mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 16:06:56 +00:00
Code Activity
4297 commits 16 branches 550 tags 288 MiB
Commit graph

312 commits

Author SHA1 Message Date
Vyankatesh Kudtarkar
eb9a36ddc8
fix policy typo (#4039) (#4045) 2022-05-31 16:51:05 +00:00
Vyankatesh Kudtarkar
515d59ebcb
Request operation value by default to CREATE (#3894) (#4026) 
* set  by default  request.operation to CREATE

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* Added test cases

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>

Co-authored-by: vivek kumar sahu <vivekkumarsahu650@gmail.com>
 2022-05-26 04:36:36 +00:00
Charles-Edouard Brétéché
78e7c5dc18
fix: move ur controller filtering in reconciler (#3964) (#3994) 
* refactor: use BackgroundProcessingEnabled method

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: webhooks metrics reporting

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refactor: metrics package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: move ur controller filtering in reconciler (#3964)

* fix: move ur controller filtering in reconciler

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: mark ur retry on conflict

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: test data

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: add filter back in update ur handler

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: added some logs about attempts and increased backoff

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: reconciliation logic

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: Test_Generate_Synchronize_Flag

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: small nits

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
(cherry picked from commit 1936d86623)
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix: conflicts

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-05-23 23:53:49 +08:00
Vyankatesh Kudtarkar
a0eadad77b
Fix subject match selector issue in cli (#3887) (#3892) 
Signed-off-by: Vyankatesh vyankateshkd@gmail.com
 2022-05-11 16:36:42 +00:00
Vyankatesh Kudtarkar
737d3bdd36
handle subresources (#3841) (#3848) 
* handle subresources

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix logger name

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix webhook and logs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-05-10 12:34:17 +08:00
Sambhav Kothari
2dc54e5c1b
Allow variables of any kind to be defined (#3828) 
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-05-07 20:30:11 +00:00
Afzal Ansari
3845225db1
refactor: imported pkg redeclared and a few other unused func (#3827) 
* Removes paths redeclared

Signed-off-by: afzal442 <afzal442@gmail.com>

* fixes v1 redeclared

Signed-off-by: afzal442 <afzal442@gmail.com>

* fixes mergeSucceededResults func never used

Signed-off-by: afzal442 <afzal442@gmail.com>

* fixes func unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors unused func

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors unused func

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors getNamespacesForRule unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors policyNamespace unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors replacing loop with ...

Signed-off-by: afzal442 <afzal442@gmail.com>

* refactors func buildPolicyLabel unused

Signed-off-by: afzal442 <afzal442@gmail.com>

* removes unused func

Signed-off-by: afzal442 <afzal442@gmail.com>

* removes unused comment

Signed-off-by: afzal442 <afzal442@gmail.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-05-07 16:44:57 +00:00
Moritz Johner
4d2ec26c90
CLI should respect scored annotation for warnings (#3821) 
Co-authored-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-05-07 13:33:50 +00:00
Sambhav Kothari
c3604c1170
Add an object_from_lists function (#3824) 2022-05-07 12:05:04 +00:00
Sambhav Kothari
e55bf0bf6f
Relax JMESPath variable validation (#3826) 2022-05-07 16:40:53 +05:30
shuting
b4f2b63f53
Load mutate.targets via dclient (#3797) 
* Load mutate.targets via dclient

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Do not fail on namespace cleanup for e2e generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Fix wildcard name listing for a certain namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Rename onPolicyUpdate to mutateExistingOnPolicyUpdate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Enable "mutateExistingOnPolicyUpdate" on policy events

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
 2022-05-06 05:46:36 +00:00
Jim Bugwadia
db3502656d
Cert attestor (#3809) 
* add certificates attestor

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle duplicate images; use container name as key

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* use OldObject for modify requests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* use unique image names

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* merge main

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* create a single annotation patch across rules and images

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fmt and change annotation key name

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix linter issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* split certs from keys

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add Rekor and fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-05-05 21:57:20 -07:00
shuting
8a9a98d8b5
Add handler to UR.status (#3791) 
* - Add "handler" to "ur.status"
- Mark / Unmark handler upon UR reconciliation

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add field onPolicyUpdate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Update API docs

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add delay in generate e2e tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Remove duplicate logic for cleaning up the cloned resource

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-05-05 16:26:27 +05:30
Sambhav Kothari
6e48fdf4ce
Fix issue with image registry when decoding OCI descriptors with out of spec keys (#3799) 2022-05-04 13:38:56 -04:00
gsweene2
af51ceb4ff
Add JMESPath Function items (#3777) 
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
Co-authored-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-05-04 10:33:24 +00:00
Vyankatesh Kudtarkar
fca068d0f6
Fix Cli test for image verification (#3760) 
* fix Cli test for image verification
 2022-05-04 04:11:59 +00:00
Sambhav Kothari
0a5f004047
Allow non-object type elements for foreach rules (#3763) 
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-05-02 16:39:37 +00:00
Jim Bugwadia
3cb620499e
Remove YAML multiline support in CM values (#3721) 
* remove YAML multiline support in CM values

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove unused code

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-05-02 08:57:35 +01:00
Sambhav Kothari
655e2a74d7
Add tests for required checks for image verify (#3755) 2022-05-01 18:00:44 -07:00
Sambhav Kothari
8342d86a9e
Retry policy creation to avoid flaky CRD readiness (#3752) 
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-05-01 22:42:14 +00:00
Sambhav Kothari
dd0f6baa7d
Enable tests in makefile (#3699) 2022-05-01 14:20:22 -07:00
shuting
a4815f77c4
Convert GenerateRequest to UpdateRequest for backward compatibility (#3730) 
- Remove GenerateRequest Informer
 - Rename GenerateRequest to UpdateRequest in logs and vars
 - Fix initContainer leader election
 - Convert GenerateRequest to UpdateRequest in initContainer
 - Remove unused methods
 - Add printer column ruleType to UR


Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-04-29 16:35:49 +05:30
shuting
e248308cb3
Create UR for both mutate and generate policies (#3717) 
* remove mutateExisting field

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update policy controller to create UR for generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove debug log

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* - Update api docs
- Ignore e2e tests cleanup failure

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Add back index to helm template

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-04-29 11:01:02 +05:30
shuting
b740e84f06
add e2e tests for mutate existing policies (#3703) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-04-27 21:44:52 +02:00
Jim Bugwadia
ab5171cee5
Verify digest (#3679) 
* add verifyDigest to check all tags are converted to digests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add required to check for image verification annotation

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* generate CRD

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* adding imageverify true/false patch

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* patch addition logic

Signed-off-by: anushkamittal20 <anumittal4641@gmail.com>

* image verify CLI tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fixes and unit tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix digest mutate

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make codegen

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix policy cache

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: anushkamittal20 <anumittal4641@gmail.com>
 2022-04-27 15:09:52 +00:00
Sambhav Kothari
9d13e89697
Enable verifyImages and CLI registry tests (#3684) 
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-04-27 17:29:54 +08:00
shuting
d5f6167e56
Fix flaky e2e tests for generate policies (#3681) 
* fix flaky generate e2e tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* enable validate, verifyimage e2e tests

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* set policy names different within a single test

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* do not delete cloned resource when sync generate policy is deleted

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* replace grLister by urLister

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* re-queue pending URs only to fix clone policy deletion

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove duplicate import

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-04-26 19:18:24 +00:00
Sambhav Kothari
25badfe4fb
Fix regression in wildcard matches in In/AnyIn operators (#3686) 
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-04-26 18:03:05 +00:00
Vyankatesh Kudtarkar
79be6379b2
fix test cli CI failures from main (#3682) 2022-04-26 20:00:46 +08:00
Vyankatesh Kudtarkar
56c90fd087
Support context variables when using foreach CLI (#3637) 
* Support context variables when using foreach CLI

* add testcases
 2022-04-25 16:36:31 +00:00
Ioannis Bouloumpasis
a205bc3e2e
fix: webhooks are not configured correctly (#3660) 
* Fix webhook rules equality when internal is empty

The current implementation of the 'webhookRulesEqual' didn't check for
the corner case were both the internal representation and the API have
length of one, but the internal representation has 1 rule with no
selectors.
In this case the 'webhookRulesEqual' should return false, as the 2
configurations are not the same.

Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>

* Fix tests

Add a small time delay when checking if a Policy is ready in tests to
ensure that the Policy is actually ready.

Signed-off-by: Ioannis Bouloumpasis <buluba@arrikto.com>
 2022-04-25 15:19:39 +00:00
Sambhav Kothari
44b5bf0b57
Allow definition of inline variables in context (#3658) 
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-04-25 19:06:07 +08:00
Sambhav Kothari
ec4e4ba452
Add support for custom image extractors (#3596) 
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-04-14 09:08:30 -07:00
Tathagata Paul
10cf0f2344
add support for roles, cluster roles and subjects (#3188) 
* add support for roles, cluster roles and subjects in kyverno cli

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-04-12 04:00:49 +00:00
Vyankatesh Kudtarkar
e268be9e88
support for deprecated API's (#3439) 
* support for deprecated API's

* add testcase

* update condition

* fix logic
 2022-03-22 18:25:35 +00:00
Aidan Delaney
4ec3b36f7f
Remove support for test.yaml (#3442) 
kyverno-test.yaml is now the only supported test file name

Signed-off-by: Aidan Delaney <adelaney21@bloomberg.net>
 2022-03-22 14:09:08 +05:30
Sambhav Kothari
6498425937
Add a registry flag to allow direct access to container registries in the CLI (#3396) 
* Add a registry flag to allow direct access to container registries in the CLI

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-03-16 09:56:47 +05:30
Vyankatesh Kudtarkar
68093cd44c
Cli Apply command support Dir as resources (#3391) 
* apply command support dir as resources

* fix issue
 2022-03-15 16:00:59 +08:00
vivek kumar sahu
c456b541af
e2e test for mutate global anchor Policy (#2574) 
* Added e2e test for mutate-global-anchor-policy

Signed-off-by: vivek kumar sahu <vivekkumarsahu650@gmail.com>

* Updated config.go for mutate globar anchor policy

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* Added resources for mutate global anchor policy

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-14 09:15:06 +00:00
Vyankatesh Kudtarkar
148a892277
Fix any_all wildcard issue (#3352) 2022-03-08 12:59:33 +00:00
Sambhav Kothari
e9e96e7b1c
Run E2E tests on all supported k8s versions (#3256) 2022-02-23 15:52:08 +00:00
Vyankatesh Kudtarkar
e8bf16a00b
Fix label mutation while updating the secret (#3273) 
* Fix label mutation while updating the secret

* Update util.go

* fix converter issue

* code indentation
 2022-02-22 19:49:03 +08:00
Vyankatesh Kudtarkar
04e5f50cde
fix mutate wildcard issue (#3193) 
Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-18 10:32:10 +00:00
Vyankatesh Kudtarkar
0a5aad39cf
Fix foreach validations precondition issue (#3228) 
* fix foreach validations precondition issue

* added test-cases
 2022-02-18 09:11:41 +00:00
Tathagata Paul
b91ff5a7f2
Bug fix: negation of string kernel version caused Cluster Policy to fail (#3229) 
* fixed bug where negation of kernel version caused cpolr to fail

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* small fix in function validateString

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* Added necessary tests

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Added one more test

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* Add more tests and added a policy to the test folder

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* added policy for test cli

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-17 09:33:30 +05:30
Afzal Ansari
fc658da1e3
Added e2e test for JSON patch mutate policy (#2966) 
* Adds e2e test for JSON patch mutate policy

Signed-off-by: afzal442 <afzal442@gmail.com>

* modifies the config to use the optimal version of that policy

Signed-off-by: afzal442 <afzal442@gmail.com>

* Fixes the lint issuue

Signed-off-by: afzal442 <afzal442@gmail.com>

* modifies test to pass

Signed-off-by: afzal442 <afzal442@gmail.com>

* adds changes to resources

Signed-off-by: afzal442 <afzal442@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-10 05:18:26 +00:00
vivek kumar sahu
0293368504
fixing bug to handle two different types of rules (#2954) 
* fixing bug for the info variable

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-02-09 10:33:54 +00:00
Vyankatesh Kudtarkar
b3f702ba8d
test-cases for wildcard match label selector (#3165) 2022-02-04 03:45:40 +00:00
Vyankatesh Kudtarkar
373f421b07
Fix panic for provides a set to the key of a precondition and deny condition (#3162) 2022-02-03 14:46:58 +00:00
Sambhav Kothari
98284114f5
Relax rule context validation to follow JMESPath grammar (#3129) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-01-31 18:23:59 +00:00