feat: add action type for rules and regexp cache#1957
Merged
oliverbaehler merged 130 commits intoJun 8, 2026
Conversation
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…apsule#1783) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…sule#1781) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
projectcapsule#1786) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…rojectcapsule#1785) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…le#1789) * fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix(controller): allow no spaces in template references Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix(controller): allow no spaces in template references Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…#1788) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…ctcapsule#1796) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
projectcapsule#1798) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
….20.0 (projectcapsule#1799) * chore(deps): update dependency kubernetes-sigs/controller-tools to v0.20.0 * chore(deps): update dependency kubernetes-sigs/controller-tools to v0.20.0 Signed-off-by: Hristo Hristov <me@hhristov.info> --------- Signed-off-by: Hristo Hristov <me@hhristov.info> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Hristo Hristov <me@hhristov.info> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…tcapsule#1776) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…psule#1790) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…psule#1777) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…apsule#1784) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…le#1809) * chore: adjust makefile and releaser for kubernetes 1.35 Signed-off-by: Hristo Hristov <me@hhristov.info> * chore: adjust makefile and releaser for kubernetes 1.35 Signed-off-by: Hristo Hristov <me@hhristov.info> --------- Signed-off-by: Hristo Hristov <me@hhristov.info> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…jectcapsule#1941) * fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: avoid rejection when users are classified as administrators Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…le#1942) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…psule#1878) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: sandert-k8s <sandert98@gmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…le#1935) Signed-off-by: sandert-k8s <sandert98@gmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: tls controller Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: add tenantowner tenant status reference Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: tlsreconciler only patches cabundles Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * chore: refactor logger usage Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: tlsreconciler only patches cabundles Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: tlsreconciler only patches cabundles Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
* chore: typo in ruleset description crd Signed-off-by: sandert-k8s <sandert98@gmail.com> * chore: fix typo Signed-off-by: sandert-k8s <sandert98@gmail.com> --------- Signed-off-by: sandert-k8s <sandert98@gmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
* fix: allow managed metadata defined per tenant Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: allow managed metadata defined per tenant Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…sule#1948) * fix: preserve ca-bundles injected from external providers (projectcapsule#1948) Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…apsule#1874) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(deps): bump golang 1.26.4 Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * feat(deps): bump golang 1.26.4 Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…le#1950) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: best effort patch reconciling status Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…e#1953) * fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: best effort patch reconciling status Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: use different match strategy for truthy and match Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…olete docs-lint workflow (projectcapsule#1955) Signed-off-by: bakito <github@bakito.ch> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
…ctcapsule#1956) * fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: translate serviceaccounts to type serviceaccount not user Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
c1e79a3 to
e9f3170
Compare
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 38 out of 40 changed files in this pull request and generated 4 comments.
Files not reviewed (2)
- api/v1beta1/zz_generated.deepcopy.go: Language not supported
- api/v1beta2/zz_generated.deepcopy.go: Language not supported
Comment on lines
+73
to
+91
| normalized := rules.NamespaceRuleBodyNamespace{ | ||
| Enforce: rules.NamespaceRuleEnforceBody{ | ||
| Action: rule.Enforce.Action, | ||
| Registries: append( | ||
| []rules.OCIRegistry(nil), | ||
| rule.Enforce.Registries..., | ||
| ), | ||
| }, | ||
| } | ||
|
|
||
| if normalized.Enforce.Action == "" { | ||
| normalized.Enforce.Action = rules.ActionTypeDeny | ||
| } | ||
|
|
||
| if len(normalized.Enforce.Registries) == 0 { | ||
| continue | ||
| } | ||
|
|
||
| out = append(out, &normalized) |
Comment on lines
+151
to
165
| normalized := *rule | ||
| normalized.Enforce = rule.Enforce | ||
|
|
||
| normalized.Enforce.Registries = append( | ||
| []rules.OCIRegistry(nil), | ||
| rule.Enforce.Registries..., | ||
| ) | ||
|
|
||
| // Keep status compact: skip empty enforce blocks. | ||
| if len(normalized.Enforce.Registries) == 0 { | ||
| continue | ||
| } | ||
|
|
||
| ruleStatus = append(ruleStatus, &normalized) | ||
| } |
Comment on lines
+71
to
+78
| for _, registry := range rule.Enforce.Registries { | ||
| expr := registry.RegExpression | ||
| if expr.Expression == "" { | ||
| continue | ||
| } | ||
|
|
||
| set[cache.HashRegex(expr)] = expr | ||
| } |
Comment on lines
+480
to
+487
| recorder.Eventf( | ||
| pod, | ||
| tnt, | ||
| corev1.EventTypeWarning, | ||
| evt.ReasonForbiddenContainerRegistry, | ||
| evt.ActionValidationDenied, | ||
| msg, | ||
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.