mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 16:06:56 +00:00
Code Activity
6225 commits 16 branches 550 tags 288 MiB
Commit graph

671 commits

Author SHA1 Message Date
Jacob Lorenzen
81fb0caf1b
fix: replace + symbol with _ symbol on the Chart.Version field (#5591) 
* fix: replace + symbol with _ symbol on the Chart.Version field

Signed-off-by: Jacob Lorenzen <jacob@lorenzen.me>

* chore: remove truncate part

Signed-off-by: Jacob Lorenzen <jacob@lorenzen.me>

Signed-off-by: Jacob Lorenzen <jacob@lorenzen.me>
 2022-12-06 13:26:15 +00:00
Charles-Edouard Brétéché
aef13773fd
feat: add cleanup controller BYOSA and RBAC extensions (#5580) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-12-05 17:37:44 +00:00
shuting
ef06833613
feat: support attestations with multiple signatures (#5409) 
* add new attribute ".verifyImages.attestations.attestors"

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Update CRDs

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* support multiple subjects for attestations

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - fix entries check; - refactors code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix linter

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - allow both attestors and attestations; - make attestations.attestor optional

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix panic

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove the invalid test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix empty attestor

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add cleanup steps

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Update api/kyverno/v1/image_verification_types.go

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* update codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-12-01 22:09:44 +00:00
cuttingedge1109
5244730f7a
feat: Add default CI test values for helm charts (#5518) 
* feat: Add default CI test values for helm charts

Signed-off-by: cuttingedge1109 <jamescarl20190101@outlook.com>

* Bump chart versions

Signed-off-by: cuttingedge1109 <jamescarl20190101@outlook.com>

* Revert version bump following release process

Signed-off-by: cuttingedge1109 <jamescarl20190101@outlook.com>

Signed-off-by: cuttingedge1109 <jamescarl20190101@outlook.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-12-01 10:39:59 +00:00
Marco Kilchhofer
91adf68602
feat(policies chart): Add ability to set autogen behavior (#5517) 
* feat(kyverno-policies): Add ability to set autogen behavior

Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>

* fix(kyverno-policies): Fix missing labels

Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>

* chore: Apply changes from code review

- Update changelog annotations
- Add test

Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>

* Update charts/kyverno-policies/Chart.yaml

Signed-off-by: shuting <shutting06@gmail.com>

* fix: Move test-autogen-none.yaml -> test-autogen-none-values.yaml

Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>

* fix: Run make codegen-helm-all

Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>

Signed-off-by: Marco Kilchhofer <mkilchhofer@users.noreply.github.com>
Signed-off-by: shuting <shutting06@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
 2022-12-01 10:05:56 +00:00
Charles-Edouard Brétéché
1bf4455555
fix: pod anti affinity (#5516) 
* fix: pod antifinity

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-11-30 21:38:05 +00:00
Nikhil Sharma
8547c8ff8c
Add reconciling logic for creating cronjobs whenever a new cleanup policy is created (#5385) 
* add reconcile logic to create CronJobs

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix lint issues

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

* watch cronjobs in reconciliation

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

* fix

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-11-25 09:59:45 +00:00
Charles-Edouard Brétéché
56aae9f505
fix: admission reports stacking up (#5457) 
* fix: admission reports stacking up

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* utils

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* warmup

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* cleanup

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix logger

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* nits

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-11-24 14:21:08 +01:00
André Bauer
8073dd4bd8
fix blank lines in crds (#5422) 
Signed-off-by: André Bauer <andre.bauer@staffbase.com>

Signed-off-by: André Bauer <andre.bauer@staffbase.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-11-21 21:57:15 +01:00
Nikhil Sharma
0fb45ed53a
feat: add CleanupPolicy validation code to CleanupPolicyHandler (#5338) 
* add validation code for cleanupPolicyHandler

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

* update

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* register kuttl tests for cleanup policy

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-11-16 13:11:33 +00:00
Charles-Edouard Brétéché
103073ff2d
chore: add helm ci values with cleanup controller (#5357) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-11-15 16:23:59 +01:00
Charles-Edouard Brétéché
4fa539a354
fix: add some missing options in cleanup helm chart (#5351) 
* fix: add some missing options in cleanup helm chart

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* release notes

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-11-15 14:05:32 +00:00
Charles-Edouard Brétéché
86fc537ce0
feat: add cleanup controller to helm chart (#5329) 
* feat: add cleanup controller to helm chart

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* add webhook config

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* rbac

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fixes

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* secret

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* certs

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix labels

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* add server

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* rbac

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* handler

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-11-14 18:30:12 +01:00
Charles-Edouard Brétéché
7a15231a1c
fix: reduce startup probe delay (#5296) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-11-10 13:49:22 +00:00
Nikhil Sharma
6d801b26db
feat: create cleanup new CRDs (#5233) 
* create new cleanup CRDs

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>

* fix package

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Nikhil Sharma <nikhilsharma230303@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-11-08 08:42:35 +00:00
Pratik Shah
6cdbd55f93
Fixed description for secret name (#5228) 
Signed-off-by: Pratik Shah <pratik@infracloud.io>

Signed-off-by: Vyankatesh <vyankateshkd@gmail.com>
 2022-11-07 10:59:16 +05:30
Charles-Edouard Brétéché
5557d6c85d
feat: add grafana dashboard to helm chart (#5230) 
* feat: add grafana dashboard to helm chart

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* release note

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: treydock <tdockendorf@osc.edu>
 2022-11-04 16:38:05 +00:00
shuting
3fc157717a
feat: support disabling schema validation on the patched resource (#5197) 
* Support disable schema validation on the patched resource

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update api doc

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-11-03 08:12:44 +00:00
Edwin Mackenzie-Owen
0e1d2cae05
Helm chart: add extraCRDAnnotations value and set ArgoCD sync option by default (#4964) 
* fix: add extraCRDAnnotations option to helm chart

set ArgoCD replace sync option by default

Signed-off-by: Edwin Mackenzie-Owen <edwin.mowen@gmail.com>

* fix: add extraCRDAnnotations via codegen

* use template

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Edwin Mackenzie-Owen <edwin.mowen@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-11-02 09:35:33 +00:00
Charles-Edouard Brétéché
d2658a1bc8
refactor: support Audit and Enforce validation failure actions (#5152) 
* feat: remove policy mutation code

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* refactor: support Audit and Enforce failure actions

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* typo

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* update changelog

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-11-01 09:56:52 +00:00
Quirino Gervacio
9e89aa341b
Corrected Kubernetes spelling (#5134) 
* Corrected Kubernetes spelling

Signed-off-by: Quirino Gervacio <qgervacio@gmail.com>

* fix codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Quirino Gervacio <qgervacio@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: kyverno-bot <104836976+kyverno-bot@users.noreply.github.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-10-31 17:00:17 +00:00
Pratik Shah
2c4a2dab7e
Fixed issue-5102: Show rule count and type in output (#5106) 
Signed-off-by: Pratik Shah <pratik@infracloud.io>

Signed-off-by: Pratik Shah <pratik@infracloud.io>
 2022-10-27 10:05:32 +00:00
Charles-Edouard Brétéché
e4bf66e756
feat: remove policy mutation for auto-gen rules (#5123) 
* feat: remove policy mutation code

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* Fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* changelog

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-10-25 23:43:46 +00:00
Santosh Kaluskar
8eb1d3988c
Add AGE in printer columns of CRDs (#5119) 
* Add AGE in printer columns of CRDs

Signed-off-by: Santosh Kaluskar <dtshbl@gmail.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Santosh Kaluskar <dtshbl@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-10-24 19:28:23 +00:00
Charles-Edouard Brétéché
0b8c9334d2
feat: add categories support to our CRDs (#5112) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-10-24 10:40:38 +00:00
XDRAGON2002
a3c129f469
[Feature] create command line option to set failurePolicy globally (#4991) 
* add forceFailurePolicyIgnore flag

Signed-off-by: Anant Vijay <anantvijay3@gmail.com>

* cleanup code

Signed-off-by: Anant Vijay <anantvijay3@gmail.com>

* add logging

Signed-off-by: Anant Vijay <anantvijay3@gmail.com>

* resolve merge conflicts

Signed-off-by: Anant Vijay <anantvijay3@gmail.com>

* fix codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Anant Vijay <anantvijay3@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-10-21 18:13:36 +00:00
Charles-Edouard Brétéché
4b3a7b7da8
fix: add more infos in reports printers (#5027) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-10-18 09:56:14 +02:00
Brian Provenzano
382c8c4ca0
Enable adding annotations to configmaps in the helm chart (#4984) 
* fix: add user info in admission request logs (#4969)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Brian Provenzano <bproven@gmail.com>

* fix: missing autogen rules in status (#4971)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Brian Provenzano <bproven@gmail.com>

* fix: config reloading not working correctly (#4951)

* fix: config reloading not working correctly

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* nits

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Brian Provenzano <bproven@gmail.com>

* enable adding annotations to configmaps in the helm chart

Signed-off-by: Brian Provenzano <bproven@gmail.com>

* add entry to artifacthub.io release notes in Chart.yaml

Signed-off-by: Brian Provenzano <bproven@gmail.com>

* change name of annotation keys; codegen the readme docs

Signed-off-by: Brian Provenzano <bproven@gmail.com>

* feat: Add container registry setting on Helm Chart (#4281)

To make the customization of the container registries easier, eg.
a custom private registry, this change adds a new property on the
images configuration to allow setting a custom image registry
without needing to customize the repository of the image.

Signed-off-by: Samuel Torres <samuelpirestorres@gmail.com>
Signed-off-by: Brian Provenzano <bproven@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Brian Provenzano <bproven@gmail.com>
Signed-off-by: Samuel Torres <samuelpirestorres@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Samuel Torres <samuelpirestorres@gmail.com>
 2022-10-18 08:52:57 +02:00
Chip Zoller
b522274d74
updates with case insensitivity guarantee (#4954) 
* updates with case insensitivity guarantee

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* fix syntax

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Chip Zoller <chipzoller@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-10-17 07:43:12 +00:00
Charles-Edouard Brétéché
ac3b5eed22
feat: add startup probes support (#4896) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: treydock <tdockendorf@osc.edu>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: treydock <tdockendorf@osc.edu>
 2022-10-16 18:50:28 +02:00
Charles-Edouard Brétéché
3686f6506c
docs: add resource exclusions note in helm docs (#4989) 
* docs: add resource exclusions note in helm docs

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* nit

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fixes

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-10-16 06:58:56 -04:00
Samuel Torres
8dc56d3f68
feat: Add container registry setting on Helm Chart (#4281) 
To make the customization of the container registries easier, eg.
a custom private registry, this change adds a new property on the
images configuration to allow setting a custom image registry
without needing to customize the repository of the image.

Signed-off-by: Samuel Torres <samuelpirestorres@gmail.com>
 2022-10-15 11:48:36 -04:00
Pratik Shah
caab013a86
Fixed issue-4530: Added separate attestor type for secrets and KMS (#4733) 
Signed-off-by: Pratik Shah <pratik@infracloud.io>

Signed-off-by: Vyankatesh <vyankateshkd@gmail.com>
 2022-10-14 09:40:46 +00:00
Charles-Edouard Brétéché
064980bd9a
fix: admission reports printer (#4950) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-10-14 08:22:00 +00:00
Pratik Shah
8a0083105d
Added support to specify key signature algorithm in verifyImages (#4855) 
Signed-off-by: Pratik Shah <pratik@infracloud.io>

Signed-off-by: Pratik Shah <pratik@infracloud.io>
 2022-10-14 05:39:57 +00:00
Chip Zoller
3c70843fdf
Fix background scan with request.operation (#4947) 
* update version drop-down

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* Add workflow to detect and report on image vulnerabilities

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* pin deps

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* bump JasonEtco/create-an-issue

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* bump versions in drop-downs

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* fix background mode scan with request.operation

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* Revert "bump versions in drop-downs"

This reverts commit 5fcea048dd.

* Revert "bump JasonEtco/create-an-issue"

This reverts commit f0d44c7aca.

Signed-off-by: Chip Zoller <chipzoller@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-10-13 16:34:49 +00:00
Charles-Edouard Brétéché
4f3656abc6
chore: update controller-tools to v0.10.0 (#4918) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-10-13 07:23:44 +00:00
James Callahan
33b5bb2a8a
fix: don't specify rules when aggregationRule is set (#4867) 
Fixes #4866

Signed-off-by: James Callahan <jamescallahan@bitgo.com>

Signed-off-by: James Callahan <jamescallahan@bitgo.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-10-12 14:17:51 +00:00
Charles-Edouard Brétéché
ea37d46137
docs: add section in helm docs to install with argocd (#4878) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-10-11 17:48:30 +02:00
shuting
4d90b7b561
Update PSa images dsecription (#4840) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-10-07 08:09:31 +00:00
ShutingZhao
f659f7791c update helm doc 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-10-06 03:50:39 +08:00
Charles-Edouard Brétéché
51b07b7bf3
fix: validationFailureAction default value (#4822) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2022-10-05 18:09:21 +00:00
Charles-Edouard Brétéché
7e0884ca36
fix: publish yaml manifests in release instead of repo (#4738) 
* fix: publish yaml manifests in release instead of repo

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* ignore

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* pin actions

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* messages

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix helm gen crds

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* chart app version

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* makefile

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-10-03 15:12:43 +00:00
Addil Afzal
5f3411e588
Add security context and resource block to test (#4712) 
* Add security context and resource block to test

Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>

* Add comment to test security context

Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>

* Add security context and resource block to other test container

Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>

* fix: shutdown controllers workers gracefully (#4681)

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: AddilAfzal <>

* fix: split webhook handlers per failure policy (#4650)

* fix: split webhook handlers per failure policy

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix handlers

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* rolling update

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* better error message

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: AddilAfzal <>

* refactor: use pod name as leader id (#4680)

* refactor: use pod name as leader id

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix manifests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* makefile

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* leader client

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>

* fix: missing client wrapper (#4703)

* fix: missing client wrapper

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* v1beta1

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* v1alpha2

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* policy report

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>

* chore: refactor manifests related makefile targets (#4706)

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>

* fix: change key used in test (#4718)

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>

* Add changelog entry

Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>

* Set user and group on test pod

Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>

* fix docs

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* Move securityContext back to container level

Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>

Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: AddilAfzal <>
 2022-10-03 14:16:14 +00:00
yinka
688b4fb8e3
add package logger in files (#4766) 
* add package logger in files

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* add package logger to initContainer and other files

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>

* helm docs

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* helm default values

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* release notes

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-10-02 19:45:03 +00:00
Charles-Edouard Brétéché
a986a98535
fix: helm self signed cert (#4745) 
* fix: helm self signed cert

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* release note

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-09-29 20:18:39 +00:00
shuting
1d83e86c12
Add PSa policy validations (#4735) 
* Validate PSa control names

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add validation checks for the PSa rule

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-29 12:03:13 +08:00
Prateek Pandey
38c252952d
feat: add matchlabel selector support with multiple clone (#4713) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-28 17:44:38 +02:00
Charles-Edouard Brétéché
e0ab72bb9a
feat: reports v2 implementation (#4608) 
This PR refactors the reports generation code.
It removes RCR and CRCR crds and replaces them with AdmissionReport, ClusterAdmissionReport, BackgroundScanReport and ClusterBackgroundScanReport crds.

The new reports system is based on 4 controllers:

Admission reports controller is responsible for cleaning up admission reports and attaching admission reports to their corresponding resource in case of a creation
Background scan reports controller is responsible for creating background scan reports when a resource and/or policy changes
Aggregation controller takes care of aggregation per resource reports into higher level reports (per namespace)
Resources controller is responsible for watching reports that need background scan reports
I added two new flags to disable admission reports and/or background scan reports, the whole reporting system can be disabled if something goes wrong.

I also added a flag to split reports in chunks to avoid creating too large resources.

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Co-authored-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-28 17:15:16 +05:30
shuting
34c6920129
Support PSa integration by controlName only (#4710) 
* Remove "restrictedField" and "values" from podSecurity.exclude

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove commented code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add unit tests for restricted_runAsNonRoot

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add baseline unit tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add unit tests for restricted controls

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Removes PSa tests at the engine level

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - Update API docs; - Add unit tests for wildcard images

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove autogen conversion for PSa policies

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* copy pod with DeepCopy()

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-28 10:03:53 +00:00