Vishal Choudhary
c0d6eaddb3
feat: delete webhook configurations after kyverno is uninstalled ( #10782 )
...
* feat: delete webhook configurations after kyverno is uninstalled
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: optionally add permissions
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: disable finalizers in latest manifest
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: move webhook cleanup to webhooks controller
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: add finalizers on deployment
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: refactor
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: add roles to cleanupcontroller
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: add cleanup to generic controllers
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: add webhook cleanup in generic controllers
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: remove unnecessary clusterrole and clusterrole bindings
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: make this behaviour opt-in
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: reconcile webhook setup on deployment change
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: update codegen and remove unused vars
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: add finalizers to chart
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-09-04 10:59:59 +00:00
Pradeep Lakshmi Narasimha
416b7d2f8b
fix: Honour generateSuccessEvents config for generating success events ( #9870 ) ( #10741 )
...
Signed-off-by: Pradeep Lakshmi Narasimha <pradeep.vaishnav4@gmail.com>
2024-09-04 10:25:34 +00:00
Alex Hamlin
218877dc03
Evaluate one version of each pod security standard ( #10924 )
...
The original logic for evaluating pod security standards took two steps
for each defined check:
1. If the policy author requested the latest version of the standard,
find the newest version of the check and evaluate the pod against it,
adding any failure to the final results.
2. Otherwise, evaluate the pod against *each version of the check* whose
minimum version is below the requested version, adding any failures
to the final results.
This second step can be problematic, as new PSS versions may permit a
broader range of values for a restricted field compared to old versions.
As a concrete example, versioned podSecurity rules don't permit some of
the newer sysctls allowed by Kubernetes v1.27 and v1.29, since Kyverno
still evaluates v1.0 of the check.
With this change, Kyverno identifies the highest version of the check
that the podSecurity rule allows, and only executes that version of the
check against the pod. Since the "latest" version is special-cased to
compare newer than all non-latest versions, no special logic is required
in that case.
I've added unit tests for several combinations of sysctl and policy
version, especially to check that policy v1.27 permits the new sysctl
allowed in v1.27 but not the sysctls allowed in v1.29. I've also taken
the liberty of changing `assert.Assert` to `assert.Check`, to collect
multiple failures from a single unit test run.
Signed-off-by: Alex Hamlin <alexanderh@qualtrics.com>
2024-09-03 18:58:40 +00:00
Vishal Choudhary
95f54a1cb6
feat: enable custom data in policy reports using properties ( #10933 )
...
* feat: enable custom data in policy reports using properties
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: dont throw error in variable substitution for properties
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-09-03 17:36:07 +00:00
Rizul Gupta
02ffe4131c
add image name in all logs ( #10837 )
...
* add image name in all logs
Signed-off-by: Rizul Gupta <mail2rizul@gmail.com>
* make lint tests pass
Signed-off-by: Rizul Gupta <mail2rizul@gmail.com>
---------
Signed-off-by: Rizul Gupta <mail2rizul@gmail.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2024-08-30 09:22:44 +00:00
Anushka Mittal
b76bb77e46
Deferred loading for image info in policy context ( #10787 )
...
* fix: add deferred loading for image info in policy context
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* chore: move logic to context.go
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* chore: add unit test
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* fix: cleanup code
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* fix: unit test
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* fix: unit test
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
---------
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
Co-authored-by: anushkamittal20 <anumittal4641@gmail.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2024-08-30 05:35:26 +00:00
asr2003
8f418a90fc
fix: variable substitution error handling in policy validation ( #10936 )
...
* fix variable substitution error handling in policy validation and add tests
Signed-off-by: Ambati Sahithi <162500856+asr2003@users.noreply.github.com>
* cleanup
Signed-off-by: Ambati Sahithi <162500856+asr2003@users.noreply.github.com>
* fix variable substitution error handling in policy validation and add tests
Signed-off-by: Ambati Sahithi <162500856+asr2003@users.noreply.github.com>
* cleanup
Signed-off-by: Ambati Sahithi <162500856+asr2003@users.noreply.github.com>
* add review comment
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: asr2003 <162500856+asr2003@users.noreply.github.com>
* Update pkg/validation/policy/validate.go
The rule and policy will be appended to the top level message, so no need to repeat here.
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fmt
Signed-off-by: Ambati Sahithi <162500856+asr2003@users.noreply.github.com>
* Update pkg/validation/policy/validate.go
update for unit tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
---------
Signed-off-by: Ambati Sahithi <162500856+asr2003@users.noreply.github.com>
Signed-off-by: asr2003 <162500856+asr2003@users.noreply.github.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2024-08-29 23:49:45 +00:00
Mariam Fahmy
bde90340a6
chore: remove v1alpha1 of VAPs and use v1beta1 ( #10955 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-29 15:31:25 +00:00
Mariam Fahmy
e00596a551
fix: match wildcard names for generateExisting policies ( #10945 )
...
* fix: match wildcard names for generateExisting policies
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix chainsaw test
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* chore: add unit tests
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-29 13:09:30 +00:00
shuting
2cd462570a
feat: foreach support for clone ( #10888 )
...
* chore: add chainsaw tests for foreach clone
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: update webhooks for foreach generate
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: rename generatePattern
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: chainsaw tests for generateExisting
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: add missing files
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: add chainsaw tests for foreach clone, sync=true
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: linter issues
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: add chainsaw test foreach clonelist, sync=true, delete source
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: sync deletion for cloneList
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2024-08-29 11:59:22 +00:00
Charles-Edouard Brétéché
f87fa52cb7
feat: bump to k8s 1.31 ( #10938 )
...
* feat: bump to k8s 1.31
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* tidy
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* mod
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix otel
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix otel schema
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* update linter
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* feat: fix image verification tests
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* linter issues
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* cel change
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-08-28 17:09:58 +00:00
Mariam Fahmy
2140a0239b
chore: rename validationFailureAction to failureAction under the rule ( #10893 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2024-08-27 20:07:57 +00:00
Khaled Emara
aceb7d5068
feat(gctx): retry logic ( #10796 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
2024-08-21 19:32:58 +00:00
Vishal Choudhary
4287f8cc29
feat: regexp support for sigstore bundle ( #10901 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-08-21 15:34:04 +00:00
Jim Bugwadia
f06399200c
remove wildcard permissions ( #10785 )
...
* remove wildcard permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update codegen
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* codegen
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix background controller perms
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* remove secrets perm
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix reports-controller role
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add wildcard check and limit generate policy checks based on `synchronize`
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update manifest
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix wildcard check
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update default QPS and burst for better performance and to prevent test failure
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix perms
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix perms
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test permissions
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix merge issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix merge issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
---------
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-20 11:55:32 +03:00
Vishal Choudhary
0c2a88638b
fix: properly use useCache field in image verification policies ( #10709 )
...
* fix: properly use useCache field in image verification policies
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: add test
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: revert client changes
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-19 14:26:07 +00:00
shuting
bd71af3291
feat: support foreach for generate.data ( #10875 )
...
* chore: refactor
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: add foreach for generate.daya to api
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: refactor generator
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: linter
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: update rule validation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: update rule validation -2
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: support foreach.data
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: policy validation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: context variables
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: add a chainsaw test
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: sync on policy deletion
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: enable new chainsaw tests in CI
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update code-gen
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: validate targets scope for ns-policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: add missing files
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: remove unreasonable test
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update docs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update install.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-08-19 06:55:19 +00:00
Jim Bugwadia
c96f224e8e
reduce recursions for nested var substutution ( #10877 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2024-08-18 17:40:27 +08:00
Khaled Emara
a5915a310b
chore(log): add caller ( #10874 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
2024-08-16 14:08:55 +00:00
Vishal Choudhary
06ffd1c961
feat: add support for sigstore bundle verification ( #10567 )
...
* feat: add support for sigstore bundle verification
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: missed change
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: ci
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: another linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: add size check in layer
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-08-16 11:36:48 +00:00
Vishal Choudhary
f69ffe12ec
feat: add full regexp support to cosign ( #10815 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2024-08-16 07:03:59 +00:00
Jim Bugwadia
3c63152f18
update message ( #10862 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2024-08-15 14:42:29 +00:00
Khaled Emara
40ba712987
fix(log): set zerolog level to logr level ( #10867 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-15 13:49:50 +00:00
Jim Bugwadia
2e39e27102
rename package: d4f --> breaker ( #10863 )
...
* rename package: d4f --> breaker
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* rename package: d4f --> breaker
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
---------
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2024-08-15 10:53:20 +00:00
shuting
5203809b73
chore: refactor background controller ( #10850 )
...
* chore: refactor
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: add foreach for generate.daya to api
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: refactor
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2024-08-14 14:32:49 +00:00
shuting
481798c836
refactor: update updaterequest to be created for each policy ( #10793 )
...
* chore: remove v1beta1 updaterequest definitions
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: update UR to map a policy instead a rule; adapt UR mapping changes for admission review
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: update code-gen
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: linter
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: remove unused function
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: add missing files
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: add missing files
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update ur in policy controller
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: update crds
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: adapt ur changes in the background controller
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: linter
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: more linter
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: modify mapping relationship for deletion events
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: remedy missing target for policy application
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: fetching logic for triggers
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: clean up targets upon policy deletion
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update crds
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* merge main
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* merge main
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: adds delay before assertion
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update docs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: wrong yaml format
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: update error handling logic
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix(attempt): enable more debug info
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix(attempt): enable debug log
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix(attempt): enable debug log
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix(attempt): enable debug log
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: makefile to update ur crds
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: generate existing
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: skip empty ur generation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: update install.yaml
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2024-08-13 17:14:06 +00:00
Khaled Emara
de37a045be
feat(logger): replace zap with zerlog for perf ( #10790 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-13 15:12:21 +00:00
Mariam Fahmy
25b7142ee0
feat: generate VAPs from exceptions ( #10771 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-13 11:55:22 +00:00
Mariam Fahmy
3a69702b49
fix: check permissions for validate.cel subrules only ( #10829 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2024-08-13 12:25:29 +03:00
Khaled Emara
bbb1d6103c
feat(mutate): don't eagerly process img-ver ( #10703 )
...
* feat(mutate): don't eagerly process img-ver
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* test(mutate): add mutate with img-ver test
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
---------
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-08-12 14:59:27 +00:00
Khaled Emara
65a43d2059
feat(mutate): minimize unmarshals ( #10702 )
...
* feat(mutate): minimize unmarshals
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* test(mutate): test type assertion
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
* chore(codegen): remove unused import
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
---------
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
2024-08-09 11:12:20 +00:00
Mariam Fahmy
60a8384fd4
feat: add tests for different values of generateExisting ( #10807 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-08 12:11:20 +00:00
Mariam Fahmy
c7122edfa8
feat: add tests for different values of mutateExistingOnPolicyUpdate ( #10797 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-07 15:06:01 +00:00
Mariam Fahmy
53e0ccdc25
fix: pass resource names to auth check for mutateExisting policies ( #10808 )
2024-08-07 14:09:16 +00:00
Mariam Fahmy
4d1f040e49
fix: add the resource name to the SubjectAccessReview ( #10221 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-08-07 12:46:44 +00:00
Mariam Fahmy
c796bb765c
fix: return policies with either audit or enforce rules from the cache ( #10667 )
...
* fix: return policies with either audit or enforce rules from the cache
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* feat: introduce validationFailureAction under verifyImage rules
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* feat: add chainsaw tests
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-08-06 18:24:28 +00:00
Frank Jogeleit
deab83d62f
reconcile only PolicyReports managed by kyverno ( #10794 )
...
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
Co-authored-by: shuting <shuting@nirmata.com>
2024-08-06 12:43:47 +00:00
Khaled Emara
c0cf6c5bf1
feat(json): unmarshal at decode time ( #10700 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-05 15:46:50 +03:00
Frank Jogeleit
91ffbb6758
feat: assert rule autogen ( #10780 )
...
* Support autogen for assert validation rules
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* simplify assert autogen logic
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* add chainsaw test
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
---------
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
2024-08-05 10:59:55 +00:00
Mariam Fahmy
ce7e570268
fix: set all operations by default in the generated VAP ( #10100 )
...
* fix: set all operations by default in the generated VAP
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix chainsaw test
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-02 14:12:42 +00:00
Mariam Fahmy
9d28116eb4
fix: allow exceptions to match Pod/ephemeralcontainers by default ( #10778 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-08-02 12:47:09 +00:00
Charles-Edouard Brétéché
a1510d9db1
feat: add more policy validation around policies using kyverno-json ( #10777 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-08-02 14:47:03 +03:00
Charles-Edouard Brétéché
fc694bc24c
feat: add kyverno json support to validation rule ( #10763 )
...
* feat: add kyverno json support to validation rule
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* v2beta1
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* validation
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* engine handler
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* bindings
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* context functions
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* better bindings
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2024-08-02 08:24:30 +00:00
Khaled Emara
d173752041
feat(json): unmarshal once per policy ( #10701 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-07-30 10:52:41 +00:00
Khaled Emara
0aeb32df3b
feat(autogen): use static bytes instead of string ( #10723 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-07-29 13:46:11 +00:00
Khaled Emara
c2646f7a9d
feat(json): reduce reliance on DocumentToUntyped() ( #10724 )
...
Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-07-29 11:57:20 +00:00
Ammar Yasser
f618717f75
fix: Check for the client being nil before applying a mutation ( #10726 )
...
Signed-off-by: aerosouund <aerosound161@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-07-26 10:49:51 +00:00
Mariam Fahmy
716611b7ea
fix: return all the exceptions that match the incoming resource ( #10722 )
...
* fix: return all the exceptions that match the incoming resource
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* fix: modify log messages
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-07-25 17:36:19 +00:00
Korada Vishal
ca17cb2c6f
Improved test covergae for forceMutate ( #10103 )
...
Signed-off-by: Vishal K <korada.vishal.phe22@itbhu.ac.in>
Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-07-24 10:43:07 +00:00
Mariam Fahmy
b0cef72df1
feat: support exclude block in generating VAPs ( #10215 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2024-07-16 18:06:58 +03:00
