Skip to content

Commit 6679e0c

Browse files
slashbenslashben
authored
Merge pull request #48 from slashben/main
Adding multiple API version support to the release process
2 parents 1d76bd9 + 487b69e commit 6679e0c

File tree

17 files changed

+173
-148
lines changed

17 files changed

+173
-148
lines changed

‎.github/workflows/release.yaml

+23-46
Original file line numberDiff line numberDiff line change
@@ -17,75 +17,52 @@ jobs:
1717
uses: slashben/setup-minikube@master
1818
with:
1919
feature-gates: 'ValidatingAdmissionPolicy=true'
20-
extra-config: 'apiserver.runtime-config=admissionregistration.k8s.io/v1alpha1'
21-
kubernetes-version: 1.27.0
20+
extra-config: 'apiserver.runtime-config=admissionregistration.k8s.io/v1beta1'
21+
kubernetes-version: v1.28.0-rc.1
2222
container-runtime: containerd
2323
- uses: actions/setup-python@v4
2424
with:
25-
python-version: '3.10'
25+
python-version: '3.10'
2626
- uses: azure/setup-kubectl@v3
2727
- name: Running all control policy tests
2828
run: |
2929
kubectl version
3030
pip install --upgrade pip
3131
pip install -r requirements.txt
3232
./scripts/run-all-control-tests.sh
33-
33+
3434
release:
3535
needs: test-all-policies
3636
runs-on: ubuntu-latest
3737
outputs:
3838
upload_url: ${{ steps.create_release.outputs.upload_url }}
3939
steps:
4040
- uses: actions/checkout@v3
41-
41+
4242
- name: Verify release tagged commit is on main
4343
run: |
4444
git fetch origin main
4545
git merge-base --is-ancestor ${GITHUB_REF##*/} origin/main && echo "${GITHUB_REF##*/} is a commit on main!"
46-
46+
47+
- uses: azure/setup-kubectl@v3
48+
4749
- name: Create release artifacts
4850
run: |
4951
mkdir release
50-
./scripts/create-release-objects.sh release
51-
52+
kubectl kustomize apis/k8s-v1beta1/ > release/kubescape-validating-admission-policies-v1beta1.yaml
53+
kubectl kustomize apis/x-k8s-v1alpha1/ > release/kubescape-validating-admission-policies-x-v1alpha1.yaml
54+
kubectl kustomize apis/k8s-v1alpha1/ > release/kubescape-validating-admission-policies-v1alpha1.yaml
55+
# Making a copy of the v1beta1 file to be used as the default policy release artifact
56+
cp release/kubescape-validating-admission-policies-v1beta1.yaml release/kubescape-validating-admission-policies.yaml
57+
5258
- name: Create a GitHub release
53-
id: create_release
54-
uses: actions/create-release@v1
55-
env:
56-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57-
with:
58-
tag_name: "${{ github.ref_name }}"
59-
release_name: "Release ${{ github.ref_name }}"
60-
draft: false
61-
prerelease: false
62-
63-
- name: Publish policy object artifact
64-
uses: actions/upload-release-asset@v1
65-
env:
66-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
67-
with:
68-
upload_url: ${{ steps.create_release.outputs.upload_url }}
69-
asset_path: release/kubescape-validating-admission-policies.yaml
70-
asset_name: kubescape-validating-admission-policies.yaml
71-
asset_content_type: text/yaml
72-
73-
- name: Publish policy configuration CRD artifact
74-
uses: actions/upload-release-asset@v1
75-
env:
76-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77-
with:
78-
upload_url: ${{ steps.create_release.outputs.upload_url }}
79-
asset_path: configuration/policy-configuration-definition.yaml
80-
asset_name: policy-configuration-definition.yaml
81-
asset_content_type: text/yaml
82-
83-
- name: Publish basic policy configuration
84-
uses: actions/upload-release-asset@v1
85-
env:
86-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
59+
uses: softprops/action-gh-release@v1
60+
if: startsWith(github.ref, 'refs/tags/')
8761
with:
88-
upload_url: ${{ steps.create_release.outputs.upload_url }}
89-
asset_path: configuration/basic-control-configuration.yaml
90-
asset_name: basic-control-configuration.yaml
91-
asset_content_type: text/yaml
62+
files: |
63+
release/kubescape-validating-admission-policies.yaml
64+
release/kubescape-validating-admission-policies-v1beta1.yaml
65+
release/kubescape-validating-admission-policies-x-v1alpha1.yaml
66+
release/kubescape-validating-admission-policies-v1alpha1.yaml
67+
configuration/policy-configuration-definition.yaml
68+
configuration/basic-control-configuration.yaml

‎apis/k8s-v1alpha1/kustomization.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
bases:
2+
- ../../controls
3+
- ../../runtime-policies
4+
patches:
5+
- target:
6+
group: admissionregistration.k8s.io
7+
version: v1beta1
8+
kind: ValidatingAdmissionPolicy
9+
name: ""
10+
path: patch.json

‎apis/k8s-v1alpha1/patch.json

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[
2+
{
3+
"op": "replace",
4+
"path": "/apiVersion",
5+
"value": "admissionregistration.k8s.io/v1alpha1"
6+
}
7+
]

‎apis/k8s-v1beta1/kustomization.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
bases:
2+
- ../../controls
3+
- ../../runtime-policies
4+
patches:
5+
- target:
6+
group: admissionregistration.k8s.io
7+
version: v1beta1
8+
kind: ValidatingAdmissionPolicy
9+
name: ""
10+
path: patch.json

‎apis/k8s-v1beta1/kustomization.yaml.old

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
resources:
2+
- ../../controls/C-0017/policy.yaml
3+
- ../../controls/C-0073/policy.yaml
4+
- ../../controls/C-0020/policy.yaml
5+
- ../../controls/C-0001/policy.yaml
6+
- ../../controls/C-0045/policy.yaml
7+
- ../../controls/C-0078/policy.yaml
8+
- ../../controls/C-0016/policy.yaml
9+
- ../../controls/C-0076/policy.yaml
10+
- ../../controls/C-0056/policy.yaml
11+
- ../../controls/C-0004/policy.yaml
12+
- ../../controls/C-0018/policy.yaml
13+
- ../../controls/C-0077/policy.yaml
14+
- ../../controls/C-0048/policy.yaml
15+
- ../../controls/C-0041/policy.yaml
16+
- ../../controls/C-0009/policy.yaml
17+
- ../../controls/C-0061/policy.yaml
18+
- ../../controls/C-0042/policy.yaml
19+
- ../../controls/C-0046/policy.yaml
20+
- ../../controls/C-0062/policy.yaml
21+
- ../../controls/C-0038/policy.yaml
22+
- ../../controls/C-0055/policy.yaml
23+
- ../../controls/C-0074/policy.yaml
24+
- ../../controls/C-0034/policy.yaml
25+
- ../../controls/C-0075/policy.yaml
26+
- ../../controls/C-0044/policy.yaml
27+
- ../../controls/C-0057/policy.yaml
28+
- ../../controls/C-0050/policy.yaml
29+
- ../../runtime-policies/hostmount/policy.yaml
30+
- ../../runtime-policies/exec/policy.yaml
31+
- ../../runtime-policies/portforward/policy.yaml
32+
- ../../runtime-policies/insecure-capabilities/policy.yaml
33+
- ../../runtime-policies/privileged/policy.yaml
34+
- ../../runtime-policies/attach/policy.yaml
35+
patches:
36+
- target:
37+
group: admissionregistration.k8s.io
38+
version: v1beta1
39+
kind: ValidatingAdmissionPolicy
40+
name: ""
41+
path: patch.json

‎apis/k8s-v1beta1/patch.json

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[
2+
{
3+
"op": "replace",
4+
"path": "/apiVersion",
5+
"value": "admissionregistration.k8s.io/v1beta1"
6+
}
7+
]

‎apis/x-k8s-v1alpha1/kustomization.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
bases:
2+
- ../../controls
3+
- ../../runtime-policies
4+
patches:
5+
- target:
6+
group: admissionregistration.k8s.io
7+
version: v1beta1
8+
kind: ValidatingAdmissionPolicy
9+
name: ""
10+
path: patch.json

‎apis/x-k8s-v1alpha1/patch.json

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[
2+
{
3+
"op": "replace",
4+
"path": "/apiVersion",
5+
"value": "admissionregistration.x-k8s.io/v1alpha1"
6+
}
7+
]

‎controls/kustomization.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
resources:
2+
- C-0017/policy.yaml
3+
- C-0073/policy.yaml
4+
- C-0020/policy.yaml
5+
- C-0001/policy.yaml
6+
- C-0045/policy.yaml
7+
- C-0078/policy.yaml
8+
- C-0016/policy.yaml
9+
- C-0076/policy.yaml
10+
- C-0056/policy.yaml
11+
- C-0004/policy.yaml
12+
- C-0018/policy.yaml
13+
- C-0077/policy.yaml
14+
- C-0048/policy.yaml
15+
- C-0041/policy.yaml
16+
- C-0009/policy.yaml
17+
- C-0061/policy.yaml
18+
- C-0042/policy.yaml
19+
- C-0046/policy.yaml
20+
- C-0062/policy.yaml
21+
- C-0038/policy.yaml
22+
- C-0055/policy.yaml
23+
- C-0074/policy.yaml
24+
- C-0034/policy.yaml
25+
- C-0075/policy.yaml
26+
- C-0044/policy.yaml
27+
- C-0057/policy.yaml
28+
- C-0050/policy.yaml

‎runtime-policies/attach/policy.yaml

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
1+
apiVersion: admissionregistration.k8s.io/v1beta1
22
kind: ValidatingAdmissionPolicy
33
metadata:
44
name: cluster-policy-deny-attach
@@ -14,13 +14,3 @@ spec:
1414
- expression: "false"
1515
message: "attach is not allowed"
1616
reason: "Medium"
17-
---
18-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
19-
kind: ValidatingAdmissionPolicyBinding
20-
metadata:
21-
name: cluster-policy-deny-attach-binding
22-
spec:
23-
policyName: cluster-policy-deny-attach
24-
validationActions:
25-
- Deny
26-
- Audit

‎runtime-policies/exec/policy.yaml

+1-10
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
1+
apiVersion: admissionregistration.k8s.io/v1beta1
22
kind: ValidatingAdmissionPolicy
33
metadata:
44
name: cluster-policy-deny-exec
@@ -14,12 +14,3 @@ spec:
1414
- expression: "false"
1515
message: "exec is not allowed"
1616
reason: "High"
17-
---
18-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
19-
kind: ValidatingAdmissionPolicyBinding
20-
metadata:
21-
name: cluster-policy-deny-exec-binding
22-
spec:
23-
policyName: cluster-policy-deny-exec
24-
validationActions:
25-
- Audit

‎runtime-policies/hostmount/policy.yaml

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
1+
apiVersion: admissionregistration.k8s.io/v1beta1
22
kind: ValidatingAdmissionPolicy
33
metadata:
44
name: cluster-policy-deny-hostMount
@@ -28,13 +28,3 @@ spec:
2828
- expression: "object.kind != 'CronJob' || object.spec.jobTemplate.spec.volumes.all(vol, !(has(vol.hostPath)))"
2929
message: "There are one or more hostPath mounts in the CronJob! (see more at https://hub.armosec.io/docs/c-0048)"
3030
reason: "Medium"
31-
---
32-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
33-
kind: ValidatingAdmissionPolicyBinding
34-
metadata:
35-
name: cluster-policy-deny-hostMount-binding
36-
spec:
37-
policyName: cluster-policy-deny-hostMount
38-
validationActions:
39-
- Deny
40-
- Audit

‎runtime-policies/insecure-capabilities/policy.yaml

+1-33
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,4 @@
1-
apiVersion: kubescape.io/v1
2-
kind: PolicyConfiguration
3-
metadata:
4-
name: basic-policy-configuration
5-
settings:
6-
insecureCapabilities:
7-
- SETPCAP
8-
- NET_ADMIN
9-
- NET_RAW
10-
- SYS_MODULE
11-
- SYS_RAWIO
12-
- SYS_PTRACE
13-
- SYS_ADMIN
14-
- SYS_BOOT
15-
- MAC_OVERRIDE
16-
- MAC_ADMIN
17-
- PERFMON
18-
- ALL
19-
- BPF
20-
---
21-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
1+
apiVersion: admissionregistration.k8s.io/v1beta1
222
kind: ValidatingAdmissionPolicy
233
metadata:
244
name: cluster-policy-deny-insecure-capabilities
@@ -66,15 +46,3 @@ spec:
6646
))
6747
message: "CronJob has one or more containers with insecure capabilities! (see more at https://hub.armosec.io/docs/c-0046)"
6848
reason: "High"
69-
---
70-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
71-
kind: ValidatingAdmissionPolicyBinding
72-
metadata:
73-
name: cluster-policy-deny-insecure-capabilities-binding
74-
spec:
75-
policyName: cluster-policy-deny-insecure-capabilities
76-
paramRef:
77-
name: basic-policy-configuration
78-
validationActions:
79-
- Deny
80-
- Audit

‎runtime-policies/kustomization.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resources:
2+
- hostmount/policy.yaml
3+
- exec/policy.yaml
4+
- portforward/policy.yaml
5+
- insecure-capabilities/policy.yaml
6+
- privileged/policy.yaml
7+
- attach/policy.yaml

‎runtime-policies/portforward/policy.yaml

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
1+
apiVersion: admissionregistration.k8s.io/v1beta1
22
kind: ValidatingAdmissionPolicy
33
metadata:
44
name: cluster-policy-deny-portforward
@@ -14,13 +14,3 @@ spec:
1414
- expression: "false"
1515
message: "portforward is not allowed"
1616
reason: "High"
17-
---
18-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
19-
kind: ValidatingAdmissionPolicyBinding
20-
metadata:
21-
name: cluster-policy-deny-portforward-binding
22-
spec:
23-
policyName: cluster-policy-deny-portforward
24-
validationActions:
25-
- Deny
26-
- Audit

‎runtime-policies/privileged/policy.yaml

+1-11
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
1+
apiVersion: admissionregistration.k8s.io/v1beta1
22
kind: ValidatingAdmissionPolicy
33
metadata:
44
name: cluster-policy-deny-priviliged-flag
@@ -46,13 +46,3 @@ spec:
4646
container.securityContext.capabilities.add.all(cap, cap != 'SYS_ADM')))
4747
)
4848
message: "CronJob has one or more privileged container.(see more at https://hub.armosec.io/docs/c-0057)"
49-
---
50-
apiVersion: admissionregistration.x-k8s.io/v1alpha1
51-
kind: ValidatingAdmissionPolicyBinding
52-
metadata:
53-
name: cluster-policy-deny-privileged-flag-binding
54-
spec:
55-
policyName: cluster-policy-deny-priviliged-flag
56-
validationActions:
57-
- Deny
58-
- Audit

0 commit comments

Comments
 (0)