add customizations for kyverno.io/v1/Policy #3498
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
karmada-bot
added
the
kind/cleanup
karmada-bot
added
the
size/L
|
The test report base on ### Check the customizations in file
$ karmadactl interpret -f customizations.yaml --check
I0507 19:37:20.283558 3795998 deploy.go:75] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:37:20.283786 3795998 enable_option.go:63] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:37:20.294560 3795998 cmdinit.go:149] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:37:20.294701 3795998 register.go:160] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
-----------------------------------
SOURCE: declarative-configuration-policy
TARGET: kyverno.io/v1 Policy
RULERS:
Retain: UNSET
InterpretReplica: UNSET
ReviseReplica: UNSET
InterpretStatus: PASS
AggregateStatus: PASS
InterpretHealth: PASS
InterpretDependency: UNSET
### Execute the statusReflection rule
$ karmadactl interpret -f customizations.yaml --operation interpretStatus --observed-file testdata/observed-helmrelease.yaml
I0507 19:38:31.522604 3796978 deploy.go:75] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:38:31.523013 3796978 enable_option.go:63] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:38:31.532197 3796978 cmdinit.go:149] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:38:31.532288 3796978 register.go:160] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
---
# [1/1] status:
autogen:
rules:
- exclude: []
generate: []
match:
any:
- resources:
kinds:
- DaemonSet
- Deployment
- Job
- StatefulSet
- ReplicaSet
- ReplicationController
name: autogen-require-pod-purpose-label
validate:
message: You must have label `purpose` with value `production` set on all new Pod in test-policy Namespace.
pattern:
spec:
template:
metadata:
labels:
purpose: production
- exclude: []
generate: []
match:
any:
- resources:
kinds:
- CronJob
name: autogen-cronjob-require-pod-purpose-label
validate:
message: You must have label `purpose` with value `production` set on all new Pod in test-policy Namespace.
pattern:
spec:
jobTemplate:
spec:
template:
metadata:
labels:
purpose: production
conditions:
- lastTransitionTime: "2023-05-07T09:19:06Z"
message: ""
reason: Succeeded
status: "True"
type: Ready
ready: true
rulecount:
generate: 0
mutate: 0
validate: 1
verifyimages: 0
### Execute the healthInterpretation rule
$ karmadactl interpret -f customizations.yaml --operation interpretHealth --observed-file testdata/observed-policy.yaml
I0507 19:40:30.357568 3798601 deploy.go:75] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:40:30.357701 3798601 enable_option.go:63] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:40:30.366363 3798601 cmdinit.go:149] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 19:40:30.366533 3798601 register.go:160] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
---
# [1/1] healthy:
true
### Execute the statusAggregation rule
$ karmadactl interpret -f customizations.yaml --operation aggregateStatus --desired-file testdata/desired-policy.yaml --status-file testdata/status-file.yaml
I0507 20:08:08.735195 3821710 deploy.go:75] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 20:08:08.735510 3821710 enable_option.go:63] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 20:08:08.753128 3821710 cmdinit.go:149] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
I0507 20:08:08.753275 3821710 register.go:160] No default release version found. build version: version.Info{GitVersion:"", GitCommit:"c8720e81c7f4badb2a2e07ed7218391b3ea7d912", GitTreeState:"dirty", BuildDate:"2023-04-12T09:43:27Z", GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
---
# [1/1] aggregatedStatus:
apiVersion: kyverno.io/v1
kind: Policy
metadata:
name: sample
namespace: test-policy
spec:
rules:
- match:
any:
- resources:
kinds:
- Pod
name: require-pod-purpose-label
validate:
message: You must have label `purpose` with value `production` set on all new Pod in test-policy Namespace.
pattern:
metadata:
labels:
purpose: production
validationFailureAction: Enforce
status:
autogen:
rules:
- match:
any:
- resources:
kinds:
- DaemonSet
- Deployment
- Job
- StatefulSet
- ReplicaSet
- ReplicationController
name: autogen-require-pod-purpose-label
validate:
message: You must have label `purpose` with value `production` set on all new Pod in test-policy Namespace.
pattern:
spec:
template:
metadata:
labels:
purpose: production
- match:
any:
- resources:
kinds:
- CronJob
name: autogen-cronjob-require-pod-purpose-label
validate:
message: You must have label `purpose` with value `production` set on all new Pod in test-policy Namespace.
pattern:
spec:
jobTemplate:
spec:
template:
metadata:
labels:
purpose: production
conditions:
- lastTransitionTime: "2023-05-07T09:19:06Z"
message: member2=, member3=
reason: Succeeded
status: "True"
type: Ready
ready: true
rulecount:
generate: 0
mutate: 0
validate: 2
verifyimages: 0
|
Codecov Report
📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more @@ Coverage Diff @@
## master #3498 +/- ##
=======================================
Coverage 52.62% 52.62%
=======================================
Files 213 213
Lines 19600 19600
=======================================
+ Hits 10314 10315 +1
+ Misses 8734 8733 -1
Partials 552 552
Flags with carried forward coverage won't be shown. Click here to find out more. |
yike21
force-pushed
the
bundle-kyverno-policy
branch
from
57930b5
to
befaaa7
Compare
17 tasks
yike21
force-pushed
the
bundle-kyverno-policy
branch
4 times, most recently
from
08e52d3
to
c1e97d4
Compare
|
It seems that #3390 still happens. |
Does the current pr contain related fix commit? |
https://github.com/yike21/karmada/blob/bundle-kyverno-policy/pkg/scheduler/event_handler.go#L191 Yes. |
|
|
ClusterAffinities: []policyv1alpha1.ClusterAffinityTerm{
{
AffinityName: "group1",
ClusterAffinity: policyv1alpha1.ClusterAffinity{LabelSelector: &metav1.LabelSelector{MatchLabels: map[string]string{member1LabelKey: "ok"}}},
},
{
AffinityName: "group2",
ClusterAffinity: policyv1alpha1.ClusterAffinity{LabelSelector: &metav1.LabelSelector{MatchLabels: map[string]string{member2LabelKey: "ok"}}},
},
{
AffinityName: "group3",
ClusterAffinity: policyv1alpha1.ClusterAffinity{LabelSelector: &metav1.LabelSelector{MatchLabels: map[string]string{"no-exist-cluster": "ok"}}},
},
{
AffinityName: "group4",
ClusterAffinity: policyv1alpha1.ClusterAffinity{ClusterNames: []string{"member1"}},
},
}})
ginkgo.It("propagate deployment and then update the cluster label", func() {
// 1. wait for deployment present on member1 cluster
framework.WaitDeploymentPresentOnClusterFitWith("member1", deployment.Namespace, deployment.Name, func(deployment *appsv1.Deployment) bool { return true })
// 2. update member1 cluster label to make it's unmatched with the policy
framework.UpdateClusterLabels(karmadaClient, "member1", map[string]string{member1LabelKey: "not-ok"})
framework.WaitDeploymentDisappearOnCluster("member1", deployment.Namespace, deployment.Name)
// 3. wait for deployment present on member2 cluster
framework.WaitDeploymentPresentOnClusterFitWith("member2", deployment.Namespace, deployment.Name, func(deployment *appsv1.Deployment) bool { return true })
// 4. update member2 cluster label to make it's unmatched with the policy
framework.UpdateClusterLabels(karmadaClient, "member2", map[string]string{member2LabelKey: "not-ok"})
framework.WaitDeploymentDisappearOnCluster("member2", deployment.Namespace, deployment.Name)
// 5. wait for deployment present on member1 cluster
framework.WaitDeploymentPresentOnClusterFitWith("member1", deployment.Namespace, deployment.Name, func(deployment *appsv1.Deployment) bool { return true })
})
|
yike21
force-pushed
the
bundle-kyverno-policy
branch
from
c1e97d4
to
71a0582
Compare
Signed-off-by: yike21 <yike21@qq.com>
yike21
force-pushed
the
bundle-kyverno-policy
branch
from
71a0582
to
b27aae5
Compare
|
/lgtm |
|
/approve Thanks! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: chaunceyjiang The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
karmada-bot
added
the
approved
8 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
Add third-party resources
kyverno.io/v1/Policyinto Resource Interpreter framework.Which issue(s) this PR fixes:
Part of #3331
Special notes for your reviewer:
@Poor12 @chaunceyjiang
Does this PR introduce a user-facing change?:
NONE