Allow kyverno-policies to have preconditions defined #3606

treydock · 2022-04-14T15:57:19Z

Related issue

Based on Slack discussions: https://kubernetes.slack.com/archives/CLGR9BJU9/p1649950188148619

Milestone of this PR

/milestone 1.7.0

What type of PR is this

/kind feature

Proposed Changes

Allow kyverno-policies chart policies to have preconditions defined. The main reason for this is I would like to have autogen policies generated and still exclude on name: dcgm-exporter* so using precondition like one added in CI tests.

Proof Manifests

Added Helm testing CI test YAML file.

Checklist

I have read the contributing guidelines.
I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
This is a bug fix and I have added unit tests that prove my fix is effective.
This is a feature and I have added CLI tests that are applicable.
My PR needs to be cherry picked to a specific release branch which is .
My PR contains new or altered behavior to Kyverno and
- CLI support should be added and my PR doesn't contain that functionality.
- I have added or changed the documentation myself in an existing PR and the link is:
- I have raised an issue in kyverno/website to track the documentation update and the link is:

Further Comments

Once this is merged I'll open back port for Kyverno 1.6 branch so can potentially get the Helm chart tag out sooner than 1.7 release if possible.

Also removed the DELETE preconditions as I'm not sure what purpose they serve but would really complicate this feature if they stayed. I tend to only avoid DELETE policies when the policy uses things like ConfigMap that might change from time object is deployed to time it's deleted.

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

treydock · 2022-04-18T16:05:12Z

@chipzoller or @realshuting When you get a chance, this could use a review.

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

codecov-commenter · 2022-04-18T16:12:06Z

Codecov Report

Merging #3606 (e50fba8) into main (1714a32) will increase coverage by 0.07%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main    #3606      +/-   ##
==========================================
+ Coverage   26.74%   26.82%   +0.07%     
==========================================
  Files         137      137              
  Lines       19139    19202      +63     
==========================================
+ Hits         5119     5150      +31     
- Misses      13390    13420      +30     
- Partials      630      632       +2

Impacted Files	Coverage Δ
pkg/engine/context/context.go	`33.09% <0.00%> (-2.30%)`	⬇️
api/kyverno/v1/rule_types.go	`53.61% <0.00%> (-0.99%)`	⬇️
pkg/config/dynamicconfig.go	`0.00% <0.00%> (ø)`
api/kyverno/v1/zz_generated.deepcopy.go	`0.00% <0.00%> (ø)`
pkg/engine/imageVerify.go	`45.00% <0.00%> (+0.12%)`	⬆️
pkg/utils/kube/image.go	`71.42% <0.00%> (+11.42%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1714a32...e50fba8. Read the comment docs.

chipzoller · 2022-04-18T16:58:42Z

It looks like in each of the policies the preconditions aren't under an any or all block. Am I looking at this right?

treydock · 2022-04-18T17:10:58Z

It looks like in each of the policies the preconditions aren't under an any or all block. Am I looking at this right?

That's correct, the any or all are defined under policyPreconditions. The file added at charts/kyverno-policies/ci/test-preconditions.yaml has example that is same example in values.yaml commented out. This way the chart doesn't dictate any/all and lets a site decide which to use.

chipzoller · 2022-04-18T17:25:35Z

May need to update branch.

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Fix docs Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Fix docs Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Signed-off-by: ShutingZhao <shuting@nirmata.com>

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Fix docs Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Signed-off-by: ShutingZhao <shuting@nirmata.com>

* feat: mutate existing, replace GR by UR in webhook server (#3601) * add attributes for post mutation Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR informer to webhook server Signed-off-by: ShutingZhao <shuting@nirmata.com> * - replace gr with ur in the webhook server; - create ur for mutateExsiting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace gr by ur across entire packages Signed-off-by: ShutingZhao <shuting@nirmata.com> * add YAMLs Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs & fix unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR deletion handler Signed-off-by: ShutingZhao <shuting@nirmata.com> * add api docs for v1beta1 Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix clientset method Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix v1beta1 client registration Signed-off-by: ShutingZhao <shuting@nirmata.com> * feat: mutate existing - generates UR for admission requests (#3623) Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace with UR in policy controller generate rules (#3635) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * - enable mutate engine to process mutateExisting rules; - add unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * implemented ur background reconciliation for mutateExisting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix webhook update error Signed-off-by: ShutingZhao <shuting@nirmata.com> * temporary comment out new unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * feat: mutate existing, replace GR by UR in webhook server (#3601) * add attributes for post mutation Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR informer to webhook server Signed-off-by: ShutingZhao <shuting@nirmata.com> * - replace gr with ur in the webhook server; - create ur for mutateExsiting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace gr by ur across entire packages Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix missing policy.kyverno.io/policy-name label (#3599) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * refactor cli code from pkg to cmd (#3591) * refactor cli code from pkg to cmd Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * fixes in imports Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * fixes tests Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * fixed conflicts Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> * moved non-commands to utils Signed-off-by: Mritunjay Sharma <mritunjaysharma394@gmail.com> Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com> * add YAMLs Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs & fix unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * add UR deletion handler Signed-off-by: ShutingZhao <shuting@nirmata.com> * add api docs for v1beta1 Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix clientset method Signed-off-by: ShutingZhao <shuting@nirmata.com> * add-kms-libraries for cosign (#3603) * add-kms-libraries Signed-off-by: anushkamittal20 <anumittal4641@gmail.com> * Shifted providers to cosign package Signed-off-by: anushkamittal20 <anumittal4641@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * Add support for custom image extractors (#3596) Signed-off-by: Sambhav Kothari <skothari44@bloomberg.net> * Update vulnerable dependencies (#3577) Signed-off-by: Shubham Gupta <shubham.gupta2956@gmail.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix v1beta1 client registration Signed-off-by: ShutingZhao <shuting@nirmata.com> * feat: mutate existing - generates UR for admission requests (#3623) Signed-off-by: ShutingZhao <shuting@nirmata.com> * updating version in Chart.yaml (#3618) * updatimg version in Chart.yaml Signed-off-by: Prateeknandle <prateeknandle@gmail.com> * changes from, make gen-helm Signed-off-by: Prateeknandle <prateeknandle@gmail.com> Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * Allow kyverno-policies to have preconditions defined (#3606) * Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Fix docs Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Signed-off-by: ShutingZhao <shuting@nirmata.com> * replace with UR in policy controller generate rules (#3635) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * - enable mutate engine to process mutateExisting rules; - add unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * implemented ur background reconciliation for mutateExisting policies Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix webhook update error Signed-off-by: ShutingZhao <shuting@nirmata.com> * temporary comment out new unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * Image verify attestors (#3614) * fix logs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix logs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * support multiple attestors Signed-off-by: Jim Bugwadia <jim@nirmata.com> * rm CLI tests (not currently supported) Signed-off-by: Jim Bugwadia <jim@nirmata.com> * apply attestor repo Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix linter issues Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix entryError assignment Signed-off-by: Jim Bugwadia <jim@nirmata.com> * fix tests Signed-off-by: Jim Bugwadia <jim@nirmata.com> * format Signed-off-by: Jim Bugwadia <jim@nirmata.com> * add intermediary certs Signed-off-by: Jim Bugwadia <jim@nirmata.com> * Allow defining imagePullSecrets (#3633) * Allow defining imagePullSecrets Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Use dict for imagePullSecrets Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> * Simplify how imagePullSecrets is defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Signed-off-by: ShutingZhao <shuting@nirmata.com> * Fix race condition in pCache (#3632) * fix race condition in pCache Signed-off-by: ShutingZhao <shuting@nirmata.com> * refact: remove unused Run function from generate (#3638) Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * Remove helm mode setting (#3628) Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * refactor: image utils (#3630) Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com> Signed-off-by: ShutingZhao <shuting@nirmata.com> * -resolve lift comments; -fix informer sync issue Signed-off-by: ShutingZhao <shuting@nirmata.com> * refact the update request cleanup controller Signed-off-by: prateekpandey14 <prateek.pandey@nirmata.com> * - fix delete request for mutateExisting; - fix context variable substitution; - improve logging Signed-off-by: ShutingZhao <shuting@nirmata.com> * - enable events; - add last applied annotation Signed-off-by: ShutingZhao <shuting@nirmata.com> * enable mutate existing on policy creation Signed-off-by: ShutingZhao <shuting@nirmata.com> * update autogen code Signed-off-by: ShutingZhao <shuting@nirmata.com> * merge main Signed-off-by: ShutingZhao <shuting@nirmata.com> * add unit tests Signed-off-by: ShutingZhao <shuting@nirmata.com> * address list comments Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs Signed-off-by: ShutingZhao <shuting@nirmata.com> * fix "Implicit memory aliasing in for loop" Signed-off-by: ShutingZhao <shuting@nirmata.com> * remove unused definitions Signed-off-by: ShutingZhao <shuting@nirmata.com> * update api docs Signed-off-by: ShutingZhao <shuting@nirmata.com> Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com> Co-authored-by: Mritunjay Kumar Sharma <mritunjaysharma394@gmail.com> Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com> Co-authored-by: Anushka Mittal <55237170+anushkamittal20@users.noreply.github.com> Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com> Co-authored-by: Shubham Gupta <shubham.gupta2956@gmail.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Co-authored-by: Prateek Nandle <56027872+Prateeknandle@users.noreply.github.com> Co-authored-by: treydock <tdockendorf@osc.edu> Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Allow kyverno-policies to have preconditions defined

84f5d44

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

treydock requested review from chipzoller and realshuting April 14, 2022 15:57

Fix docs

e50fba8

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

chipzoller approved these changes Apr 18, 2022

View reviewed changes

Merge branch 'main' into kyvenro-policies-preconditions

7ed7440

treydock enabled auto-merge (squash) April 18, 2022 17:44

treydock merged commit 1cfc80d into kyverno:main Apr 18, 2022

treydock deleted the kyvenro-policies-preconditions branch April 18, 2022 18:23

treydock added a commit to treydock/kyverno that referenced this pull request Apr 18, 2022

Allow kyverno-policies to have preconditions defined (kyverno#3606)

cb53f26

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

treydock mentioned this pull request Apr 18, 2022

Kyverno policies preconditions 1.6 #3627

Merged

treydock added a commit to treydock/kyverno that referenced this pull request Apr 18, 2022

Allow kyverno-policies to have preconditions defined (kyverno#3606)

d4cc177

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

treydock added a commit to treydock/kyverno that referenced this pull request Apr 20, 2022

Allow kyverno-policies to have preconditions defined (kyverno#3606)

fe1908d

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

treydock added a commit that referenced this pull request Apr 21, 2022

Allow kyverno-policies to have preconditions defined (#3606) (#3627)

fe8d8cd

* Allow kyverno-policies to have preconditions defined Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

chipzoller mentioned this pull request Apr 24, 2022

Helm charts to document release notes #3645

Closed

2 tasks

dkulchinsky mentioned this pull request Apr 29, 2022

webhookconfig: include services/status if services resource configured #3740

Merged

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow kyverno-policies to have preconditions defined #3606

Allow kyverno-policies to have preconditions defined #3606

Uh oh!

treydock commented Apr 14, 2022

Uh oh!

treydock commented Apr 18, 2022

Uh oh!

codecov-commenter commented Apr 18, 2022

Uh oh!

chipzoller commented Apr 18, 2022

Uh oh!

treydock commented Apr 18, 2022

Uh oh!

chipzoller commented Apr 18, 2022

Uh oh!

Uh oh!

Allow kyverno-policies to have preconditions defined #3606

Allow kyverno-policies to have preconditions defined #3606

Uh oh!

Conversation

treydock commented Apr 14, 2022

Related issue

Milestone of this PR

What type of PR is this

Proposed Changes

Proof Manifests

Checklist

Further Comments

Uh oh!

treydock commented Apr 18, 2022

Uh oh!

codecov-commenter commented Apr 18, 2022

Codecov Report

Uh oh!

chipzoller commented Apr 18, 2022

Uh oh!

treydock commented Apr 18, 2022

Uh oh!

chipzoller commented Apr 18, 2022

Uh oh!

Uh oh!