1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 16:06:56 +00:00
Commit graph

517 commits

Author SHA1 Message Date
Yuvraj
2641120907
Generate policy does not work on namespace update (#1085)
* added logic for handling generate request

* generate rules added

* added label condition for generate

* remove extra logs

* remove extra logs

* buf fixed

* bug fixed

* added logic for delete gr

* log fixed

* documentation changed

* remove best practices changes

* bug fix

* added best pratice
2020-08-31 11:25:13 -07:00
NoSkillGirl
6b6897f6e2 working version of CRD validation for CLI 2020-08-31 18:19:09 +05:30
NoSkillGirl
df154537f1 Added provision to pass cli values from a file 2020-08-22 01:07:04 +05:30
NoSkillGirl
afe98bb93c Added set flag 2020-08-22 01:07:03 +05:30
Mohan B E
f60deecdce
Feature/namespaced policy 280 (#1058)
* namespaced policy crd and cache

* modified main.go

* removed kyverno

* implemented policy violation generator for namespaced policy on audit

* modified cache

* added validation for cluster resource types

* install.yaml

* install.yaml

* removed namespaces from crd and refactored code

* modified NamespacePolicy to Policy

* added ClusterRole aggregate for policies

* modified clusterrole
2020-08-19 09:07:23 -07:00
shuting
db342d0ece
Improvements in webhook (#1057)
* remove empty flag

* format code

* revert change in install.yaml

* -  skip mutation for a deleting resource - add debug log

* format code

* revert change in install.yaml

* -  skip mutation for a deleting resource - add debug log
2020-08-17 11:17:07 -07:00
shuting
d6062fdd47
Add go fmt (#1055)
* remove empty flag

* format code

* revert change in install.yaml
2020-08-14 12:21:06 -07:00
Yuvraj
73840e3c5f
configrable rules added (#1017)
* configrable rules added

* fix exclude group logic from code

* flag added in yaml

* exclude username added

* exclude username added

* config interface implimented

* configure exclude username

* get role ref

* test case fixed

* panic fix

* move from interface to slice

* exclude added in mutate

* trim strings

* configmap changes added

* kustomize changes for configmap

* k8s resources added
2020-08-07 17:09:24 -07:00
shuting
39de46fe39
983 kustomize support (#1026)
* prototype - strategic merge patch

* add end to end test

* add engine strategic merge patch support

* set webhook reinvocationPolicy to IfNeeded

* refactor engine mutate code

* support JMESPath in strategic merge patch

* implement patchesJson6902

* update doc

* resolve pr comments
2020-08-05 09:11:23 -07:00
shuting
75a7543c6d
Events fix (#1006)
* remove success event

* remove event success message

* remove events generated on clusterpolicy
2020-07-20 20:30:02 +05:30
evalsocket
629267c40a policy group change 2020-07-15 17:19:20 -07:00
evalsocket
37e3c08476 policy name added in labels 2020-07-15 14:30:00 -07:00
shuting
67f7ed0ed3
Bug fix: perform OR across types in UserInfo (#992)
* remove policy name cache entry on policy DELETE

* buugfix: perform OR in userInfo match

* add function description
2020-07-14 20:23:30 -07:00
Yuvraj
2d11d4a695
Error message update (#988)
* error message update
2020-07-15 01:20:34 +05:30
Yuvraj
4535f43283
Added Synchronize flag in Generate Request (#980)
* fix Synchronize flag issue
2020-07-14 02:12:11 +05:30
NoSkillGirl
fed8d7f967 small fixes 2020-07-11 18:12:35 +05:30
NoSkillGirl
c26a414182 auto generating policy rules 2020-07-11 17:57:31 +05:30
NoSkillGirl
b23cfa9f93 added auto-gen policy rule for cli 2020-07-11 17:57:07 +05:30
NoSkillGirl
f0fab9499e temp 2020-07-11 17:56:14 +05:30
evalsocket
c319add062 used raw object 2020-07-10 17:01:48 -07:00
evalsocket
a64789c59d code fixes 2020-07-10 16:59:17 -07:00
evalsocket
8cf5cd70fe remove log 2020-07-10 15:43:49 -07:00
evalsocket
26ae7e2052 merge master changes 2020-07-10 15:25:05 -07:00
evalsocket
014db64ed2 validation added for deny request for generated resource 2020-07-10 11:48:27 -07:00
shuting
87fa77fbcc
965 add validate audit handler (#967)
* store policy names cache to reduce lookup time

* add validate audit handler

* fix #958, remove auto-gen annotation on Pod

* formatting code

* update processTime to readable format

* #586, add back unit test

* update logging info

* remove unused interface

* handle generate policy in a single thread in weboook

* resolve pr comments
2020-07-09 11:48:34 -07:00
Yuvraj
85d2ac9f84 added validation log 2020-07-09 05:48:35 -07:00
Yuvraj
b708770be1 added label for synchronize 2020-07-08 14:22:32 -07:00
Yuvraj
604dc395d8 check added for kyverno managed resource 2020-07-08 06:18:18 -07:00
shuting
ed52bd3d9f
Add policy cache based on policyType (#960)
* add policy cache based on policyType

* fetch policy from cache in webhook

* add unit test for policy cache

* update log for exclude resources filter

* skip webhook mutation on DELETE operation

* remove duplicate k8s version check

* add description
2020-07-02 12:49:10 -07:00
Pooja Singh
ac5d69895a
removing hardcoded namespace from the code (#955)
* removing hardcoded namespace from the code

* Added to helm chart

* removing hard-coded namespace and deployment name from config, generate, checker

* added namespace to configMap, service, serviceAccount

* updated installation documentation

passing `KYVERNO_NAMESPACE` while running in debug mode.

* Update installation.md

removing `kyverno` only namespace note
2020-07-01 14:50:49 -07:00
Jim Bugwadia
65193feccb
update logging, naming, and event retry (#959)
* update logging and naming

* check per policy patch count
2020-06-30 11:53:27 -07:00
shuting
abb51348cf
skip inserting auto-gen annotation to podController on UPDATE admission request (#953) 2020-06-25 17:24:10 -07:00
shuting
da943325fe
Ignore auto-gen annotation on Pod when processing DENY rule (#944)
* ignore auto-gen annotation on Pod when processing DENY rule

* remove unused code
2020-06-24 10:26:04 -07:00
Yuvraj
01724d63cf
Synchronize data for generated resources (#933)
* Generate request added fro update resource

* synchronize flag added

* documentation added for keeping resource synchronized

Signed-off-by: Yuvraj <yuvraj.yad001@gmail.com>
2020-06-23 07:19:43 +05:30
shuting
b3a1e51a84
bug fix auto-gen annotation reported as violation (#902)
* fix auto-gen annotation reported as violation

* update log
2020-06-03 17:47:06 -07:00
Shuting Zhao
a1d7816c10 fix violation updates when there's no change 2020-06-01 19:37:48 -07:00
Yuvraj
5c66742f52
middelware removed (#882) 2020-05-27 11:08:59 -07:00
Yuvraj
74db840b25
Added readiness and liveness prob (#874)
* Added readiness and liveness prob

* typo fix

* port number fixed

* fixed the image name
2020-05-26 18:03:32 -07:00
Jim Bugwadia
838d02c475
Bugfix/659 support wildcards for namespaces (#871)
* - support wildcards for namespaces

* do not annotate resource, unless policy is an autogen policy

* close HTTP body

* improve messages

* remove policy store

Policy store was not fully implemented and simply provided a way
to list all polices and get a policy by name, which can be done via
standard client-go interfaces.

We need to revisit and design a better PolicyStore that provides fast
lookups for matching policies based on names, namespaces, etc.

* handle wildcard namespaces in background processing

* fix unit tests 1) remove platform dependent path usage 2) remove policy store

* add test case for mutate with wildcard namespaces
2020-05-26 10:36:56 -07:00
Shuting Zhao
2dda3e2a42 pr fix 2020-05-21 08:29:35 -07:00
Shuting Zhao
e1bdfbce27 update log 2020-05-20 17:08:30 -07:00
Shuting Zhao
bda81f0b93 - fix variable scope - debug log 2020-05-20 13:43:12 -07:00
Shuting Zhao
bc981f9a11 fix 869 2020-05-20 13:42:23 -07:00
Shuting Zhao
9eb2534d63 - fix pending delete for denying deletion rule - revert timeoutHandler - update log level 2020-05-19 00:14:23 -07:00
Shuting Zhao
0e803ae532 fix DENY pending for DELETE request 2020-05-18 20:01:20 -07:00
Shuting Zhao
962b8f9865 Fix bug 2020-05-18 18:30:39 -07:00
Shuting Zhao
416f5ecc00 Merge branch 'master' into 744_deny_requests
# Conflicts:
#	pkg/utils/util.go
#	pkg/webhooks/server.go
2020-05-18 18:05:22 -07:00
Shuting Zhao
7348eda222 Fix convert resource with DELETION request 2020-05-18 17:11:08 -07:00
Yuvraj
277402ba4c
Feature - Add checks for k8s version when Kyverno starts (#831)
* Added k8s version check for mutating and validating'

* version check adde

* middelware added

* formate

* Added timeout flag value to webhook server timeout middelware and refactore kubernetes version check

* Fixed test cases

* Removed log

* Update kubernetes version check

* Added check for mutate and validate

* Skip Validation in handleValidateAdmissionRequest if kubernetes version is below 1.14

* Update return object AdmissionResponse

* fixed condition for skiping mutation

* Handle condition for skip feature in case of kubernetes version 1.14.2
2020-05-18 17:00:52 -07:00
Shuting Zhao
ad4f06f22d Merge branch 'master' into 744_deny_requests
# Conflicts:
#	pkg/webhooks/mutation.go
#	pkg/webhooks/server.go
#	pkg/webhooks/validation.go
2020-05-18 12:32:42 -07:00