Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(kyverno): update helm-release ( 3.1.4 → 3.2.0 ) #2885

Merged
merged 1 commit into from
Apr 26, 2024
Merged

feat(kyverno): update helm-release ( 3.1.4 → 3.2.0 ) #2885

merged 1 commit into from
Apr 26, 2024

Conversation

tyriis-automation[bot]
Copy link
Contributor

This PR contains the following updates:

Package Update Change OpenSSF
kyverno (source) minor 3.1.4 -> 3.2.0 OpenSSF Scorecard

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@tyriis-automation tyriis-automation bot added renovate/flux renovate flux manager renovate/helm renovate helm datasource type/minor a minor update labels Apr 26, 2024
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@tyriis-automation
Copy link
Contributor Author 

--- kubernetes/talos-flux/apps/kyverno/kyverno/app Kustomization: flux-system/apps-kyverno-app-sync HelmRelease: kyverno/kyverno

+++ kubernetes/talos-flux/apps/kyverno/kyverno/app Kustomization: flux-system/apps-kyverno-app-sync HelmRelease: kyverno/kyverno

@@ -12,13 +12,13 @@

     spec:
       chart: kyverno
       sourceRef:
         kind: HelmRepository
         name: kyverno-charts
         namespace: flux-system
-      version: 3.1.4
+      version: 3.2.0
   install:
     createNamespace: true
     remediation:
       retries: 3
   interval: 30m
   maxHistory: 2

@tyriis-automation
Copy link
Contributor Author 

--- HelmRelease: kyverno/kyverno ConfigMap: kyverno/kyverno-grafana-grafana

+++ HelmRelease: kyverno/kyverno ConfigMap: kyverno/kyverno-grafana-grafana

@@ -6,13 +6,13 @@

   namespace: kyverno
   annotations:
     grafana_folder: System
   labels:
     grafana_dashboard: '1'
 data:
-  dashboard.json: |
+  kyverno-dashboard.json: |
     {
         "__inputs": [
             {
                 "name": "DS_PROMETHEUS_KYVERNO",
                 "label": "Prometheus Data Source exposing Kyverno's metrics",
                 "description": "Prometheus Data Source exposing Kyverno's metrics",
--- HelmRelease: kyverno/kyverno ConfigMap: kyverno/kyverno

+++ HelmRelease: kyverno/kyverno ConfigMap: kyverno/kyverno

@@ -59,8 +59,9 @@

     [Service,kyverno,kyverno-cleanup-controller] [Service/*,kyverno,kyverno-cleanup-controller]
     [Service,kyverno,kyverno-cleanup-controller-metrics] [Service/*,kyverno,kyverno-cleanup-controller-metrics]
     [Service,kyverno,kyverno-reports-controller-metrics] [Service/*,kyverno,kyverno-reports-controller-metrics]
     [ServiceMonitor,kyverno,kyverno-admission-controller] [ServiceMonitor,kyverno,kyverno-background-controller]
     [ServiceMonitor,kyverno,kyverno-cleanup-controller] [ServiceMonitor,kyverno,kyverno-reports-controller]
     [Secret,kyverno,kyverno-svc.kyverno.svc.*] [Secret,kyverno,kyverno-cleanup-controller.kyverno.svc.*]'
-  webhooks: '[{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kyverno"]}]}}]'
+  webhooks: '[{"namespaceSelector":{"matchExpressions":[{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kube-system"]},{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kyverno"]}],"matchLabels":null}}]'
+  webhookAnnotations: '{"admissions.enforcer/disabled":"true"}'
 
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:admission-controller:core

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:admission-controller:core

@@ -6,12 +6,18 @@

   labels:
     app.kubernetes.io/component: admission-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - mutatingwebhookconfigurations
   - validatingwebhookconfigurations
   verbs:
@@ -39,16 +45,33 @@

   - policies
   - policies/status
   - clusterpolicies
   - clusterpolicies/status
   - updaterequests
   - updaterequests/status
+  - globalcontextentries
+  - globalcontextentries/status
   - admissionreports
   - clusteradmissionreports
   - backgroundscanreports
   - clusterbackgroundscanreports
+  - policyexceptions
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+  - deletecollection
+- apiGroups:
+  - reports.kyverno.io
+  resources:
+  - ephemeralreports
+  - clusterephemeralreports
   verbs:
   - create
   - delete
   - get
   - list
   - patch
@@ -84,12 +107,32 @@

   - authorization.k8s.io
   resources:
   - subjectaccessreviews
   verbs:
   - create
 - apiGroups:
+  - ''
+  resources:
+  - configmaps
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - update
+  - patch
+  - get
+  - list
+  - watch
+- apiGroups:
   - '*'
   resources:
   - '*'
   verbs:
   - get
   - list
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:background-controller:core

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:background-controller:core

@@ -7,19 +7,27 @@

     app.kubernetes.io/component: background-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 rules:
 - apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+- apiGroups:
   - kyverno.io
   resources:
   - policies
   - clusterpolicies
   - policyexceptions
   - updaterequests
   - updaterequests/status
+  - globalcontextentries
+  - globalcontextentries/status
   verbs:
   - create
   - delete
   - get
   - list
   - patch
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:cleanup-controller:core

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:cleanup-controller:core

@@ -6,12 +6,18 @@

   labels:
     app.kubernetes.io/component: cleanup-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
 - apiGroups:
   - admissionregistration.k8s.io
   resources:
   - validatingwebhookconfigurations
   verbs:
   - create
@@ -33,12 +39,26 @@

   resources:
   - clustercleanuppolicies
   - cleanuppolicies
   verbs:
   - list
   - watch
+- apiGroups:
+  - kyverno.io
+  resources:
+  - globalcontextentries
+  - globalcontextentries/status
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+  - deletecollection
 - apiGroups:
   - kyverno.io
   resources:
   - clustercleanuppolicies/status
   - cleanuppolicies/status
   verbs:
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno-cleanup-jobs

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno-cleanup-jobs

@@ -1,20 +0,0 @@

----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kyverno-cleanup-jobs
-  labels:
-    app.kubernetes.io/instance: kyverno
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: kyverno
-rules:
-- apiGroups:
-  - kyverno.io
-  resources:
-  - admissionreports
-  - clusteradmissionreports
-  verbs:
-  - list
-  - deletecollection
-  - delete
-
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:rbac:admin:reports

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:rbac:admin:reports

@@ -22,7 +22,20 @@

   - delete
   - get
   - list
   - patch
   - update
   - watch
+- apiGroups:
+  - reports.kyverno.io
+  resources:
+  - ephemeralreports
+  - clusterephemeralreports
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:rbac:view:reports

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:rbac:view:reports

@@ -18,7 +18,16 @@

   - backgroundscanreports
   - clusterbackgroundscanreports
   verbs:
   - get
   - list
   - watch
+- apiGroups:
+  - reports.kyverno.io
+  resources:
+  - ephemeralreports
+  - clusterephemeralreports
+  verbs:
+  - get
+  - list
+  - watch
 
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:reports-controller:core

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:reports-controller:core

@@ -7,26 +7,53 @@

     app.kubernetes.io/component: reports-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 rules:
 - apiGroups:
-  - '*'
+  - apiextensions.k8s.io
   resources:
-  - '*'
+  - customresourcedefinitions
+  verbs:
+  - get
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  - configmaps
+  - namespaces
   verbs:
   - get
   - list
   - watch
 - apiGroups:
   - kyverno.io
   resources:
+  - globalcontextentries
+  - globalcontextentries/status
   - admissionreports
   - clusteradmissionreports
   - backgroundscanreports
   - clusterbackgroundscanreports
+  - policyexceptions
+  - policies
+  - clusterpolicies
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+  - deletecollection
+- apiGroups:
+  - reports.kyverno.io
+  resources:
+  - ephemeralreports
+  - clusterephemeralreports
   verbs:
   - create
   - delete
   - get
   - list
   - patch
@@ -54,7 +81,15 @@

   - events.k8s.io
   resources:
   - events
   verbs:
   - create
   - patch
+- apiGroups:
+  - '*'
+  resources:
+  - '*'
+  verbs:
+  - get
+  - list
+  - watch
 
--- HelmRelease: kyverno/kyverno ClusterRoleBinding: kyverno/kyverno-cleanup-jobs

+++ HelmRelease: kyverno/kyverno ClusterRoleBinding: kyverno/kyverno-cleanup-jobs

@@ -1,18 +0,0 @@

----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: kyverno-cleanup-jobs
-  labels:
-    app.kubernetes.io/instance: kyverno
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: kyverno
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kyverno-cleanup-jobs
-subjects:
-- kind: ServiceAccount
-  name: kyverno-cleanup-jobs
-  namespace: kyverno
-
--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-admission-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-admission-controller

@@ -8,12 +8,13 @@

     app.kubernetes.io/component: admission-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas: 3
+  revisionHistoryLimit: 10
   strategy:
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 40%
     type: RollingUpdate
   selector:
@@ -50,13 +51,13 @@

                   - admission-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-admission-controller
       initContainers:
       - name: kyverno-pre
-        image: ghcr.io/kyverno/kyvernopre:v1.11.4
+        image: ghcr.io/kyverno/kyvernopre:v1.12.0
         imagePullPolicy: IfNotPresent
         args:
         - --loggingFormat=text
         - --v=2
         resources:
           limits:
@@ -93,31 +94,34 @@

         - name: KYVERNO_DEPLOYMENT
           value: kyverno-admission-controller
         - name: KYVERNO_SVC
           value: kyverno-svc
       containers:
       - name: kyverno
-        image: ghcr.io/kyverno/kyverno:v1.11.4
+        image: ghcr.io/kyverno/kyverno:v1.12.0
         imagePullPolicy: IfNotPresent
         args:
         - --caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca
         - --tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair
         - --backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller
         - --servicePort=443
+        - --webhookServerPort=9443
         - --disableMetrics=false
         - --otelConfig=prometheus
         - --metricsPort=8000
         - --admissionReports=true
         - --autoUpdateWebhooks=true
         - --enableConfigMapCaching=true
         - --enableDeferredLoading=true
         - --dumpPayload=false
         - --forceFailurePolicyIgnore=false
         - --generateValidatingAdmissionPolicy=false
+        - --maxAPICallResponseLength=2000000
         - --loggingFormat=text
         - --v=2
+        - --omitEvents=PolicyApplied,PolicySkipped
         - --enablePolicyException=true
         - --protectManagedResources=false
         - --allowInsecureRegistry=false
         - --registryCredentialHelpers=default,google,amazon,azure,github
         resources:
           limits:
--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-background-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-background-controller

@@ -8,12 +8,13 @@

     app.kubernetes.io/component: background-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas: null
+  revisionHistoryLimit: 10
   strategy:
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 40%
     type: RollingUpdate
   selector:
@@ -42,13 +43,13 @@

                   - background-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-background-controller
       containers:
       - name: controller
-        image: ghcr.io/kyverno/background-controller:v1.11.4
+        image: ghcr.io/kyverno/background-controller:v1.12.0
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9443
           name: https
           protocol: TCP
         - containerPort: 8000
@@ -57,14 +58,16 @@

         args:
         - --disableMetrics=false
         - --otelConfig=prometheus
         - --metricsPort=8000
         - --enableConfigMapCaching=true
         - --enableDeferredLoading=true
+        - --maxAPICallResponseLength=2000000
         - --loggingFormat=text
         - --v=2
+        - --omitEvents=PolicyApplied,PolicySkipped
         - --enablePolicyException=true
         env:
         - name: KYVERNO_SERVICEACCOUNT_NAME
           value: kyverno-background-controller
         - name: KYVERNO_DEPLOYMENT
           value: kyverno-background-controller
--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-cleanup-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-cleanup-controller

@@ -8,12 +8,13 @@

     app.kubernetes.io/component: cleanup-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas: null
+  revisionHistoryLimit: 10
   strategy:
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 40%
     type: RollingUpdate
   selector:
@@ -42,32 +43,36 @@

                   - cleanup-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-cleanup-controller
       containers:
       - name: controller
-        image: ghcr.io/kyverno/cleanup-controller:v1.11.4
+        image: ghcr.io/kyverno/cleanup-controller:v1.12.0
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9443
           name: https
           protocol: TCP
         - containerPort: 8000
           name: metrics
           protocol: TCP
         args:
         - --caSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-ca
         - --tlsSecretName=kyverno-cleanup-controller.kyverno.svc.kyverno-tls-pair
         - --servicePort=443
+        - --cleanupServerPort=9443
+        - --webhookServerPort=9443
         - --disableMetrics=false
         - --otelConfig=prometheus
         - --metricsPort=8000
         - --enableDeferredLoading=true
         - --dumpPayload=false
+        - --maxAPICallResponseLength=2000000
         - --loggingFormat=text
         - --v=2
+        - --protectManagedResources=false
         - --ttlReconciliationInterval=1m
         env:
         - name: KYVERNO_DEPLOYMENT
           value: kyverno-cleanup-controller
         - name: INIT_CONFIG
           value: kyverno
--- HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-reports-controller

+++ HelmRelease: kyverno/kyverno Deployment: kyverno/kyverno-reports-controller

@@ -8,12 +8,13 @@

     app.kubernetes.io/component: reports-controller
     app.kubernetes.io/instance: kyverno
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/part-of: kyverno
 spec:
   replicas: null
+  revisionHistoryLimit: 10
   strategy:
     rollingUpdate:
       maxSurge: 1
       maxUnavailable: 40%
     type: RollingUpdate
   selector:
@@ -42,13 +43,13 @@

                   - reports-controller
               topologyKey: kubernetes.io/hostname
             weight: 1
       serviceAccountName: kyverno-reports-controller
       containers:
       - name: controller
-        image: ghcr.io/kyverno/reports-controller:v1.11.4
+        image: ghcr.io/kyverno/reports-controller:v1.12.0
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 9443
           name: https
           protocol: TCP
         - containerPort: 8000
@@ -65,16 +66,18 @@

         - --backgroundScan=true
         - --backgroundScanWorkers=2
         - --backgroundScanInterval=1h
         - --skipResourceFilters=true
         - --enableConfigMapCaching=true
         - --enableDeferredLoading=true
+        - --maxAPICallResponseLength=2000000
         - --loggingFormat=text
         - --v=2
+        - --omitEvents=PolicyApplied,PolicySkipped
         - --enablePolicyException=true
-        - --reportsChunkSize=1000
+        - --reportsChunkSize=0
         - --allowInsecureRegistry=false
         - --registryCredentialHelpers=default,google,amazon,azure,github
         env:
         - name: KYVERNO_SERVICEACCOUNT_NAME
           value: kyverno-reports-controller
         - name: KYVERNO_DEPLOYMENT
--- HelmRelease: kyverno/kyverno CronJob: kyverno/kyverno-cleanup-admission-reports

+++ HelmRelease: kyverno/kyverno CronJob: kyverno/kyverno-cleanup-admission-reports

@@ -13,24 +13,26 @@

   schedule: '*/10 * * * *'
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
   jobTemplate:
     spec:
+      backoffLimit: 3
       template:
         metadata: null
         spec:
           serviceAccountName: kyverno-cleanup-jobs
           containers:
           - name: cleanup
             image: bitnami/kubectl:1.28.5
             imagePullPolicy: null
             command:
-            - /bin/sh
+            - /bin/bash
             - -c
             - |
+              set -euo pipefail
               COUNT=$(kubectl get admissionreports.kyverno.io -A | wc -l)
               if [ "$COUNT" -gt 10000 ]; then
                 echo "too many reports found ($COUNT), cleaning up..."
                 kubectl delete admissionreports.kyverno.io -A -l='!audit.kyverno.io/report.aggregate'
               else
                 echo "($COUNT) reports found, no clean up needed"
--- HelmRelease: kyverno/kyverno CronJob: kyverno/kyverno-cleanup-cluster-admission-reports

+++ HelmRelease: kyverno/kyverno CronJob: kyverno/kyverno-cleanup-cluster-admission-reports

@@ -13,24 +13,26 @@

   schedule: '*/10 * * * *'
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 1
   failedJobsHistoryLimit: 1
   jobTemplate:
     spec:
+      backoffLimit: 3
       template:
         metadata: null
         spec:
           serviceAccountName: kyverno-cleanup-jobs
           containers:
           - name: cleanup
             image: bitnami/kubectl:1.28.5
             imagePullPolicy: null
             command:
-            - /bin/sh
+            - /bin/bash
             - -c
             - |
+              set -euo pipefail
               COUNT=$(kubectl get clusteradmissionreports.kyverno.io -A | wc -l)
               if [ "$COUNT" -gt 10000 ]; then
                 echo "too many reports found ($COUNT), cleaning up..."
                 kubectl delete clusteradmissionreports.kyverno.io -A -l='!audit.kyverno.io/report.aggregate'
               else
                 echo "($COUNT) reports found, no clean up needed"
--- HelmRelease: kyverno/kyverno Job: kyverno/kyverno-hook-post-upgrade

+++ HelmRelease: kyverno/kyverno Job: kyverno/kyverno-hook-post-upgrade

@@ -1,52 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: kyverno-hook-post-upgrade
-  namespace: kyverno
-  labels:
-    app.kubernetes.io/component: hooks
-    app.kubernetes.io/instance: kyverno
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: kyverno
-  annotations:
-    helm.sh/hook: post-upgrade
-    helm.sh/hook-delete-policy: hook-succeeded,hook-failed
-spec:
-  backoffLimit: 2
-  template:
-    spec:
-      serviceAccount: kyverno-admission-controller
-      restartPolicy: Never
-      containers:
-      - name: kubectl
-        image: bitnami/kubectl:1.28.5
-        imagePullPolicy: null
-        command:
-        - /bin/bash
-        - -c
-        - "NAMESPACES=$(kubectl get namespaces --no-headers=true | awk '{print $1}')\n\
-          \nfor ns in ${NAMESPACES[@]};\ndo\n  COUNT=$(kubectl get policyreports.wgpolicyk8s.io\
-          \ -n $ns --no-headers=true | awk '/pol/{print $1}' | wc -l)\n\n  if [ $COUNT\
-          \ -gt 0 ]; then\n    echo \"deleting $COUNT policyreports in namespace $ns\"\
-          \n    kubectl get policyreports.wgpolicyk8s.io -n $ns --no-headers=true\
-          \ | awk '/pol/{print $1}' | xargs kubectl delete -n $ns policyreports.wgpolicyk8s.io\n\
-          \  else\n    echo \"no policyreports in namespace $ns\"\n  fi\ndone\n\n\
-          COUNT=$(kubectl get clusterpolicyreports.wgpolicyk8s.io --no-headers=true\
-          \ | awk '/pol/{print $1}' | wc -l)\n  \nif [ $COUNT -gt 0 ]; then\n  echo\
-          \ \"deleting $COUNT clusterpolicyreports\"\n  kubectl get clusterpolicyreports.wgpolicyk8s.io\
-          \ --no-headers=true | awk '/pol/{print $1}' | xargs kubectl delete clusterpolicyreports.wgpolicyk8s.io\n\
-          else\n  echo \"no clusterpolicyreports\"\nfi\n"
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsGroup: 65534
-          runAsNonRoot: true
-          runAsUser: 65534
-          seccompProfile:
-            type: RuntimeDefault
-
--- HelmRelease: kyverno/kyverno Job: kyverno/kyverno-hook-pre-delete

+++ HelmRelease: kyverno/kyverno Job: kyverno/kyverno-hook-pre-delete

@@ -1,45 +0,0 @@

----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: kyverno-hook-pre-delete
-  namespace: kyverno
-  labels:
-    app.kubernetes.io/component: hooks
-    app.kubernetes.io/instance: kyverno
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: kyverno
-  annotations:
-    helm.sh/hook: pre-delete
-    helm.sh/hook-delete-policy: hook-succeeded,hook-failed
-spec:
-  backoffLimit: 2
-  template:
-    spec:
-      serviceAccount: kyverno-admission-controller
-      restartPolicy: Never
-      containers:
-      - name: kubectl
-        image: bitnami/kubectl:1.28.5
-        imagePullPolicy: null
-        command:
-        - sh
-        - -c
-        - |-
-          kubectl scale -n kyverno deployment -l app.kubernetes.io/part-of=kyverno --replicas=0
-          sleep 30
-          kubectl delete validatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno
-          kubectl delete mutatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop:
-            - ALL
-          privileged: false
-          readOnlyRootFilesystem: true
-          runAsGroup: 65534
-          runAsNonRoot: true
-          runAsUser: 65534
-          seccompProfile:
-            type: RuntimeDefault
-
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:cleanup-jobs

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:cleanup-jobs

@@ -0,0 +1,20 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:cleanup-jobs
+  labels:
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - admissionreports
+  - clusteradmissionreports
+  verbs:
+  - list
+  - deletecollection
+  - delete
+
--- HelmRelease: kyverno/kyverno ClusterRoleBinding: kyverno/kyverno:cleanup-jobs

+++ HelmRelease: kyverno/kyverno ClusterRoleBinding: kyverno/kyverno:cleanup-jobs

@@ -0,0 +1,18 @@

+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kyverno:cleanup-jobs
+  labels:
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:cleanup-jobs
+subjects:
+- kind: ServiceAccount
+  name: kyverno-cleanup-jobs
+  namespace: kyverno
+
--- HelmRelease: kyverno/kyverno ServiceAccount: kyverno/kyverno-migrate-resources

+++ HelmRelease: kyverno/kyverno ServiceAccount: kyverno/kyverno-migrate-resources

@@ -0,0 +1,16 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kyverno-migrate-resources
+  namespace: kyverno
+  labels:
+    app.kubernetes.io/component: hooks
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+    helm.sh/hook-weight: '100'
+
--- HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:migrate-resources

+++ HelmRelease: kyverno/kyverno ClusterRole: kyverno/kyverno:migrate-resources

@@ -0,0 +1,36 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:migrate-resources
+  labels:
+    app.kubernetes.io/component: hooks
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
+    helm.sh/hook-weight: '100'
+rules:
+- apiGroups:
+  - kyverno.io
+  resources:
+  - '*'
+  verbs:
+  - get
+  - list
+  - update
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions/status
+  verbs:
+  - update
+
--- HelmRelease: kyverno/kyverno ClusterRoleBinding: kyverno/kyverno:migrate-resources

+++ HelmRelease: kyverno/kyverno ClusterRoleBinding: kyverno/kyverno:migrate-resources

@@ -0,0 +1,23 @@

+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kyverno:migrate-resources
+  labels:
+    app.kubernetes.io/component: hooks
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
+    helm.sh/hook-weight: '100'
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:migrate-resources
+subjects:
+- kind: ServiceAccount
+  name: kyverno-migrate-resources
+  namespace: kyverno
+
--- HelmRelease: kyverno/kyverno Job: kyverno/kyverno-clean-reports

+++ HelmRelease: kyverno/kyverno Job: kyverno/kyverno-clean-reports

@@ -0,0 +1,54 @@

+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kyverno-clean-reports
+  namespace: kyverno
+  labels:
+    app.kubernetes.io/component: hooks
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
+spec:
+  backoffLimit: 2
+  template:
+    metadata: null
+    spec:
+      serviceAccount: kyverno-admission-controller
+      restartPolicy: Never
+      containers:
+      - name: kubectl
+        image: bitnami/kubectl:1.28.5
+        imagePullPolicy: null
+        command:
+        - /bin/bash
+        - -c
+        - "set -euo pipefail\nNAMESPACES=$(kubectl get namespaces --no-headers=true\
+          \ | awk '{print $1}')\n\nfor ns in ${NAMESPACES[@]};\ndo\n  COUNT=$(kubectl\
+          \ get policyreports.wgpolicyk8s.io -n $ns --no-headers=true | awk '/pol/{print\
+          \ $1}' | wc -l)\n\n  if [ $COUNT -gt 0 ]; then\n    echo \"deleting $COUNT\
+          \ policyreports in namespace $ns\"\n    kubectl get policyreports.wgpolicyk8s.io\
+          \ -n $ns --no-headers=true | awk '/pol/{print $1}' | xargs kubectl delete\
+          \ -n $ns policyreports.wgpolicyk8s.io\n  else\n    echo \"no policyreports\
+          \ in namespace $ns\"\n  fi\ndone\n\nCOUNT=$(kubectl get clusterpolicyreports.wgpolicyk8s.io\
+          \ --no-headers=true | awk '/pol/{print $1}' | wc -l)\n  \nif [ $COUNT -gt\
+          \ 0 ]; then\n  echo \"deleting $COUNT clusterpolicyreports\"\n  kubectl\
+          \ get clusterpolicyreports.wgpolicyk8s.io --no-headers=true | awk '/pol/{print\
+          \ $1}' | xargs kubectl delete clusterpolicyreports.wgpolicyk8s.io\nelse\n\
+          \  echo \"no clusterpolicyreports\"\nfi\n"
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 65534
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
+
--- HelmRelease: kyverno/kyverno Job: kyverno/kyverno-migrate-resources

+++ HelmRelease: kyverno/kyverno Job: kyverno/kyverno-migrate-resources

@@ -0,0 +1,63 @@

+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kyverno-migrate-resources
+  namespace: kyverno
+  labels:
+    app.kubernetes.io/component: hooks
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+  annotations:
+    helm.sh/hook: post-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
+    helm.sh/hook-weight: '200'
+spec:
+  backoffLimit: 2
+  template:
+    metadata: null
+    spec:
+      serviceAccount: kyverno-migrate-resources
+      restartPolicy: Never
+      containers:
+      - name: kubectl
+        image: ghcr.io/kyverno/kyverno-cli:v1.12.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - migrate
+        - --resource
+        - admissionreports.kyverno.io
+        - --resource
+        - backgroundscanreports.kyverno.io
+        - --resource
+        - cleanuppolicies.kyverno.io
+        - --resource
+        - clusteradmissionreports.kyverno.io
+        - --resource
+        - clusterbackgroundscanreports.kyverno.io
+        - --resource
+        - clustercleanuppolicies.kyverno.io
+        - --resource
+        - clusterpolicies.kyverno.io
+        - --resource
+        - globalcontextentries.kyverno.io
+        - --resource
+        - policies.kyverno.io
+        - --resource
+        - policyexceptions.kyverno.io
+        - --resource
+        - updaterequests.kyverno.io
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 65534
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
+
--- HelmRelease: kyverno/kyverno Job: kyverno/kyverno-scale-to-zero

+++ HelmRelease: kyverno/kyverno Job: kyverno/kyverno-scale-to-zero

@@ -0,0 +1,47 @@

+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kyverno-scale-to-zero
+  namespace: kyverno
+  labels:
+    app.kubernetes.io/component: hooks
+    app.kubernetes.io/instance: kyverno
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/part-of: kyverno
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded,hook-failed
+spec:
+  backoffLimit: 2
+  template:
+    metadata: null
+    spec:
+      serviceAccount: kyverno-admission-controller
+      restartPolicy: Never
+      containers:
+      - name: kubectl
+        image: bitnami/kubectl:1.28.5
+        imagePullPolicy: null
+        command:
+        - /bin/bash
+        - -c
+        - |-
+          set -euo pipefail
+          kubectl scale -n kyverno deployment -l app.kubernetes.io/part-of=kyverno --replicas=0
+          sleep 30
+          kubectl delete validatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno
+          kubectl delete mutatingwebhookconfiguration -l webhook.kyverno.io/managed-by=kyverno
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          privileged: false
+          readOnlyRootFilesystem: true
+          runAsGroup: 65534
+          runAsNonRoot: true
+          runAsUser: 65534
+          seccompProfile:
+            type: RuntimeDefault
+

@tyriis-automation
Copy link
Contributor Author

🦙 MegaLinter status: ✅ SUCCESS

Descriptor Linter Files Fixed Errors Elapsed time
✅ EDITORCONFIG editorconfig-checker 1 0 0.01s
✅ REPOSITORY gitleaks yes no 2.27s
✅ YAML prettier 1 0 0.54s
✅ YAML yamllint 1 0 0.4s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

@tyriis-automation tyriis-automation bot merged commit a669576 into main Apr 26, 2024
15 checks passed
@tyriis-automation tyriis-automation bot deleted the renovate/kyverno-3.x branch April 26, 2024 09:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
area/kubernetes cluster/talos-flux renovate/flux renovate flux manager renovate/helm renovate helm datasource type/minor a minor update
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants