feat: Add support for server-side-apply in generate rules #7705

mikebryant · 2023-06-28T21:20:49Z

Explanation

Add support for using server-side-apply in Kyverno generate policies. This allows us to generate objects that may be individually patched by other controllers, but will still keep the fields set by the policy synchronized.

Related issue

Related to #7524

Milestone of this PR

What type of PR is this

/kind feature

Proposed Changes

Proof Manifests

Checklist

I have read the contributing guidelines.
I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
This is a bug fix and I have added unit tests that prove my fix is effective.
This is a feature and I have added CLI tests that are applicable.
My PR needs to be cherry picked to a specific release branch which is .
My PR contains new or altered behavior to Kyverno and
- CLI support should be added and my PR doesn't contain that functionality.
- I have added or changed the documentation myself in an existing PR and the link is:
- I have raised an issue in kyverno/website to track the documentation update and the link is: [Enhancement] useServerSideApply docs website#925

Further Comments

codecov · 2023-06-28T21:36:22Z

Codecov Report

Merging #7705 (c84f7ac) into main (329c11a) will decrease coverage by 0.07%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main    #7705      +/-   ##
==========================================
- Coverage   33.13%   33.07%   -0.07%     
==========================================
  Files         243      243              
  Lines       22875    22917      +42     
==========================================
  Hits         7579     7579              
- Misses      14506    14548      +42     
  Partials      790      790

Files Changed	Coverage Δ
api/kyverno/v1/spec_types.go	`17.03% <ø> (ø)`
api/kyverno/v2beta1/spec_types.go	`18.34% <ø> (ø)`
pkg/background/generate/clone.go	`0.00% <0.00%> (ø)`
pkg/background/generate/generate.go	`0.00% <0.00%> (ø)`
pkg/clients/dclient/client.go	`31.85% <0.00%> (-6.21%)`	⬇️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

Signed-off-by: Mike Bryant <mike@mikebryant.me.uk>

eddycharly · 2023-07-11T11:39:48Z

@mikebryant aren't we supposed to provide partial objects when using SSA ?

mikebryant · 2023-07-11T11:50:56Z

@mikebryant aren't we supposed to provide partial objects when using SSA ?

We're supposed to provide the full set of fields that we care about - so here that's everything produced by our data generation template, or the cloned object (minus all the fields that shouldn't be cloned). Any fields we don't provide, but previously did, will be removed by the apiserver.

If anything else adds stuff to the object, we'll still provide the same stuff, which would now be a partial of the full object server-side.

mikebryant · 2023-07-11T11:56:41Z

https://kubernetes.io/docs/reference/using-api/server-side-apply/#using-server-side-apply-in-a-controller

As a developer of a controller, you can use server-side apply as a way to simplify the update logic of your controller. The main differences with a read-modify-write and/or patch are the following:

the applied object must contain all the fields that the controller cares about.

there is no way to remove fields that haven't been applied by the controller before (controller can still send a PATCH/UPDATE for these use-cases).

the object doesn't have to be read beforehand, resourceVersion doesn't have to be specified.

It is strongly recommended for controllers to always "force" conflicts, since they might not be able to resolve or act on these conflicts.

chipzoller · 2023-07-11T12:40:31Z

It looks like, aside from one flaky test I'm re-running, this passed all our e2e tests!

mikebryant · 2023-07-11T12:52:29Z

Nice! Looks like I've missed some stuff on the codegen - just run make codegen-all and that'll hopefully fix that check

mikebryant · 2023-07-11T12:57:16Z

...well that did not go well. Do I have a different version of codegen loccally or something? 😕
Right, hacky fix time to make the diff match :D

Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk>

eddycharly · 2023-07-11T14:17:55Z

I wonder if the useServerSideApply field should go in the rule rather than being a policy level field 🤔

mikebryant · 2023-07-11T16:24:35Z

🤔 I guess I put it there because it feels like it's the same sort of thing as generateExisting

Someone could always have two policies if they needed different behaviour.. In practice most generate policies I see have one rule. And I'd expect multiple rules to be closely related, and have similar semantics, I think...

I'm not entirely sure either place to put it has super-strong arguments

eddycharly · 2023-07-12T13:48:32Z

IMHO it would be better to add in relevant rules. It’s kind of confusing to have it at the policy level because it only applies to certain rules.

...te/clusterpolicy/standard/clone/sync/cpol-clone-sync-modify-downstream-apply/99-cleanup.yaml

realshuting · 2023-07-12T15:05:22Z

I guess I put it there because it feels like it's the same sort of thing as generateExisting
Someone could always have two policies if they needed different behaviour..

I agree with @mikebryant , IMHO the policy groups rules share the same behavior, and that simplifies the generate behavior. We already have a pretty complex logic with the combination of generateExisting(policy level) and synchronization(rule level), I would add this new SSA at the policy level to start with. We can always add it at rule level to overwrite the policy behavior if needed.

mikebryant · 2023-07-12T16:16:16Z

To note something we discussed on the community call - we might want to use the same useServerSideApply field in future for mutate rules, if/when we try to implement SSA for those

Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk>

chipzoller · 2023-07-20T12:02:20Z

@mikebryant, as this introduces a new field (and optional functionality), it requires documentation. Would you please raise an accompanying issue in kyverno/website and link in the first post?

mikebryant · 2023-07-21T11:45:22Z

Sure, done :)

mikebryant · 2023-07-27T09:48:07Z

@eddycharly Did you have any more comments on this? :)

chipzoller · 2023-07-27T10:58:14Z

He's on vacation currently but will be back next week.

chipzoller · 2023-08-02T16:51:35Z

Thank you, @mikebryant!

* feat: Add support for server-side-apply in generate rules Signed-off-by: Mike Bryant <mike@mikebryant.me.uk> * chore: run make codegen-all Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk> * chore: Remove unnecessary file I got from copy/paste Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk> --------- Signed-off-by: Mike Bryant <mike@mikebryant.me.uk> Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk> Co-authored-by: Chip Zoller <chipzoller@gmail.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Co-authored-by: shuting <shuting@nirmata.com>

* feat:add usage of flux auth package for creating keychain for every oci provider, we will create a client from flux and use its login() method Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: add registry checking Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * bug: update azure keychain to return anonymous kc Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * bug: remove google keychain Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * bug: kubeconfig redefined Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * bug: fix kubeconfig flag being double defined Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * updated comments (#7902) Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> Co-authored-by: shuting <shuting@nirmata.com> * chore(deps): bump google.golang.org/grpc from 1.56.2 to 1.57.0 (#7918) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.2 to 1.57.0. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.56.2...v1.57.0) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github.com/go-git/go-git/v5 from 5.8.0 to 5.8.1 (#7919) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.8.0 to 5.8.1. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](go-git/go-git@v5.8.0...v5.8.1) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: shuting <shuting@nirmata.com> * refactor validating admission policies (#7835) Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com> * feat: update default keychain in registry to be empty (#7906) * feat: update default keychain to be empty Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: update registryCredentialHelpers description Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> --------- Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * fix: rename vap to its full name (#7929) Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com> * fix(chart): only create ServiceMonitor if cluster supports it (#7926) * fix: only create ServiceMonitor if cluster supports it Adds an additional check to the ServiceMonitor template to ensure that the cluster supports the `monitoring.coreos.com/v1` API version. Signed-off-by: Alexej Disterhoft <alexej@disterhoft.de> * add IITS Consulting as adopter from Google Form (#7932) Signed-off-by: Chip Zoller <chipzoller@gmail.com> * Adding other folder's subfolders to workflows/conformance.yaml's tests array (#7927) Signed-off-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> Co-authored-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com> Co-authored-by: Chip Zoller <chipzoller@gmail.com> * feat: add create metrics-config cli command (#7782) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore(deps): bump svenstaro/upload-release-action from 2.6.1 to 2.7.0 (#7940) Bumps [svenstaro/upload-release-action](https://github.com/svenstaro/upload-release-action) from 2.6.1 to 2.7.0. - [Release notes](https://github.com/svenstaro/upload-release-action/releases) - [Changelog](https://github.com/svenstaro/upload-release-action/blob/master/CHANGELOG.md) - [Commits](svenstaro/upload-release-action@2b9d284...1beeb57) --- updated-dependencies: - dependency-name: svenstaro/upload-release-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: shuting <shuting@nirmata.com> * test: add tests for ghcr private repository (#7791) * chore: organize constants better (#7941) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore: move cert.kyverno.io/managed-by label in constants (#7942) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix: rename --compact to --detailed-results in CLI (#7937) * fix: rename --compact to --detailed-results in CLI Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com> * rename compact arg Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> --------- Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com> Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore: move more constants (#7944) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * feat: add `create values` cli command (#7779) * feat: add cli command Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * feat: add create values cli command Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> --------- Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * Removed usage of `replacements` from goreleaser.yml file (#7833) * Changed goreleaser.yml file Signed-off-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> * Changed syntax Signed-off-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> * Small indent fix Signed-off-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> --------- Signed-off-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> Co-authored-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com> * add 1.10.2 (#7947) Signed-off-by: Chip Zoller <chipzoller@gmail.com> * chore: move cache enabled label (#7949) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore(deps): bump go.uber.org/zap from 1.24.0 to 1.25.0 (#7952) Bumps [go.uber.org/zap](https://github.com/uber-go/zap) from 1.24.0 to 1.25.0. - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](uber-go/zap@v1.24.0...v1.25.0) --- updated-dependencies: - dependency-name: go.uber.org/zap dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * doc: add feature flag guidelines (#7951) Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com> * chore: move kyverno.io/verify-images constant (#7955) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * feat: add ttl controller (#7821) * added the ttl controller Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fixed label and vars Signed-off-by: Ved Ratan <vedratan8@gmail.com> * added logger Signed-off-by: Ved Ratan <vedratan8@gmail.com> * applied fixes Signed-off-by: Ved Ratan <vedratan8@gmail.com> * removed comments Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint Signed-off-by: Ved Ratan <vedratan8@gmail.com> * more lint fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * applied changes Signed-off-by: Ved Ratan <vedratan8@gmail.com> * minor fixes Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix logger, separate parse logic Signed-off-by: Ved Ratan <vedratan8@gmail.com> * added tests Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * added kuttl tests, validation utilities Signed-off-by: Ved Ratan <vedratan8@gmail.com> * commented code Signed-off-by: Ved Ratan <vedratan8@gmail.com> * renamed tests Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix test Signed-off-by: Ved Ratan <vedratan8@gmail.com> * created log.go Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix log.go Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * added README.md refactor code Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * added validation webhook Signed-off-by: Ved Ratan <vedratan8@gmail.com> * label-validation fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * added flag, updated verbs Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * updated verbs Signed-off-by: Ved Ratan <vedratan8@gmail.com> * updated helm chart Signed-off-by: Ved Ratan <vedratan8@gmail.com> * test fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint Signed-off-by: Ved Ratan <vedratan8@gmail.com> * linter Signed-off-by: Ved Ratan <vedratan8@gmail.com> * imporoved webhook validation Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * linter fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix codegen Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * webhook names and path constants Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * constant label Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix label selector Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * kuttl test fix Signed-off-by: Ved Ratan <vedratan8@gmail.com> * helm docs Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix controller logger Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix: manager logger Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix failure policy Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * kuttl tests Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * move kuttl tests in separate job Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * remove rbac steps Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * remove configmaps from core cluster role Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix logger Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * rename flag Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * kuttl Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix error Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix linter Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> --------- Signed-off-by: Ved Ratan <vedratan8@gmail.com> Signed-off-by: Ved Ratan <82467006+VedRatan@users.noreply.github.com> Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore: rename ttl controller package (#7957) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore: move ttl formats to constants (#7958) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * feat: Add support for server-side-apply in generate rules (#7705) * feat: Add support for server-side-apply in generate rules Signed-off-by: Mike Bryant <mike@mikebryant.me.uk> * chore: run make codegen-all Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk> * chore: Remove unnecessary file I got from copy/paste Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk> --------- Signed-off-by: Mike Bryant <mike@mikebryant.me.uk> Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk> Co-authored-by: Chip Zoller <chipzoller@gmail.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Co-authored-by: shuting <shuting@nirmata.com> * refactor: ttl label validation (#7960) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore(deps): bump github.com/google/go-containerregistry (#7961) Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.14.1-0.20230425172351-b7c6e9dc3944 to 0.16.1. - [Release notes](https://github.com/google/go-containerregistry/releases) - [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml) - [Commits](https://github.com/google/go-containerregistry/commits/v0.16.1) --- updated-dependencies: - dependency-name: github.com/google/go-containerregistry dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: fix cleanup controller debug in vscode (#7963) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix: ttl cleanup controller events processing (#7964) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * test: add test to cleanup the same resource twice (#7965) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix: ttl manager stop informer on error (#7966) Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * chore(deps): bump slsa-framework/slsa-github-generator (#7968) Bumps [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) from 1.7.0 to 1.8.0. - [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases) - [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md) - [Commits](slsa-framework/slsa-github-generator@v1.7.0...v1.8.0) --- updated-dependencies: - dependency-name: slsa-framework/slsa-github-generator dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add basic structure for image verify cache (#7890) * feat: add interface for image verify cache Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: add basic client for cache Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: add ttl to client Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: add flags and flag setup Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: added a default image verify cache Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: add propogation of cache to image verifier Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: add useCache to image verification types Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * bug: add ivcache to image verifier Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: add logger to cache Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * typo: DisabledImageVerfiyCache Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * typo: DisabledImageVerfiyCache Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * Update cmd/internal/flag.go Signed-off-by: shuting <shutting06@gmail.com> * feat: add use cache to v2beta1 crd Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * bug: change public attribute TTL to private Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * fix: replace nil in test with disabled cache Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * fix: convert ttl time to time.Duration Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: update opts to use time.Duration Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat:add policy version and remove delete functions by adding policy version, old entries will automatically become outdated and we will not have to remove them manually Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: remove clear and update get and set to take interface as input Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * style: fix lint issue Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> --------- Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> Signed-off-by: shuting <shutting06@gmail.com> Co-authored-by: shuting <shutting06@gmail.com> Co-authored-by: shuting <shuting@nirmata.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * Fixes kyverno cli container reorder (#7943) * added combine rule response Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * added kyverno test cli tests Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * added kyverno test cli tests Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * small nits Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * added ; in between the err messages Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * removed fixed rulename and ruletype Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> --------- Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com> Co-authored-by: shuting <shuting@nirmata.com> * chore(deps): bump sigs.k8s.io/controller-runtime from 0.15.0 to 0.15.1 (#7975) Bumps [sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime) from 0.15.0 to 0.15.1. - [Release notes](https://github.com/kubernetes-sigs/controller-runtime/releases) - [Changelog](https://github.com/kubernetes-sigs/controller-runtime/blob/main/RELEASE.md) - [Commits](kubernetes-sigs/controller-runtime@v0.15.0...v0.15.1) --- updated-dependencies: - dependency-name: sigs.k8s.io/controller-runtime dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump golang.org/x/text from 0.11.0 to 0.12.0 (#7976) Bumps [golang.org/x/text](https://github.com/golang/text) from 0.11.0 to 0.12.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.11.0...v0.12.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump golang.org/x/crypto from 0.11.0 to 0.12.0 (#7977) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.11.0 to 0.12.0. - [Commits](golang/crypto@v0.11.0...v0.12.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix:Add Missing Severity Cases in SeverityFromString Function (#7974) Signed-off-by: lichanghao.orange <lichanghao.orange@bytedance.com> Co-authored-by: shuting <shuting@nirmata.com> * feat(chart) Allow podSecurityContext and securityContext for webhooksCleanup (#7970) Fixes #7962 Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix: Fixed issue with AddVariable that prevented certain variables (#7981) When using a label or annotation with quoted dots, AddVariable was splitting inside the quote causing it to be improperly parsed and replaced Signed-off-by: mvaal <mvaal@expediagroup.com> * fix: Kyverno cli apply duplicate result counts (#7945) * removed repeated logic from kyverno_policies_types Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> fixed unit tests * fixed unit tests Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * updated common.go logic Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * remove skip response logic from common.go Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * remove skip response logic from common.go Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> * fixed conflict Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> --------- Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> Co-authored-by: shuting <shuting@nirmata.com> * fix: return err in load data (#7982) Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> Co-authored-by: shuting <shuting@nirmata.com> * fix, enhancement (#7988) * fix, enhancement Signed-off-by: Ved Ratan <vedratan8@gmail.com> * lint Signed-off-by: Ved Ratan <vedratan8@gmail.com> --------- Signed-off-by: Ved Ratan <vedratan8@gmail.com> * fix: improve lint Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: update auth pkg Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * chore: fix go mod Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * feat: updated CLI keychains Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> * chore update fluxcd/pkg/auth@0.31.1 Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> --------- Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com> Signed-off-by: hackeramitkumar <amit9116260192@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com> Signed-off-by: Alexej Disterhoft <alexej@disterhoft.de> Signed-off-by: Chip Zoller <chipzoller@gmail.com> Signed-off-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Signed-off-by: Ved Ratan <vedratan8@gmail.com> Signed-off-by: Ved Ratan <82467006+VedRatan@users.noreply.github.com> Signed-off-by: Mike Bryant <mike@mikebryant.me.uk> Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk> Signed-off-by: shuting <shutting06@gmail.com> Signed-off-by: lichanghao.orange <lichanghao.orange@bytedance.com> Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu> Signed-off-by: mvaal <mvaal@expediagroup.com> Co-authored-by: Amit kumar <amit9116260192@gmail.com> Co-authored-by: shuting <shuting@nirmata.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mariam Fahmy <mariam.fahmy@nirmata.com> Co-authored-by: Alexej Disterhoft <github@disterhoft.de> Co-authored-by: Chip Zoller <chipzoller@gmail.com> Co-authored-by: Pradyot Ranjan <99216956+prady0t@users.noreply.github.com> Co-authored-by: Pradyot Ranjan <99216956+pradyotRanjan@users.noreply.github.com> Co-authored-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> Co-authored-by: Ved Ratan <82467006+VedRatan@users.noreply.github.com> Co-authored-by: Mike Bryant <mike.bryant@mettle.co.uk> Co-authored-by: Jim Bugwadia <jim@nirmata.com> Co-authored-by: shuting <shutting06@gmail.com> Co-authored-by: UgOrange <lichanghao.orange@bytedance.com> Co-authored-by: treydock <tdockendorf@osc.edu> Co-authored-by: Marcus Vaal <mvaal@expediagroup.com>

mikebryant force-pushed the m/7524/ssa branch from c68b74c to 9c647a6 Compare June 28, 2023 21:25

feat: Add support for server-side-apply in generate rules

29ca19c

Signed-off-by: Mike Bryant <mike@mikebryant.me.uk>

mikebryant force-pushed the m/7524/ssa branch from 9c647a6 to 29ca19c Compare July 11, 2023 11:08

mikebryant changed the title ~~wip: What happens if we just change generate to use server-side apply?~~ feat: Add support for server-side-apply in generate rules Jul 11, 2023

mikebryant marked this pull request as ready for review July 11, 2023 11:12

mikebryant requested review from chipzoller, eddycharly, realshuting, MariamFahmy98 and treydock as code owners July 11, 2023 11:12

Merge branch 'main' into m/7524/ssa

c8c6699

mikebryant force-pushed the m/7524/ssa branch from 3a6d06c to 061a04e Compare July 11, 2023 12:58

chore: run make codegen-all

cc65d62

Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk>

mikebryant force-pushed the m/7524/ssa branch from 061a04e to cc65d62 Compare July 11, 2023 12:59

Merge branch 'main' into m/7524/ssa

3f4b879

realshuting reviewed Jul 12, 2023

View reviewed changes

...te/clusterpolicy/standard/clone/sync/cpol-clone-sync-modify-downstream-apply/99-cleanup.yaml Outdated Show resolved Hide resolved

realshuting added Documentation Update Documentation milestone 1.11.0 labels Jul 12, 2023

mikebryant and others added 2 commits July 19, 2023 09:01

chore: Remove unnecessary file I got from copy/paste

7ace17b

Signed-off-by: Mike Bryant <mike.bryant@mettle.co.uk>

Merge branch 'main' into m/7524/ssa

a520264

JimBugwadia approved these changes Jul 19, 2023

View reviewed changes

Merge branch 'main' into m/7524/ssa

ad486a0

JimBugwadia requested a review from realshuting July 19, 2023 16:46

Merge branch 'main' into m/7524/ssa

3ca365d

realshuting approved these changes Jul 20, 2023

View reviewed changes

mikebryant mentioned this pull request Jul 21, 2023

[Enhancement] useServerSideApply docs kyverno/website#925

Closed

Merge branch 'main' into m/7524/ssa

26cbe92

eddycharly approved these changes Aug 2, 2023

View reviewed changes

eddycharly added this to the Kyverno Release 1.11.0 milestone Aug 2, 2023

eddycharly enabled auto-merge (squash) August 2, 2023 17:27

Merge branch 'main' into m/7524/ssa

c84f7ac

eddycharly merged commit fd67707 into kyverno:main Aug 2, 2023

mikebryant deleted the m/7524/ssa branch August 3, 2023 12:31

dlydiard mentioned this pull request Sep 27, 2023

[Bug] Generate policy perpetually updates target even if rule resource is not updated #8480

Closed

2 tasks

realshuting mentioned this pull request Oct 15, 2024

[Feature] Support field manager when mutating #5077

Open

2 tasks

mikebryant mentioned this pull request Apr 10, 2025

docs: Add myself to CONTRIBUTORS kyverno/community#34

Merged

feat: Add support for server-side-apply in generate rules #7705

feat: Add support for server-side-apply in generate rules #7705

Uh oh!

Conversation

mikebryant commented Jun 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Related issue

Milestone of this PR

What type of PR is this

Proposed Changes

Proof Manifests

Checklist

Further Comments

Uh oh!

codecov bot commented Jun 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

eddycharly commented Jul 11, 2023

Uh oh!

mikebryant commented Jul 11, 2023

Uh oh!

mikebryant commented Jul 11, 2023

Uh oh!

chipzoller commented Jul 11, 2023

Uh oh!

mikebryant commented Jul 11, 2023

Uh oh!

mikebryant commented Jul 11, 2023

Uh oh!

eddycharly commented Jul 11, 2023

Uh oh!

mikebryant commented Jul 11, 2023

Uh oh!

eddycharly commented Jul 12, 2023

Uh oh!

Uh oh!

realshuting commented Jul 12, 2023

Uh oh!

mikebryant commented Jul 12, 2023

Uh oh!

chipzoller commented Jul 20, 2023

Uh oh!

mikebryant commented Jul 21, 2023

Uh oh!

mikebryant commented Jul 27, 2023

Uh oh!

chipzoller commented Jul 27, 2023

Uh oh!

chipzoller commented Aug 2, 2023

Uh oh!

Uh oh!

mikebryant commented Jun 28, 2023 •

edited

Loading

codecov bot commented Jun 28, 2023 •

edited

Loading