mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-06 16:06:56 +00:00
e9a972a362
* Fix Dev setup * webhook monitor - start webhook monitor in main process Signed-off-by: Shuting Zhao <shutting06@gmail.com> * add leaderelection Signed-off-by: Jim Bugwadia <jim@nirmata.com> * - add isLeader; - update to use configmap lock Signed-off-by: Shuting Zhao <shutting06@gmail.com> * - add initialization method - add methods to get attributes Signed-off-by: Shuting Zhao <shutting06@gmail.com> * address comments Signed-off-by: Shuting Zhao <shutting06@gmail.com> * remove newContext in runLeaderElection Signed-off-by: Shuting Zhao <shutting06@gmail.com> * add leader election to GenerateController Signed-off-by: Jim Bugwadia <jim@nirmata.com> * skip processing for non-leaders Signed-off-by: Jim Bugwadia <jim@nirmata.com> * skip processing for non-leaders Signed-off-by: Jim Bugwadia <jim@nirmata.com> * add leader election to generate cleanup controller Signed-off-by: Jim Bugwadia <jim@nirmata.com> * Gracefully drain request * HA - Webhook Register / Webhook Monitor / Certificate Renewer (#1920) * enable leader election for webhook register Signed-off-by: Shuting Zhao <shutting06@gmail.com> * extract certManager to its own process Signed-off-by: Shuting Zhao <shutting06@gmail.com> * leader election for cert manager Signed-off-by: Shuting Zhao <shutting06@gmail.com> * certManager - init certs by the leader Signed-off-by: Shuting Zhao <shutting06@gmail.com> * add leader election to webhook monitor Signed-off-by: Shuting Zhao <shutting06@gmail.com> * update log message Signed-off-by: Shuting Zhao <shutting06@gmail.com> * add leader election to policy controller Signed-off-by: Shuting Zhao <shutting06@gmail.com> * add leader election to policy report controller Signed-off-by: Shuting Zhao <shutting06@gmail.com> * rebuild leader election config Signed-off-by: Shuting Zhao <shutting06@gmail.com> * start informers in leaderelection Signed-off-by: Shuting Zhao <shutting06@gmail.com> * start policy informers in main Signed-off-by: Shuting Zhao <shutting06@gmail.com> * enable leader election in main Signed-off-by: Shuting Zhao <shutting06@gmail.com> * move eventHandler to the leader election start method Signed-off-by: Shuting Zhao <shutting06@gmail.com> * address reviewdog comments Signed-off-by: Shuting Zhao <shutting06@gmail.com> * add clusterrole leaderelection Signed-off-by: Shuting Zhao <shutting06@gmail.com> * fixed generate flow (#1936) Signed-off-by: NoSkillGirl <singhpooja240393@gmail.com> * - init separate kubeclient for leaderelection - fix webhook monitor Signed-off-by: Shuting Zhao <shutting06@gmail.com> * address reviewdog comments Signed-off-by: Shuting Zhao <shutting06@gmail.com> * cleanup Kyverno managed resources on stopLeading Signed-off-by: Shuting Zhao <shutting06@gmail.com> * tag v1.4.0-beta1 Signed-off-by: Shuting Zhao <shutting06@gmail.com> * fix cleanup process on Kyverno stops Signed-off-by: Shuting Zhao <shutting06@gmail.com> * bump kind to 0.11.0, k8s v1.21 (#1980) Co-authored-by: vyankatesh <vyankatesh@neualto.com> Co-authored-by: vyankatesh <vyankateshkd@gmail.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Co-authored-by: Pooja Singh <36136335+NoSkillGirl@users.noreply.github.com>
224 lines
No EOL
3.9 KiB
YAML
Executable file
224 lines
No EOL
3.9 KiB
YAML
Executable file
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kyverno:leaderelection
|
|
labels:
|
|
app: kyverno
|
|
rules:
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- patch
|
|
- update
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
name: kyverno:webhook
|
|
rules:
|
|
# Dynamic creation of webhooks, events & certs
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- events
|
|
- mutatingwebhookconfigurations
|
|
- validatingwebhookconfigurations
|
|
- certificatesigningrequests
|
|
- certificatesigningrequests/approval
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- certificates.k8s.io
|
|
resources:
|
|
- certificatesigningrequests
|
|
- certificatesigningrequests/approval
|
|
- certificatesigningrequests/status
|
|
resourceNames:
|
|
- kubernetes.io/legacy-unknown
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- certificates.k8s.io
|
|
resources:
|
|
- signers
|
|
resourceNames:
|
|
- kubernetes.io/legacy-unknown
|
|
verbs:
|
|
- approve
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
name: kyverno:userinfo
|
|
rules:
|
|
# get the roleRef for incoming api-request user
|
|
- apiGroups:
|
|
- "*"
|
|
resources:
|
|
- roles
|
|
- clusterroles
|
|
- rolebindings
|
|
- clusterrolebindings
|
|
- configmaps
|
|
- namespaces
|
|
verbs:
|
|
- watch
|
|
- list
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
name: kyverno:customresources
|
|
rules:
|
|
# Kyverno CRs
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- policies
|
|
- policies/status
|
|
- clusterpolicies
|
|
- clusterpolicies/status
|
|
- policyreports
|
|
- policyreports/status
|
|
- clusterpolicyreports
|
|
- clusterpolicyreports/status
|
|
- generaterequests
|
|
- generaterequests/status
|
|
- reportchangerequests
|
|
- reportchangerequests/status
|
|
- clusterreportchangerequests
|
|
- clusterreportchangerequests/status
|
|
verbs:
|
|
- create
|
|
- delete
|
|
- get
|
|
- list
|
|
- patch
|
|
- update
|
|
- watch
|
|
- apiGroups:
|
|
- 'apiextensions.k8s.io'
|
|
resources:
|
|
- customresourcedefinitions
|
|
verbs:
|
|
- delete
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
name: kyverno:policycontroller
|
|
rules:
|
|
# background processing, identify all existing resources
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- '*'
|
|
verbs:
|
|
- get
|
|
- list
|
|
- update
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
name: kyverno:generatecontroller
|
|
rules:
|
|
# process generate rules to generate resources
|
|
- apiGroups:
|
|
- "*"
|
|
resources:
|
|
- namespaces
|
|
- networkpolicies
|
|
- secrets
|
|
- configmaps
|
|
- resourcequotas
|
|
- limitranges
|
|
verbs:
|
|
- create
|
|
- update
|
|
- delete
|
|
- list
|
|
- get
|
|
# dynamic watches on trigger resources for generate rules
|
|
# re-evaluate the policy if the resource is updated
|
|
- apiGroups:
|
|
- '*'
|
|
resources:
|
|
- namespaces
|
|
verbs:
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
name: kyverno:admin-policies
|
|
rules:
|
|
- apiGroups:
|
|
- kyverno.io
|
|
resources:
|
|
- policies
|
|
- clusterpolicies
|
|
verbs:
|
|
- "*"
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
name: kyverno:admin-policyreport
|
|
rules:
|
|
- apiGroups:
|
|
- wgpolicyk8s.io/v1alpha1
|
|
resources:
|
|
- policyreports
|
|
- clusterpolicyreports
|
|
verbs:
|
|
- '*'
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app: kyverno
|
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
name: kyverno:admin-reportchangerequest
|
|
rules:
|
|
- apiGroups:
|
|
- kyverno.io
|
|
resources:
|
|
- reportchangerequests
|
|
- clusterreportchangerequests
|
|
verbs:
|
|
- "*" |