Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add miscellaneous policies in CEL expressions - Part 2 #1004

Merged
merged 34 commits into from
Jul 10, 2024
Merged

feat: add miscellaneous policies in CEL expressions - Part 2 #1004

merged 34 commits into from
Jul 10, 2024

Conversation

Chandan-DK
Copy link
Contributor

@Chandan-DK Chandan-DK commented May 12, 2024 •
edited

Partially addresses #891

This PR includes the conversion of policies in the following folders:

  • istio
  • kasten
  • kubecost

Description

Policies converted in this PR:

istio

  • enforce-sidecar-injection-namespace
  • enforce-strict-mtls
  • prevent-disabling-injection-pods

kasten

  • k10-data-protection-by-label
  • k10-hourly-rpo
  • k10-validate-ns-by-preset-label

kubecost

  • require-kubecost-labels

Checklist

  • [] I have read the policy contribution guidelines.
  • [] I have added test manifests and resources covering both positive and negative tests that prove this policy works as intended.
  • [] I have added the artifacthub-pkg.yml file and have verified it is complete and correct.

@Chandan-DK
copy enforce-sidecar-injection-namespace
059efbe 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
add kyverno tests for enforce-sidecar-injection-namespace
ccb21cf 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert enforce-sidecar-injection-namespace
150dd03 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy enforce-strict-mtls
5be9651 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
add kyverno tests for enforce-strict-mtls
7424d9c 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert enforce-strict-mtls
9977271 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy enforce-tls-hosts-host-subnets
c5605c1 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
add kyverno tests for enforce-tls-hosts-host-subnets
14fe8c9 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert enforce-tls-hosts-host-subnets
f590890 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy prevent-disabling-injection-pods
4b07ffe 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
make corrections in chainsaw resources
4ad24eb 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
add kyverno tests for prevent-disabling-injection-pods
5c1055d 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert prevent-disabling-injection-pods
c0f95de 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy restrict-virtual-service-wildcard
7ac7be2 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert restrict-virtual-service-wildcard
cd38901 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
add CI tests for istio-cel
e00c353 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy require-kubecost-labels
a65ee2b 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
correct chainsaw resource
1396439 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert require-kubecost-labels
e870211 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
correct chainsaw resource
a4d7a13 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy enforce-instancetype
e704c6b 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert enforce-instancetype
c7cde05 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy k10-data-protection-by-label
ebe227b 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert k10-data-protection-by-label
c6fe9c5 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy k10-hourly-rpo
dcadbf7 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert k10-hourly-rpo
046781b 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
copy k10-validate-ns-by-preset-label
3354995 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
convert k10-validate-ns-by-preset-label
e9958ee 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
rename files for clarity
56be409 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
add CI tests for cel directories
21b9111 
Signed-off-by: Chandan-DK <chandandk468@gmail.com>
@Chandan-DK
remove cel policies due to issue
1976723 
kyverno/kyverno#10313

Signed-off-by: Chandan-DK <chandandk468@gmail.com>
MariamFahmy98
MariamFahmy98 reviewed Jul 9, 2024
View reviewed changes
Copy link
Contributor

@MariamFahmy98 MariamFahmy98 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Chandan-DK - Can you update the policies to set the operations?

@MariamFahmy98 MariamFahmy98 merged commit 5cbdc13 into kyverno:main Jul 10, 2024
224 of 225 checks passed
@Chandan-DK Chandan-DK deleted the miscellaneous-policies-cel-part-2 branch July 10, 2024 05:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@MariamFahmy98 MariamFahmy98 MariamFahmy98 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
Good First Issues
Status: Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@Chandan-DK @MariamFahmy98