Prateek Pandey
9def86c49a
refactor generate controller ( #3589 )
...
* refact generate controller
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* rename the dir to background
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-04-13 12:45:04 +00:00
Charles-Edouard Brétéché
06c2b2bb79
refactor: switch to admission v1 ( #3526 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-04-06 20:43:07 +00:00
Prateek Pandey
bdb675b9c0
feat: generate support for namespace policy ( #3472 )
...
* feat: generate support for namespace policy
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* use policy spec instead
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* refactor the changes
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* add synced flag for Namespace policies
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-03-29 13:04:33 +00:00
Charles-Edouard Brétéché
20069c13c3
feat: stop mutating rules ( #3410 )
...
* feat: stop adding autogen annotation
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: stop mutating rules
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: stop mutating rules
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: use toggle
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: review comments
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-03-28 22:01:27 +08:00
Charles-Edouard Brétéché
0c8e8c1212
feat: move GetRules() at the policy level ( #3420 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-03-18 15:18:32 +00:00
Charles-Edouard Brétéché
ce5f648f30
refactor: introduce rules getters and setters ( #3350 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
2022-03-09 15:28:31 +00:00
shuting
b6447e0649
Remove resourceCache from engine ( #3013 )
...
* update log messages
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* remove resourceCache from the background controller when:
- register resource scope
- list resources per namespace
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - use client call for configmap lookup;
- remove resourceCache from policy controller, webhook server and generate controller
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-18 12:59:35 +00:00
Jose Armesto
831a9826d1
Restructure project to follow standards ( #2632 )
...
Signed-off-by: Jose Armesto <github@armesto.net>
2021-10-29 18:13:20 +02:00
shuting
b10947b975
Dynamic webhooks ( #2425 )
...
* support k8s 1.22, update admissionregistration.k8s.io/v1beta1 to admissionregistration.k8s.io/v1
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - add failurePolicy to policy spec; - fix typo
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - add schema validation for failurePolicy; - add a printer column
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* set default failure policy to fail if not defined
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* resolve conflicts
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix missing type for printerColumn
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* refactor policy controller
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* add webhook config manager
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - build webhook objects per policy update; - add fail webhook to default webhook configurations
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix panic on policy update
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* build default webhook: match empty if autoUpdateWebhooks is enabled, otherwise match all
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - set default webhook configs rule to empty; - handle policy deletion
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* reset webhook config if policies with a specific failurePolicy are cleaned up
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* handle wildcard pocliy
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* update default webhook timeout to 10s
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* cleanups
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* added webhook informer to re-create it immediately if missing
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* update tag webhookTimeoutSeconds description
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix e2e tests
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix linter issue
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* correct metric endpoint
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* add pol.generate.kind to webhooks
Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-05 00:15:09 -07:00
Pooja Singh
c32002837d
supporting request object for generate policies ( #2455 )
...
* supporting request object for generate policies
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* updated naming for operation
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* run make kustomize-crd
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-10-01 11:39:29 -07:00
Jim Bugwadia
003c865ab9
deprecate policy status ( #2136 )
...
* deprecate policy status
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* remove policy status tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix generate metrics
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-14 12:18:59 -07:00
shuting
e9a972a362
feat: HA ( #1931 )
...
* Fix Dev setup
* webhook monitor - start webhook monitor in main process
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leaderelection
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* - add isLeader; - update to use configmap lock
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* - add initialization method - add methods to get attributes
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove newContext in runLeaderElection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to GenerateController
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* skip processing for non-leaders
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* skip processing for non-leaders
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add leader election to generate cleanup controller
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Gracefully drain request
* HA - Webhook Register / Webhook Monitor / Certificate Renewer (#1920 )
* enable leader election for webhook register
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* extract certManager to its own process
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* leader election for cert manager
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* certManager - init certs by the leader
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to webhook monitor
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update log message
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to policy controller
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to policy report controller
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* rebuild leader election config
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* start informers in leaderelection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* start policy informers in main
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* enable leader election in main
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* move eventHandler to the leader election start method
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address reviewdog comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add clusterrole leaderelection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fixed generate flow (#1936 )
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* - init separate kubeclient for leaderelection - fix webhook monitor
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address reviewdog comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* cleanup Kyverno managed resources on stopLeading
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* tag v1.4.0-beta1
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix cleanup process on Kyverno stops
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* bump kind to 0.11.0, k8s v1.21 (#1980 )
Co-authored-by: vyankatesh <vyankatesh@neualto.com>
Co-authored-by: vyankatesh <vyankateshkd@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Pooja Singh <36136335+NoSkillGirl@users.noreply.github.com>
2021-06-08 12:37:19 -07:00
Shuting Zhao
c3360b7389
make the number of generate workers configurable
...
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-22 19:14:06 -07:00
Pooja Singh
bcc19971eb
skip GRs for spec being same in old and updated policy ( #1723 )
...
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-03-19 15:33:52 -07:00
Pooja Singh
c148573d48
issue fixed ( #1558 )
...
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-02-08 10:36:39 -08:00
Pooja Singh
32522e7827
namespace selector ( #1532 )
...
* updated crd with namespace selector
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added logic for validate
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added condition in utils for namespace labels
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added function for extracting namespace label using lister
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added logic for generate
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added lister in generate
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* commented generate controller changes
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns lister
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label in apply.go
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label in generation.go
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label in mutation.go
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label for validation
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* using dynaminc informer
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-02-03 13:09:42 -08:00
shuting
c692263177
Refactor resourceCache; Reduce throttling requests (background controller) ( #1500 )
...
* skip sending API request for filtered resource
* fix PR comment
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fixes https://github.com/kyverno/kyverno/issues/1490
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix bug - namespace is not returned properly
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* reduce throttling - list resource using lister
* refactor resource cache
* fix test
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix label selector
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix build failure
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-01-29 17:38:23 -08:00
Jim Bugwadia
05da4190f8
handle discovery errors for metrics API group ( #1494 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-01-24 11:34:02 -08:00
NoSkillGirl
eef15dff89
changed synchronize label
2020-12-29 00:05:29 +05:30
NoSkillGirl
068ec5922f
changed label prefix
2020-12-24 12:28:32 +05:30
NoSkillGirl
53e2e38cd3
enqueing gr on getting deleted
2020-12-24 12:28:32 +05:30
shuting
2fc3b3b998
Fixes 1410 strategic merge patch ( #1414 )
...
* fixes #1410
* fix unit test
* re-initialize worker immediately on failure
2020-12-23 17:48:00 -08:00
shuting
d0347afa59
Fix invalid failure event for generate policy ( #1413 )
...
* reduce RCR throttling requests by merging policy application (policy - namespace) results into single RCR
* - refactor policy controller; - fix RCR issue
* - refactor RCR controller; - fix cpolr on ns update; - reduce throttling when getting resources; - fix tests
* update CRD schema
* fix typo
* fix invalid generate failure event
2020-12-22 11:07:31 -08:00
Jim Bugwadia
ad9f189144
merge main
2020-12-14 16:08:01 -08:00
Pooja Singh
bff7229678
1345 use GR lister ( #1387 )
...
* improved log message
* added lister for GR
* added label to GR
* added wait for cache is sync
2020-12-14 14:52:13 -08:00
Jim Bugwadia
b25a037113
fix generate clone/data check
2020-12-14 02:43:16 -08:00
shuting
630a9cc94c
Fix Kyverno crash when CRD is not installed ( #1353 )
...
* ignore Kyverno CRDs existence check when server is not available
* clean up cluster / reportChangeRequest
* resolve PR comments
2020-12-03 19:19:36 -08:00
shuting
2ec5a0fa42
1319 fix throttling ( #1348 )
...
* fix policy status and generate controller issues
* shorten ACTION column name
* update logs
* improve naming
* add temp logs for troubleshooting
* cleanup logs
* apply generate policy to old & new resource in webhook
* cleanup log messages
* cleanup log messages
* cleanup log messages
* fix clean up of policy report in init container
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2020-12-01 12:30:08 -08:00
Jim Bugwadia
2344b2c305
1319 fix throttling ( #1341 )
...
* fix policy status and generate controller issues
* shorten ACTION column name
* update logs
Co-authored-by: Shuting Zhao <shutting06@gmail.com>
2020-11-30 11:22:20 -08:00
