Charles-Edouard Brétéché
|
97cf1b3e95
|
feat: gracefull certificates rotation support (#3890)
* refactor: remove deployment hash on certs secrets
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: add label on kyverno webhooks
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: implement update ca bundle
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* test: set very low validity and expiration intervals
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: writing secret
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* add renew ca
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* decouple ca and tls validity duration
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactored code, everything is in place to finalize implementation
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* use real validity periods
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
|
2022-05-12 14:07:25 +00:00 |
|
Charles-Edouard Brétéché
|
2064a69b8a
|
refactor: make config vars private (#3823)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
|
2022-05-11 06:14:30 +00:00 |
|
Charles-Edouard Brétéché
|
97e5e64fd4
|
chore: enable whitespace linter (#3864)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
|
2022-05-10 17:01:29 +00:00 |
|
Charles-Edouard Brétéché
|
972be16ad3
|
refactor: remove unstructured usage from webhookconfig (#3737)
* refactor: use typed informers and add tombstone support to webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove unstructured usage from webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
|
2022-05-02 18:58:04 +08:00 |
|
Charles-Edouard Brétéché
|
a6924a11ab
|
refactor: use typed k8s client in tls package (#3678)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
|
2022-04-26 20:18:14 +00:00 |
|
Mritunjay Kumar Sharma
|
e303dddf86
|
adds lease objects for storing last-request-time and set-status annotations in deployment (#3447)
* funcs to patch last request time and status
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* instead of patch, updating status
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* added lease object appraoch
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* cleanup
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* attempt to solve panic issue
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixes lease updates for both annotations
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* minor cleanups in log messages
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* clean up
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* add object selector
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixed leases and object selector
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
|
2022-03-25 21:42:01 +08:00 |
|
shuting
|
69518b7c9c
|
Fix webhook re-creation error (#3403)
* fix webhook re-creation issue
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix webhook monitor blocking call
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
|
2022-03-16 15:23:46 +00:00 |
|
Abhinav Sinha
|
b5341b685d
|
Support namespaceSelector with dynamic webhook enabled (#2953)
* Support `namespaceSelector` with dynamic webhook enabled
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
* Implemented suggested changes
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
* Implemented suggest changes
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
|
2022-01-19 07:59:08 +00:00 |
|
shuting
|
b10947b975
|
Dynamic webhooks (#2425)
* support k8s 1.22, update admissionregistration.k8s.io/v1beta1 to admissionregistration.k8s.io/v1
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - add failurePolicy to policy spec; - fix typo
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - add schema validation for failurePolicy; - add a printer column
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* set default failure policy to fail if not defined
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* resolve conflicts
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix missing type for printerColumn
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* refactor policy controller
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* add webhook config manager
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - build webhook objects per policy update; - add fail webhook to default webhook configurations
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix panic on policy update
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* build default webhook: match empty if autoUpdateWebhooks is enabled, otherwise match all
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - set default webhook configs rule to empty; - handle policy deletion
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* reset webhook config if policies with a specific failurePolicy are cleaned up
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* handle wildcard pocliy
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* update default webhook timeout to 10s
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* cleanups
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* added webhook informer to re-create it immediately if missing
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* update tag webhookTimeoutSeconds description
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix e2e tests
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix linter issue
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* correct metric endpoint
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* add pol.generate.kind to webhooks
Signed-off-by: ShutingZhao <shutting06@gmail.com>
|
2021-10-05 00:15:09 -07:00 |
|
shuting
|
6d5e988ebe
|
BugFix - update the annotation lastRequestTimestamp from active instances (#2019)
* fix webhook monitor - inactive instance did not get latest request timestamp
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add checks for registered webhook configs
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update veridy_deployment.sh
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add debug steps in e2d workflow
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix CI errors
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
|
2021-06-15 18:39:22 -07:00 |
|
shuting
|
fa419439ec
|
fix merge eror (#2016)
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
|
2021-06-14 15:50:34 -07:00 |
|
shuting
|
e9a972a362
|
feat: HA (#1931)
* Fix Dev setup
* webhook monitor - start webhook monitor in main process
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leaderelection
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* - add isLeader; - update to use configmap lock
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* - add initialization method - add methods to get attributes
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove newContext in runLeaderElection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to GenerateController
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* skip processing for non-leaders
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* skip processing for non-leaders
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add leader election to generate cleanup controller
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Gracefully drain request
* HA - Webhook Register / Webhook Monitor / Certificate Renewer (#1920)
* enable leader election for webhook register
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* extract certManager to its own process
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* leader election for cert manager
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* certManager - init certs by the leader
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to webhook monitor
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update log message
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to policy controller
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to policy report controller
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* rebuild leader election config
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* start informers in leaderelection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* start policy informers in main
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* enable leader election in main
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* move eventHandler to the leader election start method
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address reviewdog comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add clusterrole leaderelection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fixed generate flow (#1936)
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* - init separate kubeclient for leaderelection - fix webhook monitor
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address reviewdog comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* cleanup Kyverno managed resources on stopLeading
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* tag v1.4.0-beta1
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix cleanup process on Kyverno stops
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* bump kind to 0.11.0, k8s v1.21 (#1980)
Co-authored-by: vyankatesh <vyankatesh@neualto.com>
Co-authored-by: vyankatesh <vyankateshkd@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Pooja Singh <36136335+NoSkillGirl@users.noreply.github.com>
|
2021-06-08 12:37:19 -07:00 |
|
shuting
|
e9952fbaf2
|
Remove secret from default resourceCache (#1878)
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
|
2021-05-04 22:10:01 -07:00 |
|
shuting
|
c816cf3d69
|
Add certificate renewer in webhook registration controller (#1692)
* load TLS pair from existing secret, if applicable
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove Kyverno managed secrets during shutdown
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* - add certificate renewer; - re-structure certificate package
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* commit un-saved file
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* eliminate throttling requests while registering webhook configs
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* disable webhook monitor (in old pod) during rolling update
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove webhook cleanup logic from init container
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update PR template
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update link to the website repo
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update repo name
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
|
2021-03-16 11:31:04 -07:00 |
|
Shuting Zhao
|
54b0afb8b9
|
clean up old webhooks before registering new ones
|
2020-12-08 15:04:24 -08:00 |
|
Jim Bugwadia
|
2344b2c305
|
1319 fix throttling (#1341)
* fix policy status and generate controller issues
* shorten ACTION column name
* update logs
Co-authored-by: Shuting Zhao <shutting06@gmail.com>
|
2020-11-30 11:22:20 -08:00 |
|
Jim Bugwadia
|
ec95724e97
|
update webhook registration and monitor (#1318)
* update webhook registration and monitor
* update log
* fix test
* improve logs
* improve logs
* format changes
* decrease interval for webhook config checks
|
2020-11-26 16:07:06 -08:00 |
|