mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-10 01:46:55 +00:00
Code Activity
4818 commits 19 branches 550 tags 292 MiB
Commit graph

2764 commits

Author SHA1 Message Date
shuting
1d83e86c12
Add PSa policy validations (#4735) 
* Validate PSa control names

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add validation checks for the PSa rule

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-29 12:03:13 +08:00
Abhinav Sinha
a1182859ad
Added x509_decode JMESPath function (#4664) 
* Added `x509_decode` JMESPath function

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Use `crypto/x509` stdlib

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Return result as `map[string]interface{}`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Made minor fixes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Fixed error with unmarshalling decoded certificate

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Added e2e test for decoding X.509 certs

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Reverted to using `smallstep/zcrypto` for X.509

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Minor fix

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Addressed reviews

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Removed redundant dependency on `pkg/errors`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-09-28 18:15:39 +00:00
Prateek Pandey
38c252952d
feat: add matchlabel selector support with multiple clone (#4713) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-28 17:44:38 +02:00
Charles-Edouard Brétéché
e0ab72bb9a
feat: reports v2 implementation (#4608) 
This PR refactors the reports generation code.
It removes RCR and CRCR crds and replaces them with AdmissionReport, ClusterAdmissionReport, BackgroundScanReport and ClusterBackgroundScanReport crds.

The new reports system is based on 4 controllers:

Admission reports controller is responsible for cleaning up admission reports and attaching admission reports to their corresponding resource in case of a creation
Background scan reports controller is responsible for creating background scan reports when a resource and/or policy changes
Aggregation controller takes care of aggregation per resource reports into higher level reports (per namespace)
Resources controller is responsible for watching reports that need background scan reports
I added two new flags to disable admission reports and/or background scan reports, the whole reporting system can be disabled if something goes wrong.

I also added a flag to split reports in chunks to avoid creating too large resources.

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Co-authored-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-28 17:15:16 +05:30
shuting
34c6920129
Support PSa integration by controlName only (#4710) 
* Remove "restrictedField" and "values" from podSecurity.exclude

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove commented code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add unit tests for restricted_runAsNonRoot

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add baseline unit tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add unit tests for restricted controls

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Removes PSa tests at the engine level

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - Update API docs; - Add unit tests for wildcard images

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove autogen conversion for PSa policies

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* copy pod with DeepCopy()

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-28 10:03:53 +00:00
Charles-Edouard Brétéché
56c74272bb
chore: update client code generator (#4711) 
* chore: update client code generator

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix inconsistency on my mac

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-28 09:31:06 +00:00
Charles-Edouard Brétéché
073ff38cc9
fix: change key used in test (#4718) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-27 17:18:14 +00:00
Charles-Edouard Brétéché
160259d954
fix: missing client wrapper (#4703) 
* fix: missing client wrapper

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* v1beta1

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* v1alpha2

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* policy report

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-26 16:54:29 +00:00
Charles-Edouard Brétéché
481a09823f
refactor: use pod name as leader id (#4680) 
* refactor: use pod name as leader id

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix manifests

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* makefile

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* leader client

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-26 16:25:27 +00:00
Charles-Edouard Brétéché
665e513c5e
fix: split webhook handlers per failure policy (#4650) 
* fix: split webhook handlers per failure policy

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix handlers

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* rolling update

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* better error message

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-09-26 15:55:46 +00:00
Charles-Edouard Brétéché
8741c34081
fix: shutdown controllers workers gracefully (#4681) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-09-26 15:24:57 +00:00
Pradeep Lakshmi Narasimha
e305aea95c
fix: namespaced policy targets namespace validation and scoping them to the policy's namespace (#4671) 
Signed-off-by: praddy26 <pradeep.vaishnav4@gmail.com>

Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-26 14:54:13 +00:00
Charles-Edouard Brétéché
79bff1c19c
refactor: replace signal package by signal.NotifyContext (#4691) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-09-26 14:24:32 +00:00
Charles-Edouard Brétéché
6a8085522a
fix: jmespath random error handling (#4697) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-26 13:33:52 +00:00
Prateek Pandey
9cc1e6b2b3
fix: handle auth permission for cloneList validation (#4684) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-09-26 13:23:00 +05:30
Charles-Edouard Brétéché
4d7e1281de
fix: namespaced policy not validated in engine (#4653) 
* fix: namespaced policy not validated in engine

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix test

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-26 12:47:37 +08:00
Vyankatesh Kudtarkar
23269b7f5c
Fix issue for wildcard versions (#4670) 
* Fix wildcard issue

Co-Authored-By: vyankd <51167361+vyankd@users.noreply.github.com>

* Delete res.yaml

Co-Authored-By: vyankd <51167361+vyankd@users.noreply.github.com>

Co-authored-by: vyankd <51167361+vyankd@users.noreply.github.com>
 2022-09-23 22:04:39 +08:00
Sandesh More
01b1ece704
added kubeconfig and context flag to kyverno apply (#4524) 
Signed-off-by: Sandesh More <sandesh.more@infracloud.io>
 2022-09-20 19:05:18 +05:30
Charles-Edouard Brétéché
328fdc8b3d
feat: add feature flag to disable background scan (#4638) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-19 12:00:36 +00:00
Charles-Edouard Brétéché
6eea7c45f7
feat: add explicit key support to controller utils (#4628) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 11:25:03 +00:00
Prateek Pandey
71404df826
refactor: update log based on the policy types (#4646) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 10:56:55 +00:00
Charles-Edouard Brétéché
42a2df56c1
refactor: add a couple of constants in api (#4640) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 09:11:12 +00:00
Charles-Edouard Brétéché
b9baae9746
fix: incorrect namespace in report controller (#4637) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-19 07:33:34 +00:00
Charles-Edouard Brétéché
316640c72b
fix: remove RCR from mutation webhook (#4636) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-19 09:04:50 +02:00
Charles-Edouard Brétéché
d256735399
feat: add controller utils tools (#4639) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-18 10:12:29 +01:00
Anurag
cadf577e4b
enhance jmespath random-filter (#4591) 
Signed-off-by: Anurag <contact.anurag7@gmail.com>

Signed-off-by: Anurag <contact.anurag7@gmail.com>
 2022-09-14 06:27:32 +00:00
Charles-Edouard Brétéché
e516fb868e
fix: lock in policy report mapper (#4601) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-13 16:30:14 +08:00
Charles-Edouard Brétéché
da5312c177
refactor: simplify RCR creator queue (#4578) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-12 14:48:27 +00:00
Charles-Edouard Brétéché
7c74e40b86
refactor: info in policyreport package (#4598) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-09-12 09:00:56 +00:00
Vyankatesh Kudtarkar
c7bcd5fadf
Fix multiple crd slowness issue (#4275) 
Signed-off-by: Vyankatesh vyankateshkd@gmail.com

* fix multiple crd issue
 2022-09-12 16:14:28 +08:00
Jim Bugwadia
ed6d9b9624
enable autogen for validate.podsecurity with no exclude (#4594) 
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-09-12 12:33:35 +05:30
Charles-Edouard Brétéché
bc4bf5ee27
chore: switch to github.com/IGLOU-EU/go-wildcard (#4563) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-09-10 17:30:13 +00:00
Jim Bugwadia
c2b4a9434b
allow PSa validation with no exceptions (#4558) 
Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-10 16:58:10 +00:00
Charles-Edouard Brétéché
6a0fff7c9f
fix: split policy report flag (#4576) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-09-10 15:29:48 +00:00
Charles-Edouard Brétéché
f4fe017ede
chore: add toggle package unit tests (#4577) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-10 13:00:20 +00:00
Charles-Edouard Brétéché
d558c12470
refactor: move generation handler out of webhooks package (#4570) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 19:49:38 +05:30
Charles-Edouard Brétéché
10638362dc
refactor: move image verification handler out of webhooks package (#4569) 
* refactor: move mutation handler out of webhooks package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: move image verification handler out of webhooks package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 15:05:57 +02:00
Charles-Edouard Brétéché
20b8697ad8
refactor: move mutation handler out of webhooks package (#4567) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 12:48:29 +02:00
Charles-Edouard Brétéché
3e5af370a5
refactor: move validation audit out of webhooks package (#4562) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 09:27:07 +00:00
Charles-Edouard Brétéché
e900815dc0
refactor: move validation handler out of webhooks package (#4556) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 07:52:38 +00:00
Charles-Edouard Brétéché
3e5645dd32
refactor: make webhook metrics helpers static (#4554) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-09 07:11:16 +03:00
Charles-Edouard Brétéché
16c2d880c8
refactor: move webhook events utils in utils package (#4545) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-08 18:10:27 +02:00
Charles-Edouard Brétéché
3b556abe63
chore: add unit test for updating ur status (#4541) 
* fix: defer ur update until validation passes

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* chore: add unit test for updating ur status

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-08 21:59:51 +08:00
Charles-Edouard Brétéché
8fb0a9e8c7
fix: defer ur update until validation passes (#4540) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-08 12:53:08 +00:00
Charles-Edouard Brétéché
ed31fb0326
refactor: introduce ur updater (#4535) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-08 20:07:18 +08:00
Vyankatesh Kudtarkar
aa6abd99f2
Support V2beta1 Version (#4514) 
introduce new version V2beta1 which remove deprecated CRD 
types from version v1.

Signed-off-by: Vyankatesh <vyankateshkd@gmail.com>
 2022-09-08 11:19:16 +00:00
Charles-Edouard Brétéché
f0fa50b27e
refactor: webhook block and unit tests (#4531) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-08 08:36:31 +00:00
Charles-Edouard Brétéché
f791717aad
refactor: webhook propagate start time along handlers (#4529) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-08 07:34:55 +00:00
Charles-Edouard Brétéché
8e33532b38
refactor: webhook exclusion and unit tests (#4528) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-09-08 06:19:18 +00:00
Prateek Pandey
1cacd0173d
feat: allow cloning multiple resource from a namespace (#4384) 2022-09-08 04:47:09 +00:00