mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-01-20 18:52:16 +00:00
Code Activity
4155 commits 14 branches 543 tags 268 MiB
Commit graph

2379 commits

Author SHA1 Message Date
Christian Kotzbauer
851a81845c
Update cosign to v1.6.0 (#3341) 
Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de>

fix ecr-helper creation

Signed-off-by: Christian Kotzbauer <git@ckotzbauer.de>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-03-11 11:25:10 -08:00
Vyankatesh Kudtarkar
b3a53f0658
fix PodExecOptions issue (#3373) 
* fix PodExecOptions issue

* add note

* update comment
 2022-03-11 15:09:32 +05:30
Charles-Edouard Brétéché
8d08250e07
feat: add autogen controllers to policy status (#3332) 
* feat: add autogen controllers to policy status

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* feat: add autogen controllers to policy status

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-10 23:51:29 +08:00
Charles-Edouard Brétéché
ce5f648f30
refactor: introduce rules getters and setters (#3350) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
 2022-03-09 15:28:31 +00:00
Charles-Edouard Brétéché
ea977b259c
refactor: move controller autogen annotation in api package (#3364) 
* fix: configmap resource filters generated by helm does not account for namespace

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refator: move controller autogen annotation in api package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-09 21:48:04 +08:00
Shubham Nazare
4c1a8336b0
Add new test-case-selector flag to test command (#3183) 
* added new test-case flag to test command
Signed-off-by: Shubham Nazare <shubham4443@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-03-09 07:40:53 +00:00
Ivan Wallis
deda7a5336
support RSA, ECDSA and EDDSA public key verification (#3362) 
Signed-off-by: Ivan Wallis <iwallis@gmail.com>
 2022-03-08 21:58:14 -08:00
Vyankatesh Kudtarkar
148a892277
Fix any_all wildcard issue (#3352) 2022-03-08 12:59:33 +00:00
Charles-Edouard Brétéché
90d0badda4
fix: CRD generation (#3334) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-06 11:07:51 -08:00
Charles-Edouard Brétéché
1293ef4691
refactor: reduce usage of reflect.DeepEqual (#3328) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-02 17:20:27 +00:00
Charles-Edouard Brétéché
8cc883becc
fix: naming typos (#3327) 
fix: naming typos

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-02 07:29:33 +00:00
Charles-Edouard Brétéché
7232de45c6
refactor: introduce autogen package (#3316) 
* refactor: pass only spec instead of whole policy when possible

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: introduce autogen package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-03-01 23:19:31 +00:00
Charles-Edouard Brétéché
1154612489
refactor: pass only spec instead of whole policy when possible (#3315) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-03-01 22:42:19 +00:00
Sambhav Kothari
c4075af3d1
Improve CLI test times by instantiating openapi controller once (#3297) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-24 23:34:12 +08:00
Emin AKTAS
388b160840
Fix namespace typo (#3298) 
Signed-off-by: Emin Aktas <emin.aktas@trendyol.com>
Signed-off-by: eminaktas <eminaktas34@gmail.com>
 2022-02-24 13:39:22 +00:00
Prateek Pandey
66969d35ea
validate and block policy based on the matched kind cache (#3283) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Co-authored-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-02-23 22:27:18 +05:30
Sambhav Kothari
147fc6db56 Shallow clone git repositories for kyverno test command 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-23 23:12:34 +08:00
Vyankatesh Kudtarkar
e8bf16a00b
Fix label mutation while updating the secret (#3273) 
* Fix label mutation while updating the secret

* Update util.go

* fix converter issue

* code indentation
 2022-02-22 19:49:03 +08:00
Afzal Ansari
9f8d2aef8e
Added kyverno test subcommand for test manifest file (#3264) 
* Adds `kyverno test` subcommand for test manifest file

Signed-off-by: afzal442 <afzal442@gmail.com>

Adds sub cmd

Signed-off-by: afzal442 <afzal442@gmail.com>

Adds usage

Signed-off-by: afzal442 <afzal442@gmail.com>

* Refactors the help command

Signed-off-by: afzal442 <afzal442@gmail.com>

Refactors help cmd

Signed-off-by: afzal442 <afzal442@gmail.com>

* Modifies manifest desc and removes the unused test manifest

Signed-off-by: afzal442 <afzal442@gmail.com>

Adds changes

Signed-off-by: afzal442 <afzal442@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-02-21 05:23:29 +00:00
Vyankatesh Kudtarkar
04e5f50cde
fix mutate wildcard issue (#3193) 
Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-18 10:32:10 +00:00
Vyankatesh Kudtarkar
0a5aad39cf
Fix foreach validations precondition issue (#3228) 
* fix foreach validations precondition issue

* added test-cases
 2022-02-18 09:11:41 +00:00
shuting
a30493e550
Fix policy report OwnerReference (#3249) 
* add namespaces/finalizers to clusterrole kyverno:generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* set policy report's owner to Kyverno namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove BlockOwnerDeletion

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove namespaces/finalizers permission

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-18 00:50:18 -08:00
Jim Bugwadia
421a81ce63
Fix old object validation check (#3248) 
* fix validation check on UPDATE

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* prevent policy bypass using preconditions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* separate replace

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add error handling

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-17 09:18:49 -08:00
Tathagata Paul
b91ff5a7f2
Bug fix: negation of string kernel version caused Cluster Policy to fail (#3229) 
* fixed bug where negation of kernel version caused cpolr to fail

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* small fix in function validateString

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* Added necessary tests

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Added one more test

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* Add more tests and added a policy to the test folder

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* added policy for test cli

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-17 09:33:30 +05:30
shuting
2eefe3a544
Skip updating webhook configs if namespaceSelector is nil (#3237) 
* skip updating webhook configs if namespaceSelector is nil

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comment for mutating webhook

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update logs

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-02-16 17:07:09 +05:30
Mritunjay Kumar Sharma
5a541567de
Fix image parsing for image referenced as digests (#3196) 
* fixes image break with sha256

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes priority to digest

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-15 08:35:53 +00:00
Jim Bugwadia
bd1a145678
Fix keyless attest (#3219) 
* allow root cert for keyless attestations checks

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add logs and improve var names

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle err in sig loading

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-13 20:35:11 -08:00
vivek kumar sahu
0293368504
fixing bug to handle two different types of rules (#2954) 
* fixing bug for the info variable

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-02-09 10:33:54 +00:00
Ramanand Thakur
7f1530c66e
Indentation fix (#3179) 
Removed unnecessary indentation on line 107 to avoid confusion.
 2022-02-08 01:00:01 +08:00
Sambhav Kothari
4445780c7c
Add a kyverno jp command to test jmespath expressions (#3169) 
* Add a kyverno jp command to test jmespath expressions

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Auto-generate custom function docs

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-04 05:23:12 +00:00
Vyankatesh Kudtarkar
373f421b07
Fix panic for provides a set to the key of a precondition and deny condition (#3162) 2022-02-03 14:46:58 +00:00
Abhinav Sinha
ed3811ea5a
Bump up verbosity for patched resource mismatch (#3127) 
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
 2022-02-03 11:24:00 +00:00
Prateek Pandey
286b0427d0
fix filtered and sort patches index (#3146) 
added missing start index value for the
patches slice

Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>
 2022-02-01 13:16:08 -08:00
Abhinav Sinha
25641abeb9
Fix kyverno panic with PodSpec.containers JSON merge patch w/o image (#3143) 
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
 2022-02-01 10:01:46 +05:30
Sambhav Kothari
98284114f5
Relax rule context validation to follow JMESPath grammar (#3129) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-31 18:23:59 +00:00
Abhinav Sinha
7a55d26d89
Fixed kyverno panic at JMESPath zero division (#3137) 
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-31 17:45:20 +00:00
Sambhav Kothari
2b1e7189b1
Fix variable substitution when curly braces are used in jmespath (#3133) 
* Fix variable substitution when inline jmespath objects are defined

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add additional test cases which use brackets

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-31 17:11:19 +00:00
Sambhav Kothari
a1daf167e7
Fix parsing of resources in preconditions (#3108) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-31 08:18:31 -08:00
Rob Best
851ebe3e65
Add cloud provider keychains to DefaultKeychain (#3116) 
Removes the need to specify an image pull secret to make use of cloud
provider credentials. As I understand it, this should be fine outside of
cloud provider contexts.

As part of this, I've switched to using authn/kubernetes, which I believe
is preferable to k8schain.

Signed-off-by: Rob Best <robertbest89@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-28 11:33:27 -08:00
Naman Lakhwani
d3dd7a7b45
fixing and adding tests (#3112) 
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
 2022-01-27 22:50:29 -08:00
Jim Bugwadia
7cf1dd2b15
update cosign to 1.5.0 and fix issuer and subject for keyless (#3089) 
* update cosign to 1.5.0 and add checks

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix subject and issuer checks

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-27 21:13:23 -08:00
Sambhav Kothari
7e5bf4083e
Fix the kyverno default keychain value to be the ggcr default keychain (#3096) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-27 14:38:08 +08:00
Sambhav Kothari
2eb8f5f285
Fix memory leak when updating ggcr keychain (#3088) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-26 12:45:05 -08:00
Jim Bugwadia
06e93fec46
apply patches cumulatively (#3083) 
* apply patches cumulatively

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle skipped rules

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add test files

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-25 09:00:18 +00:00
treydock
cd4650eb5a
Fix CLI test/apply when any/all use namespaceSelector (#3050) 
* Fix CLI test/apply when any/all use namespaceSelector
Fixes #3047

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* gofmt fix

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-25 08:06:17 +00:00
shuting
e5e64f86cf
fix mutating ownerReferenecs (#3061) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-24 05:20:27 +00:00
Jim Bugwadia
bb06901119
fix mutate preprocessing for anchors (#3052) 
* fix mutate preprocessing for anchors

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-23 13:54:22 +00:00
Mritunjay Kumar Sharma
cdedf11a1c
bumps k8s libraries for k8s v1.23 upgrade for kyverno (#3043) 
* bumps k8s libraries for k8s v1.23 upgrade for kyverno

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes kustomize version

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* updates golang to v1.17 to test fails

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* updates logr package to 1.2.2

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* Fixed tests for `pkg/cosign` and `pkg/webhooks/generation`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* fix go-logr deps version issue

Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>

* fix kube-openapi commit hash

Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: Abhinav Sinha <abhinav@nirmata.com>
Co-authored-by: prateekpandey14 <prateekpandey14@gmail.com>
 2022-01-22 20:26:53 +08:00
shuting
ae4ff4f6b9
Fix dynamic webhook for namespace policies (#3044) 
* fix dynamic webhook for namespace policies

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* improve policy listing to reduce duplicate processing

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update logger

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-22 07:55:14 +00:00
shuting
2eb9660aee
Reduce throttling requests for Kyverno resources (#3042) 
* remove resoureCache from the event controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* create rcr using typed client to reduce PUT throttling request

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* use typed client for report/rcr operations

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* clarify naming patterns for Kyverno ClusterRoles/ClusterRoleBindings  (#3029)

* clarify naming patterns for Kyverno ClusterRoles/ClusterRoleBindings (#3032)

* fix comment

* fix comment

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-22 05:36:42 +00:00