From e5a54d0960918eb116b33dc2f2ee38eb5cff07f6 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Sun, 7 Jan 2024 20:38:08 +0200 Subject: [PATCH 01/13] SSPROD-35354 - configure dry-run and denyOnError --- charts/admission-controller/templates/webhook/deployment.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/charts/admission-controller/templates/webhook/deployment.yaml b/charts/admission-controller/templates/webhook/deployment.yaml index 77a94c029..e3e081665 100644 --- a/charts/admission-controller/templates/webhook/deployment.yaml +++ b/charts/admission-controller/templates/webhook/deployment.yaml @@ -54,8 +54,10 @@ spec: image: {{ include "admissionController.kspm.image" . }} imagePullPolicy: {{ .Values.webhook.v2.image.pullPolicy | default .Values.global.image.pullPolicy }} env: + - name: DENY_ON_ERROR + value: {{ .Values.webhook.denyOnError | quote }} - name: DRY_RUN - value: "true" + value: {{ .Values.webhook.dryRun | quote }} {{- if (or (include "webhook.httpProxy" .) (include "webhook.httpsProxy" .) (include "webhook.noProxy" .) )}} - name: HTTP_PROXY value: {{ include "webhook.httpProxy" . }} From 606f35931f5b1b773b9f2c904ac0d4f695a03db7 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Mon, 8 Jan 2024 00:25:36 +0200 Subject: [PATCH 02/13] use `timeoutSeconds` as default timeout --- charts/admission-controller/Chart.yaml | 2 +- charts/admission-controller/README.md | 4 ++-- charts/admission-controller/templates/webhook/deployment.yaml | 2 ++ 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/admission-controller/Chart.yaml b/charts/admission-controller/Chart.yaml index 9490c1f91..335b9fc89 100644 --- a/charts/admission-controller/Chart.yaml +++ b/charts/admission-controller/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: admission-controller description: Sysdig Admission Controller using Sysdig Secure inline image scanner type: application -version: 0.14.18 +version: 0.14.19 appVersion: 3.9.36 home: https://sysdiglabs.github.io/admission-controller/ icon: https://avatars.githubusercontent.com/u/5068817?s=200&v=4 diff --git a/charts/admission-controller/README.md b/charts/admission-controller/README.md index 5fed0e155..e89fe8d42 100644 --- a/charts/admission-controller/README.md +++ b/charts/admission-controller/README.md @@ -68,7 +68,7 @@ For example: ```bash helm upgrade --install admission-controller sysdig/admission-controller \ - --create-namespace -n sysdig-admission-controller --version=0.14.18 \ + --create-namespace -n sysdig-admission-controller --version=0.14.19 \ --set sysdig.secureAPIToken=YOUR-KEY-HERE,clusterName=YOUR-CLUSTER-NAME ``` @@ -80,7 +80,7 @@ For example: ```bash helm upgrade --install admission-controller sysdig/admission-controller \ - --create-namespace -n sysdig-admission-controller --version=0.14.18 \ + --create-namespace -n sysdig-admission-controller --version=0.14.19 \ --values values.yaml ``` diff --git a/charts/admission-controller/templates/webhook/deployment.yaml b/charts/admission-controller/templates/webhook/deployment.yaml index e3e081665..89096f1e1 100644 --- a/charts/admission-controller/templates/webhook/deployment.yaml +++ b/charts/admission-controller/templates/webhook/deployment.yaml @@ -54,6 +54,8 @@ spec: image: {{ include "admissionController.kspm.image" . }} imagePullPolicy: {{ .Values.webhook.v2.image.pullPolicy | default .Values.global.image.pullPolicy }} env: + - name: DEFAULT_TIMEOUT + - value: {{ .Values.webhook.timeoutSeconds}} - name: DENY_ON_ERROR value: {{ .Values.webhook.denyOnError | quote }} - name: DRY_RUN From cad37faa06b011d55d5c71c85eec4edcbe48daa7 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Mon, 8 Jan 2024 17:39:48 +0200 Subject: [PATCH 03/13] set defaults for DRY_RUN and DENY_ON_ERROR --- charts/admission-controller/templates/webhook/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/admission-controller/templates/webhook/deployment.yaml b/charts/admission-controller/templates/webhook/deployment.yaml index 89096f1e1..e1ee3a35e 100644 --- a/charts/admission-controller/templates/webhook/deployment.yaml +++ b/charts/admission-controller/templates/webhook/deployment.yaml @@ -57,9 +57,9 @@ spec: - name: DEFAULT_TIMEOUT - value: {{ .Values.webhook.timeoutSeconds}} - name: DENY_ON_ERROR - value: {{ .Values.webhook.denyOnError | quote }} + value: {{ .Values.webhook.denyOnError | default "false" | quote }} - name: DRY_RUN - value: {{ .Values.webhook.dryRun | quote }} + value: {{ .Values.webhook.dryRun | default "true" | quote }} {{- if (or (include "webhook.httpProxy" .) (include "webhook.httpsProxy" .) (include "webhook.noProxy" .) )}} - name: HTTP_PROXY value: {{ include "webhook.httpProxy" . }} From 4cb3e9a5e0cf7f4f4979849d161148127b3b84a8 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Sun, 14 Jan 2024 23:51:21 +0200 Subject: [PATCH 04/13] update image and chart versions --- charts/admission-controller/values.yaml | 2 +- charts/sysdig-deploy/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/admission-controller/values.yaml b/charts/admission-controller/values.yaml index 350df8dda..93bd66cba 100644 --- a/charts/admission-controller/values.yaml +++ b/charts/admission-controller/values.yaml @@ -190,7 +190,7 @@ webhook: # The KSPM Admission Controller image repository repository: sysdig/secure-admission-controller # The KSPM Admission Controller image tag - tag: 1.0.1 + tag: 1.27.0-rc # Specifies the image digest value. If set, this value is used instead of the tag value digest: # The PullPolicy for KSPM Admission Controller image diff --git a/charts/sysdig-deploy/Chart.yaml b/charts/sysdig-deploy/Chart.yaml index 9bb6a0be7..b5fb3ca7a 100644 --- a/charts/sysdig-deploy/Chart.yaml +++ b/charts/sysdig-deploy/Chart.yaml @@ -20,7 +20,7 @@ dependencies: - name: admission-controller # repository: https://charts.sysdig.com repository: file://../admission-controller - version: ~0.14.18 + version: ~0.14.19 alias: admissionController condition: admissionController.enabled - name: agent From 905024485f7577dccae5730f8425ea8d883d1f70 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Mon, 15 Jan 2024 00:11:49 +0200 Subject: [PATCH 05/13] remove `rc` from image tag --- charts/admission-controller/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/admission-controller/values.yaml b/charts/admission-controller/values.yaml index 93bd66cba..2a39cac2b 100644 --- a/charts/admission-controller/values.yaml +++ b/charts/admission-controller/values.yaml @@ -190,7 +190,7 @@ webhook: # The KSPM Admission Controller image repository repository: sysdig/secure-admission-controller # The KSPM Admission Controller image tag - tag: 1.27.0-rc + tag: 1.27.0 # Specifies the image digest value. If set, this value is used instead of the tag value digest: # The PullPolicy for KSPM Admission Controller image From 06eaf79e2e1339f6f72be9d8c6c210433b6d3ac8 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Mon, 15 Jan 2024 00:17:36 +0200 Subject: [PATCH 06/13] add `rc` to image tag --- charts/admission-controller/README.md | 4 ++-- charts/admission-controller/values.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/admission-controller/README.md b/charts/admission-controller/README.md index e89fe8d42..e17c48b36 100644 --- a/charts/admission-controller/README.md +++ b/charts/admission-controller/README.md @@ -92,7 +92,7 @@ See the default [`values.yaml`](./values.yaml) file for more information. The following table lists the configurable parameters of the `admission-controller` chart and their default values. -| Parameter | Description | Default | +| Parameter | Description | Default | |----------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | global.clusterConfig | The global cluster configuration options. | {} | | global.sysdig.secureAPIToken | The global API token to access Sysdig Secure. | "" | @@ -142,7 +142,7 @@ The following table lists the configurable parameters of the `admission-controll | webhook.v2.http.port | HTTP serve port where the requests will be served from | 6443 | | webhook.v2.image.registry | The KSPM Admission Controller image registry | quay.io | | webhook.v2.image.repository | The KSPM Admission Controller image repository | sysdig/secure-admission-controller | -| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.0.1 | +| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.27.0-rc | | webhook.v2.image.digest | Specifies the image digest value. If set, this value is used instead of the tag value | | | webhook.v2.image.pullPolicy | The PullPolicy for KSPM Admission Controller image | | | webhook.name | The service name for Webhook deployment | webhook | diff --git a/charts/admission-controller/values.yaml b/charts/admission-controller/values.yaml index 2a39cac2b..93bd66cba 100644 --- a/charts/admission-controller/values.yaml +++ b/charts/admission-controller/values.yaml @@ -190,7 +190,7 @@ webhook: # The KSPM Admission Controller image repository repository: sysdig/secure-admission-controller # The KSPM Admission Controller image tag - tag: 1.27.0 + tag: 1.27.0-rc # Specifies the image digest value. If set, this value is used instead of the tag value digest: # The PullPolicy for KSPM Admission Controller image From 464560f067b9a4682ec79a3b973c356934ad744e Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Mon, 15 Jan 2024 00:29:11 +0200 Subject: [PATCH 07/13] attempt to pass pre-commit check --- charts/admission-controller/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/admission-controller/README.md b/charts/admission-controller/README.md index e17c48b36..d94534ff4 100644 --- a/charts/admission-controller/README.md +++ b/charts/admission-controller/README.md @@ -142,7 +142,7 @@ The following table lists the configurable parameters of the `admission-controll | webhook.v2.http.port | HTTP serve port where the requests will be served from | 6443 | | webhook.v2.image.registry | The KSPM Admission Controller image registry | quay.io | | webhook.v2.image.repository | The KSPM Admission Controller image repository | sysdig/secure-admission-controller | -| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.27.0-rc | +| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.0.1 | | webhook.v2.image.digest | Specifies the image digest value. If set, this value is used instead of the tag value | | | webhook.v2.image.pullPolicy | The PullPolicy for KSPM Admission Controller image | | | webhook.name | The service name for Webhook deployment | webhook | From a5a59413ef0b6b1c66421456394a5bb2a1171b93 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Mon, 15 Jan 2024 07:58:26 +0200 Subject: [PATCH 08/13] attempt to pass pre-commit check II --- charts/admission-controller/README.md | 2 +- charts/sysdig-deploy/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/admission-controller/README.md b/charts/admission-controller/README.md index d94534ff4..e89fe8d42 100644 --- a/charts/admission-controller/README.md +++ b/charts/admission-controller/README.md @@ -92,7 +92,7 @@ See the default [`values.yaml`](./values.yaml) file for more information. The following table lists the configurable parameters of the `admission-controller` chart and their default values. -| Parameter | Description | Default | +| Parameter | Description | Default | |----------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | global.clusterConfig | The global cluster configuration options. | {} | | global.sysdig.secureAPIToken | The global API token to access Sysdig Secure. | "" | diff --git a/charts/sysdig-deploy/Chart.yaml b/charts/sysdig-deploy/Chart.yaml index 83bf863d9..c9cb56071 100644 --- a/charts/sysdig-deploy/Chart.yaml +++ b/charts/sysdig-deploy/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: sysdig-deploy description: A chart with various Sysdig components for Kubernetes type: application -version: 1.37.3 +version: 1.37.4 maintainers: - name: AlbertoBarba email: alberto.barba@sysdig.com From fde8426e380e05d6a7f9caa1e3d38c8b1166f1df Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Mon, 15 Jan 2024 12:02:14 +0200 Subject: [PATCH 09/13] update version in README.md --- charts/admission-controller/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/admission-controller/README.md b/charts/admission-controller/README.md index e89fe8d42..b87d68353 100644 --- a/charts/admission-controller/README.md +++ b/charts/admission-controller/README.md @@ -142,7 +142,7 @@ The following table lists the configurable parameters of the `admission-controll | webhook.v2.http.port | HTTP serve port where the requests will be served from | 6443 | | webhook.v2.image.registry | The KSPM Admission Controller image registry | quay.io | | webhook.v2.image.repository | The KSPM Admission Controller image repository | sysdig/secure-admission-controller | -| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.0.1 | +| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.27.0-rc | | webhook.v2.image.digest | Specifies the image digest value. If set, this value is used instead of the tag value | | | webhook.v2.image.pullPolicy | The PullPolicy for KSPM Admission Controller image | | | webhook.name | The service name for Webhook deployment | webhook | From d060fdb31e6ccccbc77e989f4f5941aaf323d538 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Wed, 24 Jan 2024 17:54:34 +0200 Subject: [PATCH 10/13] fix DEFAULT_TIMEOUT env in deployment.yaml --- charts/admission-controller/templates/webhook/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/admission-controller/templates/webhook/deployment.yaml b/charts/admission-controller/templates/webhook/deployment.yaml index e1ee3a35e..cdf90065f 100644 --- a/charts/admission-controller/templates/webhook/deployment.yaml +++ b/charts/admission-controller/templates/webhook/deployment.yaml @@ -55,7 +55,7 @@ spec: imagePullPolicy: {{ .Values.webhook.v2.image.pullPolicy | default .Values.global.image.pullPolicy }} env: - name: DEFAULT_TIMEOUT - - value: {{ .Values.webhook.timeoutSeconds}} + value: {{ .Values.webhook.timeoutSeconds | quote }} - name: DENY_ON_ERROR value: {{ .Values.webhook.denyOnError | default "false" | quote }} - name: DRY_RUN From 703d96f4510b3716984f87bfb68e6bd616058f91 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Thu, 25 Jan 2024 13:09:01 +0200 Subject: [PATCH 11/13] remove rc tag from image --- charts/admission-controller/README.md | 2 +- charts/admission-controller/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/admission-controller/README.md b/charts/admission-controller/README.md index b87d68353..c7e74a55a 100644 --- a/charts/admission-controller/README.md +++ b/charts/admission-controller/README.md @@ -142,7 +142,7 @@ The following table lists the configurable parameters of the `admission-controll | webhook.v2.http.port | HTTP serve port where the requests will be served from | 6443 | | webhook.v2.image.registry | The KSPM Admission Controller image registry | quay.io | | webhook.v2.image.repository | The KSPM Admission Controller image repository | sysdig/secure-admission-controller | -| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.27.0-rc | +| webhook.v2.image.tag | The KSPM Admission Controller image tag | 1.27.0 | | webhook.v2.image.digest | Specifies the image digest value. If set, this value is used instead of the tag value | | | webhook.v2.image.pullPolicy | The PullPolicy for KSPM Admission Controller image | | | webhook.name | The service name for Webhook deployment | webhook | diff --git a/charts/admission-controller/values.yaml b/charts/admission-controller/values.yaml index 93bd66cba..2a39cac2b 100644 --- a/charts/admission-controller/values.yaml +++ b/charts/admission-controller/values.yaml @@ -190,7 +190,7 @@ webhook: # The KSPM Admission Controller image repository repository: sysdig/secure-admission-controller # The KSPM Admission Controller image tag - tag: 1.27.0-rc + tag: 1.27.0 # Specifies the image digest value. If set, this value is used instead of the tag value digest: # The PullPolicy for KSPM Admission Controller image From d0e062f9192e24fed211122e2c9ed22348ddeb35 Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Thu, 25 Jan 2024 13:13:26 +0200 Subject: [PATCH 12/13] versions fixes after merge with main --- charts/admission-controller/Chart.yaml | 2 +- charts/admission-controller/README.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/admission-controller/Chart.yaml b/charts/admission-controller/Chart.yaml index 335b9fc89..a5293c96d 100644 --- a/charts/admission-controller/Chart.yaml +++ b/charts/admission-controller/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: admission-controller description: Sysdig Admission Controller using Sysdig Secure inline image scanner type: application -version: 0.14.19 +version: 0.14.20 appVersion: 3.9.36 home: https://sysdiglabs.github.io/admission-controller/ icon: https://avatars.githubusercontent.com/u/5068817?s=200&v=4 diff --git a/charts/admission-controller/README.md b/charts/admission-controller/README.md index e7783641f..3050d434c 100644 --- a/charts/admission-controller/README.md +++ b/charts/admission-controller/README.md @@ -68,7 +68,7 @@ For example: ```bash helm upgrade --install admission-controller sysdig/admission-controller \ - --create-namespace -n sysdig-admission-controller --version=0.14.19 \ + --create-namespace -n sysdig-admission-controller --version=0.14.20 \ --set sysdig.secureAPIToken=YOUR-KEY-HERE,clusterName=YOUR-CLUSTER-NAME ``` @@ -80,7 +80,7 @@ For example: ```bash helm upgrade --install admission-controller sysdig/admission-controller \ - --create-namespace -n sysdig-admission-controller --version=0.14.19 \ + --create-namespace -n sysdig-admission-controller --version=0.14.20 \ --values values.yaml ``` From f0c58a5c702265c4cd5cd73128fce815df053d5a Mon Sep 17 00:00:00 2001 From: Dmitry Ribakov Date: Thu, 25 Jan 2024 13:20:13 +0200 Subject: [PATCH 13/13] version bump --- charts/sysdig-deploy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/sysdig-deploy/Chart.yaml b/charts/sysdig-deploy/Chart.yaml index 251b93652..0c15b2ecc 100644 --- a/charts/sysdig-deploy/Chart.yaml +++ b/charts/sysdig-deploy/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: sysdig-deploy description: A chart with various Sysdig components for Kubernetes type: application -version: 1.37.6 +version: 1.37.7 maintainers: - name: AlbertoBarba email: alberto.barba@sysdig.com