Control the policy controller monitoring resources from chart, enhanc…

[senanz]

…ment for the current implmentation to hadd all the resources by default, The new change add avail to pass resourcesNames through the chart with list of resources comma sperataed for which resources to be monitored by the policy controller, the default is all resources if the flag wasn't presented in the chart

This PR resolves #1388

Signed-off-by: Senan Zedan (EXT-Nokia) [email protected]

Summary

The new change add avail to pass resourcesNames through the chart with list of resources comma sperataed for which resources to be monitored by the policy controller, the default is all resources if the flag wasn't presented in the chart

[senanz]

@vaikas - Could you please look into this?

[vaikas]

Could you add some tests, maybe here: https://github.com/sigstore/policy-controller/tree/main/test

[senanz]

@vaikas - per your request, test added.

[vaikas]

@vaikas - per your request, test added.

That does not really test any of this new code. You'd have to add a test that launches policy controller with these new flags, here's one example where we change the policy-controller behaviour by the flags:

policy-controller/.github/workflows/kind-cluster-image-policy-tsa.yaml

Line 125 in b3af2f0

# Install policy-controller that does not have TUF embedded or installed.

So, create a new kustomize file that launches policy controller with say --resource-name=pods, and customize it like here:

policy-controller/.github/workflows/kind-cluster-image-policy-tsa.yaml

Line 136 in b3af2f0

kustomize build test/kustomize-no-tuf | kubectl apply -f -

And then after the policy-controller has been started with the flags under test, you'd run your new test:

policy-controller/.github/workflows/kind-cluster-image-policy-tsa.yaml

Line 177 in b3af2f0

./test/e2e_test_cluster_image_policy_with_tsa.sh

It should at the bare minimum have a negative test and a positive test. So, if you're using resource-name pods, then launching a deployment with a failing config should succeed if you instead launch a pod.

[vaikas]

Looking great! There's just some nits for naming, namespaces. One change that should be made it so make sure the tag->digest resolution does not actually happen. The webhook configuration is a good check, but it's easy enough to also make sure the actual resource (deployment) does not get modified.

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 26 lines in your changes missing coverage. Please review.

Project coverage is 42.66%. Comparing base (50ef092) to head (aa63abe).
Report is 296 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/webhook/main.go	0.00%	26 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1687       +/-   ##
===========================================
- Coverage   52.92%   42.66%   -10.27%     
===========================================
  Files          44      121       +77     
  Lines        3979     9010     +5031     
===========================================
+ Hits         2106     3844     +1738     
- Misses       1651     4811     +3160     
- Partials      222      355      +133     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[vaikas]

Looks like some of the changes I requested, and you marked as fixed have not made it in to this PR 🤔 ?

Also, looks like bunch of sed commands are failing, for example:
https://github.com/sigstore/policy-controller/actions/runs/12234409121/job/34140387122?pr=1687#step:14:132

[senanz]

Hi Ville, Fixed them locally and working in the last comment to add tests. Updated PR will raise soon.

…

On Mon, 9 Dec 2024 at 18:48 Ville Aikas ***@***.***> wrote: Looks like some of the changes I requested, and you marked as fixed have not made it in to this PR 🤔 ? Also, looks like bunch of sed commands are failing, for example: https://github.com/sigstore/policy-controller/actions/runs/12234409121/job/34140387122?pr=1687#step:14:132 — Reply to this email directly, view it on GitHub <#1687 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AIDIUC3MMEW4UY6HLKCMUCL2EXCUBAVCNFSM6AAAAABRCWYFPSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMRYGY3TMOBYGA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[senanz]

apolofize for the delay, updated.