mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-15 17:51:20 +00:00
Code Activity
4155 commits 15 branches 540 tags 276 MiB
Commit graph

2379 commits

Author SHA1 Message Date
Naman Lakhwani
9f3fc941ef
[imageVerify]: adding digestMutate to simplify tag-to-digest mutation (#3531) 
* added digestMutate

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* rebase

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* setting always to true

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* small nit

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* make codegen

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* crds & failing rule if mutation fails

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* adding new func to fetch digest and changing naming to mutateDigest

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* small nits

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* generating crds

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* minor nit

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* correcting error format
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-04-22 01:08:49 -07:00
Jim Bugwadia
9fde4fd6a1
Multiple keys (#3636) 
* fix autogen check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* allow multiple keys and fix root/intermediate certs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make issuer/subject optional

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* enable CTLog options

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix split

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* rename CTLog -> Rekor

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* api/kyverno/v1/image_verification_test.go

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-04-22 07:10:02 +00:00
Ioannis Bouloumpasis
78a6f20572
fix: do not remove webhooks during initialization (#3641) 
* Do not remove webhooks during initialization

During initialization the Kyverno leader Pod deletes all the
existing webhooks and recreates them. There is a small time window were
the cluster is not protected by the webhooks, allowing a user to apply
resources without any verfication.
This commit updates the leader registration logic to not remove and
recreate the webhooks but, in the case that the webhooks already exist,
update them.

Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>

* Fix linter errors

Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>

* Use the Lister to get webhook configurations

Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
 2022-04-22 14:50:29 +08:00
Prateek Pandey
5054148fec
refactor: use the typed ns informer in GR controller (#3554) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-04-21 14:12:34 +08:00
Charles-Edouard Brétéché
2e1a87d149
refactor: image utils (#3630) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-20 15:01:02 +00:00
Prateek Pandey
11a4884524
refact: remove unused Run function from generate (#3638) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-04-20 22:03:25 +08:00
Vyankatesh Kudtarkar
c74f5b5680
Fix race condition in pCache (#3632) 
* fix race condition in pCache
 2022-04-20 15:30:20 +05:30
Jim Bugwadia
3b1a1acd9a
Image verify attestors (#3614) 
* fix logs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix logs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* support multiple attestors

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* rm CLI tests (not currently supported)

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* apply attestor repo

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix linter issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix entryError assignment

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add intermediary certs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-04-19 08:35:12 -07:00
Sambhav Kothari
ec4e4ba452
Add support for custom image extractors (#3596) 
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-04-14 09:08:30 -07:00
Anushka Mittal
1714a328b6
add-kms-libraries for cosign (#3603) 
* add-kms-libraries

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* Shifted providers to cosign package

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
 2022-04-14 15:24:34 +00:00
Mritunjay Kumar Sharma
b815caef5d
refactor cli code from pkg to cmd (#3591) 
* refactor cli code from pkg to cmd

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes in imports

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes tests

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixed conflicts

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* moved non-commands to utils

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-04-14 12:20:18 +00:00
Prateek Pandey
ab5b46c1f1
fix missing policy.kyverno.io/policy-name label (#3599) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-04-14 17:02:30 +05:30
Prateek Pandey
9def86c49a
refactor generate controller (#3589) 
* refact generate controller

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

* rename the dir to background

Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-04-13 12:45:04 +00:00
Jim Bugwadia
4e60189f4c
change/suppress warning messages (#3593) 
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-04-13 13:41:37 +05:30
shuting
2b432490b5
Feat - add the new CR UpdateRequest for post mutation (#3592) 
* add new CR UpdateRequest

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add clienset for updaterequests

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-04-12 22:37:28 +05:30
Tathagata Paul
10cf0f2344
add support for roles, cluster roles and subjects (#3188) 
* add support for roles, cluster roles and subjects in kyverno cli

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-04-12 04:00:49 +00:00
Jim Bugwadia
0f186afb3e
update imageVerify schema (#3574) 
* update imageVerify schema

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add optional

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* change nested/recursive types to apiextv1.JSON

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix message

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-04-11 16:47:27 +01:00
Sambhav Kothari
6f7bd7451b
Refactor image extraction to allow extracting custom resources (#3572) 
* refactor: image extraction

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* Refactor image extraction to allow extracting custom resources

Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>

Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-11 09:30:38 +00:00
Charles-Edouard Brétéché
585b0f17a6
chore: remove dead code (#3561) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-04-11 08:47:18 +00:00
Soumya Singh
84aa2e3fbb
Add returnType for regexMatch in kyverno jp output (#3575) 
Signed-off-by: tend2infinity <somu12.ss@gmail.coom>

Co-authored-by: tend2infinity <somu12.ss@gmail.coom>
 2022-04-11 08:34:14 +01:00
Charles-Edouard Brétéché
3d554ce53b
refactor: engine context (#3563) 
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-09 11:52:50 +00:00
Mario Vázquez
944bf1728e
Fixes #3555 (#3558) 
Signed-off-by: Mario Vazquez <mavazque@redhat.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-08 22:54:35 +08:00
Charles-Edouard Brétéché
06c2b2bb79
refactor: switch to admission v1 (#3526) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-06 20:43:07 +00:00
Charles-Edouard Brétéché
c8275b7c00
refactor: make response type (RuleType) typed (#3556) 
* refactor: move common utils

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: make response type (RuleType) typed

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: merge

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-04-06 19:04:08 +00:00
Charles-Edouard Brétéché
98598e33cf
refactor: metrics package (#3549) 
* refactor: use BackgroundProcessingEnabled method

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: webhooks metrics reporting

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: metrics package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-07 02:14:13 +08:00
Charles-Edouard Brétéché
ae89aabb56
refactor: webhooks metrics reporting (#3548) 
refactor: webhooks metrics reporting

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-06 18:11:08 +05:30
Charles-Edouard Brétéché
975f6ba7c8
test: pass lock by value (#3481) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-04-05 15:52:13 +00:00
Charles-Edouard Brétéché
594a04db01
refactor: simplify autogen package (#3532) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-05 15:12:22 +00:00
Charles-Edouard Brétéché
29d7010e25
refactor: move common utils (#3553) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-05 13:02:43 +00:00
Charles-Edouard Brétéché
3bc0e062f9
refactor: add engine utils sub package (#3552) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-05 20:30:00 +08:00
Charles-Edouard Brétéché
bd953cf4fa
fix: checkEngineResponse in webhooks (#3551) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-05 10:41:08 +00:00
Abhi Kapoor
18d4dadab6
Do not generate preconditions not met warning for audit policies (#3487) 
* Do not generate preconditions not met warning for audit policies

Signed-off-by: abhi-kapoor <43758739+abhi-kapoor@users.noreply.github.com>

* Update PR template to reeference the closing keyword

Signed-off-by: abhi-kapoor <43758739+abhi-kapoor@users.noreply.github.com>

* Update pkg/engine/validation.go

Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>

* Update pkg/engine/validation.go

Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-05 10:08:01 +00:00
Charles-Edouard Brétéché
f77220ad66
refactor: reduce policy mutations (#3550) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-05 16:28:33 +08:00
Charles-Edouard Brétéché
e716daa22e
fix: annotation path (#3547) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-04 21:48:22 +00:00
Charles-Edouard Brétéché
2f81c77850
refactor: use GetFailurePolicy method (#3545) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-05 04:49:30 +08:00
Charles-Edouard Brétéché
4b3de26433
refactor: use BackgroundProcessingEnabled method (#3544) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-05 04:16:45 +08:00
Charles-Edouard Brétéché
a93ac45586
refactor: move some helpers in utils package (#3539) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-04 18:58:22 +00:00
Charles-Edouard Brétéché
cb6f55cdcd
refactor: use GetValidationFailureAction method (#3546) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-04 16:33:12 +00:00
Charles-Edouard Brétéché
d4a71a53c2
refactor: use existing ContainsString util (#3543) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-04 15:31:33 +00:00
silenceper
d97258654f
fix wildcards in value arrays (#3486) 
Signed-off-by: silenceper <silenceper@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-04-01 10:42:07 +00:00
Charles-Edouard Brétéché
bc6a228f7d
refactor: separate yaml utils package (#3520) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-04-01 09:56:16 +00:00
Charles-Edouard Brétéché
857cd1209c
refactor: separate kube utils package (#3527) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-04-01 08:34:25 +00:00
Charles-Edouard Brétéché
fe0ad3c68f
refactor: add os utils sub package (#3528) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-01 06:59:44 +00:00
Charles-Edouard Brétéché
663ad49dca
refactor: add a json patch util and use it in autogen package (#3524) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-01 13:26:47 +08:00
Charles-Edouard Brétéché
adca5f200b
fix: tls min version (#3521) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 17:12:38 +00:00
Charles-Edouard Brétéché
1fe203732f
refactor: separate json utils package (#3523) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 16:34:52 +00:00
Charles-Edouard Brétéché
6e813a6b9e
refactor: webhooks package (#3516) 
* refactor: use more policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: migrate to policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: webhooks package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 23:34:10 +08:00
Charles-Edouard Brétéché
9fc65fa5a7
refactor: use policy interface and introduce admission utils package (#3512) 
* refactor: use more policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: migrate to policy interface

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 20:25:54 +08:00
Charles-Edouard Brétéché
04d094f775
fix: reduce dependency to ns lister (#3509) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-03-31 12:48:36 +05:30
Charles-Edouard Brétéché
04740c52fa
refactor: use more policy interface (#3510) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-31 12:14:00 +05:30