

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use the full mutation engine policy response in the engine response

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Extract mutated targets from the policy responses and print them out

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add TargetResources field in the cli test schema

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Generate CLI crds

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: modify checkResult to take an arbitrary actual resource and resource name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: change getAndCompareResource to take a resource name and cascade it to GetResourceFromPath

Signed-off-by: aerosouund <aerosound161@gmail.com>

* test: Create a simple test to test mutate existing in the CLI

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Allow GetResourceFromPath to select a resource with a name from a multi resource yaml

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Modify the runTest command to return the TestResponse type

- Create a fake client, load the target resources in it and use it in the PolicyProcessor.
- Create the TestResponse which contains Trigger and Target fields, each is a map of gvk/name to the responses corresponding to that resource.

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Rewrite output.go to use the TestResponse type

- Check for both target and trigger
- Create logic for appending the resource array in case no resources are passed
- Move row creation logic into a separate method to avoid code duplication
- Extract the proper target resource based on rule type
- Create a function to extract mutated target from the engine response

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Move tests to the correct folder

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use apiVersion/Kind/Name as the key in the test responses

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use the apiVersion/Kind/name key schema in checking results and fix invalid resource name checking for generate policies

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use better variable names for rows

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Account for Generate resources being an array

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use generated resource name in checking the results and printing output

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Uncomment checks printing

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Remove bug in engine response creation

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Move the generate logic into an else block

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix namespace fetching bug in cel validator

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use pointer to int in the test counter

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Remove redundant method

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Skip resources not being found in the manifests

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Create another field in the engine to denote if this is a cluster engine or an offline engine

Simply checking for the client being nil is no longer enough because for cli operations the client will be a fake client
A pointer to bool is chosen because callers who don't necessarily know what to pass should be able to pass nil

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Add extra argument in fake client initiation

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: add extra argument in fuzz test

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Add extra arg

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Handle resources specified as ns/name as this schema will be deprecated in favor of apiVersion/Kind/Name

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Fix linter complaints

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Use comma separation as array separators as kubernetes names don't support commas

To avoid undefined array length on splitting on /
using commas will result in a fixed length since all resources will have an apiVersion, kind, namespace and name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Change resource array type to an array of any instead of array of string

To support the use of a string or a TestResourceSpec

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Expect the resource array to be an array of string or array of TestResourceSpec

Assert that an array element is either of these types and match the resources in both cases according to the element type
Expect that the key in responses is now separated by commas instead of slashes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Expect that the resource array is now of type array of any and modify tests that use it

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Skip response check if the policy name isnt whats in the result

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Match the name if its specified as ns/name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Create CLI CRDs

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix linter complaints

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Cleanup invalid code used in FixTest to adapt it to the schema changes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Check if resource is nil before extracting

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: use the loadResources method to open targets in a directory

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Account for target resources with the same name but different namespaces

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Add CLI test for mutate existing with the same name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Infer resource name and namespace from the actual resource and account for resources with the same name and namespace but different kinds

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: remove extra line

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add printing mutate existing resources to the output or to a file

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Minor fixes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Revert result back to error

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use io discard to not print resources in the test command

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Update vague comments and remove outdated ones

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Integrate mutate existing changes with diff generation

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Move resource key generation into a function

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Add a mutate existing test that fails

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Remove redundant comment

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Fix array of any assignment in cli test

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Dont check duplicate strings for field that is an array of any

Signed-off-by: aerosouund <aerosound161@gmail.com>

* bug: Fix appending to the wrong array

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: run fix tests

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run fix tests

Signed-off-by: aerosouund <aerosound161@gmail.com>

---------

Signed-off-by: aerosouund <aerosound161@gmail.com>
Signed-off-by: ammar <ammar.yasser@vodafone.com>
Signed-off-by: Ammar Yasser <aerosound161@gmail.com>
Co-authored-by: ammar <ammar.yasser@vodafone.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-12-19 07:42:54 +00:00
Liang Deng
e9704e7d8f
fix: exemption error caused by convertChecks function (#11780) 
Signed-off-by: Liang Deng <ytdengliang@gmail.com>
 2024-12-18 13:46:18 +00:00
Vishal Choudhary
174534b518
fix: properly verify precondition in old object validation (#11644) 
* fix: properly verify precondition in old object validation

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: assert bug

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: properly update the values

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-12-04 06:32:12 +00:00
Vishal Choudhary
bf83f37984
fix: add a check for nil rule response (#11591) 2024-11-14 15:13:23 +00:00
shuting
a26f588b86
fix: panic for nil rule response when processing old object (#11550) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-11-07 09:48:33 +00:00
Vishal Choudhary
b35aaab898
fix: match failure action case insensitively for validating old object (#11486) 
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-11-07 00:10:56 +08:00
Vishal Choudhary
4e3f297da2
fix: update match logic for old object validation (#11427) 
* fix: update match logic for old object validation

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: linter

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: failing test due to user info

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: debug logs

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-10-21 14:10:06 +00:00
Mariam Fahmy
8eb081475e
fix: skip processing the oldObject for audit policies (#10233) 
* fix: skip processing the oldObject for audit policies

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: modify error and skip messages

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: modify the log level

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-09-20 12:28:18 +00:00
Charles-Edouard Brétéché
b5e1c97913
feat: use pointer in rule (exclude field) (#11050) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-09-10 11:14:49 +00:00
Vishal Choudhary
1ef9b876e1
fix: allow changes to preexisting resources that violate a validate foreach, cel or pss policy (#10033) 
* feat: allow changes to preexisting resources that violate a validate foreach, cel or pss policy

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: do old object verification as create operation

this fixes the case where we are checking request.operation in a deny condition

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: update the json context in set operation

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: typo

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: update error message

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: add match and exclude check

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: match exclude in if

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add option to disable validation of old object

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: unit tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: update readme

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: conflicts

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: ci

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: nil ptr error

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: linter

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: linter

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: old obj verification in assert

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: codegen

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: chainsaw test for assert

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: cleanup

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: pss

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: common functions for allow existing violations

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: types

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: typos

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: pss old resource

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: chainsaw test for PSS

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: use old objects

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: more merge changes

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: e2e matrxix

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: refactor and dont return error when old obj validation fails

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: return resp when not matched

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: add logs and return skip when old object validation fails

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* Update validate_resource.go

Co-authored-by: shuting <shutting06@gmail.com>
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* Update validate_pss.go

Co-authored-by: shuting <shutting06@gmail.com>
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* Update validate_assert.go

Co-authored-by: shuting <shutting06@gmail.com>
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
 2024-09-06 06:42:56 +00:00
Vishal Choudhary
95f54a1cb6
feat: enable custom data in policy reports using properties (#10933) 
* feat: enable custom data in policy reports using properties

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: dont throw error in variable substitution for properties

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-09-03 17:36:07 +00:00
Mariam Fahmy
bde90340a6
chore: remove v1alpha1 of VAPs and use v1beta1 (#10955) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-29 15:31:25 +00:00
Mariam Fahmy
2140a0239b
chore: rename validationFailureAction to failureAction under the rule (#10893) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2024-08-27 20:07:57 +00:00
Mariam Fahmy
c796bb765c
fix: return policies with either audit or enforce rules from the cache (#10667) 
* fix: return policies with either audit or enforce rules from the cache

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: introduce validationFailureAction under verifyImage rules

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add chainsaw tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-08-06 18:24:28 +00:00
Khaled Emara
c0cf6c5bf1
feat(json): unmarshal at decode time (#10700) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-05 15:46:50 +03:00
Charles-Edouard Brétéché
fc694bc24c
feat: add kyverno json support to validation rule (#10763) 
* feat: add kyverno json support to validation rule

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* v2beta1

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* validation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* engine handler

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* bindings

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* context functions

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* better bindings

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-08-02 08:24:30 +00:00
Khaled Emara
d173752041
feat(json): unmarshal once per policy (#10701) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-07-30 10:52:41 +00:00
Mariam Fahmy
716611b7ea
fix: return all the exceptions that match the incoming resource (#10722) 
* fix: return all the exceptions that match the incoming resource

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: modify log messages

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-25 17:36:19 +00:00
Mariam Fahmy
ad6ee93e3b
fix: CEL policies aren't applied to deleted resources (#10611) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-04 22:16:36 +05:30
Mariam Fahmy
94d9bbe73f
chore: use v2 clients for policy exceptions (#10530) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-24 16:36:55 +00:00
shuting
5260b4f7bc
chore: bump k8s libs to 0.30 (#10285) 
* chore: bump k8s libs to 0.30

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update crds

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: bump kubectl-validate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: fix tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: fix panic

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: fix linter

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: bump k8s

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix sum

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix: indent

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: bump deps

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-04 15:09:44 +08:00
Vishal Choudhary
47adea6f1c
feat: add support for background scanning of existing resource in image verification (#10287) 
* feat: add support for background scanning of existing resource in image verification

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: change rule response type to image verify

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: fix nilptr reference

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-05-24 09:41:04 +00:00
Mariam Fahmy
57b2c5fe4f
fix: add a copy method to the policy context (#10236) 
* fix: add a copy method to the policy context

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* chore: add a CLI test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* chore: remove mutate changes

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-05-21 15:29:09 +00:00
shuting
fb9c66f455
feat(perf): add new linter prealloc to enforce slice declarations best practice (#10250) 
* feat(perf): add new linter prealloc to enforce slice declarations best practice

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix(linter): prealloac slices

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-05-20 14:46:35 +05:30
Mariam Fahmy
798950f72c
fix: return skip when celPreconditions/matchConditions aren't met (#9940) 
* fix: return skip when cel preconditions aren't met

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: return skip when matchConditions in VAPs aren't met

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-04-22 13:49:25 +00:00
Mariam Fahmy
ea64529e63
fix: evaluate namespaceObject for Kyverno policies in the CLI (#9977) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-04-19 10:55:41 +00:00
Charles-Edouard Brétéché
76bd67739a
fix: polex mem footprint (#9954) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-03-28 09:31:40 +00:00
Vishal Choudhary
f2833861f8
fix: properly update policy context after preexisting resource in violation check (#9893) 
* fix: properly update policy context after preexisting resource in violation check

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: remove all copy function usages

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: nit

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* refactor context resource swap

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* feat: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: test:

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: logger panic

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: copy cover policycontext

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
 2024-03-13 16:24:53 +00:00
Jim Bugwadia
5e69204c99
add unit test (#9894) 
* add unit test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* revert change

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

---------

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2024-03-13 17:09:30 +08:00
Jim Bugwadia
befcd73ea1
add control names and images to PSS results (#9869) 
* add control names and images to PSS results

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove init

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tets

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update chainsaw tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add unit test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

---------

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-03-11 09:32:05 +00:00
mohamedasifs123
d566e9886c
Fix :variables are not getting processed in validation message for "anyPattern" (#9713) 
* Update validate_resource.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Create pod.yaml

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Create chainsaw-test.yaml

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Create policy.yaml

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update validate_resource.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* test

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* test

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* test

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* test

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update chainsaw-test.yaml

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Create README.md

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages/README.md

Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages/README.md

Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages/chainsaw-test.yaml

Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update test/conformance/chainsaw/validate/clusterpolicy/cornercases/variable-substitution-failure-messages/README.md

Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

---------

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
 2024-02-21 07:20:43 +00:00
shuting
5f0d53fe34
feat: apply .matchConditions when generating reports (#9599) 
* enable matchconditions for reports

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add chainsaw tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter issues

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: move files

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-02-02 08:32:28 +00:00
Charles-Edouard Brétéché
747bc017e5
fix: follow up for #9534 (#9543) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-29 08:54:58 +00:00
mohamedasifs123
e3274386e7
Update validate_resource.go (#9534) 
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
 2024-01-28 20:41:42 +00:00
Mariam Fahmy
f01f0d6dc4
feat: support podSecurity exclusion in exceptions (#9343) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-01-26 18:43:07 +00:00
Vishal Choudhary
87c7ce254a
feat: add skipImageReferences in verify images (#8633) 
* feat: add skipImageReferences in verify images

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: chainsaw-test.yaml

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: typo in assert

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-23 12:27:39 +00:00
Gurmannat Sohal
6902a2b092
Unit tests for Pod Security Admission Integrations (#8585) 
* feat: enable field-restricted exclusions using the psa

Signed-off-by: Liang Deng <283304489@qq.com>

* fix ci error

Signed-off-by: Liang Deng <283304489@qq.com>

* fix ci error

Signed-off-by: Liang Deng <283304489@qq.com>

* initial unit tests

* Add all remaining unit tests

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* fine grain unit tests by adding fields and values

* add detailed pod level exclusion and related tests

* add tests for init & ephemeral containers

* add kuttl tests for the new advanced support

* add kuttl tests for the new advanced support

* add readme for kuttl tests

* add replacement in go.mod

* resolving CI errors

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* fix ci errors

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* fix ci errors

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* updating pod-security-admissio

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* resolving null pointer panic

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* resolved conformance error

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* chainsaw

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* chainsaw

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* remove duplication

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* fix linting

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* remove over computation

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* added field checks, pss skip condition

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* correcting chainsaw tests

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* merge branch 'main' into unit-tests

Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>

* fix builds

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: Liang Deng <283304489@qq.com>
Signed-off-by: Gurmannat Sohal <iamgurmannatsohal@gmail.com>
Signed-off-by: shuting <shuting@nirmata.com>
Signed-off-by: Gurmannat Sohal <95538438+itsgurmannatsohal@users.noreply.github.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Liang Deng <283304489@qq.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-12-26 22:28:08 +08:00
Mariam Fahmy
b61a1f3d18
fix: set v2beta1 of exceptions the storage version (#9254) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2023-12-22 10:13:58 +00:00
Mariam Fahmy
8e0a7aa204
feat: promote policy exceptions to v2 (#9208) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-12-19 10:43:39 +00:00
Vishal Choudhary
1f4181645b
fix: allow changes to preexisting resource in violation of a policy in Enforce (#9027) 
* fix: allow changes to preexisting resource in violation of a policy in Enforce

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: missing error check

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* nit: cleanup

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: update old policy context

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: preconditions always retured true

internal.CheckPreconditions always returned true when v.anyAllConditions, it should be populated with rule.RawAnyAllConditions when newValidator() is used to create a validator

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: fix chainsaw test

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: nit

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* debug

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: update test

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: add namespace

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add test for bad to good conversion

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add test step

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2023-12-12 09:17:53 +00:00
Mariam Fahmy
c0e0cea9f4
feat: compute policy exceptions as a part of the rule execution (#8713) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2023-11-13 15:43:25 +00:00
Mariam Fahmy
31858abb0b
fix: use validate.message in case there is no message associated with the CEL expression (#8883) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-11-13 14:53:24 +00:00
Charles-Edouard Brétéché
5beaec677f
fix: cache invalidation in FindResources (#8316) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-09-08 15:51:25 +02:00
AdamKorcz
34bfb57c08
[Bug] Fix nil-dereference in pss validation (#8271) 
Signed-off-by: AdamKorcz <adam@adalogics.com>
 2023-09-05 18:45:07 +00:00
Mariam Fahmy
b495c6d112
feat: support authorizer variable in CEL expressions (#8024) 
* feat: support authorizer variable in CEL expressions

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add the auth reason

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add kuttl tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix lint issue

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix kuttl test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: add helpers

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-09-05 10:16:50 +00:00
Mariam Fahmy
c583b64120
feat: generate validating admission policies and their bindings from Kyverno policies (#7840) 
* feat: generate validating admission policies and their bindings from Kyverno policies

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add generate VAPs feature flag

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: use container flags instead of feature flags

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: limit VAP generation to cluster policies

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add policy checks for generating VAPs

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* chore: rename package

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: translate match/exclude resources in Kyverno policies to their alternatives in validating admission policies

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add vap info in kyverno policy status

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: delete the translation of

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add kuttl tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add generateValidatingAdmissionPolicy feature flag in the helm chart

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* chore: update codegen

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add validating admission policy kuttl tests in the workflow

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: check K8s server version

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix lint issue

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: remove the kind config of VAPs

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-08-31 10:25:21 +00:00
Mariam Fahmy
94aa1f18c6
feat: support namespaced parameter resources for CEL expressions in Kyverno policies (#8084) 
* feat: support namespaced parameter resources for CEL expressions in Kyverno policies

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix lint issue

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix kuttl test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-08-28 14:43:09 +00:00
Mariam Fahmy
072ebeacdb
refactor: create cel package for compiling expressions (#8108) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-08-24 14:06:37 +00:00
Mariam Fahmy
10172ae8e0
feat: support variables for CEL in Kyverno policies (#8103) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-08-24 10:00:27 +00:00
Mariam Fahmy
333845677a
fix: check if client is set in CEL validations (#8099) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-08-23 17:22:37 +02:00