mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 07:57:07 +00:00
Code Activity
4181 commits 20 branches 550 tags 288 MiB
Commit graph

4181 commits

This branch
This branch
All branches
Author SHA1 Message Date
Naman Lakhwani
af98c00724
arranging permissions (#3293) 
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-25 08:11:22 +00:00
José Hisse
c8a31ab16a
fix: helm chart broken when use generatecontrollerExtraResources (#3302) 
Signed-off-by: José Hisse <josehisse@gmail.com>
 2022-02-25 07:35:34 +00:00
Charles-Edouard Brétéché
c79b66d3a3
feat: support background mode configuration in kyverno-policies chart (#3299) 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-24 16:31:51 +00:00
Sambhav Kothari
c4075af3d1
Improve CLI test times by instantiating openapi controller once (#3297) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-24 23:34:12 +08:00
Emin AKTAS
388b160840
Fix namespace typo (#3298) 
Signed-off-by: Emin Aktas <emin.aktas@trendyol.com>
Signed-off-by: eminaktas <eminaktas34@gmail.com>
 2022-02-24 13:39:22 +00:00
skuethe
bf662b1ed4
fix: add support for other platforms before executing docker buildx (#3296) 2022-02-24 11:36:10 +00:00
Prateek Pandey
66969d35ea
validate and block policy based on the matched kind cache (#3283) 
Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com>

Co-authored-by: prateekpandey14 <prateek.pandey@nirmata.com>
 2022-02-23 22:27:18 +05:30
Charles-Edouard Brétéché
447bafbed5
fix: comma separated lists in config (#3290) 
This PR fixes comma separated lists in config.

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-23 16:15:44 +00:00
Sambhav Kothari
e9e96e7b1c
Run E2E tests on all supported k8s versions (#3256) 2022-02-23 15:52:08 +00:00
Naman Lakhwani
a9c9b25bb5
latest will point to main (#3285) 
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-23 15:30:49 +00:00
Sambhav Kothari
147fc6db56 Shallow clone git repositories for kyverno test command 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-23 23:12:34 +08:00
Naman Lakhwani
81ab535433
update trivy scanning (#3284) 
Signed-off-by: Naman Lakhwani <namanlakhwani@gmail.com>
 2022-02-23 10:40:07 +08:00
skuethe
016771acde
feat: add linux/s390x builds (#3277) 
Signed-off-by: skuethe <56306041+skuethe@users.noreply.github.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-22 23:40:46 +08:00
Vyankatesh Kudtarkar
e8bf16a00b
Fix label mutation while updating the secret (#3273) 
* Fix label mutation while updating the secret

* Update util.go

* fix converter issue

* code indentation
 2022-02-22 19:49:03 +08:00
Ryan White
c13aeca7fa
Modify capabilities for compatibility with Pod Security (#3274) 
Kyverno manifests are incompatible with the restricted Pod Security
Standards included with Kubernetes 1.22 and 1.23 because the Pod
Security admission controller looks for "ALL" in securityContext.capabilities.drop,
but does not accept "all".

1b741f89aa/policy/check_capabilities_restricted.go (L88)

Signed-off-by: Ryan White <ryan@alzabo.io>
 2022-02-22 08:14:17 +00:00
treydock
99efd8136f
Fix Helm releasing to preserve creation timestamps (#3268) 2022-02-21 15:50:42 +00:00
Afzal Ansari
9f8d2aef8e
Added kyverno test subcommand for test manifest file (#3264) 
* Adds `kyverno test` subcommand for test manifest file

Signed-off-by: afzal442 <afzal442@gmail.com>

Adds sub cmd

Signed-off-by: afzal442 <afzal442@gmail.com>

Adds usage

Signed-off-by: afzal442 <afzal442@gmail.com>

* Refactors the help command

Signed-off-by: afzal442 <afzal442@gmail.com>

Refactors help cmd

Signed-off-by: afzal442 <afzal442@gmail.com>

* Modifies manifest desc and removes the unused test manifest

Signed-off-by: afzal442 <afzal442@gmail.com>

Adds changes

Signed-off-by: afzal442 <afzal442@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-02-21 05:23:29 +00:00
Abhishek Choudhary
25ffa1abd1
Clean up commented out lines of code (#3263) 
Signed-off-by: Abhishek Choudhary <shreemaan.abhishek@gmail.com>
 2022-02-19 09:40:11 +00:00
Abhishek Choudhary
ae7e636687
Add .DS_store to gitignore (#3255) 
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Sambhav Kothari <skothari44@bloomberg.net>
Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-18 11:38:04 +00:00
Vyankatesh Kudtarkar
04e5f50cde
fix mutate wildcard issue (#3193) 
Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-18 10:32:10 +00:00
Vyankatesh Kudtarkar
0a5aad39cf
Fix foreach validations precondition issue (#3228) 
* fix foreach validations precondition issue

* added test-cases
 2022-02-18 09:11:41 +00:00
shuting
a30493e550
Fix policy report OwnerReference (#3249) 
* add namespaces/finalizers to clusterrole kyverno:generate

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* set policy report's owner to Kyverno namespace

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove BlockOwnerDeletion

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* remove namespaces/finalizers permission

Signed-off-by: ShutingZhao <shuting@nirmata.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-18 00:50:18 -08:00
Sambhav Kothari
8c7f037c72
Improve E2E test CI timings (#3250) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-17 17:47:35 -08:00
Jim Bugwadia
1631f011b1
Add openssf badge (#3246) 
* add openssf badge

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* retrigger CI tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Sambhav Kothari <skothari44@bloomberg.net>
 2022-02-17 17:47:14 -08:00
Jim Bugwadia
421a81ce63
Fix old object validation check (#3248) 
* fix validation check on UPDATE

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* prevent policy bypass using preconditions

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* separate replace

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add error handling

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-17 09:18:49 -08:00
Tathagata Paul
b91ff5a7f2
Bug fix: negation of string kernel version caused Cluster Policy to fail (#3229) 
* fixed bug where negation of kernel version caused cpolr to fail

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* small fix in function validateString

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* Added necessary tests

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Added one more test

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* Add more tests and added a policy to the test folder

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

* added policy for test cli

Signed-off-by: Tathagata Paul <tathagatapaul7@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-17 09:33:30 +05:30
Rahul Sawra
1f60aee4b9
add helm pre-delete hook which deletes all the webhooks (#3148) 
* add helm pre-delete hook for graceful uninstallation of webhooks

Signed-off-by: rahulii <r.sawra@gmail.com>

* remove white spaces

Signed-off-by: rahulii <r.sawra@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-17 00:16:51 +08:00
shuting
2eefe3a544
Skip updating webhook configs if namespaceSelector is nil (#3237) 
* skip updating webhook configs if namespaceSelector is nil

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comment for mutating webhook

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* address comments

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* update logs

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-02-16 17:07:09 +05:30
shuting
a970953d51
Sync latest changes to release/install.yaml (#3239) 
* sync latest changes to release/install.yaml

Signed-off-by: ShutingZhao <shuting@nirmata.com>

* bump chart versions

Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-02-15 17:24:39 +00:00
shuting
1566d0d5fd
add aggregated role for generaterequest (#3240) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-02-15 16:15:10 +00:00
Adam Kosmin
5c91bb8217
Remove abstraction that doesn't work anyway (#3209) 
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

Co-authored-by: Trey Dockendorf <tdockendorf@osc.edu>
 2022-02-15 23:01:40 +08:00
Mritunjay Kumar Sharma
5a541567de
Fix image parsing for image referenced as digests (#3196) 
* fixes image break with sha256

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

* fixes priority to digest

Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com>

Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-15 08:35:53 +00:00
Batuhan Apaydın
943fe2dd41
feat: ha mode support in helm chart (#3207) 
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>
Co-authored-by: @necatican @f9n
Signed-off-by: Emin Aktas <eminaktas34@gmail.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

Co-authored-by: Yasin Taha Erol <yasintahaerol@gmail.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
 2022-02-15 15:57:23 +08:00
Jim Bugwadia
bd1a145678
Fix keyless attest (#3219) 
* allow root cert for keyless attestations checks

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add logs and improve var names

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle err in sig loading

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-13 20:35:11 -08:00
Jim Bugwadia
14111aaa05
update dependencies (#3221) 
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-13 11:20:24 +00:00
Chip Zoller
3dcf165d77
Issue forms and PR template adjustment (#3213) 
* add cherry pick requirement

Signed-off-by: Chip Zoller <chipzoller@gmail.com>

* adopt github issue forms

Signed-off-by: Chip Zoller <chipzoller@gmail.com>
 2022-02-12 16:51:05 +00:00
Prateek Pandey
9ec53af295
add prateekpandey14 to codeowners (#3205) 
Signed-off-by: prateekpandey14 <prateekpandey14@gmail.com>
 2022-02-10 20:43:21 +08:00
Afzal Ansari
fc658da1e3
Added e2e test for JSON patch mutate policy (#2966) 
* Adds e2e test for JSON patch mutate policy

Signed-off-by: afzal442 <afzal442@gmail.com>

* modifies the config to use the optimal version of that policy

Signed-off-by: afzal442 <afzal442@gmail.com>

* Fixes the lint issuue

Signed-off-by: afzal442 <afzal442@gmail.com>

* modifies test to pass

Signed-off-by: afzal442 <afzal442@gmail.com>

* adds changes to resources

Signed-off-by: afzal442 <afzal442@gmail.com>

Co-authored-by: shuting <shutting06@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>
 2022-02-10 05:18:26 +00:00
vivek kumar sahu
0293368504
fixing bug to handle two different types of rules (#2954) 
* fixing bug for the info variable

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
 2022-02-09 10:33:54 +00:00
treydock
3f1a0bfd6c
Allow setting validationFailureActionOverrides for policies (#3201) 
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
 2022-02-09 16:24:35 +08:00
Batuhan Apaydın
9661ea8584
feat: fix app version in NOTES.txt (#3189) 
Co-authored-by: Erkan Zileli <erkan.zileli@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

Co-authored-by: Erkan Zileli <erkan.zileli@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>
 2022-02-07 15:00:08 -05:00
Ramanand Thakur
7f1530c66e
Indentation fix (#3179) 
Removed unnecessary indentation on line 107 to avoid confusion.
 2022-02-08 01:00:01 +08:00
Sambhav Kothari
25c2ad11e4
Fix unused tagTest in helm chart tests (#3174) 
Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>
 2022-02-04 23:12:12 +00:00
treydock
4e0d8ca612
Update kyverno-policies chart with latest pod-security policies (#3126) 
* Update kyverno-policies chart with latest pod-security policies
Fixes #3063
Fixes #2277

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Update README to have better example

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Use chart testing during e2e to test against ci values

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Fix e2e tests for Helm chart

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Fix Kyverno chart testing to actually test values, and fix networkpolicy template

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Update README for exclusion

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Allow adding 'other' policies via Helm

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Update Chart.yaml for kyverno-policies

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Bump minimum Kubernetes version in charts

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Update kyverno-policies chart readme

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Use version that should catch all pre-releases

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Use version that should catch all pre-releases (part 2)

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Use same logic to get git tag by using Makefile target for updating Helm values

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Prateek Pandey <prateekpandey14@gmail.com>
 2022-02-04 14:47:36 +08:00
Sambhav Kothari
4445780c7c
Add a kyverno jp command to test jmespath expressions (#3169) 
* Add a kyverno jp command to test jmespath expressions

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

* Auto-generate custom function docs

Signed-off-by: Sambhav Kothari <sambhavs.email@gmail.com>

Co-authored-by: Jim Bugwadia <jim@nirmata.com>
 2022-02-04 05:23:12 +00:00
Vyankatesh Kudtarkar
b3f702ba8d
test-cases for wildcard match label selector (#3165) 2022-02-04 03:45:40 +00:00
Abhinav Sinha
11311a15df
Filter kyverno resources instead of entire kyverno namespace (#3170) 
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
 2022-02-04 00:38:47 +00:00
Vyankatesh Kudtarkar
373f421b07
Fix panic for provides a set to the key of a precondition and deny condition (#3162) 2022-02-03 14:46:58 +00:00
Abhinav Sinha
ed3811ea5a
Bump up verbosity for patched resource mismatch (#3127) 
Signed-off-by: Abhinav Sinha <abhinav@nirmata.com>
 2022-02-03 11:24:00 +00:00
shuting
326d141a6d
bump chart versions (#3160) 
Signed-off-by: ShutingZhao <shuting@nirmata.com>
 2022-02-03 09:31:10 +00:00