Vishal Choudhary
c47b48bda6
feat: autogenerate image verification policies for pod controllers ( #12290 )
...
* feat: autogen for image verification
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2025-03-04 21:30:23 +00:00
shuting
84e9517bad
feat: add cel evaluator for json payload ( #12288 )
...
* feat: add cel evaluator for json payload
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: linter fixes
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: shuting <shuting@nirmata.com>
2025-03-04 15:20:26 +00:00
Vishal Choudhary
0dda60bf12
fix: autogen refactor ( #12286 )
...
* fix: autogen refactor
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: more refactor
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2025-03-04 18:55:45 +08:00
shuting
f2f724469d
chore: remove mutatingpolicies ( #12261 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2025-02-28 14:22:09 +00:00
Frank Jogeleit
5f42a0bad8
feat: context function to request resources from api server ( #12181 )
...
* feat: context function to request resources from api server
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* add chainsaw test
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* replace dclient with dynamic client
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* update test case
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
---------
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-27 13:31:03 +00:00
Vishal Choudhary
8d915b52ce
feat: add evaluator for image verification policies ( #12251 )
...
* feat: add variables
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: implement evaluator
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: build
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: unit tests
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2025-02-27 15:19:11 +08:00
Charles-Edouard Brétéché
ebaad6fbb1
feat: improve validating policy api ( #12243 )
...
* feat: improve validating policy api
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* fix
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-26 15:18:12 +00:00
shuting
7a34b60ed2
feat: create patchers and apply mutations ( #12253 )
...
* feat: create patchers and apply mutations
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* feat: create patchers and apply mutations
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2025-02-26 13:32:28 +00:00
Mariam Fahmy
75a10ac550
feat: introduce generic exception interface ( #12244 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-25 16:11:19 +00:00
Charles-Edouard Brétéché
9d56f5f2b5
feat: stop reusing admissionregistrationv1.ValidatingAdmissionPolicySpec ( #12246 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-25 14:48:47 +00:00
Charles-Edouard Brétéché
61f091ccab
chore: add cel unit tests ( #12232 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-24 14:44:46 +01:00
Charles-Edouard Brétéché
7313c7c11b
chore: add CEL unit tests ( #12230 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-24 12:12:51 +00:00
Vishal Choudhary
c056321cba
chore(refactor): refactor image verification packages ( #12220 )
...
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
2025-02-23 08:55:32 +00:00
Frank Jogeleit
fef88ab433
Validating policy audit annotations ( #12115 )
...
* feat: return single result from validating policy evaluation
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* feat: support audit annotations for validating policies
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* fix error message
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* feat: return single result from validating policy evaluation
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* feat: support audit annotations for validating policies
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* fix error message
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* fix testcase
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
* rebase with main
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
---------
Signed-off-by: Frank Jogeleit <frank.jogeleit@web.de>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-19 13:10:01 +00:00
Mariam Fahmy
76751b96b3
feat: support celexceptions in the CLI apply command ( #12182 )
...
* feat: support celexceptions in the CLI
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
* feat: add unit tests
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
---------
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-19 08:38:44 +00:00
Mariam Fahmy
86fff3b394
feat: compile and evaluate autogen rules ( #12163 )
2025-02-15 12:56:51 +08:00
Mariam Fahmy
829ab94b11
fix CEL autogen ( #12165 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-14 09:45:10 +00:00
Frank Jogeleit
05f9bb4506
feat: configure admission and background flag for ValidatingPolicies ( #12153 )
2025-02-13 17:24:45 +00:00
shuting
ce2c27c2d2
fix: sort autogen resources list ( #12162 )
...
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2025-02-13 12:49:39 +00:00
shuting
813b80d3d9
fix: update match conditions for autogen rules ( #12146 )
...
* fix: update match conditions for autogen rules
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* fix: autogen match condition prefix
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: merge main
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
Signed-off-by: shuting <shuting@nirmata.com>
2025-02-12 08:34:19 +00:00
Mariam Fahmy
7d5750a717
chore: move celexceptions to the new group ( #12143 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-11 19:05:22 +02:00
Mariam Fahmy
f012241a82
feat: add cel-autogen chainsaw tests ( #12135 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
2025-02-10 22:30:12 +00:00
Vishal Choudhary
de0d8e04f8
feat: add image data fetching support ( #12134 )
2025-02-10 18:33:01 +05:30
shuting
0548d09c21
feat: add status.autogen ( #12109 )
...
* feat: add status.autogen
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update codegen
Signed-off-by: ShutingZhao <shuting@nirmata.com>
* chore: update codegen
Signed-off-by: ShutingZhao <shuting@nirmata.com>
---------
Signed-off-by: ShutingZhao <shuting@nirmata.com>
2025-02-07 22:22:49 +05:30
Mariam Fahmy
a4c10f6bb4
feat: compile and evaluate polex's match conditions ( #12113 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-06 15:30:59 +02:00
Charles-Edouard Brétéché
02fceb64f7
feat: implement background scan ( #12101 )
...
* feat: implement background scan
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* scanner
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* refactor request
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-06 05:49:41 +02:00
Mariam Fahmy
192e655c45
chore: remove polex compiler ( #12078 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-04 11:52:19 +00:00
Charles-Edouard Brétéché
b908b1037a
feat: consider validation actions ( #12072 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-04 06:29:40 +02:00
Charles-Edouard Brétéché
e55a90cc4b
feat: implement match conditions failure policy ( #12071 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-04 00:04:26 +02:00
Charles-Edouard Brétéché
884a77a044
feat: add context provider in admission handling ( #12070 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-03 19:11:31 +02:00
Mariam Fahmy
202ab74ff5
feat: compile CEL exceptions ( #12066 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-02-03 17:17:41 +02:00
Charles-Edouard Brétéché
1cb0d1c356
feat: add message expression support to validating policies ( #12063 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-03 14:04:19 +00:00
Vishal Choudhary
7d8ed212a4
feat: create image data loader ( #12036 )
...
* feat: add image data loader to context
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: build
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: tests
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: update types
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* feat: replace crane with remote
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
* fix: linter
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
---------
Signed-off-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-03 13:42:40 +00:00
Charles-Edouard Brétéché
2bf7262814
feat: add admission request cel variable ( #12054 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-03 11:40:05 +00:00
Charles-Edouard Brétéché
0077fdae2b
feat: add validation message in cel engine response ( #12052 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-02-03 11:13:06 +00:00
Charles-Edouard Brétéché
f59b78aef0
feat: process cel engine response in webhook handler ( #12047 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-31 11:07:22 +00:00
Charles-Edouard Brétéché
b8f7a83942
feat: support adminssion review in cel engine ( #12046 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-31 08:03:59 +00:00
Charles-Edouard Brétéché
7a4e1bede9
feat: use more admission attributes ( #12044 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-30 23:58:12 +00:00
Charles-Edouard Brétéché
2ab3b2dd51
fix: cel lib get config map return type ( #12042 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-31 01:15:05 +02:00
Charles-Edouard Brétéché
f448db3f36
feat: use admission attributes ( #12041 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-30 20:36:41 +00:00
Charles-Edouard Brétéché
dfa9f2f727
feat(validating policies): add support for ns and object selectors ( #12034 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-30 01:07:01 +02:00
Charles-Edouard Brétéché
a36f8c857c
fix: don't sort cel policies ( #12028 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-29 15:00:46 +00:00
Charles-Edouard Brétéché
1d3a9294cc
feat: watch validating policies ( #12008 )
...
* feat: watch validating policies
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* rest config
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-28 16:24:40 +00:00
Charles-Edouard Brétéché
db4f7fb5e6
feat: register cel context lib ( #12007 )
...
* feat: register cel context lib
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* unit test
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-27 16:16:27 +00:00
Mariam Fahmy
b8c6931aa5
feat: add autogen package for ValidatingPolicies ( #11996 )
...
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
2025-01-27 12:36:11 +00:00
Charles-Edouard Brétéché
a5fe768a53
feat: implement cel engine context provider ( #11995 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-24 15:42:58 +00:00
Charles-Edouard Brétéché
ed80be3eff
feat: add support for more context elements ( #11986 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-24 08:37:33 +00:00
Charles-Edouard Brétéché
144bf436ed
fix: implement cel context lib correctly ( #11983 )
...
* fix: implement cel context lib correctly
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
* more changes
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
---------
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-23 11:02:33 +00:00
Charles-Edouard Brétéché
f5467fcd61
refactor: reduce generic policy interface ( #11977 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-22 16:32:30 +00:00
Charles-Edouard Brétéché
9d11e8f98c
feat: introduce evaluation results in cel engine ( #11971 )
...
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
2025-01-21 16:41:45 +00:00
