-
Notifications
You must be signed in to change notification settings - Fork 36
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
get hardening policies for replicasets
, statefulsets
& daemonsets
#681
Conversation
replicasets
& statefulsets
LGTM! @Prateeknandle Can we update the helm chart as well to match the |
8993438
to
8a73faf
Compare
updated |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
can we merge the pr? |
The test is failing! |
Can we add a testcase to test this? |
tests for
it's because the tests are flaky For testing whether changes are working or not we can see logs |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Tested by deploying via deployment.yaml and helm. The code changes are able to detect and generate policies for Statefulset and Replicaset.
Only issue is if a new replicaset or statefulset is deployed we'll have to wait for the cronjob to trigger (every 1 hour) to get hardening policies for those.
ae1736f
to
a6a5df4
Compare
With the new changes I've checked locally, tests are passing and discovery-engine is able to get the hardening policies. the ginkgo test which are failing are the flaky ones and not related to this pr. |
c345399
to
919e647
Compare
dbdac38
to
8a421ea
Compare
fd79fbe
to
fd99cda
Compare
71990f3
to
01cecdb
Compare
replicasets
& statefulsets
replicasets
& statefulsets
Hey @Prateeknandle, Can you please resolve the conflicts in the PR? |
c97d3c3
to
91d00cd
Compare
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
28f53d6
to
1e57f0e
Compare
Signed-off-by: Prateeknandle <prateeknandle@gmail.com>
- add check for owner reference in case of deployment and statefulsets - show downloaded policy-template version Signed-off-by: Ankur Kothiwal <ankur.kothiwal99@gmail.com>
c46d1f3
to
e0a2154
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we should handle daemonsets as well in this. @Ankurk99 what do you think?
replicasets
& statefulsets
replicasets
, statefulsets
& daemonsets
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Mostly good. Just one small fix.
Signed-off-by: Ankur Kothiwal <ankur.kothiwal99@gmail.com>
4996f12
to
70e362b
Compare
@vishnusomank , can you provide your approval? |
for _, ns := range nsNotFilter { | ||
if d.Namespace != ns { | ||
generateHardenPolicy(d.Name, d.Namespace, d.Spec.Template.Labels) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We are already generating policies for Deployment
s here. Why are we generating them again at line 150? It should be in a single place only.
if !isLatest() { | ||
version, err := DownloadAndUnzipRelease() | ||
if err != nil { | ||
log.Error().Msgf("Unable to download %v", err.Error()) | ||
return nil | ||
} | ||
log.Info().Msgf("Downloaded version: %v", version) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should not be clubbed with GetHardenPolicy(...)
. Downloading and unzipping release is a separate process. Policy templates are required for both KubeArmor and Kyverno policies.
fixes #670
changes:
replicasets
,daemonsets
andstatefulsets
from k8s client and generating hardening policies respectivelyclusterRole
for the same