mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-15 17:51:20 +00:00
Code Activity
4138 commits 15 branches 540 tags 276 MiB
Commit graph

73 commits

Author SHA1 Message Date
Sambhav Kothari
ec4e4ba452
Add support for custom image extractors (#3596) 
Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-04-14 09:08:30 -07:00
Charles-Edouard Brétéché
fe0ad3c68f
refactor: add os utils sub package (#3528) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-04-01 06:59:44 +00:00
Charles-Edouard Brétéché
b4cf89e57f
feat: add webhooks object selector support (#3413) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-03-29 23:09:44 +08:00
shuting
d1bf3d4742
clean up dependencies (#3469) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-03-25 08:40:25 +00:00
Charles-Edouard Brétéché
5de83edafa
fix: metrics config defaults (#3387) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
 2022-03-14 22:21:50 +08:00
Abhinav Sinha
b5341b685d
Support namespaceSelector with dynamic webhook enabled (#2953) 
* Support `namespaceSelector` with dynamic webhook enabled

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Implemented suggested changes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

* Implemented suggest changes

Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>

Co-authored-by: shuting <shutting06@gmail.com>
 2022-01-19 07:59:08 +00:00
Sebastian Widmer
80664d339f
Add command-line flags to allow setting client rate limits (QPS/Burst) (#2797) 
* Add `-clientRateLimitQPS` and `-clientRateLimitBurst` flags to allow controlling client rate limits.

Signed-off-by: Sebastian Widmer <sebastian.widmer@vshn.net>

* Return error if QPS is higher than max value  of float32

Signed-off-by: Sebastian Widmer <sebastian.widmer@vshn.net>
 2021-12-08 14:03:07 +01:00
Vyankatesh Kudtarkar
fa95132806
Fix: Hard-coded ClusterRoleName in OwnerRef breaks (#2718) 
* fix hardcoded clusterrole name

* Fix label
 2021-11-16 19:32:42 +08:00
Vyankatesh Kudtarkar
6eb7cf57f7
bug fix : Kyverno policies block uninstall of Kyverno (#2659) 
* bug fix uninstall kyverno  issue

* rename the methods
 2021-11-02 23:44:32 -07:00
Marcus Noble
1966c82c6d
Fix various go lint issues (#2639) 
* Fix various go lint issues

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

* Fix if mistake

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

* Simplified returns

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>
 2021-10-29 17:06:03 +02:00
shuting
b10947b975
Dynamic webhooks (#2425) 
* support k8s 1.22, update admissionregistration.k8s.io/v1beta1  to admissionregistration.k8s.io/v1

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - add failurePolicy to policy spec; - fix typo

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - add schema validation for failurePolicy; - add a printer column

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* set default failure policy to fail if not defined

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* resolve conflicts

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix missing type for printerColumn

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* refactor policy controller

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add webhook config manager

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - build webhook objects per policy update; - add fail webhook to default webhook configurations

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix panic on policy update

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* build default webhook: match empty if autoUpdateWebhooks is enabled, otherwise match all

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - set default webhook configs rule to empty; - handle policy deletion

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* reset webhook config if policies with a specific failurePolicy are cleaned up

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* handle wildcard pocliy

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* update default webhook timeout to 10s

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* cleanups

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* added webhook informer to re-create it immediately if missing

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* update tag webhookTimeoutSeconds description

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix e2e tests

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix linter issue

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* correct metric endpoint

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add pol.generate.kind to webhooks

Signed-off-by: ShutingZhao <shutting06@gmail.com>
 2021-10-05 00:15:09 -07:00
Yashvardhan Kukreja
5fcd9b83d9
added: support for metrics configuration, periodic metrics cleanup and selective namespace whitelisting and blacklisting for metrics (#2288) 
Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>
 2021-09-10 14:39:12 -07:00
Pooja Singh
ba00ead7f8
adding ownerRef with namespace (#2263) 
Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
 2021-08-13 17:07:40 -07:00
Valentin Velkov
63f4c9a884
Configurable success events on policies & resources. Generating failure events on policies by default. (#1939) 
* Remove unused event.Reason const

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Generate failure events on policies

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Generate success events on policy

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Introduce 'generateSuccessEvents' flag

Signed-off-by: Velkov <valentin.velkov@sap.com>

* Unit tests & chart fix

Signed-off-by: Velkov <valentin.velkov@sap.com>
 2021-06-29 14:43:11 -07:00
shuting
0a13ce9c73
Revert "Fix Helm deployment name issue" (#2070) 2021-06-24 14:22:34 -07:00
vyankatesh
4f3a780cc4 fix issue 2021-06-17 20:49:28 +05:30
shuting
6f07ea407f
Customize namespaceSelector of Webhookconfigurations (#2003) 
* customize namespaceSelector of webhook configurations from configMap

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* update webhook configurations base on UPDATEs of Kyverno ConfigMap

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* register webhook configurations with the namespaceSelector from ConfigMap

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* address golint comment

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* validate webhooks config format

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix NotDefined scenario

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
 2021-06-14 13:01:40 -07:00
Arsh Sharma
7e9be24d90
updating minio verison (#1956) 2021-06-09 19:16:26 -07:00
Vineeth Reddy
6d2cb87370
change min support kubernetes version to 1.16 for kyverno 1.4 (#1935) 
* change min support kubernetes version to 1.16 for kyverno 1.4

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>

* migrate deployment to apps/v1

Signed-off-by: vineethvanga18 <reddy.8@iitj.ac.in>
 2021-06-08 13:14:28 -07:00
shuting
fd9acf21a7
Auto-recover policy report (#1730) 
* auto-recover policy report

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* add flag background-scan to tune this interval

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* cleanup webhook configurations when Kyverno deployment is deleted

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* reconcile policy reports if Kyverno Configmap changes

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
 2021-03-25 12:28:03 -07:00
shuting
62a4a3a7da
Reduce throttling - skip sending API request for filtered resources (#1489) 
* skip sending API request for filtered resource

* fix PR comment

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fixes https://github.com/kyverno/kyverno/issues/1490

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
 2021-01-21 18:58:53 -08:00
shuting
3908808e7a
Rename filterK8Resources to filterK8sResources (#1452) 
* Remove lock embedded in CRD controller, use concurrent map to store shcemas

* delete rcr info from data store

* skip policy validation on status update

* - remove status check in policy mutation; - fix test

* Remove fqdncn flag

* add flag profiling port

* skip policy mutation & validation on status update

* sync policy status every minute

* update log messages

* rename filterK8Resources to filterK8sResources
 2021-01-07 11:27:50 -08:00
shuting
3c5f9f8888
1398 - Reduce RCR throttling requests (#1406) 
* reduce RCR throttling requests by merging policy application (policy - namespace) results into single RCR

* - refactor policy controller; - fix RCR issue

* - refactor RCR controller; - fix cpolr on ns update; - reduce throttling when getting resources; - fix tests

* update CRD schema

* fix typo
 2020-12-21 11:04:19 -08:00
Jim Bugwadia
c77944ddef
filter resources excluded in config (#1404) 2020-12-16 12:29:16 -08:00
Jim Bugwadia
ec95724e97
update webhook registration and monitor (#1318) 
* update webhook registration and monitor

* update log

* fix test

* improve logs

* improve logs

* format changes

* decrease interval for webhook config checks
 2020-11-26 16:07:06 -08:00
Shuting Zhao
b9fb926ddb fixes for golint ./... 2020-11-17 13:07:30 -08:00
shuting
5e07ecc5f3
Add Policy Report (#1229) 
* add report in cli

* policy report crd added

* policy report added

* configmap added

* added jobs

* added jobs

* bug fixed

* added logic for cli

* common function added

* sub command added for policy report

* subcommand added for report

* common package changed

* configmap added

* added logic for kyverno cli

* added logic for jobs

* added logic for jobs

* added logic for jobs

* added logic for cli

* buf fix

* cli changes

* count bug fix

* docs added for command

* go fmt

* refactor codebase

* remove policy controller for policyreport

* policy report removed

* bug fixes

* bug fixes

* added job trigger if needed

* job deletation logic added

* build failed fix

* fixed e2e test

* remove hard coded variables

* packages adde

* improvment added in jobs sheduler

* policy report yaml added

* cronjob added

* small fixes

* remove background sync

* documentation added for report command

* remove extra log

* small improvement

* tested policy report

* revert hardcoded changes

* changes for demo

* demo changes

* resource aggrigation added

* More changes

* More changes

* - resolve PR comments; - refactor jobs controller

* set rbac for jobs

* add clean up in job controller

* add short names

* remove application scope for policyreport

* move job controller to policyreport

* add report logic in command apply

* - update policy report types;  - upgrade k8s library; - update code gen

* temporarily comment out code to pass CI build

* generate / update policyreport to cluster

* add unit test for CLI report

* add test for apply - generate policy report

* fix unit test

* - remove job controller; - remove in-memory configmap; - clean up kustomize manifest

* remove dependency

* add reportRequest / clusterReportRequest

* clean up policy report

* generate report request

* update crd clusterReportRequest

* - update json tag of report summary; - update definition manifests; -  fix dclient creation

* aggregate reportRequest into policy report

* fix unit tests

* - update report summary to optional; - generate clusterPolicyReport; - remove reportRequests after merged to report

* remove

* generate reportRequest in kyverno namespace

* update resource filter in helm chart

* - rename reportRequest to reportChangeRequest; -rename clusterReportRequest to clusterReportChangeRequest

* generate policy report in background scan

* skip generating report change request if there's entry results

* fix results entry removal when policy / rule gets deleted

* rename apiversion from policy.kubernetes.io to policy.k8s.io

* update summary.* to lower case

* move reportChangeRequest to kyverno.io/v1alpha1

* remove policy report flag

* fix report update

* clean up policy violation CRD

* remove violation CRD from manifest

* clean up policy violation code - remove pvGenerator

* change severity fields to lower case

* update import library

* set report category

Co-authored-by: Yuvraj <yuvraj.yad001@gmail.com>
Co-authored-by: Yuvraj <10830562+evalsocket@users.noreply.github.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2020-11-09 11:26:12 -08:00
Mohan B E
3690bf5fff
conditional anchor preprocessing for patch strategic merge (#1090) 
* conditional anchor preprocessing for patch strategic merge

* modified sequence pre processing and added unit test

* merged master

* go fmt

* corrected mistake and added error handling to policy validate
 2020-09-01 09:12:05 -07:00
Yuvraj
3799b52fc8
[BUG] filterK8Resources is not correctly configured using ConfigMap (#1059) 
* configmap issue fixed

* fixed e2e test

* helm template file added

* remove extra check

* string empty check removed
 2020-08-19 13:46:08 +05:30
shuting
d6062fdd47
Add go fmt (#1055) 
* remove empty flag

* format code

* revert change in install.yaml
 2020-08-14 12:21:06 -07:00
Yuvraj
4ee523dccf
default exclude group role (#1052) 2020-08-13 14:30:25 -07:00
Yuvraj
73840e3c5f
configrable rules added (#1017) 
* configrable rules added

* fix exclude group logic from code

* flag added in yaml

* exclude username added

* exclude username added

* config interface implimented

* configure exclude username

* get role ref

* test case fixed

* panic fix

* move from interface to slice

* exclude added in mutate

* trim strings

* configmap changes added

* kustomize changes for configmap

* k8s resources added
 2020-08-07 17:09:24 -07:00
Yuvraj
de570d577d fixed deployment name 2020-07-16 22:13:50 +00:00
Pooja Singh
59b2378274
reading kyverno svc from environment variable (#962) 
* reading kyverno svc from environment variable

* updated readme
 2020-07-04 19:35:31 -07:00
shuting
ed52bd3d9f
Add policy cache based on policyType (#960) 
* add policy cache based on policyType

* fetch policy from cache in webhook

* add unit test for policy cache

* update log for exclude resources filter

* skip webhook mutation on DELETE operation

* remove duplicate k8s version check

* add description
 2020-07-02 12:49:10 -07:00
Pooja Singh
ac5d69895a
removing hardcoded namespace from the code (#955) 
* removing hardcoded namespace from the code

* Added to helm chart

* removing hard-coded namespace and deployment name from config, generate, checker

* added namespace to configMap, service, serviceAccount

* updated installation documentation

passing `KYVERNO_NAMESPACE` while running in debug mode.

* Update installation.md

removing `kyverno` only namespace note
 2020-07-01 14:50:49 -07:00
Yuvraj
74db840b25
Added readiness and liveness prob (#874) 
* Added readiness and liveness prob

* typo fix

* port number fixed

* fixed the image name
 2020-05-26 18:03:32 -07:00
shivkumar dudhani
f94465a653 remove commented code 2020-03-26 07:59:37 -07:00
shivkumar dudhani
d327309d72 refactor logging 2020-03-17 16:25:34 -07:00
shivkumar dudhani
1b1ab78f77 logs & access 2020-03-17 11:05:20 -07:00
shravan
15656a0518 536 resolving merge conflicts 2020-02-15 22:32:42 +05:30
shravan
c4a8efbd7b Merge branch 'master' into 253_ValidationInMutationFlag_v3 2020-01-29 14:34:15 +05:30
shravan
865eb57812 resolving merge conflicts 2020-01-25 16:38:12 +05:30
Shivkumar Dudhani
8c1d79ab28
linter suggestions (#655) 
* cleanup phase 1

* linter fixes phase 2
 2020-01-24 12:05:53 -08:00
shravan
12076f6183 Merge branch 'master' into 253_ValidationInMutationFlag_v3 2020-01-24 23:32:15 +05:30
Shivkumar Dudhani
1171ac691b
cleanup phase 1 (#653) 2020-01-24 09:37:12 -08:00
shravan
79999c4948 extended cli 2020-01-17 00:05:15 +05:30
shravan
1b417f42dd changed validating webhook configuration names 2020-01-15 20:29:02 +05:30
shravan
8dc6b06d79 resolving merge conflicts 2020-01-11 18:33:11 +05:30
shivkumar dudhani
3df71f6fea Merge branch 'v1.1.0' into 507_bug 2019-11-18 11:44:17 -08:00