mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-07 00:17:13 +00:00
Code Activity
8033 commits 17 branches 550 tags 289 MiB
Commit graph

3861 commits

Author SHA1 Message Date
Khaled Emara
de37a045be
feat(logger): replace zap with zerlog for perf (#10790) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-13 15:12:21 +00:00
Mariam Fahmy
25b7142ee0
feat: generate VAPs from exceptions (#10771) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-13 11:55:22 +00:00
Mariam Fahmy
3a69702b49
fix: check permissions for validate.cel subrules only (#10829) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2024-08-13 12:25:29 +03:00
Khaled Emara
bbb1d6103c
feat(mutate): don't eagerly process img-ver (#10703) 
* feat(mutate): don't eagerly process img-ver

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(mutate): add mutate with img-ver test

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-08-12 14:59:27 +00:00
Khaled Emara
65a43d2059
feat(mutate): minimize unmarshals (#10702) 
* feat(mutate): minimize unmarshals

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(mutate): test type assertion

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(codegen): remove unused import

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
 2024-08-09 11:12:20 +00:00
Mariam Fahmy
60a8384fd4
feat: add tests for different values of generateExisting (#10807) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-08 12:11:20 +00:00
Mariam Fahmy
c7122edfa8
feat: add tests for different values of mutateExistingOnPolicyUpdate (#10797) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-07 15:06:01 +00:00
Mariam Fahmy
53e0ccdc25
fix: pass resource names to auth check for mutateExisting policies (#10808) 2024-08-07 14:09:16 +00:00
Mariam Fahmy
4d1f040e49
fix: add the resource name to the SubjectAccessReview (#10221) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-08-07 12:46:44 +00:00
Mariam Fahmy
c796bb765c
fix: return policies with either audit or enforce rules from the cache (#10667) 
* fix: return policies with either audit or enforce rules from the cache

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: introduce validationFailureAction under verifyImage rules

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add chainsaw tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-08-06 18:24:28 +00:00
Frank Jogeleit
deab83d62f
reconcile only PolicyReports managed by kyverno (#10794) 
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-08-06 12:43:47 +00:00
Khaled Emara
c0cf6c5bf1
feat(json): unmarshal at decode time (#10700) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-05 15:46:50 +03:00
Frank Jogeleit
91ffbb6758
feat: assert rule autogen (#10780) 
* Support autogen for assert validation rules

Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>

* simplify assert autogen logic

Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>

* add chainsaw test

Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>

---------

Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
 2024-08-05 10:59:55 +00:00
Mariam Fahmy
ce7e570268
fix: set all operations by default in the generated VAP (#10100) 
* fix: set all operations by default in the generated VAP

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix chainsaw test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-02 14:12:42 +00:00
Mariam Fahmy
9d28116eb4
fix: allow exceptions to match Pod/ephemeralcontainers by default (#10778) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-08-02 12:47:09 +00:00
Charles-Edouard Brétéché
a1510d9db1
feat: add more policy validation around policies using kyverno-json (#10777) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-08-02 14:47:03 +03:00
Charles-Edouard Brétéché
fc694bc24c
feat: add kyverno json support to validation rule (#10763) 
* feat: add kyverno json support to validation rule

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* v2beta1

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* validation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* engine handler

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* bindings

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* context functions

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* better bindings

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-08-02 08:24:30 +00:00
Khaled Emara
d173752041
feat(json): unmarshal once per policy (#10701) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-07-30 10:52:41 +00:00
Khaled Emara
0aeb32df3b
feat(autogen): use static bytes instead of string (#10723) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-29 13:46:11 +00:00
Khaled Emara
c2646f7a9d
feat(json): reduce reliance on DocumentToUntyped() (#10724) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-29 11:57:20 +00:00
Ammar Yasser
f618717f75
fix: Check for the client being nil before applying a mutation (#10726) 
Signed-off-by: aerosouund <aerosound161@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-07-26 10:49:51 +00:00
Mariam Fahmy
716611b7ea
fix: return all the exceptions that match the incoming resource (#10722) 
* fix: return all the exceptions that match the incoming resource

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: modify log messages

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-25 17:36:19 +00:00
Korada Vishal
ca17cb2c6f
Improved test covergae for forceMutate (#10103) 
Signed-off-by: Vishal K <korada.vishal.phe22@itbhu.ac.in>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-24 10:43:07 +00:00
Mariam Fahmy
b0cef72df1
feat: support exclude block in generating VAPs (#10215) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-16 18:06:58 +03:00
Mariam Fahmy
35494bd8bb
feat add chainsaw tests for pod security and exceptions (#10664) 
* feat add chainsaw tests for pod security and exceptions

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: enable ProcMountType in the kind config

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-16 12:14:47 +00:00
Mariam Fahmy
5b715420a3
fix: truncate event messages to 1024 chars (#10636) 
* fix: truncate event messages to 1024 chars

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* add chainsaw test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2024-07-10 14:31:32 +00:00
Vishal Choudhary
9904718d08
fix: rename level 1 logs to INFO from DEBUG (#10617) 
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-07-10 12:31:19 +00:00
Anushka Mittal
429b05544a
fix: compute operations for mutatingwebhookconf (#10639) 
* fix: compute operations for mutatingwebhookconf

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* chore: add unit test

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

---------

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
Co-authored-by: anushkamittal20 <anumittal4641@gmail.com>
 2024-07-10 10:02:04 +00:00
Khaled Emara
aafc4fe97e
fix(json-ctx): overwrite element each iteration (#10615) 
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
 2024-07-05 15:06:48 +00:00
Mariam Fahmy
ad6ee93e3b
fix: CEL policies aren't applied to deleted resources (#10611) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-04 22:16:36 +05:30
Charles-Edouard Brétéché
1647675190
feat: improve api json parsing (#10600) 
* feat: improve api json parsing

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-04 16:05:42 +02:00
Khaled Emara
c2a9e9ef69
feat(events): normalize gctx events reason to be inline with other po… (#10395) 
* feat(events): normalize gctx events reason to be inline with other policies

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(events): hide queue limit messages at a higher level

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(gctx): add factory test

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-04 16:12:48 +03:00
Mariam Fahmy
a46f1eb48c
fix: failed to delete resource (#10582) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-07-02 19:54:27 +00:00
Mariam Fahmy
f738b027c3
fix: cleanup policy name is appended to logs (#10583) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-07-02 16:32:51 +00:00
Vishal Choudhary
d57edc8530
feat: fix notary tests (#10579) 
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
 2024-07-02 14:18:29 +00:00
Yukun Wang
8890fffafb
fix: include error message when policy context creation failed (#10566) 
* fix: include error message when policy context creation failed

Signed-off-by: airycanon <airycanon@airycanon.me>

* Update pkg/webhooks/resource/validation/validation.go

Co-authored-by: shuting <shuting@nirmata.com>
Signed-off-by: Yukun Wang <airycanon@airycanon.me>

---------

Signed-off-by: airycanon <airycanon@airycanon.me>
Signed-off-by: Yukun Wang <airycanon@airycanon.me>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-07-01 13:29:11 +00:00
Mariam Fahmy
68df5af40e
fix rule type for mutate and generate rules (#10554) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-28 16:40:56 +00:00
Husni Alhamdani
52ec560ffb
move mutate existing rule skipped log to v4 (#10560) 
Signed-off-by: Husni Alhamdani <dhanielluis@gmail.com>
 2024-06-28 12:08:46 +08:00
Charles-Edouard Brétéché
1a02b70a1c
feat: make any struct common to all api versions (#10553) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-27 10:09:57 +00:00
Charles-Edouard Brétéché
6f4818d724
feat: rework conditions marshaling (#10550) 
* feat: rework conditions marshaling

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* tests

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-27 10:00:02 +03:00
Charles-Edouard Brétéché
e900abf3a0
feat: remove kyverno client v2beta1 (#10543) 
* feat: remove kyverno client v2beta1

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix tests

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-26 08:48:32 +00:00
Mariam Fahmy
ff88c4c39a
feat: migrate validationFailureAction and validationFailureActionOverrides (#10528) 
* feat: migrate validationFailureAction and validationFailureActionOverrides under validate rule

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add unit tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-26 09:13:02 +02:00
shuting
88ae60ea9d
fix: correctly validate patterns for old and new objects (#10310) 
* fix: correctly validate patterns for old and new objects

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* test: add new scenario to the existing test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: indention

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: chainsaw tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-06-25 14:11:34 +00:00
Husni Alhamdani
cd6988d1e2
fix: reset mutable fields orphandownstream (#10478) 
* fix: reset mutable fields orphandownstream

Signed-off-by: Husni Alhamdani <dhanielluis@gmail.com>

* fix: reset mutable fields orphandownstream

Signed-off-by: Husni Alhamdani <dhanielluis@gmail.com>

* fix: reset mutable fields orphandownstream

Signed-off-by: Husni Alhamdani <dhanielluis@gmail.com>

---------

Signed-off-by: Husni Alhamdani <dhanielluis@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-06-25 09:24:35 +00:00
Charles-Edouard Brétéché
018d45cb29
feat: add reports circuit breaker (#10499) 
* feat: add reports circuit breaker

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* improve metrics and granularity

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-25 11:16:30 +08:00
Mariam Fahmy
94d9bbe73f
chore: use v2 clients for policy exceptions (#10530) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-24 16:36:55 +00:00
Mariam Fahmy
e892a0531e
chore: add tests that use spec.webhookConfiguration (#10526) 
* chore: add tests that use spec.webhookConfiguration

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix chainsaw tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-24 13:40:50 +00:00
Mariam Fahmy
b7bf894fe9
chore: use v2 for exceptions in chainsaw tests (#10529) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-24 11:54:57 +00:00
Mariam Fahmy
abe2a2310b
feat: migrate webhookTimeoutSeconds and failurePolicy (#10515) 
* feat: migrate webhookTimeoutSeconds and failurePolicy

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix lint issue

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-20 13:04:37 +00:00
Charles-Edouard Brétéché
b36a2ecdcc
feat: bump update request api version (#10508) 
* feat: bump update request api version

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* use v2

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-20 09:44:43 +00:00