shuting
5e07ecc5f3
Add Policy Report ( #1229 )
...
* add report in cli
* policy report crd added
* policy report added
* configmap added
* added jobs
* added jobs
* bug fixed
* added logic for cli
* common function added
* sub command added for policy report
* subcommand added for report
* common package changed
* configmap added
* added logic for kyverno cli
* added logic for jobs
* added logic for jobs
* added logic for jobs
* added logic for cli
* buf fix
* cli changes
* count bug fix
* docs added for command
* go fmt
* refactor codebase
* remove policy controller for policyreport
* policy report removed
* bug fixes
* bug fixes
* added job trigger if needed
* job deletation logic added
* build failed fix
* fixed e2e test
* remove hard coded variables
* packages adde
* improvment added in jobs sheduler
* policy report yaml added
* cronjob added
* small fixes
* remove background sync
* documentation added for report command
* remove extra log
* small improvement
* tested policy report
* revert hardcoded changes
* changes for demo
* demo changes
* resource aggrigation added
* More changes
* More changes
* - resolve PR comments; - refactor jobs controller
* set rbac for jobs
* add clean up in job controller
* add short names
* remove application scope for policyreport
* move job controller to policyreport
* add report logic in command apply
* - update policy report types; - upgrade k8s library; - update code gen
* temporarily comment out code to pass CI build
* generate / update policyreport to cluster
* add unit test for CLI report
* add test for apply - generate policy report
* fix unit test
* - remove job controller; - remove in-memory configmap; - clean up kustomize manifest
* remove dependency
* add reportRequest / clusterReportRequest
* clean up policy report
* generate report request
* update crd clusterReportRequest
* - update json tag of report summary; - update definition manifests; - fix dclient creation
* aggregate reportRequest into policy report
* fix unit tests
* - update report summary to optional; - generate clusterPolicyReport; - remove reportRequests after merged to report
* remove
* generate reportRequest in kyverno namespace
* update resource filter in helm chart
* - rename reportRequest to reportChangeRequest; -rename clusterReportRequest to clusterReportChangeRequest
* generate policy report in background scan
* skip generating report change request if there's entry results
* fix results entry removal when policy / rule gets deleted
* rename apiversion from policy.kubernetes.io to policy.k8s.io
* update summary.* to lower case
* move reportChangeRequest to kyverno.io/v1alpha1
* remove policy report flag
* fix report update
* clean up policy violation CRD
* remove violation CRD from manifest
* clean up policy violation code - remove pvGenerator
* change severity fields to lower case
* update import library
* set report category
Co-authored-by: Yuvraj <yuvraj.yad001@gmail.com>
Co-authored-by: Yuvraj <10830562+evalsocket@users.noreply.github.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2020-11-09 11:26:12 -08:00
Jim Bugwadia
1f24ea6f75
fix regex for allowed variable to support spaces ( #1200 )
...
* fix regex for allowed variable to support spaces
* remove log
* fix regex
2020-10-19 12:36:55 -07:00
Jim Bugwadia
ae0c09a05c
remove ContextEntry.path (prototype for API server lookup)
2020-10-14 18:48:23 -07:00
Jim Bugwadia
7f5c19332a
update name
2020-10-14 18:30:18 -07:00
Jim Bugwadia
4ea1126fce
remove docs and update README.md
2020-10-14 17:39:45 -07:00
Shuting Zhao
cdc5190c56
update nirmata/kyverno to kyverno/kyverno
2020-10-07 11:12:31 -07:00
Pooja Singh
7fc0eaaee3
added condition for exclude selector ( #1169 )
...
* added exclude selector condition
* small fix
2020-10-06 14:27:40 -07:00
Mohan B E
51ac382c6c
Feature/configmaps var 724 ( #1118 )
...
* added configmap data substitution for foreground mutate and validate
* added configmap data substitution for foreground mutate and validate fmt
* added configmap lookup for background
* added comments to resource cache
* added configmap data lookup in preConditions
* added parse strings in In operator and configmap lookup docs
* added configmap lookup docs
* modified configmap lookup docs
2020-09-22 14:11:49 -07:00
Mohan B E
a1081c8f82
fixed policy validationa and patch strategic merge bug ( #1136 )
2020-09-18 12:18:13 -07:00
Yuvraj
b7524467a3
Reconcile Generate request on policy update ( #1096 )
...
* policy report crd added
* added namespaced rule
* remove extra field from crd
* revert crd change
* remove policy report chnages
* remove policy report chnages
* remove policy report chnages
* remove policy report chnages
* added logic for gr
* revert changes
* fixed generate rules
* fixed generate rules
* fixed generate rules
* fixed generate rules
* remove extra logs
* remove extra logs
* fixed e2e test
* remove extra logs
* crd issue resolved
* added check for sync
* add labels update
* add label update
* added permission to role
* roles added to helm
* roles added to helm
2020-09-03 14:34:23 -07:00
Mohan B E
118b40c644
added invalid field validation for policy ( #1094 )
2020-09-03 22:14:54 +05:30
Mohan B E
3690bf5fff
conditional anchor preprocessing for patch strategic merge ( #1090 )
...
* conditional anchor preprocessing for patch strategic merge
* modified sequence pre processing and added unit test
* merged master
* go fmt
* corrected mistake and added error handling to policy validate
2020-09-01 09:12:05 -07:00
shuting
e0f617b383
810 support cronJob for auto-gen ( #1089 )
...
* add watch policy to clusterrole kyverno:customresources
* - improve auto-gen policy application logic - remove unused code
* move method to common util
* auto-gen rule for cronJob
* update doc
* set CronJob as default auto-gen pod controller
* - update doc; - fix test
* remove unused code
2020-09-01 09:11:20 -07:00
Mohan B E
a827f88dc7
resolved conditional anchor issue and added validation to pattern labels ( #1060 )
...
* resolved conditional anchor issue and added validation to pattern labels
* restored IsConditionAnchor
* added annotation and anypattern validation
* added conditional anchor key checker
* reverted docs
* fixed tests
* modified validation
* modified validate condition check
2020-08-28 18:22:22 -07:00
Pooja Singh
8105e4cad8
Allowing only few variables in the policies ( #1063 )
...
* Checking for non whitelisted variables in the policy
* method name change
* small issue while rebasing
2020-08-23 15:11:03 -07:00
Pooja Singh
2717a03ab2
Not checking for cluster resources for CLI in policy validate ( #1076 )
2020-08-21 23:07:54 +05:30
Mohan B E
f60deecdce
Feature/namespaced policy 280 ( #1058 )
...
* namespaced policy crd and cache
* modified main.go
* removed kyverno
* implemented policy violation generator for namespaced policy on audit
* modified cache
* added validation for cluster resource types
* install.yaml
* install.yaml
* removed namespaces from crd and refactored code
* modified NamespacePolicy to Policy
* added ClusterRole aggregate for policies
* modified clusterrole
2020-08-19 09:07:23 -07:00
shuting
d6062fdd47
Add go fmt ( #1055 )
...
* remove empty flag
* format code
* revert change in install.yaml
2020-08-14 12:21:06 -07:00
Yuvraj
73840e3c5f
configrable rules added ( #1017 )
...
* configrable rules added
* fix exclude group logic from code
* flag added in yaml
* exclude username added
* exclude username added
* config interface implimented
* configure exclude username
* get role ref
* test case fixed
* panic fix
* move from interface to slice
* exclude added in mutate
* trim strings
* configmap changes added
* kustomize changes for configmap
* k8s resources added
2020-08-07 17:09:24 -07:00
Mohan B E
a14828246d
Feature/api version 852 ( #1028 )
...
* apiVersion support for generate
* added apiVersion to crds
2020-08-07 09:47:33 +05:30
shuting
75a7543c6d
Events fix ( #1006 )
...
* remove success event
* remove event success message
* remove events generated on clusterpolicy
2020-07-20 20:30:02 +05:30
shuting
87fa77fbcc
965 add validate audit handler ( #967 )
...
* store policy names cache to reduce lookup time
* add validate audit handler
* fix #958 , remove auto-gen annotation on Pod
* formatting code
* update processTime to readable format
* #586 , add back unit test
* update logging info
* remove unused interface
* handle generate policy in a single thread in weboook
* resolve pr comments
2020-07-09 11:48:34 -07:00
Jim Bugwadia
05250c2870
replace deletion timestamp check ( #961 )
2020-06-30 23:30:31 -07:00
Jim Bugwadia
65193feccb
update logging, naming, and event retry ( #959 )
...
* update logging and naming
* check per policy patch count
2020-06-30 11:53:27 -07:00
shuting
7ffeb6efca
skip generate violation on pre-exist pod ( #952 )
2020-06-25 09:52:54 -07:00
shuting
06a2b246dd
Background mode only apply to running pods ( #949 )
...
* background mode process Running pod only
* update debug doc
2020-06-25 09:52:27 -07:00
shuting
b3a1e51a84
bug fix auto-gen annotation reported as violation ( #902 )
...
* fix auto-gen annotation reported as violation
* update log
2020-06-03 17:47:06 -07:00
Jim Bugwadia
5cdcbec3c9
Bugfix/1.1.6 adjust resync and cleanup unused ( #884 )
...
* - support wildcards for namespaces
* do not annotate resource, unless policy is an autogen policy
* close HTTP body
* improve messages
* remove policy store
Policy store was not fully implemented and simply provided a way
to list all polices and get a policy by name, which can be done via
standard client-go interfaces.
We need to revisit and design a better PolicyStore that provides fast
lookups for matching policies based on names, namespaces, etc.
* handle wildcard namespaces in background processing
* fix unit tests 1) remove platform dependent path usage 2) remove policy store
* add test case for mutate with wildcard namespaces
* adjust all resync periods
* remove unused data fields
* add pattern for match
2020-05-27 19:51:34 -07:00
Shuting Zhao
087f183895
fix typo
2020-05-26 23:07:48 -07:00
Shuting Zhao
139000fe3f
fix namespace lister
2020-05-26 22:26:07 -07:00
Shuting Zhao
7ea2930fa4
- fix violations re-create on the same resource - skip background processing if a resource is to be deleted
2020-05-26 16:25:11 -07:00
Jim Bugwadia
838d02c475
Bugfix/659 support wildcards for namespaces ( #871 )
...
* - support wildcards for namespaces
* do not annotate resource, unless policy is an autogen policy
* close HTTP body
* improve messages
* remove policy store
Policy store was not fully implemented and simply provided a way
to list all polices and get a policy by name, which can be done via
standard client-go interfaces.
We need to revisit and design a better PolicyStore that provides fast
lookups for matching policies based on names, namespaces, etc.
* handle wildcard namespaces in background processing
* fix unit tests 1) remove platform dependent path usage 2) remove policy store
* add test case for mutate with wildcard namespaces
2020-05-26 10:36:56 -07:00
Shuting Zhao
bc981f9a11
fix 869
2020-05-20 13:42:23 -07:00
Shuting Zhao
0670abe2d2
set log level
2020-05-18 21:16:48 -07:00
Shuting Zhao
416f5ecc00
Merge branch 'master' into 744_deny_requests
...
# Conflicts:
# pkg/utils/util.go
# pkg/webhooks/server.go
2020-05-18 18:05:22 -07:00
Shuting Zhao
ad4f06f22d
Merge branch 'master' into 744_deny_requests
...
# Conflicts:
# pkg/webhooks/mutation.go
# pkg/webhooks/server.go
# pkg/webhooks/validation.go
2020-05-18 12:32:42 -07:00
Shuting Zhao
f97c202d52
extract controller resync period to a constant file
2020-05-18 11:56:17 -07:00
Shuting Zhao
b9d38d2fd3
fix error "failed to list resources"
2020-05-18 11:56:17 -07:00
Jim Bugwadia
8c4c98d1a4
Merge pull request #855 from nirmata/bugfix/fixes_791_792_832
...
Bugfix/fixes 791 792 832
2020-05-17 19:30:11 -07:00
Yuvraj
0635df7b11
Bug - annotation inserted to podTemplate by auto-gen should reflect the policy name ( #850 )
...
* Added check for annotation inserted to podTemplate by auto-gen
* skip reporting violation on pod which has annotation pod-policies.kyverno.io/autogen-applied
* Revert Changes
* typo fixed
* Update condition for skiping the pods
2020-05-17 18:51:56 -07:00
Jim Bugwadia
993bad7b65
improve comments
2020-05-17 09:54:32 -07:00
Jim Bugwadia
bf1aaba99b
allow cross platform builds
2020-05-17 09:51:46 -07:00
Jim Bugwadia
bc37d27de6
remove unnecessary comments and reduce cache resync intervals
2020-05-17 09:51:18 -07:00
shravan
3a146a5952
744 added not found error type
2020-05-13 10:06:21 +05:30
shravan
09310d19e1
744 fixing policy validation
2020-05-06 22:27:06 +05:30
shravan
6b1498b770
744 fixing policy validation and removing allRequests field
2020-05-06 19:46:32 +05:30
shravan
1b2868620e
744 fixing tests and making sure policy with variables that are not request.object are not allowed in background mode
2020-05-06 00:29:40 +05:30
shravan
f8f27cea18
744 fixing policy validation
2020-04-27 22:01:33 +05:30
shravan
0a34357921
744 improving error message
2020-04-27 16:02:02 +05:30
shravan
f839f27b41
Merge branch 'master' into 744_deny_requests
2020-04-27 15:12:35 +05:30
