mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity
3918 commits 15 branches 540 tags 276 MiB
Commit graph

3918 commits

This branch
This branch
All branches
Author SHA1 Message Date
Sambhav Kothari
b27248111f
Add b/w compat support for K8s version 1.20 and below for Kyverno 1.6 (#3100) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-27 07:27:58 +00:00
Sambhav Kothari
7e5bf4083e
Fix the kyverno default keychain value to be the ggcr default keychain (#3096) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-27 14:38:08 +08:00
Batuhan Apaydın
3be48b9fb5
fix: typo Cluter to Cluster (#3092) 
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
 2022-01-26 22:02:17 +00:00
Sambhav Kothari
2eb8f5f285
Fix memory leak when updating ggcr keychain (#3088) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-26 12:45:05 -08:00
Rob Best
7a8c19e0cb
Support registry keychain from cloud providers (#3036) 
* Enable cloud provider registry keychains

It's desirable that Kyverno supports using workload identity and other
cloud provider metadata services for registry credentials.

Signed-off-by: Rob Best <robertbest89@gmail.com>

* Always initialize registry keychain

This supports using docker configuration on disk and credentials from
cloud providers without having to specify image pull secrets.

Signed-off-by: Rob Best <robertbest89@gmail.com>

* Get pull secrets from kyverno service account

It was previously using 'default'. I think it makes more sense to use
the service account that Kyverno actually runs with.

Signed-off-by: Rob Best <robertbest89@gmail.com>

* Don't split empty pull secrets list

Signed-off-by: Rob Best <robertbest89@gmail.com>

* Add KYVERNO_SVC_ACCOUNT to config manifests

Signed-off-by: Rob Best <robertbest89@gmail.com>

* Don't retrieve secrets from service account

Signed-off-by: Rob Best <robertbest89@gmail.com>

* Reduce scope of keychain changes

Just enable cloud provider keychains.

Signed-off-by: Rob Best <robertbest89@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-26 07:28:36 +00:00
Mritunjay Kumar Sharma
05bd2ff4bb
Updates Changelog to add note for anyPattern issue due to k8s v1.23 (#3045) 
* adds notes for anyPattern issue due to k8s v1.23

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* updates changelog

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* updates changelog for any/all

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* Update CHANGELOG.md

Co-authored-by: Jordan Liggitt <jordan@liggitt.net>

Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: Jordan Liggitt <jordan@liggitt.net>
 2022-01-26 03:36:22 +00:00
Kumar Mallikarjuna
e42908a85a
Add KYVERNO_DEPLOYMENT to initContainer (#3086) 
Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
 2022-01-25 23:50:19 +08:00
Jim Bugwadia
06e93fec46
apply patches cumulatively (#3083) 
* apply patches cumulatively

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle skipped rules

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add test files

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-25 09:00:18 +00:00
treydock
cd4650eb5a
Fix CLI test/apply when any/all use namespaceSelector (#3050) 
* Fix CLI test/apply when any/all use namespaceSelector
Fixes #3047

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* gofmt fix

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-25 08:06:17 +00:00
shuting
e5e64f86cf
fix mutating ownerReferenecs (#3061) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-24 05:20:27 +00:00
shuting
c479b41d34
update workflow configurations to fix CI failure (#3060) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-24 04:39:15 +00:00
Tathagata Paul
f7f4828dcd
Fix documentation for helm charts (#3056) 
Signed-off-by: 4molybdenum2 <tathagatapaul7@gmail.com>
 2022-01-23 12:13:01 -05:00
Jim Bugwadia
bb06901119
fix mutate preprocessing for anchors (#3052) 
* fix mutate preprocessing for anchors

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-23 13:54:22 +00:00
Abhinav Sinha
bd50291848
Bump go version from 1.16 to 1.17 (#3048) 
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
 2022-01-23 17:41:44 +05:30
Mritunjay Kumar Sharma
cdedf11a1c
bumps k8s libraries for k8s v1.23 upgrade for kyverno (#3043) 
* bumps k8s libraries for k8s v1.23 upgrade for kyverno

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes kustomize version

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* updates golang to v1.17 to test fails

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* updates logr package to 1.2.2

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* Fixed tests for `pkg/cosign` and `pkg/webhooks/generation`

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* fix go-logr deps version issue

Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>

* fix kube-openapi commit hash

Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: Abhinav Sinha <abhinav@nirmata.com>
Co-authored-by: prateekpandey14 <prateekpandey14@gmail.com>
 2022-01-22 20:26:53 +08:00
shuting
ae4ff4f6b9
Fix dynamic webhook for namespace policies (#3044) 
* fix dynamic webhook for namespace policies

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* improve policy listing to reduce duplicate processing

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update logger

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-22 07:55:14 +00:00
shuting
2eb9660aee
Reduce throttling requests for Kyverno resources (#3042) 
* remove resoureCache from the event controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* create rcr using typed client to reduce PUT throttling request

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* use typed client for report/rcr operations

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* clarify naming patterns for Kyverno ClusterRoles/ClusterRoleBindings  (#3029)

* clarify naming patterns for Kyverno ClusterRoles/ClusterRoleBindings (#3032)

* fix comment

* fix comment

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-22 05:36:42 +00:00
Kumar Mallikarjuna
5ad0d15240
Namespace Specific ValidationFailureAction (#2794) 
* Implement ValidationFailureActionOverride

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Update CRDs

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Update getEnforceFailureErrorMsg()

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Allow validate policies to be checked

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Fix linting issues

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Added tests for ValidationFailureActionOverrides

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Added schema validation

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Added description for ValidationFailureActionOverrides

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Policy validation

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Update CRDs

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Replace literals with constants

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Updated Policy Cache

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Refactor

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-21 12:36:44 +00:00
Kumar Mallikarjuna
4124e0f682
Update division for same units (#3038) 
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-21 11:06:08 +00:00
shuting
376a8d3b22
Reduce throttling requests for Kyverno managed resources (#3016) 
* remove resoureCache from the event controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* create rcr using typed client to reduce PUT throttling request

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-21 18:36:05 +08:00
Vyankatesh Kudtarkar
ccb33a08f6
clarify naming patterns for Kyverno ClusterRoles/ClusterRoleBindings (#3032) 
* fix comment

* fix comment
 2022-01-21 13:41:41 +08:00
Vyankatesh Kudtarkar
8c6a993470
clarify naming patterns for Kyverno ClusterRoles/ClusterRoleBindings (#3029) 2022-01-20 21:18:13 +05:30
Anushka Mittal
df4d7ae26c
Broken exclude any all (#2990) 
* added check for any/all

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* minor corrections

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* corrected return check for rbac info

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* added cli test

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-20 08:29:16 +00:00
Liu Shaohui
25722366f0
Fix: namespace quota policy failed to be applied for two resources named ResourceQuota with different APIVersions (#2612) 
Signed-off-by: Shaohui Liu <liushaohui@xiaomi.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-20 12:48:52 +05:30
Kumar Mallikarjuna
e4e15322d1
Disable autogen for policies without Pod (#2737) 
* Disable autogen for policies without Pod

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Fix autogen check

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Fix failing test

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Fix webhook tests

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Remove redundant checks

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Check autogen for exclude block

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
 2022-01-19 17:42:31 +00:00
Prateek Pandey
c30dfe70a5
fix deployment replica type conversion and refactor webhook logs (#3022) 
- add level in info webhook configuration update success logs
- fix deployment replica count conversion issue

Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>
 2022-01-19 17:14:33 +00:00
shuting
ad56087b91
list resources once per policy in the background reconcilliation (#3026) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-19 16:42:01 +00:00
Kumar Mallikarjuna
e39489f838
SharedInformers for WebhookConfigurations (#3007) 
* SharedInformers for WebhookConfigurations

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Add GVK to typed resources

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Remove ToUnstructured()

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Remove default informers from Resource Cache

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Formatted files

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
 2022-01-19 15:57:32 +00:00
Naman Lakhwani
73a02a5df3
fixing bildx version (#3023) 
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
 2022-01-19 22:14:48 +08:00
Sambhav Kothari
8ddfcacd79
Fix permissions for image publish workflows (#3021) 
All of the jobs in this workflow use the same set of permissions and this workflow is only run on pushes to master. Adding the appropriate permissions to read repository contents, publish packages and ID token for cosign.

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-19 11:39:51 +00:00
Abhinav Sinha
f0359f8272
Fixed error handling for negation anchors (#2986) 
* Fixed error handling for negation anchors

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-01-19 15:39:07 +05:30
Abhinav Sinha
b5341b685d
Support namespaceSelector with dynamic webhook enabled (#2953) 
* Support `namespaceSelector` with dynamic webhook enabled

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Implemented suggested changes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Implemented suggest changes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-19 07:59:08 +00:00
Vyankatesh Kudtarkar
e22e9499b6
CLI fix for foreach policies (#2997) 
* CLI fix for foreach policies

* add test-case for foreach container and initcontainer

* fix comments

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-18 23:38:49 +00:00
Naman Lakhwani
1580837526
refactoring github actions to remove duplication and enhancement for versioned sbom's (#2979) 
* initial commit

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* adding docker-buildx-builder to makefile

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* reverting git describe in makefile

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* uploading sbom for each kyverno image

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* small nits

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

* scanning image before pushing and removed cosign.pub

Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
 2022-01-18 15:07:59 -08:00
shuting
cde1d0f2b2
clean up managed resources when cannot find kyverno deployment (#3018) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
 2022-01-18 16:45:24 +00:00
Kumar Mallikarjuna
771d62b735
Added Kyverno specific SharedInformerFactory (#2987) 
* Added Kyverno specific SharedInformerFactory

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Replace ToUnstructured()

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

* Add GVK to returned resource

Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-18 15:52:48 +00:00
Prateek Pandey
421e6d9622
fix(generate): use JSON patch for GenerateRequests status updates (#3000) 
Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-18 14:53:48 +00:00
shuting
b6447e0649
Remove resourceCache from engine (#3013) 
* update log messages

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove resourceCache from the background controller when:
- register resource scope
- list resources per namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - use client call for configmap lookup;
- remove resourceCache from policy controller, webhook server and generate controller

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-18 12:59:35 +00:00
Sambhav Kothari
8ea7a62cad
Add samj1912 to codeowners (#3015) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-18 12:11:15 +00:00
Marcus Noble
2526f2ab16
Added Mac ARM64 build to Krew config (#3002) 
Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>
 2022-01-18 11:32:34 +00:00
Vyankatesh Kudtarkar
c2de92d8c6
Support mutation of variables in validate.deny (#2947) 
* Support mutation of variables in validate.deny

* remove comment

* fix e2e test
 2022-01-18 10:53:30 +00:00
Vyankatesh Kudtarkar
38c8dfd073
Add CODEOWNER (#3011) 
* Add CODEOWNER

* update codeowner  file

* update file
 2022-01-18 06:49:59 +00:00
Sambhav Kothari
f5e00ee034
Add a parse_yaml function (#2999) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-17 13:41:08 +00:00
shuting
de6c6f2199
cherry-pick #2980 (#3001) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-01-17 13:00:39 +00:00
Sambhav Kothari
1af9e48b0d
Add image data to validate image configs (#2946) 
* Add image data to validate image configs

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add tests for image context

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Add e2e test cases for image size policy

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-17 04:06:44 +00:00
Sambhav Kothari
f42092208f
Fix variable substitution for foreach preconditions (#2993) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-16 05:33:34 +00:00
Roee Landesman
665d2022d8
add top level permissions to remaining github workflows (#2995) 
Signed-off-by: Roee Landesman <roee.landesman@gmail.com>
 2022-01-16 03:57:35 +00:00
Roee Landesman
3e524b5586
Add github token permissions to improve ossf scorecard (#2992) 
* Fix autogen issue with cronjob generator and foreach pod generator (#2989)

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
Signed-off-by: Roee Landesman <roee.landesman@gmail.com>

* Add baseline read-all permissions

Signed-off-by: Roee Landesman <roee.landesman@gmail.com>

* remove extra read-all

Signed-off-by: Roee Landesman <roee.landesman@gmail.com>

* Add arm64 goarch to go releaser (#2991)

Signed-off-by: Roee Landesman <roee.landesman@gmail.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-15 17:14:22 -08:00
Roee Landesman
4450edc7d3
Add arm64 goarch to go releaser (#2991) 
Signed-off-by: Roee Landesman <roee.landesman@gmail.com>
 2022-01-15 15:39:52 -08:00
Sambhav Kothari
0c11af2d9a
Fix autogen issue with cronjob generator and foreach pod generator (#2989) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-01-15 12:28:28 -08:00