mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-11 18:37:16 +00:00
5e07ecc5f3
* add report in cli * policy report crd added * policy report added * configmap added * added jobs * added jobs * bug fixed * added logic for cli * common function added * sub command added for policy report * subcommand added for report * common package changed * configmap added * added logic for kyverno cli * added logic for jobs * added logic for jobs * added logic for jobs * added logic for cli * buf fix * cli changes * count bug fix * docs added for command * go fmt * refactor codebase * remove policy controller for policyreport * policy report removed * bug fixes * bug fixes * added job trigger if needed * job deletation logic added * build failed fix * fixed e2e test * remove hard coded variables * packages adde * improvment added in jobs sheduler * policy report yaml added * cronjob added * small fixes * remove background sync * documentation added for report command * remove extra log * small improvement * tested policy report * revert hardcoded changes * changes for demo * demo changes * resource aggrigation added * More changes * More changes * - resolve PR comments; - refactor jobs controller * set rbac for jobs * add clean up in job controller * add short names * remove application scope for policyreport * move job controller to policyreport * add report logic in command apply * - update policy report types; - upgrade k8s library; - update code gen * temporarily comment out code to pass CI build * generate / update policyreport to cluster * add unit test for CLI report * add test for apply - generate policy report * fix unit test * - remove job controller; - remove in-memory configmap; - clean up kustomize manifest * remove dependency * add reportRequest / clusterReportRequest * clean up policy report * generate report request * update crd clusterReportRequest * - update json tag of report summary; - update definition manifests; - fix dclient creation * aggregate reportRequest into policy report * fix unit tests * - update report summary to optional; - generate clusterPolicyReport; - remove reportRequests after merged to report * remove * generate reportRequest in kyverno namespace * update resource filter in helm chart * - rename reportRequest to reportChangeRequest; -rename clusterReportRequest to clusterReportChangeRequest * generate policy report in background scan * skip generating report change request if there's entry results * fix results entry removal when policy / rule gets deleted * rename apiversion from policy.kubernetes.io to policy.k8s.io * update summary.* to lower case * move reportChangeRequest to kyverno.io/v1alpha1 * remove policy report flag * fix report update * clean up policy violation CRD * remove violation CRD from manifest * clean up policy violation code - remove pvGenerator * change severity fields to lower case * update import library * set report category Co-authored-by: Yuvraj <yuvraj.yad001@gmail.com> Co-authored-by: Yuvraj <10830562+evalsocket@users.noreply.github.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com>
392 lines
No EOL
7.6 KiB
YAML
Executable file
392 lines
No EOL
7.6 KiB
YAML
Executable file
---
|
|
kind: Namespace
|
|
apiVersion: v1
|
|
metadata:
|
|
name: "kyverno"
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
namespace: kyverno
|
|
name: kyverno-svc
|
|
labels:
|
|
app: kyverno
|
|
spec:
|
|
ports:
|
|
- port: 443
|
|
targetPort: https
|
|
selector:
|
|
app: kyverno
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kyverno-service-account
|
|
namespace: kyverno
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:policyviolations
|
|
rules:
|
|
- apiGroups: ["kyverno.io"]
|
|
resources:
|
|
- policyviolations
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: kyverno:webhook
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kyverno:webhook
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kyverno-service-account
|
|
namespace: kyverno
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: kyverno:userinfo
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kyverno:userinfo
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kyverno-service-account
|
|
namespace: kyverno
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: kyverno:customresources
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kyverno:customresources
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kyverno-service-account
|
|
namespace: kyverno
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: kyverno:policycontroller
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kyverno:policycontroller
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kyverno-service-account
|
|
namespace: kyverno
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: kyverno:generatecontroller
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kyverno:generatecontroller
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kyverno-service-account
|
|
namespace: kyverno
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:webhook
|
|
rules:
|
|
# Dynamic creation of webhooks, events & certs
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- events
|
|
- mutatingwebhookconfigurations
|
|
- validatingwebhookconfigurations
|
|
- certificatesigningrequests
|
|
- certificatesigningrequests/approval
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- certificates.k8s.io
|
|
resources:
|
|
- certificatesigningrequests
|
|
- certificatesigningrequests/approval
|
|
- certificatesigningrequests/status
|
|
resourceNames:
|
|
- kubernetes.io/legacy-unknown
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- certificates.k8s.io
|
|
resources:
|
|
- signers
|
|
resourceNames:
|
|
- kubernetes.io/legacy-unknown
|
|
verbs:
|
|
- approve
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:userinfo
|
|
rules:
|
|
# get the roleRef for incoming api-request user
|
|
- apiGroups:
|
|
- "*"
|
|
resources:
|
|
- roles
|
|
- clusterroles
|
|
- rolebindings
|
|
- clusterrolebindings
|
|
- configmaps
|
|
- namespaces
|
|
verbs:
|
|
- watch
|
|
- list
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:customresources
|
|
rules:
|
|
# Kyverno CRs
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- policies
|
|
- policies/status
|
|
- clusterpolicies
|
|
- clusterpolicies/status
|
|
- policyreports
|
|
- policyreports/status
|
|
- clusterpolicyreports
|
|
- clusterpolicyreports/status
|
|
- clusterpolicyviolations
|
|
- clusterpolicyviolations/status
|
|
- policyviolations
|
|
- policyviolations/status
|
|
- generaterequests
|
|
- generaterequests/status
|
|
- reportchangerequests
|
|
- reportchangerequests/status
|
|
- clusterreportchangerequests
|
|
- clusterreportchangerequests/status
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- 'apiextensions.k8s.io'
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- delete
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:policycontroller
|
|
rules:
|
|
# background processing, identify all existing resources
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- '*'
|
|
verbs:
|
|
- get
|
|
- list
|
|
- update
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:generatecontroller
|
|
rules:
|
|
# process generate rules to generate resources
|
|
- apiGroups:
|
|
- "*"
|
|
resources:
|
|
- namespaces
|
|
- networkpolicies
|
|
- secrets
|
|
- configmaps
|
|
- resourcequotas
|
|
- limitranges
|
|
- clusterroles
|
|
- rolebindings
|
|
- clusterrolebindings
|
|
verbs:
|
|
- create
|
|
- update
|
|
- delete
|
|
- get
|
|
# dynamic watches on trigger resources for generate rules
|
|
# re-evaluate the policy if the resource is updated
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- namespaces
|
|
verbs:
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:view-policies-policyviolations
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
|
rules:
|
|
- apiGroups: ["kyverno.io"]
|
|
resources:
|
|
- policyviolations
|
|
- policies
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:view-clusterpolicyviolations
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
rules:
|
|
- apiGroups: ["kyverno.io"]
|
|
resources:
|
|
- clusterpolicyviolations
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
name: kyverno:admin-policies
|
|
rules:
|
|
- apiGroups:
|
|
- kyverno.io
|
|
resources:
|
|
- policies
|
|
verbs:
|
|
- "*"
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:policyreport
|
|
rules:
|
|
- apiGroups: ["*"]
|
|
resources:
|
|
- policyreports
|
|
- clusterpolicyreports
|
|
- pods
|
|
verbs: ["get", "list", "watch", "delete"]
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: kyverno:policyreport
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kyverno:policyreport
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kyverno-service-account
|
|
namespace: kyverno
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:view-policyreport
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
|
rules:
|
|
- apiGroups: [ "policy.k8s.io/v1alpha1" ]
|
|
resources:
|
|
- policyreport
|
|
verbs: [ "get", "list", "watch" ]
|
|
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:view-clusterpolicyreport
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
rules:
|
|
- apiGroups: ["policy.k8s.io/v1alpha1"]
|
|
resources:
|
|
- clusterpolicyreport
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
|
name: kyverno:edit-policies-policyreport
|
|
rules:
|
|
- apiGroups:
|
|
- policy.k8s.io/v1alpha1
|
|
resources:
|
|
- policyreport
|
|
- clusterpolicyreport
|
|
- policies
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
---
|
|
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
name: kyverno:admin-policyreport
|
|
rules:
|
|
- apiGroups:
|
|
- policy.k8s.io/v1alpha1
|
|
resources:
|
|
- policyreport
|
|
- clusterpolicyreport
|
|
verbs:
|
|
- '*'
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
|
name: kyverno:edit-policies-policyviolations
|
|
rules:
|
|
- apiGroups:
|
|
- kyverno.io
|
|
resources:
|
|
- policyviolations
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch |