1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-05 15:37:19 +00:00
Commit graph

44 commits

Author SHA1 Message Date
Sandesh More
fa178ebd82
added apiCalls support in kyverno-apply command (#4938)
Signed-off-by: Sandesh More <sandesh.more@infracloud.io>

Signed-off-by: Sandesh More <sandesh.more@infracloud.io>
2022-10-19 16:39:15 +00:00
Charles-Edouard Brétéché
1e25bfd16f
feat: remove context api call constraints (#4389)
* feat: add raw api call support

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* feat: remove context api call constraints

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-01 08:30:04 +00:00
shuting
3bf3dcc1af
Add the metric "kyverno_client_queries_total" (#4359)
* Add metric "kyverno_kube_client_queries_total"

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* publish metric for missing queries

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Refactor the way Kyverno registers QPS metric

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Move clientsets to a dedicated folder

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Wrap Kyverno client and policyreport client to register client query metric

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address linter comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address linter comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Switch to use wrapper clients

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-08-31 11:33:47 +05:30
Charles-Edouard Brétéché
5cc97993dc
feat: add raw api call support (#3820)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-23 18:52:54 +02:00
vivek kumar sahu
c95bb74992
Context vars substitution in CLI (#4290)
* context variables substitution will be independent of sequence

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* Added test cases

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-08-09 05:48:57 +00:00
Anton Popovichenko
afc9a56d33
Feature: Add support for allowing insecure registries. (#3983)
Now you can work with self signed registries by updating your deployment with adding `--allowInsecureRegistry` to the `args` field.

Signed-off-by: Anton Popovichenko <anton.popovichenko@mendix.com>

Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-25 11:03:36 +02:00
Charles-Edouard Brétéché
1afda6a137
refactor: make registry client variables private (#3975)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-23 18:45:25 +05:30
Charles-Edouard Brétéché
5aaf2d8770
chore: make kyverno api import aliases consistent (#3939)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 13:12:43 +02:00
Charles-Edouard Brétéché
97e5e64fd4
chore: enable whitespace linter (#3864)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-10 17:01:29 +00:00
Jim Bugwadia
bc07943c81
handle subresources (#3841)
* handle subresources

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix logger name

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix webhook and logs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-09 18:50:50 -07:00
Sambhav Kothari
876a216b5f
Improve logging and error handling in json context (#3825) 2022-05-07 11:32:48 +00:00
Sambhav Kothari
6e48fdf4ce
Fix issue with image registry when decoding OCI descriptors with out of spec keys (#3799) 2022-05-04 13:38:56 -04:00
Charles-Edouard Brétéché
f70ef051dc
refactor: move ImageExtractorConfigs in api package (#3781) 2022-05-03 08:45:08 +00:00
Jim Bugwadia
3cb620499e
Remove YAML multiline support in CM values (#3721)
* remove YAML multiline support in CM values

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove unused code

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: shuting <shuting@nirmata.com>
2022-05-02 08:57:35 +01:00
Vyankatesh Kudtarkar
56c90fd087
Support context variables when using foreach CLI (#3637)
* Support context variables when using foreach CLI

* add testcases
2022-04-25 16:36:31 +00:00
Sambhav Kothari
44b5bf0b57
Allow definition of inline variables in context (#3658)
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
2022-04-25 19:06:07 +08:00
Naman Lakhwani
9f3fc941ef
[imageVerify]: adding digestMutate to simplify tag-to-digest mutation (#3531)
* added digestMutate

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* rebase

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* setting always to true

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* small nit

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* make codegen

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* crds & failing rule if mutation fails

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* adding new func to fetch digest and changing naming to mutateDigest

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* small nits

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* generating crds

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* minor nit

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* correcting error format
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-04-22 01:08:49 -07:00
Mritunjay Kumar Sharma
b815caef5d
refactor cli code from pkg to cmd (#3591)
* refactor cli code from pkg to cmd

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes in imports

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes tests

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixed conflicts

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* moved non-commands to utils

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-04-14 12:20:18 +00:00
Charles-Edouard Brétéché
3d554ce53b
refactor: engine context (#3563)
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-04-09 11:52:50 +00:00
Charles-Edouard Brétéché
83343697b9
refactor: make use of policy interface (#3499)
- refactor: make use of policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-03-30 18:34:30 +05:30
Sambhav Kothari
6498425937
Add a registry flag to allow direct access to container registries in the CLI (#3396)
* Add a registry flag to allow direct access to container registries in the CLI

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-03-16 09:56:47 +05:30
Sambhav Kothari
2eb8f5f285
Fix memory leak when updating ggcr keychain (#3088)
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-26 12:45:05 -08:00
shuting
b6447e0649
Remove resourceCache from engine (#3013)
* update log messages

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove resourceCache from the background controller when:
- register resource scope
- list resources per namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - use client call for configmap lookup;
- remove resourceCache from policy controller, webhook server and generate controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-18 12:59:35 +00:00
Sambhav Kothari
1af9e48b0d
Add image data to validate image configs (#2946)
* Add image data to validate image configs

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add tests for image context

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add e2e test cases for image size policy

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-17 04:06:44 +00:00
Jose Armesto
831a9826d1
Restructure project to follow standards (#2632)
Signed-off-by: Jose Armesto <github@armesto.net>
2021-10-29 18:13:20 +02:00
Sunghoon Kang
e401d57b35
Check client if nil before loading resource list (#2562)
Unlike loading resource, current implementation doesn't check if
client is nil or not when loading resource list.

This commit checks if client is nil or not before loading resource
list.

Signed-off-by: Sunghoon Kang <hoon@linecorp.com>
2021-10-26 17:30:19 -07:00
Jim Bugwadia
836d88191d make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-26 10:49:51 -07:00
Jim Bugwadia
ef9e9ec9ac add variable substitutoion for imageVerify and allow PEM in ConfigMaps
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-26 10:41:27 -07:00
Kumar Mallikarjuna
f6933bb439
Block scalars for value files (#2380)
* Block scalars for value files

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Handle non-block values

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Unit tests for block scalars

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
2021-09-13 16:33:30 +05:30
Max Goncharenko
0fdd349849
Changed error to info for NotFoundError in jsonContext (#2140)
* changed error to info for NotFoundError in jsonContext

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>

* raise log level for NotFoundError in jsonContext

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>
2021-07-14 14:50:28 -07:00
Trey Dockendorf
beabeddb81 Fix reviewdog failure
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
2021-05-04 11:14:07 -04:00
Trey Dockendorf
d7886bddc9 Fix tests with variables to use Mock store
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
2021-05-03 19:54:19 -04:00
Pooja Singh
1e4c950104
Feature/1515 - handle configmap and api variable cli (#1789)
* added store package

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* added changes to handle api and configmap variables in cli

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* removed comments

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* refactoring code

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* added test case for mutation

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* added test case for validation

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* code improvement

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-04-29 10:09:44 -07:00
Max Goncharenko
6a0305674a
JMESPath custom functions (#1772)
* JMESPath: Support regex expressions

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* JMESPath: Add string functions

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* Removed {{$}} variable handling logic

Signed-off-by: Max Goncharenko <kacejot@fex.net>

* Name all functions in snake case; Update error message; Fix {{@}} behavior

Signed-off-by: Max Goncharenko <kacejot@fex.net>
2021-04-16 16:17:00 -07:00
Shuting Zhao
cab81eadda operate on the copy of configmap data
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-31 15:22:25 -07:00
Jim Bugwadia
6dff9e0ab9 merge and resolve conflicts
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-03-25 16:43:12 -07:00
Shuting Zhao
d650d2b609 fixes variable substitution in context.apiCall.jmesPath
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-22 12:15:29 -07:00
Max Goncharenko
24c4f06ecd Fix #1506; Resolve path reference in entire rule instead of just pattern/overlay
Signed-off-by: Max Goncharenko <kacejot@fex.net>
2021-03-16 13:45:40 +02:00
Jim Bugwadia
bb361df696
Merge pull request #1597 from yashvardhan-kukreja/issue-1242/multiline-yaml-string-support
feat: added functionality for delimiting multi-line block by newline characters
2021-03-10 09:58:38 -08:00
Yashvardhan Kukreja
ca347b27bf
feat: added functionality for delimiting multi-line block by newline characters
Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>
2021-03-01 00:46:50 +05:30
Shuting Zhao
17c72c1578 substitute variables in context.configMap
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-02-22 16:27:20 -08:00
shuting
267be0815f
Bug fixes - policy validation, auto-generated rules, apiCall support in mutate and generate (#1629)
* Fix invalid policy reports generated for blocked resource

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix 1464 - copy context and preconditions to auto-gen rules

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix 1628 - add policy validations

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix 1593 - support apiCall in mutate and generate

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix test

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-02-22 12:08:26 -08:00
Jim Bugwadia
2bb812aa2d redo changes reverted by merge
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-02-01 23:22:19 -08:00
Jim Bugwadia
e8e3b93a5f
api server lookups (#1514)
* initial commit for api server lookups

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* initial commit for API server lookups

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* Enhancing dockerfiles (multi-stage) of kyverno components and adding non-root user to the docker images (#1495)

* Dockerfile refactored

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>

* Adding non-root commands to docker images and enhanced the dockerfiles

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>

* changing base image to scratch

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>

* Minor typo fix

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>

* changing dockerfiles to use /etc/passwd to use non-root user'

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>

* minor typo

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>

* minor typo

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* revert cli image name (#1507)

Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* Refactor resourceCache; Reduce throttling requests (background controller) (#1500)

* skip sending API request for filtered resource

* fix PR comment

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fixes https://github.com/kyverno/kyverno/issues/1490

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix bug - namespace is not returned properly

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* reduce throttling - list resource using lister

* refactor resource cache

* fix test

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix label selector

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix build failure

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix merge issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix unit test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add nil check for API client

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Raj Babu Das <mail.rajdas@gmail.com>
Co-authored-by: shuting <shutting06@gmail.com>
2021-02-01 12:59:13 -08:00