Charles-Edouard Brétéché
7bfcf7d7e2
refactor: add config support to webhook controller ( #4838 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
2022-10-07 11:32:38 +00:00
Charles-Edouard Brétéché
ebe86473fc
feat: use a dedicated policy metrics controller ( #4818 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-07 10:53:54 +00:00
Charles-Edouard Brétéché
7849fbbc8a
refactor: leader controllers management ( #4832 )
...
* refactor: leader controllers management
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* rename
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix start
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix deps
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* remove dead code
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-07 07:38:38 +00:00
Charles-Edouard Brétéché
1509fa6251
refactor: non leader controllers management ( #4831 )
2022-10-06 18:38:35 +08:00
Charles-Edouard Brétéché
74172f2079
refactor: make tls cert func not depending on cert controller ( #4820 )
...
* refactor: make tls cert func not depending on cert controller
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fmt
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* clean
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-06 08:43:43 +00:00
Charles-Edouard Brétéché
13ce3f55ed
fix: use new client in tls package ( #4746 )
...
* fix: use new client in tls package
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix import
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-06 08:11:59 +00:00
Charles-Edouard Brétéché
1c337bdf44
fix: debug mode ( #4785 )
...
* fix: debug mode
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
2022-10-06 15:41:05 +08:00
Charles-Edouard Brétéché
1db08f82dd
refactor: split main into sub funcs ( #4821 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-05 17:39:04 +00:00
Charles-Edouard Brétéché
90a62e76ce
fix: controllers start in loop ( #4815 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-05 13:40:54 +00:00
Charles-Edouard Brétéché
144afb6f0f
refactor: split main into sub func ( #4810 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-05 10:58:35 +00:00
Charles-Edouard Brétéché
3941754a92
feat: add context support to leader election ( #4811 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-05 10:19:50 +00:00
Charles-Edouard Brétéché
433c5bfd77
feat: add context funcs to logging package ( #4812 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-05 17:37:52 +08:00
Charles-Edouard Brétéché
4cb171c980
refactor: split main func for metrics ( #4796 )
...
* refactor: split main func for metrics
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* clients
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* todo
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* metrics shutdown
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-04 17:05:21 +08:00
Charles-Edouard Brétéché
f079bfb25f
fix: remove error prone debug field ( #4794 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2022-10-04 13:21:03 +05:30
Charles-Edouard Brétéché
29696c106a
refactor: split main into funcs ( #4795 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-03 22:04:56 +05:30
Addil Afzal
5f3411e588
Add security context and resource block to test ( #4712 )
...
* Add security context and resource block to test
Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>
* Add comment to test security context
Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>
* Add security context and resource block to other test container
Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>
* fix: shutdown controllers workers gracefully (#4681 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: AddilAfzal <>
* fix: split webhook handlers per failure policy (#4650 )
* fix: split webhook handlers per failure policy
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix handlers
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* rolling update
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* better error message
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: AddilAfzal <>
* refactor: use pod name as leader id (#4680 )
* refactor: use pod name as leader id
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix manifests
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* makefile
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* leader client
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>
* fix: missing client wrapper (#4703 )
* fix: missing client wrapper
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* v1beta1
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* v1alpha2
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* policy report
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>
* chore: refactor manifests related makefile targets (#4706 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>
* fix: change key used in test (#4718 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <>
* Add changelog entry
Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>
* Set user and group on test pod
Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>
* fix docs
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* Move securityContext back to container level
Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: aaz10 <6935594+AddilAfzal@users.noreply.github.com>
Signed-off-by: AddilAfzal <>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: AddilAfzal <6935594+AddilAfzal@users.noreply.github.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: AddilAfzal <>
2022-10-03 14:16:14 +00:00
Charles-Edouard Brétéché
278dbba316
fix: new cert manager controller never returns error ( #4789 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-03 13:48:34 +00:00
Charles-Edouard Brétéché
3971376814
refactor: introduce webhook controller ( #4749 )
...
* refactor: introduce webhook controller
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix linter issues
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix linter
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix imports
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* merge main
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* merge main
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix linter
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-03 11:23:02 +00:00
Charles-Edouard Brétéché
209bab2059
refactor: more context less chans ( #4764 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-03 09:19:01 +00:00
Charles-Edouard Brétéché
25cf8d6c1e
fix: add workers to the controller interface ( #4776 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-03 07:55:59 +00:00
yinka
688b4fb8e3
add package logger in files ( #4766 )
...
* add package logger in files
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* add package logger to initContainer and other files
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* helm docs
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* helm default values
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* release notes
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-02 19:45:03 +00:00
Charles-Edouard Brétéché
6e64d4fb1a
fix: parse flags error handling ( #4775 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-10-02 21:04:14 +05:30
Charles-Edouard Brétéché
ac8f4ba59c
refactor: make server owner of the cleanup chan ( #4765 )
...
* refactor: make server owner of the cleanup chan
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* gofumpt
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-30 16:13:29 +02:00
Charles-Edouard Brétéché
9aca37fe9f
refactor: use context in openapi controller ( #4760 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
2022-09-30 11:56:47 +00:00
Charles-Edouard Brétéché
287eb84d07
refactor: use context in controllers instead of chan ( #4761 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-30 16:54:47 +05:30
Charles-Edouard Brétéché
c42851a37a
refactor: use context in dynamic client instead of chan ( #4756 )
...
* refactor: use context in dynamic client instead of chan
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-30 10:12:21 +02:00
Eng Zer Jun
f40a3bc8f5
refactor: move from io/ioutil to io and os packages ( #4752 )
...
The io/ioutil package has been deprecated as of Go 1.16 [1]. This commit
replaces the existing io/ioutil functions with their new definitions in
io and os packages.
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-09-30 12:55:19 +05:30
Charles-Edouard Brétéché
8784f95cc7
refactor: split main in a couple of funcs and use local loggers ( #4754 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-30 08:13:13 +02:00
yinka
528bcbad6b
add and use package level logger ( #4750 )
...
* add and use package level logger
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* small fixes
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix comments
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* add Info and Error functions
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* small fixes
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* move function calls
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* replace init function
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-29 19:43:20 +00:00
Charles-Edouard Brétéché
8e24dbece0
fix: reports not generated ( #4743 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-29 08:39:14 +00:00
yinka
bb2e193d44
feat: allow users enable JSON logging with a --loggingFormat=json flag ( #4661 )
...
* feat: add feature flag to disable background scan (#4638 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* allow users configure JSON logging with a --logging-format=json flag
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* Clean up changes
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* added kubeconfig and context flag to kyverno apply (#4524 )
Signed-off-by: Sandesh More <sandesh.more@infracloud.io>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* chore: publish sbom result to a different repositry from an image (#4665 )
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* Fix issue for wildcard versions (#4670 )
* Fix wildcard issue
Co-Authored-By: vyankd <51167361+vyankd@users.noreply.github.com>
* Delete res.yaml
Co-Authored-By: vyankd <51167361+vyankd@users.noreply.github.com>
Co-authored-by: vyankd <51167361+vyankd@users.noreply.github.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* chore: bump minimum go version (#4677 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: namespaced policy not validated in engine (#4653 )
* fix: namespaced policy not validated in engine
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix test
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: handle auth permission for cloneList validation (#4684 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: bump net standard lib (#4685 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* small fixes
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* add json logger
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix import
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix go mod
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix go mod
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* chore: simplify go mod (#4692 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: jmespath random error handling (#4697 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* refactor: replace signal package by signal.NotifyContext (#4691 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: namespaced policy targets namespace validation and scoping them to the policy's namespace (#4671 )
Signed-off-by: praddy26 <pradeep.vaishnav4@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: shutdown controllers workers gracefully (#4681 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: split webhook handlers per failure policy (#4650 )
* fix: split webhook handlers per failure policy
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix handlers
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* rolling update
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* better error message
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* refactor: use pod name as leader id (#4680 )
* refactor: use pod name as leader id
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix manifests
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* makefile
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* leader client
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* fix: missing client wrapper (#4703 )
* fix: missing client wrapper
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* v1beta1
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* v1alpha2
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* policy report
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* chore: refactor manifests related makefile targets (#4706 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
* deps
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: damilola olayinka <holayinkajr@gmail.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Co-authored-by: Sandesh More <34198712+sandeshlmore@users.noreply.github.com>
Co-authored-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: vyankd <51167361+vyankd@users.noreply.github.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Pradeep Lakshmi Narasimha <pradeep.vaishnav4@gmail.com>
2022-09-29 07:49:29 +00:00
Charles-Edouard Brétéché
82a9eeb16c
fix: use a single leader election ( #4722 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-29 07:23:21 +00:00
Charles-Edouard Brétéché
e0ab72bb9a
feat: reports v2 implementation ( #4608 )
...
This PR refactors the reports generation code.
It removes RCR and CRCR crds and replaces them with AdmissionReport, ClusterAdmissionReport, BackgroundScanReport and ClusterBackgroundScanReport crds.
The new reports system is based on 4 controllers:
Admission reports controller is responsible for cleaning up admission reports and attaching admission reports to their corresponding resource in case of a creation
Background scan reports controller is responsible for creating background scan reports when a resource and/or policy changes
Aggregation controller takes care of aggregation per resource reports into higher level reports (per namespace)
Resources controller is responsible for watching reports that need background scan reports
I added two new flags to disable admission reports and/or background scan reports, the whole reporting system can be disabled if something goes wrong.
I also added a flag to split reports in chunks to avoid creating too large resources.
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Co-authored-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-09-28 17:15:16 +05:30
Shivansh Yadav
2a5407f7f0
fix: remove deprecation notice ( #4635 )
...
Signed-off-by: Shivansh-yadav13 <yadavshivansh@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-09-27 18:18:16 +00:00
Charles-Edouard Brétéché
481a09823f
refactor: use pod name as leader id ( #4680 )
...
* refactor: use pod name as leader id
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix manifests
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* makefile
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* leader client
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-26 16:25:27 +00:00
Charles-Edouard Brétéché
79bff1c19c
refactor: replace signal package by signal.NotifyContext ( #4691 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-09-26 14:24:32 +00:00
Sandesh More
01b1ece704
added kubeconfig and context flag to kyverno apply ( #4524 )
...
Signed-off-by: Sandesh More <sandesh.more@infracloud.io>
2022-09-20 19:05:18 +05:30
Charles-Edouard Brétéché
328fdc8b3d
feat: add feature flag to disable background scan ( #4638 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
2022-09-19 12:00:36 +00:00
Charles-Edouard Brétéché
3e5af370a5
refactor: move validation audit out of webhooks package ( #4562 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-09 09:27:07 +00:00
Charles-Edouard Brétéché
a95d61b9d7
refactor: client wrappers ( #4519 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-07 12:01:43 +08:00
Charles-Edouard Brétéché
317a3ae0bf
feat: add kyverno managed resources protection ( #4414 )
...
* feat: add kyverno managed resources protection
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* add toggle
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-09-06 15:43:04 +00:00
Charles-Edouard Brétéché
1947dafed6
fix: load policy and add tests ( #4515 )
...
* fix: load policy and add tests
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix callers
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-09-06 15:16:44 +00:00
Mritunjay Kumar Sharma
c07f6bd8a8
refactor: to remove generate cleanup controller ( #4041 )
...
- refactored cleanup controller
- handle delete policy
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
2022-09-01 09:39:06 +00:00
Charles-Edouard Brétéché
f243a7dd84
refactor: make toggles easier to define and use ( #4456 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-31 06:41:14 +00:00
shuting
3bf3dcc1af
Add the metric "kyverno_client_queries_total" ( #4359 )
...
* Add metric "kyverno_kube_client_queries_total"
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* publish metric for missing queries
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Refactor the way Kyverno registers QPS metric
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Move clientsets to a dedicated folder
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Wrap Kyverno client and policyreport client to register client query metric
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* address linter comments
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* address linter comments
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Switch to use wrapper clients
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-08-31 11:33:47 +05:30
Ayushman
1394b91898
Added kubeconfig flag support ( #4308 )
...
* Added kubeconfig flag support
Signed-off-by: Ayushman Mishra <ayushvidushi01@gmail.com>
* removed swp file
Signed-off-by: Ayushman Mishra <ayushvidushi01@gmail.com>
* changed
Signed-off-by: Ayushman Mishra <ayushvidushi01@gmail.com>
Signed-off-by: Ayushman Mishra <ayushvidushi01@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-29 06:21:42 +00:00
Charles-Edouard Brétéché
9e49b25484
refactor: makefile build targets ( #4418 )
...
* refactor: makefile
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: makefile build targets
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-08-26 15:23:04 +08:00
Jason Hall
6055713dfc
Use ko to build images ( #4366 )
...
This updates Makefile targets to build images using `docker buildx
build` to use `ko build` instead.
End-to-end tests are accomplished by building and loading the image
directly into the KinD cluster via ko.
Also:
- use GitHub Actions token to push to ghcr.io (setup-ko sets this up for us)
- allow forks to push to their forked repo's packages (useful for testing)
Signed-off-by: Jason Hall <jason@chainguard.dev>
Signed-off-by: Jason Hall <jason@chainguard.dev>
2022-08-25 20:32:40 +02:00
Prateek Pandey
6db747224a
bump golang 1.18.5 version digest in Dockerfile ( #4413 )
...
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-08-25 22:07:18 +08:00
Charles-Edouard Brétéché
144985ee5a
chore: fix golangcilint timeout ( #4388 )
...
* chore: fix golangcilint timeout
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix commit sha
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* add .gitattributes
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-08-24 21:08:24 +08:00
Ayushman
a79fb4d963
Added remove-color flag for CLI-test ( #4345 )
...
* added remove-color flag
Signed-off-by: Ayushman Mishra <ayushvidushi01@gmail.com>
* applied to print table
Signed-off-by: Ayushman Mishra <ayushvidushi01@gmail.com>
Signed-off-by: Ayushman Mishra <ayushvidushi01@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-08-19 19:11:19 +05:30
Anutosh Bhat
d92e16526f
Added appropriate logging levels to log.Info() calls wherever necessary ( #4341 )
...
* Added appropriate logging levels to log.Info() calls wherever necessary
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
* Changed logging levels to 2
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-18 13:24:59 +00:00
Anurag
0e25017ff8
update apply help message ( #4344 )
...
Signed-off-by: Anurag <81210977+kranurag7@users.noreply.github.com>
Signed-off-by: Anurag <81210977+kranurag7@users.noreply.github.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-08-18 06:52:30 +00:00
Dylan Shepard
d10f9d1b5a
trivial typo update ( #4291 )
...
Signed-off-by: Dylan Shepard <dylan@shepard.dev>
2022-08-03 04:28:06 +00:00
Jim Bugwadia
943c3a1929
use failurePolicy to block or allow requests, on policy errors ( #4183 )
...
* use failurePolicy to block or allow requests, on policy errors
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add warnings
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* codegen
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add unit tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* handle network errors
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix title conversion
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix path in generated file
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix test
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix fake metrics
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add check for klog flag initialization
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* check for flag reinitialization
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* check for flag reinitialization
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix spelling
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix flag init
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-08-02 20:24:02 +05:30
Guilhem Lettron
b03e461f25
feat: auto optimize GOMAXPROCS ( #4277 )
...
Signed-off-by: Guilhem Lettron <guilhem@barpilot.io>
2022-07-29 23:59:47 +08:00
James Callahan
975a2a21fa
fix: use an absolute path in docker entrypoint ( #4263 )
...
With a relative path, containers started with a different working
directory will fail to find the entrypoint
Fixes : #4252
Signed-off-by: James Callahan <jamescallahan@bitgo.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-07-26 07:16:01 +00:00
Tathagata Paul
9b41e2e017
Add shutdown methods for exporters and controllers ( #4214 )
...
* add shutdown methods for exporters and controllers
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
* remove shutdown exporter and add timeout in main.go
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
* move ctx timeout to main
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
* change variable order
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
2022-07-25 09:25:26 +00:00
Guilhem Lettron
96999f8995
fix: use only 1 kubernetes client ( #4256 )
...
Signed-off-by: Guilhem Lettron <guilhem@barpilot.io>
Co-authored-by: shuting <shuting@nirmata.com>
2022-07-25 13:49:51 +08:00
Anutosh Bhat
be6cc1381f
Implementing flag to show all failing tests only through the test command ( #4227 )
...
* fix kyverno cli policy-report typo (#4224 )
- fix kyverno cli policy report typo
- add shorthand for policy-report flag
Signed-off-by: Vyankatesh vyankateshkd@gmail.com
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
* Added flag for getting fail only tests
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
* Improve output message
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
* Updated flag name as per CamelCase
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-07-22 20:02:12 +05:30
Prateek Pandey
3f1997c0e8
fix split policyreport name with background scan ( #4237 )
...
- fix split policyreport name with background scan
- fix the label selector initialising
- refactor the generatePolicyName func
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-07-21 14:31:42 +05:30
Batuhan Apaydın
9af9717f16
chore: use new distroless base image provided by distroless org ( #4219 )
...
* chore: use new distroless base image provided by distroless org
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
* chore: remove unnecessary user instruction
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-07-21 06:37:56 +00:00
shuting
23a1df0d7b
Cherry-pick #4233 ( #4236 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-07-20 22:22:15 +05:30
Anutosh Bhat
81c699b4a5
Removed confusing output message for the apply and replaced no of policies by no of policy rules count in the output message ( #4229 )
...
Signed-off-by: anutosh491 <andersonbhat491@gmail.com>
2022-07-19 16:28:09 +05:30
Vyankatesh Kudtarkar
612b7fdff2
fix kyverno cli policy-report typo ( #4224 )
...
- fix kyverno cli policy report typo
- add shorthand for policy-report flag
Signed-off-by: Vyankatesh vyankateshkd@gmail.com
2022-07-18 07:12:19 +00:00
Meha Bhalodiya
06460c0e68
feat: improve flag message for disableMetricsExport ( #4194 )
...
* feat: improve flag message for disableMetricsExport
Signed-off-by: Meha Bhalodiya <mehabhalodiya@gmail.com>
* update description
Signed-off-by: Meha Bhalodiya <mehabhalodiya@gmail.com>
2022-07-15 01:07:45 +08:00
Vyankatesh Kudtarkar
e71493e5cc
Make method public ( #4207 )
...
* npmctl chnages
* revert commit
* remove comment
2022-07-13 13:37:51 -07:00
Tathagata Paul
3e2894b6fa
feat: Opentelemetry support for metrics and traces ( #3910 )
...
* integrating opentelemetry
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
* fix multiple imports
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
* fixed cli help statement
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
* added init file for metrics
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-07-11 17:49:47 +00:00
vivek kumar sahu
a37901425f
return helpful error message on invalid patched resources. ( #4129 )
...
Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-07-06 13:24:28 +05:30
Prateek Pandey
9226873e68
feat: split policy report per policy bases ( #4147 )
...
* feat: split policy report per policy bases
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* add policy name as a handler key
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* update merge change request logic
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* handle the delete resource update on policy report
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* add splitPolicyReport feature gate
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* delete old reports if splitPolicyReport feature enable
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* use trim policyname as label and create name
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* fix change request result
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-06-28 15:27:57 +00:00
shuting
77fb10a430
Clean up RCRs if the count exceeds the threshold ( #4148 )
...
* Clean up RCRs if the count exceeds the limit
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Sets reports to inactive on resourceExhausted error
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix linter
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Add a container flag changeRequestLimit
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Skip generating RCRs if resourceExhausted error occurs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* set default RCR limit to 1000
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Update log messages and CHANGELOG.md
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Address review comments
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Extract mapper to a separate file
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-06-28 06:18:57 +00:00
shuting
cd2d89bf55
Wait for informers' cache to be synced before starting controllers ( #4155 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-06-28 04:55:52 +00:00
shuting
1c329ea65f
Use kyverno namespace informer to list pods while processing URs ( #4156 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-06-27 12:44:42 +08:00
Tathagata Paul
16f8620993
added resource lists for test cli ( #4082 )
...
Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>
2022-06-20 06:38:13 +00:00
vivek kumar sahu
051b0751e0
set test.namespace value implict as resource namespace until and unless explict value is added ( #4100 )
...
Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
2022-06-15 17:59:13 +05:30
Jim Bugwadia
c3be689851
remove TUF initialization from main ( #4098 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-06-10 00:52:12 -07:00
vivek kumar sahu
7e79403324
Updated jp command flags and also added URL for help. ( #4084 )
...
* Updated jp command flags and also added URL for help.
Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
* Update cmd/cli/kubectl-kyverno/jp/jp_command.go
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-06-07 06:19:44 +00:00
Prateek Nandle
70175ae5e8
Print for failed test cases ( #4048 )
...
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-06-02 17:31:46 +00:00
Batuhan Apaydın
e756ae522a
chore(dockerfile): use buildx features for cross-compilation ( #4023 )
...
* chore(dockerfile): use buildx features for cross-compilation
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
* feat(kyverno): main container image
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-06-01 20:35:02 +08:00
Charles-Edouard Brétéché
dae3dad027
refactor: used typed admission request in ur ( #4022 )
...
* refactor: add policy event listener in ur controller (#4012 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
(cherry picked from commit cd1fa030ee
2022-05-29 07:27:14 +00:00
Shubham Nazare
165c5d9fc3
feat: Extend CLI to cover generate policies ( #3456 )
...
- Change in namespace for test-generate example
- Change cloneResource to cloneSourceResource
- Add support for namespaced Policy and fix log messages
- Add test-generate in Makefile and an example of namespaced Policy
- Fix namespaced policy issue and add comments
- Refactor according to new generate controller
- Add json tag to GeneratedResource field of RuleResponse struct
Signed-off-by: Shubham Nazare <shubham4443@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-25 14:26:22 +00:00
vivek kumar sahu
fbbe57f5e1
Request operation value by default to CREATE ( #3894 )
...
* set by default request.operation to CREATE
Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
* Added test cases
Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-25 13:59:53 +00:00
Anton Popovichenko
afc9a56d33
Feature: Add support for allowing insecure registries. ( #3983 )
...
Now you can work with self signed registries by updating your deployment with adding `--allowInsecureRegistry` to the `args` field.
Signed-off-by: Anton Popovichenko <anton.popovichenko@mendix.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-25 11:03:36 +02:00
Charles-Edouard Brétéché
73fdbd3e76
refactor: ur cleaner controller ( #3974 )
...
* fix: move ur controller filtering in reconciler
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: mark ur retry on conflict
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: test data
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: add filter back in update ur handler
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: added some logs about attempts and increased backoff
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: reconciliation logic
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: Test_Generate_Synchronize_Flag
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: small nits
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: interface and logger
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: remove useless Control and ControlInterface
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: use GetObjectWithTombstone helper
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: reoder methods
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: is not found check
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: move check in reconcile code
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: stop mutating cached resource in ur controller (#4003 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
(cherry picked from commit dac733755b
2022-05-24 13:30:00 +00:00
Charles-Edouard Brétéché
88f769cb39
fix: init container gr copy ( #3995 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-23 17:57:19 +02:00
Charles-Edouard Brétéché
caa769fb1d
refactor: clean updaterequest generator ( #3949 )
...
* refactor: clean updaterequest generator
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: clean updaterequest generator
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-23 22:39:12 +08:00
Charles-Edouard Brétéché
c1df363a0e
fix: release ur when handler pod is gone ( #3973 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-20 17:43:00 +08:00
Charles-Edouard Brétéché
1936d86623
fix: move ur controller filtering in reconciler ( #3964 )
...
* fix: move ur controller filtering in reconciler
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: mark ur retry on conflict
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: test data
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: add filter back in update ur handler
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: added some logs about attempts and increased backoff
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: reconciliation logic
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: Test_Generate_Synchronize_Flag
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: small nits
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-20 00:06:56 +08:00
Charles-Edouard Brétéché
c988d519b4
fix: mark ur retry on conflict ( #3961 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-18 06:07:13 +00:00
Charles-Edouard Brétéché
41a3f6c388
chore: make kyverno informers and listers import aliases consistent ( #3958 )
...
* chore: make kyverno api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make apimachinery api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make dclient api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make clients import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make kube informers and listers import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make kyverno informers and listers import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-18 04:02:31 +00:00
Charles-Edouard Brétéché
5243763674
chore: make dclient import aliases consistent ( #3951 )
...
* chore: make kyverno api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make apimachinery api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make dclient api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 14:40:51 +00:00
Charles-Edouard Brétéché
666bcb3c15
chore: make k8s api import aliases consistent ( #3950 )
...
* chore: make kyverno api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: make apimachinery api import aliases consistent
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 22:14:31 +08:00
Charles-Edouard Brétéché
5aaf2d8770
chore: make kyverno api import aliases consistent ( #3939 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 13:12:43 +02:00
Charles-Edouard Brétéché
0099ef54ad
chore: enable gofmt and gofumpt linters ( #3931 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-17 06:19:03 +00:00
Charles-Edouard Brétéché
c12f94d6d4
chore: enble gci linter ( #3930 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-05-17 07:56:48 +02:00
Charles-Edouard Brétéché
53adf904d6
refactor: separate policy cache and controller ( #3925 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-16 18:36:19 +02:00
Charles-Edouard Brétéché
c112aaefa1
refactor: separate resource mutation/validation handlers from server ( #3908 )
...
* refactor: webhooks server logger
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: separate policy mutation/validation handlers from server
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* separate resource mutation from server code
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-16 22:36:21 +08:00
Charles-Edouard Brétéché
70954b9995
refactor: policy cache ( #3919 )
...
* refactor: simplify policy cache
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: policy cache
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* remove update and add policies map
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: review comments
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-16 07:56:16 +00:00
Dhaval Shah
4d0d719735
fix: gosec G304 file inclusion error ( #3916 )
...
Part of KubeCon EU 2022 Bugbash
Signed-off-by: Dhaval Shah <30974879+dhavalgshah@users.noreply.github.com>
2022-05-14 16:40:04 +00:00
Charles-Edouard Brétéché
87ac548563
refactor: separate policy mutation/validation handlers from server ( #3905 )
...
* refactor: webhooks server logger
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: separate policy mutation/validation handlers from server
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-13 07:33:20 +02:00
Charles-Edouard Brétéché
526876452e
fix: docker build ( #3907 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-12 22:24:25 +01:00
Charles-Edouard Brétéché
97cf1b3e95
feat: gracefull certificates rotation support ( #3890 )
...
* refactor: remove deployment hash on certs secrets
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: add label on kyverno webhooks
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: implement update ca bundle
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* test: set very low validity and expiration intervals
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: writing secret
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* add renew ca
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* decouple ca and tls validity duration
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactored code, everything is in place to finalize implementation
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* use real validity periods
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-12 14:07:25 +00:00
Charles-Edouard Brétéché
c15ad0c520
chore: remove ca-certificates from our repository ( #3859 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-12 11:41:45 +00:00
Jim Bugwadia
36affff4b7
Timeout and init ( #3893 )
...
* increase timeout to 30s to match webhook timeout
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* initialize Fulcio roots at startup
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add TUF root
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix chart
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make helm-gen
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-12 10:55:14 +08:00
Vyankatesh Kudtarkar
31928c9507
Fix subject match selector issue in cli ( #3887 )
...
* Fix subject match selector issue in cli
* remove space
* code refactoring
2022-05-11 15:21:13 +00:00
Charles-Edouard Brétéché
8f825bb040
refactor: remove deployment hash on certs secrets ( #3886 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-11 16:58:14 +02:00
Charles-Edouard Brétéché
747f4128ef
chore: enable noctx linter ( #3888 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-11 17:34:40 +05:30
Charles-Edouard Brétéché
c2602d8181
refactor: cleanup tls package ( #3854 )
...
* refactor: init certs with certs renewer directly
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: tls package
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: cleanup tls package
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-11 08:05:13 +00:00
Charles-Edouard Brétéché
2064a69b8a
refactor: make config vars private ( #3823 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-11 06:14:30 +00:00
Charles-Edouard Brétéché
f508e9a0b8
chore: add unconvert linter ( #3867 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-10 20:28:45 +01:00
Charles-Edouard Brétéché
97e5e64fd4
chore: enable whitespace linter ( #3864 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-10 17:01:29 +00:00
Charles-Edouard Brétéché
bfc4290285
chore: enable more linters ( #3862 )
...
* chore: enable deadcode and unused linters
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* chore: enable more linters
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-10 21:20:04 +05:30
Charles-Edouard Brétéché
ec2bf3b6da
refactor: init certs with certs renewer directly ( #3853 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-10 16:08:36 +02:00
Charles-Edouard Brétéché
a981957a9d
feat: fetch tls certificate dynamically ( #3851 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-10 09:55:39 +00:00
Charles-Edouard Brétéché
967ad7cb8e
refactor: remove the need for self-signed annotation on cert secret ( #3850 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-10 08:58:51 +00:00
Charles-Edouard Brétéché
cea7a7e11e
fix: golangci-lint warnings in cmd ( #3843 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-05-09 16:55:35 +00:00
Sambhav Kothari
2dc54e5c1b
Allow variables of any kind to be defined ( #3828 )
...
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
2022-05-07 20:30:11 +00:00
Afzal Ansari
3845225db1
refactor: imported pkg redeclared and a few other unused func ( #3827 )
...
* Removes paths redeclared
Signed-off-by: afzal442 <afzal442@gmail.com>
* fixes v1 redeclared
Signed-off-by: afzal442 <afzal442@gmail.com>
* fixes mergeSucceededResults func never used
Signed-off-by: afzal442 <afzal442@gmail.com>
* fixes func unused
Signed-off-by: afzal442 <afzal442@gmail.com>
* refactors unused func
Signed-off-by: afzal442 <afzal442@gmail.com>
* refactors unused func
Signed-off-by: afzal442 <afzal442@gmail.com>
* refactors getNamespacesForRule unused
Signed-off-by: afzal442 <afzal442@gmail.com>
* refactors policyNamespace unused
Signed-off-by: afzal442 <afzal442@gmail.com>
* refactors replacing loop with ...
Signed-off-by: afzal442 <afzal442@gmail.com>
* refactors func buildPolicyLabel unused
Signed-off-by: afzal442 <afzal442@gmail.com>
* removes unused func
Signed-off-by: afzal442 <afzal442@gmail.com>
* removes unused comment
Signed-off-by: afzal442 <afzal442@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-07 16:44:57 +00:00
Moritz Johner
4d2ec26c90
CLI should respect scored annotation for warnings ( #3821 )
...
Co-authored-by: Sambhav Kothari <skothari44@bloomberg.net>
2022-05-07 13:33:50 +00:00
Jim Bugwadia
76608e315e
handle duplicate images; use container name as key ( #3779 )
...
* handle duplicate images; use container name as key
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* use OldObject for modify requests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* use unique image names
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* merge main
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* create a single annotation patch across rules and images
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fmt and change annotation key name
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-05 14:06:18 -07:00
Prateek Pandey
2af9046e13
refact: disable leader for update request controller ( #3807 )
...
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-05-05 14:19:19 +00:00
Charles-Edouard Brétéché
4d08354498
fix: remove kubeconfig ( #3802 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-05 10:12:43 +00:00
Prateek Nandle
5be6a4e2b0
removed kubeconfig flags ( #3744 )
...
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-04 21:11:21 +02:00
Charles-Edouard Brétéché
bb6e9a1ada
refactor: move config controller in controllers package ( #3790 )
...
* refactor: use typed informers and add tombstone support to webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove unstructured usage from webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: cert manager controller
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: move config controller in controllers package
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-04 16:05:03 +00:00
Charles-Edouard Brétéché
288125ebd0
chore: add informer util ( #3796 )
2022-05-04 12:39:14 +00:00
Charles-Edouard Brétéché
0a783bdc7d
chore: remove useless util NewKubeClient ( #3795 )
2022-05-04 13:14:17 +01:00
Vyankatesh Kudtarkar
fca068d0f6
Fix Cli test for image verification ( #3760 )
...
* fix Cli test for image verification
2022-05-04 04:11:59 +00:00
Charles-Edouard Brétéché
2b6549fd5b
chore: remove config flags ( #3786 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-03 17:52:10 +00:00
Charles-Edouard Brétéché
400e486b46
refactor: create a package for controllers and move certmanager in it ( #3782 )
...
* refactor: use typed informers and add tombstone support to webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove unstructured usage from webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: cert manager controller
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-04 00:23:34 +08:00
Charles-Edouard Brétéché
207459cc40
refactor: policycache package logger ( #3783 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-03 20:24:11 +08:00
Charles-Edouard Brétéché
52d1b642d6
refactor: dclient package logger ( #3778 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-03 08:24:30 +00:00
Charles-Edouard Brétéché
873e394e5f
fix: cert manager duplicate event handler ( #3772 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-03 07:37:18 +00:00
Charles-Edouard Brétéché
c79223393b
refactor: dclient package ( #3775 )
...
* refactor: replace clientset by inteface
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: dclient package
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-03 13:30:04 +08:00
Charles-Edouard Brétéché
6e07acdd87
refactor: replace clientset by inteface ( #3774 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-02 20:30:07 +00:00
Charles-Edouard Brétéché
18af55ed49
refactor: wait for cache sync ( #3765 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-03 01:41:39 +08:00
Sambhav Kothari
05c5f1b340
Allow kyverno jp to take yaml files as inputs ( #3768 )
2022-05-02 17:03:45 +00:00
Charles-Edouard Brétéché
80abda568e
fix: logger call depth ( #3759 )
...
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-05-02 15:49:39 +00:00
Charles-Edouard Brétéché
972be16ad3
refactor: remove unstructured usage from webhookconfig ( #3737 )
...
* refactor: use typed informers and add tombstone support to webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove unstructured usage from webhookconfig
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-05-02 18:58:04 +08:00
Prateek Nandle
d980a3b883
Fix test Summary printing for failure test cases ( #3749 )
...
* Test Summary printing for failure test cases
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
* shifted rc.fail block below print statement
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
2022-05-01 22:22:40 +00:00
Charles-Edouard Brétéché
96b33f6200
refactor: metrics package logger ( #3734 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-29 19:33:08 +02:00
Jim Bugwadia
e92623b015
Use inclusive language ( #3738 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-04-29 17:29:18 +01:00
shuting
a4815f77c4
Convert GenerateRequest to UpdateRequest for backward compatibility ( #3730 )
...
- Remove GenerateRequest Informer
- Rename GenerateRequest to UpdateRequest in logs and vars
- Fix initContainer leader election
- Convert GenerateRequest to UpdateRequest in initContainer
- Remove unused methods
- Add printer column ruleType to UR
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-04-29 16:35:49 +05:30
Charles-Edouard Brétéché
68c35b2f2e
refactor: remove some api unnecessary pointers (2) ( #3705 )
...
* refactor: remove some api unnecessary pointers
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* refactor: remove some api unnecessary pointers (2)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-28 17:11:14 +08:00
Jim Bugwadia
ab5171cee5
Verify digest ( #3679 )
...
* add verifyDigest to check all tags are converted to digests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add required to check for image verification annotation
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* generate CRD
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* adding imageverify true/false patch
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* patch addition logic
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* image verify CLI tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fixes and unit tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix digest mutate
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make codegen
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix policy cache
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: anushkamittal20 <anumittal4641@gmail.com>
2022-04-27 15:09:52 +00:00
Charles-Edouard Brétéché
b689f1f15c
fix: kind wash in mutate policy helper ( #3698 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-27 19:38:31 +05:30
Vyankatesh Kudtarkar
d72ecd4853
Fix test command git issue ( #3692 )
...
Co-authored-by: shuting <shutting06@gmail.com>
2022-04-27 12:49:40 +01:00
Charles-Edouard Brétéché
a6924a11ab
refactor: use typed k8s client in tls package ( #3678 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-26 20:18:14 +00:00
Charles-Edouard Brétéché
c97af0094f
refactor: config package logger ( #3683 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-26 21:55:24 +02:00
Charles-Edouard Brétéché
8c930134ef
feat: remove deprecated flags ( #3680 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-04-26 14:53:01 +00:00
Vyankatesh Kudtarkar
ae75b97cb7
Fix issue pod should not be ready until the policy cache loaded ( #3646 )
...
* fix issue pod should not be ready until the policy cache loaded.
* remove unused code
* remove testcase
* add test case
* fix issue
* add lister
* fix lift issue
* address comment
2022-04-26 06:26:46 +00:00
Vyankatesh Kudtarkar
4cbfecc0d9
remove Validate Cmd ( #3674 )
2022-04-26 04:03:03 +00:00
Vyankatesh Kudtarkar
56c90fd087
Support context variables when using foreach CLI ( #3637 )
...
* Support context variables when using foreach CLI
* add testcases
2022-04-25 16:36:31 +00:00
shuting
2c4ca04e25
bump to Go 1.17.9 ( #3671 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-04-25 13:26:00 +00:00
shuting
2a656f6de0
feat: mutate existing resources ( #3669 )
...
* feat: mutate existing, replace GR by UR in webhook server (#3601 )
* add attributes for post mutation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR informer to webhook server
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - replace gr with ur in the webhook server; - create ur for mutateExsiting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace gr by ur across entire packages
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add YAMLs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs & fix unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR deletion handler
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add api docs for v1beta1
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix clientset method
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix v1beta1 client registration
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: mutate existing - generates UR for admission requests (#3623 )
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace with UR in policy controller generate rules (#3635 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* - enable mutate engine to process mutateExisting rules; - add unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* implemented ur background reconciliation for mutateExisting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix webhook update error
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* temporary comment out new unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: mutate existing, replace GR by UR in webhook server (#3601 )
* add attributes for post mutation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR informer to webhook server
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - replace gr with ur in the webhook server; - create ur for mutateExsiting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace gr by ur across entire packages
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix missing policy.kyverno.io/policy-name label (#3599 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* refactor cli code from pkg to cmd (#3591 )
* refactor cli code from pkg to cmd
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixes in imports
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixes tests
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixed conflicts
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* moved non-commands to utils
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
* add YAMLs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs & fix unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add UR deletion handler
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add api docs for v1beta1
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix clientset method
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add-kms-libraries for cosign (#3603 )
* add-kms-libraries
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* Shifted providers to cosign package
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Add support for custom image extractors (#3596 )
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
* Update vulnerable dependencies (#3577 )
Signed-off-by: Shubham Gupta <shubham.gupta2956@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix v1beta1 client registration
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: mutate existing - generates UR for admission requests (#3623 )
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* updating version in Chart.yaml (#3618 )
* updatimg version in Chart.yaml
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
* changes from, make gen-helm
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Allow kyverno-policies to have preconditions defined (#3606 )
* Allow kyverno-policies to have preconditions defined
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Fix docs
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* replace with UR in policy controller generate rules (#3635 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - enable mutate engine to process mutateExisting rules; - add unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* implemented ur background reconciliation for mutateExisting policies
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix webhook update error
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* temporary comment out new unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Image verify attestors (#3614 )
* fix logs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix logs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* support multiple attestors
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* rm CLI tests (not currently supported)
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* apply attestor repo
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix entryError assignment
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add intermediary certs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Allow defining imagePullSecrets (#3633 )
* Allow defining imagePullSecrets
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Use dict for imagePullSecrets
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Simplify how imagePullSecrets is defined
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* Fix race condition in pCache (#3632 )
* fix race condition in pCache
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* refact: remove unused Run function from generate (#3638 )
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* Remove helm mode setting (#3628 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* refactor: image utils (#3630 )
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* -resolve lift comments; -fix informer sync issue
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* refact the update request cleanup controller
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* - fix delete request for mutateExisting; - fix context variable substitution; - improve logging
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - enable events; - add last applied annotation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* enable mutate existing on policy creation
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update autogen code
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* merge main
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* add unit tests
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* address list comments
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix "Implicit memory aliasing in for loop"
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* remove unused definitions
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* update api docs
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
Co-authored-by: Mritunjay Kumar Sharma <mritunjaysharma394@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Anushka Mittal <55237170+anushkamittal20@users.noreply.github.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
Co-authored-by: Shubham Gupta <shubham.gupta2956@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Prateek Nandle <56027872+Prateeknandle@users.noreply.github.com>
Co-authored-by: treydock <tdockendorf@osc.edu>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
2022-04-25 12:20:40 +00:00
Prateek Pandey
5054148fec
refactor: use the typed ns informer in GR controller ( #3554 )
...
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-04-21 14:12:34 +08:00
Prateek Pandey
11a4884524
refact: remove unused Run function from generate ( #3638 )
...
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-04-20 22:03:25 +08:00
Jim Bugwadia
3b1a1acd9a
Image verify attestors ( #3614 )
...
* fix logs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix logs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* support multiple attestors
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* rm CLI tests (not currently supported)
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* apply attestor repo
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix entryError assignment
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add intermediary certs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2022-04-19 08:35:12 -07:00
Mritunjay Kumar Sharma
b815caef5d
refactor cli code from pkg to cmd ( #3591 )
...
* refactor cli code from pkg to cmd
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixes in imports
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixes tests
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* fixed conflicts
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
* moved non-commands to utils
Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-04-14 12:20:18 +00:00
Prateek Pandey
9def86c49a
refactor generate controller ( #3589 )
...
* refact generate controller
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* rename the dir to background
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-04-13 12:45:04 +00:00
Shubham Gupta
f70cd4222f
Update hash of dependencies instead of mutable version ( #3582 )
...
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-04-12 10:22:38 +01:00
Charles-Edouard Brétéché
fe0ad3c68f
refactor: add os utils sub package ( #3528 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-04-01 06:59:44 +00:00
Prateek Pandey
bdb675b9c0
feat: generate support for namespace policy ( #3472 )
...
* feat: generate support for namespace policy
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* use policy spec instead
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* refactor the changes
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
* add synced flag for Namespace policies
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>
2022-03-29 13:04:33 +00:00
Charles-Edouard Brétéché
20069c13c3
feat: stop mutating rules ( #3410 )
...
* feat: stop adding autogen annotation
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: stop mutating rules
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* feat: stop mutating rules
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: use toggle
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
* fix: review comments
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-03-28 22:01:27 +08:00
Charles-Edouard Brétéché
65409890b4
refactor: remove ns lister from webhookconfig ( #3452 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
2022-03-23 16:04:02 +08:00
Charles-Edouard Brétéché
5816144912
feat: use IsReady method ( #3426 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-03-21 09:18:54 +00:00
Charles-Edouard Brétéché
4136566bd9
feat: add toggle package for feature flags ( #3419 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-03-18 16:16:42 +00:00
Charles-Edouard Brétéché
865eef248d
feat: stop adding autogen annotation ( #3379 )
...
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
2022-03-18 11:30:49 +00:00
shuting
69518b7c9c
Fix webhook re-creation error ( #3403 )
...
* fix webhook re-creation issue
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix webhook monitor blocking call
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-03-16 15:23:46 +00:00
Rob Best
7a8c19e0cb
Support registry keychain from cloud providers ( #3036 )
...
* Enable cloud provider registry keychains
It's desirable that Kyverno supports using workload identity and other
cloud provider metadata services for registry credentials.
Signed-off-by: Rob Best <robertbest89@gmail.com>
* Always initialize registry keychain
This supports using docker configuration on disk and credentials from
cloud providers without having to specify image pull secrets.
Signed-off-by: Rob Best <robertbest89@gmail.com>
* Get pull secrets from kyverno service account
It was previously using 'default'. I think it makes more sense to use
the service account that Kyverno actually runs with.
Signed-off-by: Rob Best <robertbest89@gmail.com>
* Don't split empty pull secrets list
Signed-off-by: Rob Best <robertbest89@gmail.com>
* Add KYVERNO_SVC_ACCOUNT to config manifests
Signed-off-by: Rob Best <robertbest89@gmail.com>
* Don't retrieve secrets from service account
Signed-off-by: Rob Best <robertbest89@gmail.com>
* Reduce scope of keychain changes
Just enable cloud provider keychains.
Signed-off-by: Rob Best <robertbest89@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2022-01-26 07:28:36 +00:00
shuting
376a8d3b22
Reduce throttling requests for Kyverno managed resources ( #3016 )
...
* remove resoureCache from the event controller
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* create rcr using typed client to reduce PUT throttling request
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-21 18:36:05 +08:00
Kumar Mallikarjuna
e39489f838
SharedInformers for WebhookConfigurations ( #3007 )
...
* SharedInformers for WebhookConfigurations
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Add GVK to typed resources
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Remove ToUnstructured()
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Remove default informers from Resource Cache
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Formatted files
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
2022-01-19 15:57:32 +00:00
Abhinav Sinha
b5341b685d
Support namespaceSelector with dynamic webhook enabled ( #2953 )
...
* Support `namespaceSelector` with dynamic webhook enabled
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
* Implemented suggested changes
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
* Implemented suggest changes
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
2022-01-19 07:59:08 +00:00
Naman Lakhwani
1580837526
refactoring github actions to remove duplication and enhancement for versioned sbom's ( #2979 )
...
* initial commit
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
* adding docker-buildx-builder to makefile
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
* reverting git describe in makefile
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
* uploading sbom for each kyverno image
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
* small nits
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
* scanning image before pushing and removed cosign.pub
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
2022-01-18 15:07:59 -08:00
Kumar Mallikarjuna
771d62b735
Added Kyverno specific SharedInformerFactory ( #2987 )
...
* Added Kyverno specific SharedInformerFactory
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Replace ToUnstructured()
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Add GVK to returned resource
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
Co-authored-by: shuting <shutting06@gmail.com>
2022-01-18 15:52:48 +00:00
shuting
b6447e0649
Remove resourceCache from engine ( #3013 )
...
* update log messages
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* remove resourceCache from the background controller when:
- register resource scope
- list resources per namespace
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* - use client call for configmap lookup;
- remove resourceCache from policy controller, webhook server and generate controller
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-18 12:59:35 +00:00
shuting
de6c6f2199
cherry-pick #2980 ( #3001 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2022-01-17 13:00:39 +00:00
Sambhav Kothari
1af9e48b0d
Add image data to validate image configs ( #2946 )
...
* Add image data to validate image configs
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
* Add tests for image context
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
* Add e2e test cases for image size policy
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
2022-01-17 04:06:44 +00:00
Boojapho
c8e93356fe
chore: bump golang to 1.7.6 in dockerfiles ( #2968 )
...
Signed-off-by: Michael McLeroy <michaelmcleroy@cloudfitsoftware.com>
Co-authored-by: Michael McLeroy <michaelmcleroy@cloudfitsoftware.com>
Co-authored-by: shuting <shutting06@gmail.com>
2022-01-14 07:57:33 +00:00
Kumar Mallikarjuna
037a320fba
Added TLS annotation check in the initContainer ( #2956 )
...
* Added TLS annotation check in the initContainer
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Error checks
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Refactor annotation addition code
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Strict error reporting
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Error handling for Secrets
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Updated error conditions
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
* Update for nil error
Signed-off-by: Kumar Mallikarjuna <kumar@nirmata.com>
2022-01-11 08:47:24 +00:00
Jim Bugwadia
a9fef256c7
updates for foreach and mutate ( #2891 )
...
* updates for foreach and mutate
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* allow tests to pass on Windows
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter check
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add elementIndex variable
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix jsonResult usage
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add mutate validation and fix error in validate.foreach
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update message
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* do not skip validation for all array entries when one is skipped
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add foreach tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix format errors
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* remove unused declarations
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* revert namespaceWithLabelYaml
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix mutate of element list
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update CRDs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Update api/kyverno/v1/policy_types.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/forceMutate.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/forceMutate.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/forceMutate.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/mutation.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/mutation.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/mutation.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/validate/validate.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update pkg/engine/validate/validate.go
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update test/cli/test/custom-functions/policy.yaml
Co-authored-by: Steven E. Harris <seh@panix.com>
* Update test/cli/test/foreach/policies.yaml
Co-authored-by: Steven E. Harris <seh@panix.com>
* accept review comments and format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add comments to strategicMergePatch buffer
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* load context and evaluate preconditions foreach element
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add test for foreach mutate context and precondition
* precondition testcase
* address review comments
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update message
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Steven E. Harris <seh@panix.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
2022-01-05 09:36:33 +08:00
Frank Jogeleit
abb5bd2947
Add SelectorLabel to (Cluster)PolicyReporter resources ( #2841 )
...
Signed-off-by: Frank Jogeleit <frank.jogeleit@lovoo.com>
Co-authored-by: shuting <shutting06@gmail.com>
2021-12-17 05:03:52 +00:00
Sebastian Widmer
80664d339f
Add command-line flags to allow setting client rate limits (QPS/Burst) ( #2797 )
...
* Add `-clientRateLimitQPS` and `-clientRateLimitBurst` flags to allow controlling client rate limits.
Signed-off-by: Sebastian Widmer <sebastian.widmer@vshn.net>
* Return error if QPS is higher than max value of float32
Signed-off-by: Sebastian Widmer <sebastian.widmer@vshn.net>
2021-12-08 14:03:07 +01:00
Marcus Noble
1966c82c6d
Fix various go lint issues ( #2639 )
...
* Fix various go lint issues
Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>
* Fix if mistake
Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>
* Simplified returns
Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>
2021-10-29 17:06:03 +02:00
Siddharth Lal
11a9eb3fb9
switched to default serve mux ( #2592 )
...
Signed-off-by: Siddharth Lal <siddharthlal25@gmail.com>
2021-10-26 16:09:07 -07:00
shuting
0ee045be4f
update Golang base image to 1.17.2 ( #2596 )
...
Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-25 21:32:07 -07:00
Jim Bugwadia
36763d8cc2
Merge pull request #2536 from ShubhamPalriwala/signature-and-sbom-repo
...
Shift Image signatures and SBOM to different repo
2021-10-15 07:09:44 -07:00
Bricktop
ab8822963b
Add exclusions to make gosec happy ( #2540 )
...
* Add exclusions to make gosec happy
Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>
* Add forgotten file
Signed-off-by: Marcel Mueller <marcel.mueller1@rwth-aachen.de>
2021-10-13 15:05:13 -07:00
ShubhamPalriwala
5417b9d3c1
feat: shift sigs and sbom
...
Signed-off-by: ShubhamPalriwala <spalriwalau@gmail.com>
2021-10-13 21:34:04 +05:30
Kumar Mallikarjuna
254be4c1d3
Leader Election for initContainer ( #2489 )
...
* Local build
Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
* Leader Election for initContainer
Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
* Lease deletion
Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
* Use wrc client
Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
* log error out
Signed-off-by: ShutingZhao <shutting06@gmail.com>
Co-authored-by: ShutingZhao <shutting06@gmail.com>
2021-10-06 16:12:07 -07:00
Anushka Mittal
efe0c28f6b
Fixes port names in flags ( #2490 )
...
* fixed port names in flags
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* minor fixes
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
2021-10-06 14:41:07 -07:00
treydock
b460490984
Improve init container to use DeleteCollection to remove policy reports ( #2477 )
...
* Improve init container to use DeleteCollection to remove policy reports
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Do not use go routine for each namespace
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
2021-10-06 11:25:38 -07:00
shuting
c2751828d1
update the flag to "autoUpdateWebhooks" ( #2482 )
...
Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-06 11:24:51 -07:00
Anushka Mittal
3914c513a8
Changing flag names for consistency ( #2467 )
...
* changing flag names for consistency
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* changes for backward compatibility
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
* updated the CHANGELOG.md
Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>
2021-10-06 10:32:48 -07:00
shuting
b10947b975
Dynamic webhooks ( #2425 )
...
* support k8s 1.22, update admissionregistration.k8s.io/v1beta1 to admissionregistration.k8s.io/v1
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - add failurePolicy to policy spec; - fix typo
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - add schema validation for failurePolicy; - add a printer column
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* set default failure policy to fail if not defined
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* resolve conflicts
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix missing type for printerColumn
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* refactor policy controller
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* add webhook config manager
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - build webhook objects per policy update; - add fail webhook to default webhook configurations
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix panic on policy update
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* build default webhook: match empty if autoUpdateWebhooks is enabled, otherwise match all
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* - set default webhook configs rule to empty; - handle policy deletion
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* reset webhook config if policies with a specific failurePolicy are cleaned up
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* handle wildcard pocliy
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* update default webhook timeout to 10s
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* cleanups
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* added webhook informer to re-create it immediately if missing
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* update tag webhookTimeoutSeconds description
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix e2e tests
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* fix linter issue
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* correct metric endpoint
Signed-off-by: ShutingZhao <shutting06@gmail.com>
* add pol.generate.kind to webhooks
Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-05 00:15:09 -07:00
Jim Bugwadia
23af42dc92
allow alternate image repositories ( #2393 )
...
* allow alternate image repositories
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* generate CRD YAMLs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-09-16 16:11:38 -07:00
Yashvardhan Kukreja
5fcd9b83d9
added: support for metrics configuration, periodic metrics cleanup and selective namespace whitelisting and blacklisting for metrics ( #2288 )
...
Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>
2021-09-10 14:39:12 -07:00
Frank Jogeleit
c522343c03
Update PolicyReport CRDs to wgpolicyk8s.io/v1alpha2 ( #1825 )
2021-08-21 10:35:17 -07:00
Jim Bugwadia
7e053cccd7
Merge branch 'main' of https://github.com/kyverno/kyverno into main
2021-07-20 21:49:53 -07:00
shuting
b2515fa9eb
Add default image registry to patched resource ( #2166 )
2021-07-20 21:20:37 -07:00
Jim Bugwadia
1fdb49e47a
fix typo
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-20 09:29:58 -07:00
Jim Bugwadia
003c865ab9
deprecate policy status ( #2136 )
...
* deprecate policy status
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* make fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* remove policy status tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix generate metrics
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-14 12:18:59 -07:00
Jim Bugwadia
13caaed8b7
Feature/cosign ( #2078 )
...
* add image verification
* inline policy list
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* cosign version and dependencies updates
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add registry initialization
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add build tag to exclude k8schain for cloud providers
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add build tag to exclude k8schain for cloud providers
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* generate deep copy and other fixtures
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix deep copy issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* mutate images to add digest
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add certificates to Kyverno container for HTTPS lookups
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* align flag syntax
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update docs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update dependencies
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update dependencies
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* patch image with digest and fix checks
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* hardcode image for demos
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add default registry (docker.io) before calling reference.Parse
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix definition
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* increase webhook timeout
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix args
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* run gofmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* rename for clarity
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix HasImageVerify check
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* align make test commands
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* align make test commands
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* align make test commands
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix linter error
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* handle API conflict and retry
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix reviewdog issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix make for unit tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* improve error message
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix durations
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* handle errors in tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* print policy name
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* update tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add retries and duration to error log
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix time check in tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* round creation times in test
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix retry loop
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* remove timing check for policy creation
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix e2e error - policy not found
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update string comparison method
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix test Generate_Namespace_Label_Actions
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add debug info for e2e tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix error
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix generate bug
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix format
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add check for update operations
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* increase time for deleteing a resource
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix check
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Shuting Zhao <shutting06@gmail.com>
2021-07-09 18:01:46 -07:00
Valentin Velkov
63f4c9a884
Configurable success events on policies & resources. Generating failure events on policies by default. ( #1939 )
...
* Remove unused event.Reason const
Signed-off-by: Velkov <valentin.velkov@sap.com>
* Generate failure events on policies
Signed-off-by: Velkov <valentin.velkov@sap.com>
* Generate success events on policy
Signed-off-by: Velkov <valentin.velkov@sap.com>
* Introduce 'generateSuccessEvents' flag
Signed-off-by: Velkov <valentin.velkov@sap.com>
* Unit tests & chart fix
Signed-off-by: Velkov <valentin.velkov@sap.com>
2021-06-29 14:43:11 -07:00
shuting
6f07ea407f
Customize namespaceSelector of Webhookconfigurations ( #2003 )
...
* customize namespaceSelector of webhook configurations from configMap
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update webhook configurations base on UPDATEs of Kyverno ConfigMap
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* register webhook configurations with the namespaceSelector from ConfigMap
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address golint comment
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* validate webhooks config format
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix NotDefined scenario
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-06-14 13:01:40 -07:00
Vineeth Reddy
6d2cb87370
change min support kubernetes version to 1.16 for kyverno 1.4 ( #1935 )
...
* change min support kubernetes version to 1.16 for kyverno 1.4
Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>
* migrate deployment to apps/v1
Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>
2021-06-08 13:14:28 -07:00
shuting
e9a972a362
feat: HA ( #1931 )
...
* Fix Dev setup
* webhook monitor - start webhook monitor in main process
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leaderelection
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* - add isLeader; - update to use configmap lock
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* - add initialization method - add methods to get attributes
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove newContext in runLeaderElection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to GenerateController
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* skip processing for non-leaders
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* skip processing for non-leaders
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add leader election to generate cleanup controller
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Gracefully drain request
* HA - Webhook Register / Webhook Monitor / Certificate Renewer (#1920 )
* enable leader election for webhook register
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* extract certManager to its own process
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* leader election for cert manager
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* certManager - init certs by the leader
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to webhook monitor
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update log message
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to policy controller
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add leader election to policy report controller
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* rebuild leader election config
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* start informers in leaderelection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* start policy informers in main
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* enable leader election in main
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* move eventHandler to the leader election start method
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address reviewdog comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add clusterrole leaderelection
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fixed generate flow (#1936 )
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* - init separate kubeclient for leaderelection - fix webhook monitor
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* address reviewdog comments
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* cleanup Kyverno managed resources on stopLeading
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* tag v1.4.0-beta1
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix cleanup process on Kyverno stops
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* bump kind to 0.11.0, k8s v1.21 (#1980 )
Co-authored-by: vyankatesh <vyankatesh@neualto.com>
Co-authored-by: vyankatesh <vyankateshkd@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Pooja Singh <36136335+NoSkillGirl@users.noreply.github.com>
2021-06-08 12:37:19 -07:00
Yashvardhan Kukreja
b0ef84c581
added e2e tests: ensuring the availability of kyverno's prometheus metrics-server
...
Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>
2021-05-24 08:09:17 +05:30
Yashvardhan Kukreja
bb80e1b641
added: initial prometheus client setup
...
Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>
2021-05-16 13:06:14 +05:30
shuting
e9952fbaf2
Remove secret from default resourceCache ( #1878 )
...
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-05-04 22:10:01 -07:00
Vyankatesh Kudtarkar
ab8d077384
Fix Dev setup ( #1815 )
...
Co-authored-by: vyankatesh <vyankatesh@neualto.com>
2021-04-21 12:35:13 -07:00
Shuting Zhao
4d01f76797
- fix variable validation; - update log level
...
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-31 13:24:36 -07:00
treydock
0131f375f1
Register webhooks only once service endpoint is ready ( #1741 )
...
* Register webhooks only once service endpoint is ready
Fixes #1740
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Wait for webhook to become ready in main loop
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Better error handling and logging around checking endpoint
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
* Log soft failure as info, remove redundant return
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
2021-03-30 13:46:01 -07:00
shuting
fd9acf21a7
Auto-recover policy report ( #1730 )
...
* auto-recover policy report
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add flag background-scan to tune this interval
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* cleanup webhook configurations when Kyverno deployment is deleted
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* reconcile policy reports if Kyverno Configmap changes
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-25 12:28:03 -07:00
shuting
c08843ef77
Add Images info to variables context ( #1725 )
...
* - remove supportMutateValidate; - refactor new context in the webhook
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add ImageInfo to variables context
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* revert unexpected changes
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-23 10:34:03 -07:00
Shuting Zhao
c3360b7389
make the number of generate workers configurable
...
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-22 19:14:06 -07:00
shuting
c816cf3d69
Add certificate renewer in webhook registration controller ( #1692 )
...
* load TLS pair from existing secret, if applicable
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove Kyverno managed secrets during shutdown
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* - add certificate renewer; - re-structure certificate package
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* commit un-saved file
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* eliminate throttling requests while registering webhook configs
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* disable webhook monitor (in old pod) during rolling update
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove webhook cleanup logic from init container
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update PR template
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update link to the website repo
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update repo name
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-16 11:31:04 -07:00
shuting
70d90ffb06
- remove preProcessJSONPatches; - update local Dockerfile ( #1703 )
...
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-15 10:29:46 -07:00
shuting
c8a41d83f7
Update Dockerfile; remove securityContext runAsUser ( #1695 )
...
* - run Kyverno with specific uid; - remove "runAsUser" from deployment manifest
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add LD_FLAGS when push Kyverno images
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* start Kyverno with UID 10001
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* update initContainer and CLI Dockerfiles
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-10 14:47:09 -08:00
Raj Babu Das
0b832a038d
Adding multi arch support in all kyverno components (AMD6 and ARM64) ( #1542 )
...
* Adding multi arch support
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* Adding multi arch support
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* minor refactors
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* adding buildx action in e2e.yaml
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* Adding kyvernopre
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* Adding kyvernopre
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* Adding amd build
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* Adding go env
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* minor fix
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* removing docker tag
Signed-off-by: Raj Das <mail.rajdas@gmail.com>
* Adding local dockerfile build command
Signed-off-by: rajdas98 <mail.rajdas@gmail.com>
2021-02-18 18:09:01 -08:00
shuting
2f2d6c2e38
Upgrade client libraries to 0.20.2 ( #1547 )
...
* upgrade clients to 0.20.2
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* remove debug log
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix unit tests
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix e2e test
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-02-07 20:26:56 -08:00
shuting
bd44dbff41
Reduce RCR Throttling ( #1545 )
...
* buffer report change requests
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix clusterReportChangeRequest
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* further reduce RCRs in background scan
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-02-07 19:46:50 -08:00
shuting
39b27a16ed
Reduce throttling requests (GET) ( #1522 )
...
* add resource lister to even handler
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* use lister to get Kyverno deployment
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* add lister for webhook configs
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-02-05 09:58:10 -08:00
Pooja Singh
32522e7827
namespace selector ( #1532 )
...
* updated crd with namespace selector
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added logic for validate
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added condition in utils for namespace labels
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added function for extracting namespace label using lister
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added logic for generate
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added lister in generate
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* commented generate controller changes
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns lister
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label in apply.go
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label in generation.go
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label in mutation.go
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* added ns label for validation
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
* using dynaminc informer
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-02-03 13:09:42 -08:00
Jim Bugwadia
e8e3b93a5f
api server lookups ( #1514 )
...
* initial commit for api server lookups
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* initial commit for API server lookups
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Enhancing dockerfiles (multi-stage) of kyverno components and adding non-root user to the docker images (#1495 )
* Dockerfile refactored
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* Adding non-root commands to docker images and enhanced the dockerfiles
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* changing base image to scratch
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* Minor typo fix
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* changing dockerfiles to use /etc/passwd to use non-root user'
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* minor typo
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* minor typo
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* revert cli image name (#1507 )
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* Refactor resourceCache; Reduce throttling requests (background controller) (#1500 )
* skip sending API request for filtered resource
* fix PR comment
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fixes https://github.com/kyverno/kyverno/issues/1490
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix bug - namespace is not returned properly
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* reduce throttling - list resource using lister
* refactor resource cache
* fix test
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix label selector
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix build failure
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix merge issues
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* fix unit test
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
* add nil check for API client
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Raj Babu Das <mail.rajdas@gmail.com>
Co-authored-by: shuting <shutting06@gmail.com>
2021-02-01 12:59:13 -08:00
shuting
c692263177
Refactor resourceCache; Reduce throttling requests (background controller) ( #1500 )
...
* skip sending API request for filtered resource
* fix PR comment
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fixes https://github.com/kyverno/kyverno/issues/1490
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix bug - namespace is not returned properly
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* reduce throttling - list resource using lister
* refactor resource cache
* fix test
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix label selector
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fix build failure
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-01-29 17:38:23 -08:00
Raj Babu Das
9da94d5220
Enhancing dockerfiles (multi-stage) of kyverno components and adding non-root user to the docker images ( #1495 )
...
* Dockerfile refactored
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* Adding non-root commands to docker images and enhanced the dockerfiles
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* changing base image to scratch
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* Minor typo fix
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* changing dockerfiles to use /etc/passwd to use non-root user'
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* minor typo
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
* minor typo
Signed-off-by: Raj Babu Das <mail.rajdas@gmail.com>
2021-01-29 11:58:07 -08:00
Jim Bugwadia
05da4190f8
handle discovery errors for metrics API group ( #1494 )
...
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-01-24 11:34:02 -08:00
shuting
62a4a3a7da
Reduce throttling - skip sending API request for filtered resources ( #1489 )
...
* skip sending API request for filtered resource
* fix PR comment
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
* fixes https://github.com/kyverno/kyverno/issues/1490
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-01-21 18:58:53 -08:00
shuting
d82f19be4e
Feature/fix dev mode execution ( #1477 )
...
* add serverIP to X.509 certificate SANs
* disable webhook monitor in debug mode
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2021-01-20 15:25:27 -08:00
shuting
3908808e7a
Rename filterK8Resources to filterK8sResources ( #1452 )
...
* Remove lock embedded in CRD controller, use concurrent map to store shcemas
* delete rcr info from data store
* skip policy validation on status update
* - remove status check in policy mutation; - fix test
* Remove fqdncn flag
* add flag profiling port
* skip policy mutation & validation on status update
* sync policy status every minute
* update log messages
* rename filterK8Resources to filterK8sResources
2021-01-07 11:27:50 -08:00
shuting
52d091c5a3
Improve / clean up code ( #1444 )
...
* Remove lock embedded in CRD controller, use concurrent map to store shcemas
* delete rcr info from data store
* skip policy validation on status update
* - remove status check in policy mutation; - fix test
* Remove fqdncn flag
* add flag profiling port
* skip policy mutation & validation on status update
* sync policy status every minute
* update log messages
2021-01-06 16:32:02 -08:00
shuting
35aa3149c8
Remove lock embedded in CRD controller, use concurrent map to store shcemas ( #1441 )
2021-01-04 23:17:17 -08:00
NoSkillGirl
c66e2a7058
adding label to clone source
2020-12-29 18:04:20 +05:30
NoSkillGirl
1412b922f7
folder structure refactoring
2020-12-29 16:47:54 +05:30
NoSkillGirl
dfaeaa7f8e
add lables update fix
2020-12-29 16:35:48 +05:30
NoSkillGirl
9913af0253
adding GR for older GR's
2020-12-29 15:35:12 +05:30
NoSkillGirl
53e2e38cd3
enqueing gr on getting deleted
2020-12-24 12:28:32 +05:30
shuting
3c5f9f8888
1398 - Reduce RCR throttling requests ( #1406 )
...
* reduce RCR throttling requests by merging policy application (policy - namespace) results into single RCR
* - refactor policy controller; - fix RCR issue
* - refactor RCR controller; - fix cpolr on ns update; - reduce throttling when getting resources; - fix tests
* update CRD schema
* fix typo
2020-12-21 11:04:19 -08:00
Pooja Singh
bff7229678
1345 use GR lister ( #1387 )
...
* improved log message
* added lister for GR
* added label to GR
* added wait for cache is sync
2020-12-14 14:52:13 -08:00
shuting
39421ca6e9
Reduce RCR throttling requests ( #1376 )
...
* reduce RCR throtlling requests
* update logger in init container
2020-12-09 09:29:52 -08:00
shuting
c1764a85d1
1370 clean up stale RCRs ( #1373 )
...
* remove env "POLICY-TYPE"
* clean up resource in goroutine
* clean up stale RCRs on namespace deletion
* go vet
* clean up code
2020-12-08 23:04:16 -08:00
shuting
630a9cc94c
Fix Kyverno crash when CRD is not installed ( #1353 )
...
* ignore Kyverno CRDs existence check when server is not available
* clean up cluster / reportChangeRequest
* resolve PR comments
2020-12-03 19:19:36 -08:00
shuting
2ec5a0fa42
1319 fix throttling ( #1348 )
...
* fix policy status and generate controller issues
* shorten ACTION column name
* update logs
* improve naming
* add temp logs for troubleshooting
* cleanup logs
* apply generate policy to old & new resource in webhook
* cleanup log messages
* cleanup log messages
* cleanup log messages
* fix clean up of policy report in init container
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2020-12-01 12:30:08 -08:00
Shuting Zhao
6e1be1c901
fix https://github.com/kyverno/kyverno/issues/1324
2020-11-30 12:54:48 -08:00
Jim Bugwadia
2344b2c305
1319 fix throttling ( #1341 )
...
* fix policy status and generate controller issues
* shorten ACTION column name
* update logs
Co-authored-by: Shuting Zhao <shutting06@gmail.com>
2020-11-30 11:22:20 -08:00
Jim Bugwadia
ec95724e97
update webhook registration and monitor ( #1318 )
...
* update webhook registration and monitor
* update log
* fix test
* improve logs
* improve logs
* format changes
* decrease interval for webhook config checks
2020-11-26 16:07:06 -08:00
Shuting Zhao
2292bf860b
update policyreport group to wgpolicyk8s.io
2020-11-11 15:09:07 -08:00
shuting
5e07ecc5f3
Add Policy Report ( #1229 )
...
* add report in cli
* policy report crd added
* policy report added
* configmap added
* added jobs
* added jobs
* bug fixed
* added logic for cli
* common function added
* sub command added for policy report
* subcommand added for report
* common package changed
* configmap added
* added logic for kyverno cli
* added logic for jobs
* added logic for jobs
* added logic for jobs
* added logic for cli
* buf fix
* cli changes
* count bug fix
* docs added for command
* go fmt
* refactor codebase
* remove policy controller for policyreport
* policy report removed
* bug fixes
* bug fixes
* added job trigger if needed
* job deletation logic added
* build failed fix
* fixed e2e test
* remove hard coded variables
* packages adde
* improvment added in jobs sheduler
* policy report yaml added
* cronjob added
* small fixes
* remove background sync
* documentation added for report command
* remove extra log
* small improvement
* tested policy report
* revert hardcoded changes
* changes for demo
* demo changes
* resource aggrigation added
* More changes
* More changes
* - resolve PR comments; - refactor jobs controller
* set rbac for jobs
* add clean up in job controller
* add short names
* remove application scope for policyreport
* move job controller to policyreport
* add report logic in command apply
* - update policy report types; - upgrade k8s library; - update code gen
* temporarily comment out code to pass CI build
* generate / update policyreport to cluster
* add unit test for CLI report
* add test for apply - generate policy report
* fix unit test
* - remove job controller; - remove in-memory configmap; - clean up kustomize manifest
* remove dependency
* add reportRequest / clusterReportRequest
* clean up policy report
* generate report request
* update crd clusterReportRequest
* - update json tag of report summary; - update definition manifests; - fix dclient creation
* aggregate reportRequest into policy report
* fix unit tests
* - update report summary to optional; - generate clusterPolicyReport; - remove reportRequests after merged to report
* remove
* generate reportRequest in kyverno namespace
* update resource filter in helm chart
* - rename reportRequest to reportChangeRequest; -rename clusterReportRequest to clusterReportChangeRequest
* generate policy report in background scan
* skip generating report change request if there's entry results
* fix results entry removal when policy / rule gets deleted
* rename apiversion from policy.kubernetes.io to policy.k8s.io
* update summary.* to lower case
* move reportChangeRequest to kyverno.io/v1alpha1
* remove policy report flag
* fix report update
* clean up policy violation CRD
* remove violation CRD from manifest
* clean up policy violation code - remove pvGenerator
* change severity fields to lower case
* update import library
* set report category
Co-authored-by: Yuvraj <yuvraj.yad001@gmail.com>
Co-authored-by: Yuvraj <10830562+evalsocket@users.noreply.github.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
2020-11-09 11:26:12 -08:00
Jim Bugwadia
48b98bd17b
allow text after patch versions ( #1230 )
2020-11-02 22:14:36 -08:00
Shuting Zhao
cdc5190c56
update nirmata/kyverno to kyverno/kyverno
2020-10-07 11:12:31 -07:00
