1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-06 07:57:07 +00:00
Commit graph

181 commits

Author SHA1 Message Date
Marcus Noble
1e183626ce Handle reports with missing result property (#2696)
* Handle reports with missing result property

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

* Make use of type structs

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

* Fix import

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>

* Fix cast from map to struct

Signed-off-by: Marcus Noble <github@marcusnoble.co.uk>
2021-11-30 15:35:56 +08:00
Kumar Mallikarjuna
c09e6c9fa9 Add nil checks in custom deep copy function (#2664)
Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
2021-11-11 14:56:47 -08:00
Kumar Mallikarjuna
cbcb474c8c Fix deep copy methods (#2651)
* Fix deep copy methods

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Implemented deep copy for apiextensions.JSON

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

* Resolve redundant type assertions

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>
2021-11-11 14:54:19 -08:00
Vyankatesh Kudtarkar
17956bfd19 support list foreach (#2522)
* support list foreach

* fix testcase for each

* fix mutate issue

* Fix mutate patch issue

* fix yaml

* fix e2e test foreach validate list

* code indentation

* fix comments

* delete unwanted files

Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-14 00:21:40 -07:00
shuting
9dc2c2b4bf
Bugfixes - handle verifyImage rules for webhooks configurations (#2501)
* dynamic webhooks for verifyImages rule

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add namespace env to the initContainer

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add debug log

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* update operator schema validation tag

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* set policy to ready if auto-update-webhook disabled

Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-07 13:50:30 -07:00
Vyankatesh Kudtarkar
176f139f26 Fix autogen issue for Foreach mutate policy 2021-10-07 16:12:34 +05:30
Jim Bugwadia
69bb7090a4
Merge pull request #2493 from JimBugwadia/feature/foreach_mutate
Feature/foreach mutate
2021-10-07 00:32:22 -07:00
Jim Bugwadia
b56757ce2a generate code and CRDs
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-06 23:16:40 -07:00
Jim Bugwadia
7c761b4bc9 Merge branch 'main' into feature/foreach_mutate 2021-10-06 22:45:03 -07:00
Jim Bugwadia
ed93a9bddf
Merge pull request #2487 from JimBugwadia/feature/cosign_attest
Feature/cosign attest
2021-10-06 22:10:03 -07:00
Jim Bugwadia
b9d4ee6876 fix tests
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-06 18:31:20 -07:00
Vyankatesh Kudtarkar
05a0737184
Fix Autogen issue for any/all block and new rule foreach (#2471)
* Fix Autogen issue for any/all block and Support gvk in match kind block

* remove log and fix test

* Fix issues

* Fix cronjob issue

* Fix autogen for Foreach

* Fix autogen for For each

* Fix for each issue

* adding missing assignements

* Update autogen for foreach rule
2021-10-06 16:19:55 -07:00
Jim Bugwadia
0bb35aa302 merge main
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-06 10:51:43 -07:00
Jim Bugwadia
90edc69dcf merge and update
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-05 22:42:42 -07:00
shuting
b7473b018b
update deepcopy methods for types.fo (#2478) 2021-10-05 16:57:10 -07:00
shuting
b10947b975
Dynamic webhooks (#2425)
* support k8s 1.22, update admissionregistration.k8s.io/v1beta1  to admissionregistration.k8s.io/v1

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - add failurePolicy to policy spec; - fix typo

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - add schema validation for failurePolicy; - add a printer column

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* set default failure policy to fail if not defined

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* resolve conflicts

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix missing type for printerColumn

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* refactor policy controller

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add webhook config manager

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - build webhook objects per policy update; - add fail webhook to default webhook configurations

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix panic on policy update

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* build default webhook: match empty if autoUpdateWebhooks is enabled, otherwise match all

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* - set default webhook configs rule to empty; - handle policy deletion

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* reset webhook config if policies with a specific failurePolicy are cleaned up

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* handle wildcard pocliy

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* update default webhook timeout to 10s

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* cleanups

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* added webhook informer to re-create it immediately if missing

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* update tag webhookTimeoutSeconds description

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix e2e tests

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* fix linter issue

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* correct metric endpoint

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add pol.generate.kind to webhooks

Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-10-05 00:15:09 -07:00
Kumar Mallikarjuna
b7c8368569
Adding deprecation warning for any and all (Rebased) (#2466)
* added deprecation warning for any and all

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* Updated schemas

Signed-off-by: Kumar Mallikarjuna <kumarmallikarjuna1@gmail.com>

Co-authored-by: RinkiyaKeDad <arshsharma461@gmail.com>
2021-10-04 11:57:39 -07:00
Jim Bugwadia
705e029ff0
Merge pull request #2443 from JimBugwadia/feature/foreach_validate
Feature/foreach validate
2021-10-04 00:05:36 -07:00
Jim Bugwadia
086194ffab fix reporting
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-03 01:31:05 -07:00
Jim Bugwadia
8b7d404ea2 generate CRDs and validate handling of skip/error
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-02 18:29:25 -07:00
Jim Bugwadia
2bd5bca721 merge foreach and add attestation checks
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-02 14:24:06 -07:00
Jim Bugwadia
249c0f62f8 support attestations
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-02 01:19:47 -07:00
Pooja Singh
c32002837d
supporting request object for generate policies (#2455)
* supporting request object for generate policies

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* updated naming for operation

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>

* run make kustomize-crd

Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com>
2021-10-01 11:39:29 -07:00
Jim Bugwadia
0dbe7ea675 start attestation support
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-10-01 11:10:36 -07:00
Jim Bugwadia
6ae3063038 merge main
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-09-30 11:53:33 -07:00
shuting
af944b9cd5
Add new fields webhookTimeoutSeconds and failurePolicy to the policy Spec (#2456)
* add tag WebhookTimeoutSeconds to policy spec

Signed-off-by: ShutingZhao <shutting06@gmail.com>

* add spec.failurePolicy

Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-09-29 20:53:34 -07:00
Jim Bugwadia
3957a1400e fix deny check and fmt
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-09-27 23:40:05 -07:00
Jim Bugwadia
6c5fb08e45 merge main
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-09-26 02:20:29 -07:00
Jim Bugwadia
39061d91c4 implement validate.foreach
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-09-26 02:12:31 -07:00
ShutingZhao
ee10ab66b0 update policy.status subresource
Signed-off-by: ShutingZhao <shutting06@gmail.com>
2021-09-23 16:13:27 -07:00
Jim Bugwadia
23af42dc92
allow alternate image repositories (#2393)
* allow alternate image repositories

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* generate CRD YAMLs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-09-16 16:11:38 -07:00
Shuting Zhao
fd7e4735d7 add v1alpha1 CRDs schema back 2021-09-09 17:13:16 -07:00
Shuting Zhao
9d75181fb1 add v1alpha1 policy report resources back 2021-09-09 17:12:08 -07:00
Vyankatesh Kudtarkar
12530619ce
allowing users to skip policy validation when mutating resources (#2365)
* allowing users to skip policy validation when mutating resources

* fix unit test issue

* fix comment
2021-09-07 22:12:44 -07:00
Frank Jogeleit
c522343c03
Update PolicyReport CRDs to wgpolicyk8s.io/v1alpha2 (#1825) 2021-08-21 10:35:17 -07:00
treydock
8204028009
Add DurationOperator to handle duration comparison operations (#2214)
Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>
2021-07-30 13:11:52 -07:00
Max Goncharenko
922840b344
added deep copy for rule; changed rule deep copy logic (#2216)
* added deep copy for rule; changed rule deep copy logic

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>

* fixed linter error

Signed-off-by: Maxim Goncharenko <goncharenko.maxim@apriorit.com>
2021-07-30 12:07:01 -07:00
Arsh Sharma
97eaa7e854
adding any/all under match and exclude blocks (#2130)
* intial commit

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* update types

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* updated all type

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* extract to single struct

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* updated match resource description function

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* minor test working

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* match resources test is working

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* exclude resources test is working

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* changed double negetive in logic

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* yamls updated and added validation and cache loops

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* match exclude working but need to fix matchExcludeConflict function

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* restored doMatchAndExcludeConflict function

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* rewrote the matchExcludeConflictFunction

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* finalizing completed till utils_test.go

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* ready for review complete

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* update yamls

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* one more merge conflict solved

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* regenerates YAMLs

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* possible fix for failing tests

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* removed duplicate any/all logic and added a test, (rest refacotring is in progress)

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* cache test is working

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* improved cache test and it is working

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added check for mutate and generate policies too

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* cleaned doesResourceMatchConditionBlock logic but validation still has code from attempt to combine the all block

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* reverted validate.go to older logic

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* removed commented code

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* removed extra comments

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
2021-07-28 12:59:53 -07:00
Jim Bugwadia
003c865ab9
deprecate policy status (#2136)
* deprecate policy status

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* make fmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove policy status tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix generate metrics

Signed-off-by: Jim Bugwadia <jim@nirmata.com>
2021-07-14 12:18:59 -07:00
Jim Bugwadia
13caaed8b7
Feature/cosign (#2078)
* add image verification

* inline policy list

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* cosign version and dependencies updates

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add registry initialization

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add build tag to exclude k8schain for cloud providers

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add build tag to exclude k8schain for cloud providers

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* generate deep copy and other fixtures

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix deep copy issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* mutate images to add digest

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add certificates to Kyverno container for HTTPS lookups

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align flag syntax

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update docs

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update dependencies

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update dependencies

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* patch image with digest and fix checks

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* hardcode image for demos

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add default registry (docker.io) before calling reference.Parse

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix definition

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* increase webhook timeout

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix args

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* run gofmt

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* rename for clarity

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix HasImageVerify check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align make test commands

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align make test commands

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* align make test commands

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix linter error

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle API conflict and retry

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix reviewdog issues

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix make for unit tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* improve error message

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix durations

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* handle errors in tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* print policy name

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* update tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add retries and duration to error log

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix time check in tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* round creation times in test

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix retry loop

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* remove timing check for policy creation

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix e2e error - policy not found

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* update string comparison method

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* fix test Generate_Namespace_Label_Actions

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* add debug info for e2e tests

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix error

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix generate bug

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix format

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* add check for update operations

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* increase time for deleteing a resource

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

* fix check

Signed-off-by: Jim Bugwadia <jim@nirmata.com>

Co-authored-by: Shuting Zhao <shutting06@gmail.com>
2021-07-09 18:01:46 -07:00
Arsh Sharma
e74a5c803c
adding a note to deprecate name in favour of names (#2096)
Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
2021-07-06 11:34:06 -07:00
Arsh Sharma
fbc80cdfae
adding support for multiple names in match and exclude blocks (#2010)
* add names in rd struct

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added checking logic

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* updated yamls

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* wip: fix empty set problem

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* working with exclude

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* fixing name and names

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added error if both name and names are specified

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* added tests

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* changed empty set logic, fixed whitespaces and comments

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>

* fix match and exclude bug

Signed-off-by: RinkiyaKeDad <arshsharma461@gmail.com>
2021-06-28 22:31:22 -07:00
vivek kumar sahu
faa88699af
fix typo in policy struct (#1992)
* Updates L-30  Signed-off-by: viveksahu26  vivekkumarsahu650@gmail.com

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>

* compile the code using

Signed-off-by: viveksahu26 <vivekkumarsahu650@gmail.com>
2021-06-22 10:03:15 -07:00
shuting
f3ca1d78f1
Fix log message (#1779)
* update log message

Signed-off-by: Shuting Zhao <shutting06@gmail.com>

* update printer column - validation failure action

Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-04-08 12:10:30 -07:00
Frank Jogeleit
072d9f7951
Add Support for policies.kyverno.io/severity annotation (#1763)
Signed-off-by: Frank Jogeleit <fj@move-elevator.de>
2021-04-07 14:56:27 -07:00
Shuting Zhao
7502e5da98 fix variable substitution in NumericOperatorHandler
Signed-off-by: Shuting Zhao <shutting06@gmail.com>
2021-03-18 13:40:14 -07:00
Arsh Sharma
ccfe8c443c
fix: added details regarding match.resources (#1654)
* fix: added details regarding match.resources

Signed-off-by: Arsh Sharma <arshsharma461@gmail.com>

* fix: made revisions

Signed-off-by: Arsh Sharma <arshsharma461@gmail.com>

* fix: removed if not statement

Signed-off-by: Arsh Sharma <arshsharma461@gmail.com>
2021-03-03 11:22:45 -08:00
Yashvardhan Kukreja
10c714d5ba
feat: [preconditions, conditions] added backwards-compatible support for logical operators (#1604)
Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>
2021-03-01 20:31:06 -08:00
Yashvardhan Kukreja
6f15432a21
added: make target to auto generate code (#1603)
* added: make auto-generate target to sync the auto-generated code by kubebuilder

Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>

* synced: all the auto-generable files with kubebuilder's controller-gen

Signed-off-by: Yashvardhan Kukreja <yash.kukreja.98@gmail.com>
2021-03-01 10:58:58 -08:00
Arsh Sharma
da8e449d3c
fix: removed validator (#1646)
Signed-off-by: Arsh Sharma <arshsharma461@gmail.com>
2021-02-26 11:27:21 -08:00