mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-05 15:37:19 +00:00
Code Activity
7403 commits 16 branches 550 tags 287 MiB
Commit graph

687 commits

Author SHA1 Message Date
Charles-Edouard Brétéché
b36a2ecdcc
feat: bump update request api version (#10508) 
* feat: bump update request api version

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* use v2

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix linter

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-06-20 09:44:43 +00:00
shuting
fe8c429e78
fix: avoid creating duplicate urs for background policies (#10431) 
* feat: add generator abstraction

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: replace urgenerator

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: ko build

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: load threshold from kyverno configmap

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add metadata client to get ur count

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add helm option to preserve configmap settings during upgrade

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add helm option to preserve configmap settings during upgrade 2

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: rename imports

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update codegen manifests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: handle nil value

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter issue

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update threshold to 1000

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: avoid duplicate URs creation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: revert false changes

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: simplify background applications

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-06-12 15:23:53 +00:00
shuting
9e5c297dcf
feat: add a circuit breaker for updaterequests (#10382) 
* feat: add generator abstraction

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: replace urgenerator

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: ko build

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: load threshold from kyverno configmap

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add metadata client to get ur count

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add helm option to preserve configmap settings during upgrade

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: add helm option to preserve configmap settings during upgrade 2

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: rename imports

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update codegen manifests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: handle nil value

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: linter issue

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* chore: update threshold to 1000

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-06-11 08:54:51 +00:00
mohamedasifs123
97327fd31c
Fix : failed to parse BACKGROUND_SCAN_INTERVAL log message wrong (#9933) 
* Update policy_controller.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Signed-off-by: mohamedasifs123 <asifabu272@gmail.com>

* Update policy_controller.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Signed-off-by: mohamedasifs123 <asifabu272@gmail.com>

* Update policy_controller.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Signed-off-by: mohamedasifs123 <asifabu272@gmail.com>

* Update policy_controller.go

-s

Signed-off-by: mohamedasifs123 <asifabu272@gmail.com>

* Update policy_controller.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Signed-off-by: mohamedasifs123 <asifabu272@gmail.com>

* Update policy_controller.go

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Signed-off-by: mohamedasifs123 <asifabu272@gmail.com>

---------

Signed-off-by: mohamedasifs123 <142201466+mohamedasifs123@users.noreply.github.com>
Signed-off-by: mohamedasifs123 <asifabu272@gmail.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-06-05 10:05:31 +00:00
Mariam Fahmy
59ff771ae8
fix: process the matched resources only for mutate existing policies (#10164) 
* fix: process the matched resources only for mutate existing policies

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix lint issue

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* chore: add unit tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2024-05-20 12:40:53 +00:00
shuting
fb9c66f455
feat(perf): add new linter prealloc to enforce slice declarations best practice (#10250) 
* feat(perf): add new linter prealloc to enforce slice declarations best practice

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix(linter): prealloac slices

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-05-20 14:46:35 +05:30
Khaled Emara
c9055ac2ff
fix(autogen): only generate rule for request kind (#9984) 
* fix(autogen): only generate rule for request kind

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* feat(autogen): use jsoniter instead of std for json

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* chore(atogen): use sets instead of manipulating strings

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(autogen): formatting linter

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix(autogen): backwards compatability

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* revert(autogen): old behavior

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* fix: builds error

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: ShutingZhao <shuting@nirmata.com>
 2024-04-04 08:09:30 +00:00
Mariam Fahmy
07a6bf42f5
fix: add podSecurity validation checks for exceptions (#9817) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-02-28 08:21:10 +00:00
Mariam Fahmy
956b403c7e
fix: add validation check for podSecurity subrule (#9770) 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2024-02-23 15:16:53 +08:00
shuting
635f160ae0
feat (generate): add orphanDownstreamOnPolicyDelete to preserve downstream on policy deletion (#9579) 
* add chainsaw tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add .orphanDownstreamOnPolicyDelete

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update codegen

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update docs

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2024-01-31 13:50:38 +02:00
Charles-Edouard Brétéché
0b7a6a1e3e
fix: kyverno apply panic for mutate policies (#9492) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2024-01-24 09:37:48 +00:00
shuting
67b96a7cf2
refactor: mutate checks (#9255) 
* refactor

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-12-22 15:07:17 +02:00
shuting
85e0d9b836
fix mutate existing force reconciliation (#9230) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-12-20 16:29:37 +00:00
Chandan-DK
cafc0990f9
fix: generate policy fails if triggered resource name exceeds 63 characters limit (#8466) 
* fix: generate label resource name character length issue

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* add source label

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* modify newUR function

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* fix

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* improve readability

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* remove generate source name label

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* Revert changes

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* update ResourceSpec

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* add URGenerateResourceUIDLabel

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* make codegen crds all

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* make codegen client all

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* add GenerateSourceUIDLabel

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* modify comment

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* make codegen crds all

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* make codegen-docs-all

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* make codegen-all

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* set trigger uid

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* add uid in transform()

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* add name label

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* fix: use resource name labels along with its UID

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: use the resource name label only if its uid label isn't set

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* add kuttl tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: delete the trigger resource in the test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: delete the source in the kuttl test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* add generate trigger uid label

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* modify TriggerInfo function

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* populate uid field for new update requests

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* populate new ur spec with uid

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* handle downstream resources cleanup

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* populate uid of ur status

Signed-off-by: Chandan-DK <chandandk468@gmail.com>

* fetch triggers by the UID label

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* label triggers

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fetch trigger by comparing UID

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fetch cloneList downstream resource by UID

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update test names

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove trigger name label assertions from kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add unit name selector

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add sleep

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* assert events on failures

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* rename tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: Chandan-DK <chandandk468@gmail.com>
Signed-off-by: Chip Zoller <chipzoller@gmail.com>
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Signed-off-by: shuting <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Chip Zoller <chipzoller@gmail.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2023-11-06 10:37:13 +00:00
Charles-Edouard Brétéché
c96199dee1
chore: move utils/wildcard in ext (#8772) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-10-29 23:59:53 +00:00
Mariam Fahmy
b495c6d112
feat: support authorizer variable in CEL expressions (#8024) 
* feat: support authorizer variable in CEL expressions

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add the auth reason

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* feat: add kuttl tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix lint issue

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix kuttl test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: add helpers

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-09-05 10:16:50 +00:00
Mariam Fahmy
94aa1f18c6
feat: support namespaced parameter resources for CEL expressions in Kyverno policies (#8084) 
* feat: support namespaced parameter resources for CEL expressions in Kyverno policies

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix lint issue

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix kuttl test

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-08-28 14:43:09 +00:00
Charles-Edouard Brétéché
87728f1771
refactor: background controller permissions (#8083) 
* fix: reduce background controller permissions

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* debug

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* codegen

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-08-23 12:29:56 +00:00
Mariam Fahmy
a60dc00392
feat: migrate to events.k8s.io/v1 (#7673) 
* feat: migrate events to events.k8s.io group

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* fix: kuttl event tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* migrate background events to events.k8s.io

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* update kuttl tests

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

* remove ResourceSkipped from actions

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

---------

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
 2023-07-26 14:06:51 +00:00
Charles-Edouard Brétéché
03702476fa
refactor: move kyverno constants out of v1 package (#7760) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-07-06 08:00:36 +00:00
shuting
955570b0c5
fix: auth checks with the APIVersion and the subresource (#7628) 
* fix auth checks with apiVersion and subresource

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove duplicate code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update permissions

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-06-22 14:14:06 +00:00
Mike Bryant
91021b65b6
fix: Delete downstream objects on precondition fail (#7496) 
* fix: Delete downstream objects on precondition fail

When a rule fails the match in a generate rule, the downstream resource gets deleted. This will now also happen if the rule is skipped due to a precondition.

Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk>

* add debug command

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* sync trigger updates to downstream

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix bgscan fetching trigger

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix: Move rbac change into tests for better isolation

Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk>

* fix unit test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2023-06-15 11:32:19 -04:00
shuting
d3db3bc342
refactor: generate reconciliation on policy updates (#7531) 
* generate rule type validation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* generate rule type validation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add the kuttl test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* linter fixes

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* rever validation checks

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* refactor

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-06-14 13:52:27 +00:00
itsCheithanya
692d419aa4
Updated the message to the level4log and removed err that originated from ApplyBackgroundChecks. (#7528) 
* updated the message to the level4log and removed err that originated from ApplyBackgroundChecks

Signed-off-by: Cheithanya <cheithanya2002@gmail.com>

* Update pkg/policy/policy_controller.go

Signed-off-by: shuting <shutting06@gmail.com>

---------

Signed-off-by: Cheithanya <cheithanya2002@gmail.com>
Signed-off-by: shuting <shutting06@gmail.com>
Co-authored-by: shuting <shutting06@gmail.com>
 2023-06-14 12:36:26 +00:00
shuting
0c3351887a
fix: the same source cannot be used for multiple targets with a generate clone rule (#7436) 
* add source labels to targets

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* handle multiple triggers/targets for the same clone source

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add source labels to targets

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove unused code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* rename the test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* split apiversion label into version and group

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-06-07 13:50:47 +00:00
Mariam Fahmy
7f6fb24057
feat: support cel expression in validate rules (#7070) 
* feat: support cel expression in validate rules

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Adding CEL preconditions in kyverno policies

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Support parameter resources in validate.cel subrule

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* fix

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Adding CEL preconditions in kyverno policies

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Add kuttl tests for validate.cel subrule

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* fix

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Fix disallow-host-path kuttl test

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Add kuttl test for cel preconditions

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Fix kuttl tests for validate.cel

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Use K8S API Validation and AuditAnnotation

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

* Use K8S API ParamKind and ParamRef

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>

---------

Signed-off-by: Mariam Fahmy <mariamfahmy66@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2023-05-31 14:30:55 -07:00
Charles-Edouard Brétéché
194bfacc71
fix: permission validation message (#7362) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-05-31 19:14:32 +00:00
shuting
d99c000b17
fix: mutate existing auth check (#7219) 
* fix auth check when using variables in ns

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-05-17 18:20:34 +02:00
shuting
f7e9c45585
update background scan logging messages (#7142) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-05-09 15:18:03 +00:00
shuting
a7900ff40c
require generate.apiVersion (#7080) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-05-03 10:33:29 +00:00
shuting
f87b0204e6
fix: generate policy validation to prevent endless loop (#7026) 
* refactor policy validation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add loop check for generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* linter fixes

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* linter fixes

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-04-28 13:54:17 +00:00
Jim Bugwadia
0c22858bbc
add support for Kubernetes API server POST (#6948) 
* allow POST for Kubernetes API calls

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add kuttl tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fmt and undo local changes

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix codegen and unit test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix unit test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests and extends docs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

---------

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2023-04-26 16:31:44 -07:00
shuting
e14fe847bc
feat: new access checks for background policies (#6970) 
* switch to use sar for access checks

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix unit tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update helm config

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix username

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update msg

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix sa name

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update install.yaml

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-04-24 10:31:42 +00:00
shuting
5a6b3c86f6
fix background variables validation (#6978) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-04-23 16:22:29 +00:00
Charles-Edouard Brétéché
76d1b37e68
fix: incorrect json patch validation (#6941) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-04-17 19:06:50 +08:00
Charles-Edouard Brétéché
544fe04508
refactor: introduce jmespath interface (#6882) 
* refactor: introduce jmespath interface

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-04-13 11:29:40 +00:00
shuting
2948adba57
fix: auth check the generate policy when use variables in name/namespace (#6874) 
* decrease log level

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* set namespace to  for 'all'

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* udpate kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* rename file

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* rename file

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-04-13 07:38:47 +00:00
Charles-Edouard Brétéché
289ff3e1ce
refactor: factorise engine creation (#6837) 
* refactor: factorise engine creation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-04-11 07:12:05 +00:00
Charles-Edouard Brétéché
784ca07419
refactor: engine rule response creation (#6784) 
* refactor: engine rule response creation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* private fields

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* more private

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix unit tests

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-04-05 10:35:38 +00:00
Vyom Yadav
80fc3013d3
fix: Support subresources as the trigger in generate rules (#6760) 
* fix: check background scanning only for validation policies

Signed-off-by: Vyom-Yadav <jackhammervyom@gmail.com>

* fix: Support subresources as the trigger in generate rules

Signed-off-by: Vyom-Yadav <jackhammervyom@gmail.com>

---------

Signed-off-by: Vyom-Yadav <jackhammervyom@gmail.com>
 2023-04-04 11:01:06 +00:00
Charles-Edouard Brétéché
40ac8eb863
feat: add context/preconditions support to mutate existing (#6754) 
* refactor: engine handlers

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* feat: add context/preconditions support to mutate existing

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* kuttl

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* readme

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix and context kuttl test

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* validation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* final fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2023-04-03 19:58:58 +00:00
Pradeep Lakshmi Narasimha
cc9adc5cd8
Adding validation to reject audit mode policy creation/updation when mutateDigest is set to true (#6757) 
* Adding validation to reject audit mode policy creation/updation when mutateDigest is set to true

Signed-off-by: praddy26 <pradeep.vaishnav4@gmail.com>

* fix tests

Signed-off-by: realshuting <shutting06@gmail.com>

---------

Signed-off-by: praddy26 <pradeep.vaishnav4@gmail.com>
Signed-off-by: realshuting <shutting06@gmail.com>
Co-authored-by: realshuting <shutting06@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2023-04-03 15:52:32 +00:00
shuting
81ec6c96a1
fix auth validation (#6696) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-03-27 11:56:24 +00:00
Charles-Edouard Brétéché
1e30aacbd9
fix: replace more refect.DeepEqual (#6674) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-03-24 10:01:49 +00:00
Charles-Edouard Brétéché
49f0baa277
fix: policy validation with subresource and background scan enabled (#6571) 
* fix: policy validation with subresource

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* kuttl

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* workflow

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-03-22 17:12:10 +00:00
shuting
6249ab70e8
fix: block generate policies when lack of permission to operate downstream resources (#6610) 
* debug

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* return on errors only

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update clusterrolebinding

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update clusterrolebinding

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove debug

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* add kuttl tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix ns

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-03-22 13:14:57 +00:00
Charles-Edouard Brétéché
0b56613d59
fix: map APIResource in FindResources results (#6611) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-03-17 11:21:26 +00:00
shuting
6f7f06f0d4
chore: cleanup generate codebase (#6598) 
* add debug info

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* cleanup code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* linter fix

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove unused labels

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* rename ns

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* reset resource version

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove ur updater

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* fix tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* cleanup code

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove code to add labels to clone source #6583

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* rename ns

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remvove labels from test resource

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove generated by labels

Signed-off-by: ShutingZhao <shuting@nirmata.com>

---------

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2023-03-17 08:36:06 +00:00
Charles-Edouard Brétéché
ad3bf969bf
fix: add message to bypass schema validation when it fails (#6604) 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-03-16 15:03:00 +00:00
Charles-Edouard Brétéché
062bd798f0
test: add kuttl tests for policy kinds validation (#6547) 
* test: add kuttl tests for policy kinds validation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
 2023-03-13 18:24:11 +08:00