mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 16:06:56 +00:00
Code Activity
7959 commits 16 branches 550 tags 288 MiB
Commit graph

912 commits

Author SHA1 Message Date
Ammar Yasser
739e6a21c4
Mutate existing CLI support (#11453) 
* feat: Add flags for target resources and add fake client initialization

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add fake discovery client and cluster bool in the policy processor

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use the full mutation engine policy response in the engine response

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Extract mutated targets from the policy responses and print them out

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add TargetResources field in the cli test schema

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Generate CLI crds

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: modify checkResult to take an arbitrary actual resource and resource name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: change getAndCompareResource to take a resource name and cascade it to GetResourceFromPath

Signed-off-by: aerosouund <aerosound161@gmail.com>

* test: Create a simple test to test mutate existing in the CLI

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Allow GetResourceFromPath to select a resource with a name from a multi resource yaml

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Modify the runTest command to return the TestResponse type

- Create a fake client, load the target resources in it and use it in the PolicyProcessor.
- Create the TestResponse which contains Trigger and Target fields, each is a map of gvk/name to the responses corresponding to that resource.

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Rewrite output.go to use the TestResponse type

- Check for both target and trigger
- Create logic for appending the resource array in case no resources are passed
- Move row creation logic into a separate method to avoid code duplication
- Extract the proper target resource based on rule type
- Create a function to extract mutated target from the engine response

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Move tests to the correct folder

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use apiVersion/Kind/Name as the key in the test responses

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use the apiVersion/Kind/name key schema in checking results and fix invalid resource name checking for generate policies

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use better variable names for rows

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Account for Generate resources being an array

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use generated resource name in checking the results and printing output

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Uncomment checks printing

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Remove bug in engine response creation

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Move the generate logic into an else block

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix namespace fetching bug in cel validator

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use pointer to int in the test counter

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Remove redundant method

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Skip resources not being found in the manifests

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Create another field in the engine to denote if this is a cluster engine or an offline engine

Simply checking for the client being nil is no longer enough because for cli operations the client will be a fake client
A pointer to bool is chosen because callers who don't necessarily know what to pass should be able to pass nil

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Add extra argument in fake client initiation

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: add extra argument in fuzz test

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Add extra arg

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Handle resources specified as ns/name as this schema will be deprecated in favor of apiVersion/Kind/Name

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Fix linter complaints

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Use comma separation as array separators as kubernetes names don't support commas

To avoid undefined array length on splitting on /
using commas will result in a fixed length since all resources will have an apiVersion, kind, namespace and name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Change resource array type to an array of any instead of array of string

To support the use of a string or a TestResourceSpec

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Expect the resource array to be an array of string or array of TestResourceSpec

Assert that an array element is either of these types and match the resources in both cases according to the element type
Expect that the key in responses is now separated by commas instead of slashes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Expect that the resource array is now of type array of any and modify tests that use it

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Skip response check if the policy name isnt whats in the result

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Match the name if its specified as ns/name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Create CLI CRDs

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix linter complaints

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Cleanup invalid code used in FixTest to adapt it to the schema changes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Check if resource is nil before extracting

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: use the loadResources method to open targets in a directory

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Account for target resources with the same name but different namespaces

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Add CLI test for mutate existing with the same name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Infer resource name and namespace from the actual resource and account for resources with the same name and namespace but different kinds

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: remove extra line

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add printing mutate existing resources to the output or to a file

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Minor fixes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Revert result back to error

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use io discard to not print resources in the test command

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Update vague comments and remove outdated ones

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Integrate mutate existing changes with diff generation

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Move resource key generation into a function

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Add a mutate existing test that fails

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Remove redundant comment

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Fix array of any assignment in cli test

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Dont check duplicate strings for field that is an array of any

Signed-off-by: aerosouund <aerosound161@gmail.com>

* bug: Fix appending to the wrong array

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: run fix tests

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run fix tests

Signed-off-by: aerosouund <aerosound161@gmail.com>

---------

Signed-off-by: aerosouund <aerosound161@gmail.com>
Signed-off-by: ammar <ammar.yasser@vodafone.com>
Signed-off-by: Ammar Yasser <aerosound161@gmail.com>
Co-authored-by: ammar <ammar.yasser@vodafone.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-12-19 07:42:54 +00:00
Charles-Edouard Brétéché
a5e082303d
refactor: introduce autogen interface (#11418) 
* refactor: introduce autogen interface

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-10-16 15:24:37 +02:00
Charles-Edouard Brétéché
4d1683d167
refactor: move autogen v1 and v2 packages (#11416) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-10-16 08:51:38 +00:00
Vishal Choudhary
ec546e6fb4
feat: add helm configuration for reporting in different rules (#11376) 
* feat: add helm configuration for reporting in different rules (forgot signoff)

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: linter and tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: rename reporting.imageVerification

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-10-11 09:42:29 +00:00
Vishal Choudhary
53922941d6
fix: isolate report creation context for mutate in admission (#11304) 
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-10-07 13:17:35 +00:00
Vishal Choudhary
fe49e97fba
feat: add reporting to mutate and generate rules (#11265) 
* feat: add reports to standard mutatation

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add warnings for permissions

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: remove unnecessary fields

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add reporting to generate and mutate existing

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add reporting to generate and mutate existing

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: codegen and add generate tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: linter

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: e2e matrix

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: cleanup

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-10-02 12:05:05 +00:00
Mariam Fahmy
1331209b19
feat: add dumpPatch flag (#11237) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-09-25 13:11:43 +00:00
Charles-Edouard Brétéché
b463ee40d2
feat: use pointer in rule (validate field) (#11095) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-09-11 09:12:53 +00:00
shuting
1b1b90ed93
fix: avoid generating empty urs (#11065) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-09-10 09:42:16 +00:00
Charles-Edouard Brétéché
02e27ec3d4
fix: unsupported defaults in api (#11021) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-09-05 14:48:47 +00:00
Vishal Choudhary
86b8a6d0f3
feat: show violations and mutations as warning (#10214) 
* feat: add audit warning to policy spec

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: emit warning when audit warning is set

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add audit warn to policy cache

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add warnings for validation

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add warnings for mutation

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add chainsaw test

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add more chainsaw test

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: fix ci

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: rename field to emit warning

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: unit tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: validate tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: cleanup

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: remove validation action failure fro mutation unit tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-09-05 10:02:00 +00:00
Vishal Choudhary
c0d6eaddb3
feat: delete webhook configurations after kyverno is uninstalled (#10782) 
* feat: delete webhook configurations after kyverno is uninstalled

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: optionally add permissions

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: linter

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: disable finalizers in latest manifest

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: move webhook cleanup to webhooks controller

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add finalizers on deployment

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: refactor

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add roles to cleanupcontroller

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add cleanup to generic controllers

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add webhook cleanup in generic controllers

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: remove unnecessary clusterrole and clusterrole bindings

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: make this behaviour opt-in

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: reconcile webhook setup on deployment change

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: update codegen and remove unused vars

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add finalizers to chart

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-09-04 10:59:59 +00:00
Pradeep Lakshmi Narasimha
416b7d2f8b
fix: Honour generateSuccessEvents config for generating success events (#9870) (#10741) 
Signed-off-by: Pradeep Lakshmi Narasimha <pradeep.vaishnav4@gmail.com>
 2024-09-04 10:25:34 +00:00
Vishal Choudhary
95f54a1cb6
feat: enable custom data in policy reports using properties (#10933) 
* feat: enable custom data in policy reports using properties

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: dont throw error in variable substitution for properties

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-09-03 17:36:07 +00:00
shuting
2cd462570a
feat: foreach support for clone (#10888) 
* chore: add chainsaw tests for foreach clone

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: update webhooks for foreach generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: rename generatePattern

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: chainsaw tests for generateExisting

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: add missing files

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: add chainsaw tests for foreach clone, sync=true

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter issues

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: add chainsaw test foreach clonelist, sync=true, delete source

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: sync deletion for cloneList

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-08-29 11:59:22 +00:00
Charles-Edouard Brétéché
f87fa52cb7
feat: bump to k8s 1.31 (#10938) 
* feat: bump to k8s 1.31

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* tidy

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* mod

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix otel

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix otel schema

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* update linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* feat: fix image verification tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* linter issues

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* cel change

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-08-28 17:09:58 +00:00
Mariam Fahmy
2140a0239b
chore: rename validationFailureAction to failureAction under the rule (#10893) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2024-08-27 20:07:57 +00:00
Jim Bugwadia
f06399200c
remove wildcard permissions (#10785) 
* remove wildcard permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix background controller perms

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove secrets perm

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix reports-controller role

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add wildcard check and limit generate policy checks based on `synchronize`

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update manifest

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix wildcard check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update default QPS and burst for better performance and to prevent test failure

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix perms

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix perms

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test permissions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix merge issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix merge issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

---------

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-20 11:55:32 +03:00
Jim Bugwadia
2e39e27102
rename package: d4f --> breaker (#10863) 
* rename package: d4f --> breaker

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* rename package: d4f --> breaker

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

---------

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2024-08-15 10:53:20 +00:00
shuting
481798c836
refactor: update updaterequest to be created for each policy (#10793) 
* chore: remove v1beta1 updaterequest definitions

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: update UR to map a policy instead a rule; adapt UR mapping changes for admission review

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: update code-gen

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: remove unused function

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: add missing files

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: add missing files

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update ur in policy controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: update crds

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: adapt ur changes in the background controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: more linter

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: modify mapping relationship for deletion events

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: remedy missing target for policy application

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: fetching logic for triggers

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: clean up targets upon policy deletion

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update crds

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* merge main

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* merge main

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: adds delay before assertion

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update docs

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: wrong yaml format

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: update error handling logic

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix(attempt): enable more debug info

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix(attempt): enable debug log

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix(attempt): enable debug log

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix(attempt): enable debug log

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: makefile to update ur crds

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: generate existing

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: skip empty ur generation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: update install.yaml

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-08-13 17:14:06 +00:00
Khaled Emara
bbb1d6103c
feat(mutate): don't eagerly process img-ver (#10703) 
* feat(mutate): don't eagerly process img-ver

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(mutate): add mutate with img-ver test

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-08-12 14:59:27 +00:00
Mariam Fahmy
c796bb765c
fix: return policies with either audit or enforce rules from the cache (#10667) 
* fix: return policies with either audit or enforce rules from the cache

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: introduce validationFailureAction under verifyImage rules

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add chainsaw tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-08-06 18:24:28 +00:00
Yukun Wang
8890fffafb
fix: include error message when policy context creation failed (#10566) 
* fix: include error message when policy context creation failed

Signed-off-by: airycanon <airycanon@airycanon.me>

* Update pkg/webhooks/resource/validation/validation.go

Co-authored-by: shuting <shuting@nirmata.com>
Signed-off-by: Yukun Wang <airycanon@airycanon.me>

---------

Signed-off-by: airycanon <airycanon@airycanon.me>
Signed-off-by: Yukun Wang <airycanon@airycanon.me>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-07-01 13:29:11 +00:00
Mariam Fahmy
ff88c4c39a
feat: migrate validationFailureAction and validationFailureActionOverrides (#10528) 
* feat: migrate validationFailureAction and validationFailureActionOverrides under validate rule

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add unit tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-26 09:13:02 +02:00
Charles-Edouard Brétéché
018d45cb29
feat: add reports circuit breaker (#10499) 
* feat: add reports circuit breaker

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* improve metrics and granularity

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-25 11:16:30 +08:00
Mariam Fahmy
94d9bbe73f
chore: use v2 clients for policy exceptions (#10530) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-24 16:36:55 +00:00
Charles-Edouard Brétéché
b36a2ecdcc
feat: bump update request api version (#10508) 
* feat: bump update request api version

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* use v2

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-20 09:44:43 +00:00
shuting
9e5c297dcf
feat: add a circuit breaker for updaterequests (#10382) 
* feat: add generator abstraction

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: replace urgenerator

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: ko build

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: load threshold from kyverno configmap

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add metadata client to get ur count

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add helm option to preserve configmap settings during upgrade

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add helm option to preserve configmap settings during upgrade 2

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: rename imports

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update codegen manifests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: handle nil value

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter issue

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update threshold to 1000

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-06-11 08:54:51 +00:00
JenTing
3e37f80f87
Fix typo (#10360) 
Signed-off-by: JenTing Hsiao <hsiaoairplane@gmail.com>
 2024-06-02 06:50:40 +00:00
shuting
37af1f83a7
fix: isolate reports creation context (#10245) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-05-16 15:58:38 +03:00
Vishal Choudhary
3db5bdfad8
fix: add mutex to mock policy context builder (#10057) 
It is possible that two different threads call the build function at the same time causing one append to be lost, this PR adds a mutex to avoid this

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-04-17 09:13:19 +00:00
Khaled Emara
fb40aa5f38
feat(audit): use a worker pool for Audit policies (#10048) 
* enhancement: split validation logic for enforce and audit policies to return admission response earlier

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: add missing file

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: unit tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter issues

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: unit tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: get latest policy object before updating status

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: remove debug code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: compare before updates

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: initial reconcile

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: updates

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat(audit): use a worker pool for Audit policies

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix: unit test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix(attempt): spin up go routine

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add flags maxAuditWorkers, maxAuditCapacity

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: enable debug log on failure

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: wait group panic

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* load-tests: add stess tests configurations

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* load-tests: disable admissionreports

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: build policy contexts syncronously

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: only run generate and mutate existing go routines when policies are present

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: mutate and verify tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: return early if no audit policy

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: run handlegenerate and mutate existing in all cases

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: only test bgapplies in generate test

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: defer wait in tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* enhancement: process validate enforce in a go routine

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-04-17 15:46:18 +08:00
Khaled Emara
c9055ac2ff
fix(autogen): only generate rule for request kind (#9984) 
* fix(autogen): only generate rule for request kind

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* feat(autogen): use jsoniter instead of std for json

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(atogen): use sets instead of manipulating strings

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(autogen): formatting linter

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(autogen): backwards compatability

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* revert(autogen): old behavior

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix: builds error

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
 2024-04-04 08:09:30 +00:00
Vishal Choudhary
93eac3f7a4
fix: deferred loader panic when mutate and generate policies are applied (#9935) 
* fix: deferred loader panic when mutate and generate policies are applied

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: update policies

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* remove clusterrolebinding

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: copy only json context

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: polctx

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-03-29 14:37:15 +01:00
Charles-Edouard Brétéché
4438b24b69
refactor: exception selector interface (#9907) 
* refactor: exception selector interface

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-03-28 08:03:01 +00:00
Vishal Choudhary
f2833861f8
fix: properly update policy context after preexisting resource in violation check (#9893) 
* fix: properly update policy context after preexisting resource in violation check

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: remove all copy function usages

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: nit

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* refactor context resource swap

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* feat: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: test:

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: logger panic

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: copy cover policycontext

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
 2024-03-13 16:24:53 +00:00
Khaled Emara
2b2587469d
feat: enhance global context (#9710) 
* feat(globalcontext): add event handling

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* feat(globalcontext): handle cache sync error

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* feat(globalcontext): ensure api is called during init

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* design(events): decouple events from policies a bit

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* feat(globalcontext): use status

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): make status optional

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): status update

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): codegen

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(globalcontext): delete yaml annotations

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): fix status in tests

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcotext): update enqueue func

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): error

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(globalcontext): rbac

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(globalcontext): retry logic

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): unknown api call in test

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* bump

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix: set unique name for each testing resource

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: update readme

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: log msg

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: add delays

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: delay gctce creation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* debug: check Kyverno status

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* debug: update chainsaw config

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* debug: revert chainsaw config

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* test(globalcontext): print actual status

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): add necessary delays and check status before applying

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(globalcontext): long refreshInterval

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* debug: log success

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* debug: print informer data

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): use client instead of informer

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* debug: print status after update

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* debug: print ResourceVersion

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* debug: remove gcecontroller from other controllers

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): update status only once

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore: remove excess logs

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(globalcontext): add store to cleanup controller

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-02-23 10:34:04 +00:00
mohamedasifs123
66f54d8fd6
fix: Policies skipped because of preconditions not met should not be included in admission requests denial responses (#9719) 
* Update block.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update block.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* lint

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update block.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* test added

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* test

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* test

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* --signoff

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Create README.md

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Rename Policy1.yaml to policy-1.yaml

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/README.md

Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/README.md

Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/chainsaw-test.yaml

Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Rename Policy2.yaml to policy-2.yaml

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

* Update chainsaw-test.yaml

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>

---------

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Co-authored-by: Chip Zoller <chipzoller@gmail.com>
Co-authored-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-02-20 15:42:18 +00:00
Charles-Edouard Brétéché
a1cb4f1c30
fix: remove deprecated imageSignatureRepository flag (#9698) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-02-08 12:10:29 +00:00
Khaled Emara
10258921ac
feat(validation-webhook): validate global context reference (#9678) 
* feat(validation-webhook): validate global context reference

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(validation-webhook): global reference name

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(globalcontext): fix tests after valdiation

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(policycache): dont add NotReady Policies

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(globalcontext): rename e2e tests

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(globalcontext): add entry errors

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(globalcontext): fix chainsaw  test

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
 2024-02-08 07:46:58 +00:00
Vishal Choudhary
3142af64a0
feat: add global context entry validation webhook (#9619) 
* feat: add global context entry validation webhook

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: use `k8s.io/apimachinery/pkg/util/json` instead of `encoding/json`

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: lint

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-02-02 18:04:50 +01:00
Khaled Emara
8fcd9945a1
feat: use custom events watcher (#9324) 
* feat: use cusotm events watcher

This custom Event handler solved the problem of a goroutine per Event.

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(events): add unit test to EventGenerator

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(events): linter

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* feat: do away with EventBroadcaster

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* eddycharly fixes

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-30 14:08:15 -08:00
Charles-Edouard Brétéché
9102753323
fix: make alternate reports storage transparent (#9553) 
* fix: make alternate reports storage transparent

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* bg scan

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* aggregation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* aggregation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* rm manager

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* update

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fixes

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fixes

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-30 14:53:37 +00:00
shuting
7170cbb0c2
feat:Webhook config per policy (#9483) 
* add spec.webhookConfigurations

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update crd

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* configure webhook

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* register webhook handler

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* skip storing finegrained policies in cache

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update resource validate handler

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* updates

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* enable mutate resource handler for fine-grained policies

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-01-27 13:00:22 +00:00
Vishal Choudhary
e6c39f31a5
feat: add a new API group reports.kyverno.io (#9521) 
* feat: add new report interface

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: reports.kyverno.io/v1 apigroup

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* chore: codegen

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add report manager

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add reports manager to reports controller

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* feat: add alternateReportStorage to helm chart

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: report utils deepcopy

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* init flag

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: wrong return value

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-26 13:40:29 +00:00
Vishal Choudhary
87c7ce254a
feat: add skipImageReferences in verify images (#8633) 
* feat: add skipImageReferences in verify images

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: chainsaw tests

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: chainsaw-test.yaml

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

* fix: typo in assert

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>

---------

Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-23 12:27:39 +00:00
Charles-Edouard Brétéché
a597d65a33
chore: bump otel deps (#9442) 
* chore: bump otel deps

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix semconv version

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-19 09:36:28 +00:00
shuting
025a477688
fix: non-trigger resources should be skipped for background policies regardless of skipBackgroundRequests settings (#9333) 
* fix skip checks

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: skip request for non-triggers

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add missing files

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: empty policy

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-01-04 12:47:58 +02:00
shuting
67b96a7cf2
refactor: mutate checks (#9255) 
* refactor

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-12-22 15:07:17 +02:00
Mariam Fahmy
b61a1f3d18
fix: set v2beta1 of exceptions the storage version (#9254) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2023-12-22 10:13:58 +00:00