feat: Modify policy categories (#3)

* ci: Modify pipelines and issue templates

* feat: Create new policy categories

* ci: Fix typo

* ci: Fix bug report

* ci: Fix bug report

* ci: Modify CONTRIBUTING.md

Author: Balsir

.github/CONTRIBUTING.md

@@ -6,15 +6,15 @@ Please note we have a code of conduct, please follow it in all your interactions
 
 ## Pull Request Process
 
-1. Update the README.md with details of changes including example hcl blocks and [example files](./examples) if appropriate.
+1. Document your changes in the chart's README.md.gotmpl. The README.md will be generated from it by the pre-commit hook in the next step.
 2. Run pre-commit hooks `pre-commit run -a`.
-3. Once all outstanding comments and checklist items have been addressed, your contribution will be merged! Merged PRs will be included in the next release. The terraform-aws-vpc maintainers take care of updating the CHANGELOG as they merge.
+3. Once all outstanding comments and checklist items have been addressed, your contribution will be merged! Merged PRs will be included in the next release.
 
 ## Checklists for contributions
 
 - [ ] Add [semantics prefix](#semantic-pull-requests) to your PR or Commits.
 - [ ] CI tests are passing
-- [ ] README.md has been updated after any changes. The variables and outputs in the README.md has been generated (using the `terraform_docs` pre-commit hook).
+- [ ] README.md has been updated after any changes. The variables and outputs in the README.md has been generated (using the `helm-docs` pre-commit hook)
 - [ ] Run pre-commit hooks `pre-commit run -a`
 
 ## Semantic Pull Requests

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -8,7 +8,7 @@ body:
 - type: markdown
   attributes:
     value: >
-      **Thank you for wanting to report a bug!**
+      **Thank you for reporting a bug!**
 
       Verify first that your issue is not [already reported on
       GitHub][issue search].
@@ -20,77 +20,68 @@ body:
     label: Summary
     description: Explain the problem briefly below.
     placeholder: >-
-      When I try to do X with teraform module from the main branch on GitHub, Y
-      breaks in a way Z under the env E. Here are all the details I know
+      When I try to do X with the Helm chart from the main branch on GitHub,
+      Y breaks in a way Z under the env E. Here are all the details I know
       about this problem...
   validations:
     required: true
 
 - type: dropdown
   attributes:
     label: Issue Type
-    description: >
-      Please select the single available option in the drop-down.
-
-      <details>
-        <summary>
-          <em>Why?</em>
-        </summary>
-
-        We would do it by ourselves but unfortunatelly, the curent
-        edition of GitHub Issue Forms Alpha does not support this yet 🤷
-
-
-        _We will make it easier in the future, once GitHub
-        supports dropdown defaults. Promise!_
-
-      </details>
+    description: Issue type
     options:
     - Bug Report
   validations:
     required: true
 
+- type: input
+  attributes:
+    label: Chart version
+    description: Input the chart version
+    placeholder: v0.1.0
+  validations:
+    required: true
+
 - type: textarea
   attributes:
-    label: Terraform Version
-    description: >-
-      Paste verbatim output from `terraform --version` below, under
-      the prompt line. Please don't wrap it with tripple backticks — your
-      whole input will be turned into a code snippet automatically.
+    label: Helm version
+    description: Paste the output of `helm version`
     render: console
     placeholder: |
-        $ terraform --version
-        Terraform v1.1.4
-        on linux_amd64
-        + provider registry.terraform.io/cloudposse/utils v0.17.23
-        + provider registry.terraform.io/hashicorp/aws v4.13.0
-        + provider registry.terraform.io/hashicorp/helm v2.5.1
-        + provider registry.terraform.io/hashicorp/kubernetes v2.11.0
+      $ helm version
+      version.BuildInfo{Version:"v3.10.2", GitCommit:"50f003e5ee8704ec937a756c646870227d7c8b58", GitTreeState:"clean", GoVersion:"go1.18.8"}
   validations:
     required: true
 
 - type: textarea
   attributes:
-    label: Steps to Reproduce
-    description: |
-      Describe exactly how to reproduce the problem, using a minimal test-case.
-
-      **HINT:** You can paste https://gist.github.com links for larger files.
-    value: |
-      <!--- Paste example terraform code between quotes below -->
-      ```hcl (paste below)
+    label: Kubectl version
+    description: Paste the output of `kubectl version`
+    render: console
+    placeholder: |
+      $ kubectl version
+      ...
+  validations:
+    required: true
 
-      ```
+- type: textarea
+  attributes:
+    label: Steps to reproduce
+    description: Enter details about how to reproduce the bug.
+    placeholder: |
+      1. In this environment...
+      2. With this config...
+      3. Run '...'
+      4. See error...
   validations:
     required: true
 
 - type: textarea
   attributes:
     label: Expected Results
-    description: >-
-      Describe what you expected to happen when running the steps above.
-    placeholder: >-
-      I expected X to happen because I assumed Y.
+    description: Describe what you expected to happen.
+    placeholder: I expected X to happen because I assumed Y.
   validations:
     required: true
 
@@ -99,10 +90,22 @@ body:
     label: Actual Results
     description: |
       Describe what actually happened.
-
-      Paste verbatim command output and don't wrap it with tripple backticks — your
-      whole input will be turned into a code snippet automatically.
+      Paste verbatim command output or any other details.
     render: console
-    placeholder: Terrafom command output...
+    placeholder: Helm command output...
   validations:
     required: true
+
+- type: textarea
+  attributes:
+    label: Custom values or parameters?
+    description: Add any parameter used via `--set` or as a `values.yaml` customization.
+  validations:
+    required: false
+
+- type: textarea
+  attributes:
+    label: Additional information
+    description: Tell us anything else you think we should know.
+  validations:
+    required: false

.github/workflows/helm-lint-test.yaml

@@ -4,7 +4,7 @@ on: pull_request
 
 jobs:
   lint-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -18,7 +18,7 @@ jobs:
 
       - uses: actions/setup-python@v4
         with:
-          python-version: '3.9'
+          python-version: '3.11'
           check-latest: true
 
       - name: Set up chart-testing
@@ -38,7 +38,7 @@ jobs:
 
       - name: Create kind cluster
         if: steps.list-changed.outputs.changed == 'true'
-        uses: helm/kind-action@v1.5.0
+        uses: helm/kind-action@v1.7.0
 
       - name: Install Kyverno
         id: install-kyverno
@@ -52,7 +52,7 @@ jobs:
         run: ct install --target-branch ${{ github.event.repository.default_branch }}
 
   linter-artifacthub:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     container:
       image: artifacthub/ah
       options: --user root

charts/kyverno-policies/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: 0.2.0
 
 # Maintainers
 maintainers:

charts/kyverno-policies/README.md

@@ -2,14 +2,16 @@
 
 Helm chart for deployment of Kyverno policies
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 ## Description
 Helm chart to deploy Kyverno policies.
 Policy categories:
+- **bestPractices** - Policies which validate and enforce Kubernetes best practices
 - **podSecurityBaseline** - https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
 - **podSecurityRestricted** - https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
-- **other**
+- **other** - All other policies, may be split into separate categories in the future
+- **sample** - Policies that showcase a certain Kyverno functionality
 
 ## Installation
 ````shell
@@ -174,7 +176,7 @@ policies:
 | fullnameOverride | string | `""` | fullnameOverride |
 | nameOverride | string | `""` | nameOverride |
 | policies | object | `{"blockStaleImages":{},"checkServiceAccount":{"background":false},"disableAutomountServiceAccountToken":{},"disablePodAutomountServiceAccountToken":{},"disableServiceDiscovery":{},"disallowAllSecrets":{},"disallowCapabilitiesStrict":{},"disallowDefaultNamespace":{},"disallowEmptyIngressHost":{},"disallowHostNamespaces":{},"disallowHostPath":{},"disallowHostPorts":{},"disallowPrivilegeEscalation":{},"disallowPrivilegedContainers":{},"disallowProcMount":{},"disallowSELinux":{},"preventNakedPods":{},"protectNodeTaints":{"background":false},"requireEncryptionAwsLoadBalancers":{},"requireLabels":{},"requireRoRootFs":{},"requireRunAsNonRoot":{},"requireRunAsNonRootUser":{},"restrictAppArmor":{},"restrictImageRegistries":{},"restrictIngressWildcard":{},"restrictNodePort":{},"restrictSeccompStrict":{},"restrictServiceExternalIps":{},"restrictSysctls":{},"restrictVolumeTypes":{}}` | Used to enable and override individual policies. Policy override takes precedence over category override. Policy name matches its filename. |
-| policyCategories | object | `{"other":{},"podSecurityBaseline":{},"podSecurityRestricted":{}}` | Used to enable policies in bulk per category. May override policy attributes for the entire category. |
+| policyCategories | object | `{"bestPractices":{},"other":{},"podSecurityBaseline":{},"podSecurityRestricted":{},"sample":{}}` | Used to enable policies in bulk per category. May override policy attributes for the entire category. |
 | validationFailureAction | string | `"Audit"` | Default validationFailureAction policy setting according to https://kyverno.io/docs/writing-policies/policy-settings/ |
 | validationFailureActionOverrides | list | `[]` | Default validationFailureActionOverrides policy setting according to https://kyverno.io/docs/writing-policies/policy-settings/ |
 

charts/kyverno-policies/README.md.gotmpl

@@ -7,9 +7,11 @@
 ## Description
 Helm chart to deploy Kyverno policies.
 Policy categories:
+- **bestPractices** - Policies which validate and enforce Kubernetes best practices
 - **podSecurityBaseline** - https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
 - **podSecurityRestricted** - https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
-- **other**
+- **other** - All other policies, may be split into separate categories in the future
+- **sample** - Policies that showcase a certain Kyverno functionality
 
 ## Installation
 ````shell

charts/kyverno-policies/ci/enable-categories-values.yaml

@@ -1,7 +1,11 @@
 policyCategories:
+  bestPractices:
+    enabled: true
   podSecurityBaseline:
     enabled: true
   podSecurityRestricted:
     enabled: true
   other:
     enabled: true
+  sample:
+    enabled: true

…disableAutomountServiceAccountToken.yaml …disableAutomountServiceAccountToken.yamlcharts/kyverno-policies/templates/other/disableAutomountServiceAccountToken.yaml renamed to charts/kyverno-policies/templates/bestPractices/disableAutomountServiceAccountToken.yaml charts/kyverno-policies/templates/other/disableAutomountServiceAccountToken.yaml renamed to charts/kyverno-policies/templates/bestPractices/disableAutomountServiceAccountToken.yaml

@@ -1,5 +1,5 @@
 {{- $name := "disableAutomountServiceAccountToken" }}
-{{- $category := "other" }}
+{{- $category := "bestPractices" }}
 {{- $policyValues := get .Values.policies $name }}
 {{- $categoryValues := get .Values.policyCategories $category }}
 
@@ -13,7 +13,7 @@ metadata:
     pod-policies.kyverno.io/autogen-controllers: {{ . }}
 {{- end }}
     policies.kyverno.io/title: Disable automountServiceAccountToken
-    policies.kyverno.io/category: {{ $category }}, EKS Best Practices
+    policies.kyverno.io/category: {{ $category }}
     policies.kyverno.io/severity: medium
     policies.kyverno.io/subject: ServiceAccount
     kyverno.io/kyverno-version: 1.6.0

…ablePodAutomountServiceAccountToken.yaml …ablePodAutomountServiceAccountToken.yamlcharts/kyverno-policies/templates/other/disablePodAutomountServiceAccountToken.yaml renamed to charts/kyverno-policies/templates/bestPractices/disablePodAutomountServiceAccountToken.yaml charts/kyverno-policies/templates/other/disablePodAutomountServiceAccountToken.yaml renamed to charts/kyverno-policies/templates/bestPractices/disablePodAutomountServiceAccountToken.yaml

@@ -1,5 +1,5 @@
 {{- $name := "disablePodAutomountServiceAccountToken" }}
-{{- $category := "other" }}
+{{- $category := "bestPractices" }}
 {{- $policyValues := get .Values.policies $name }}
 {{- $categoryValues := get .Values.policyCategories $category }}
 
@@ -13,7 +13,7 @@ metadata:
     pod-policies.kyverno.io/autogen-controllers: {{ . }}
 {{- end }}
     policies.kyverno.io/title: Disable automountServiceAccountToken
-    policies.kyverno.io/category: {{ $category }}, EKS Best Practices
+    policies.kyverno.io/category: {{ $category }}
     policies.kyverno.io/severity: medium
     policies.kyverno.io/subject: Pod
     kyverno.io/kyverno-version: 1.6.0

…lates/other/disableServiceDiscovery.yaml …stPractices/disableServiceDiscovery.yamlcharts/kyverno-policies/templates/other/disableServiceDiscovery.yaml renamed to charts/kyverno-policies/templates/bestPractices/disableServiceDiscovery.yaml charts/kyverno-policies/templates/other/disableServiceDiscovery.yaml renamed to charts/kyverno-policies/templates/bestPractices/disableServiceDiscovery.yaml

@@ -1,5 +1,5 @@
 {{- $name := "disableServiceDiscovery" }}
-{{- $category := "other" }}
+{{- $category := "bestPractices" }}
 {{- $policyValues := get .Values.policies $name }}
 {{- $categoryValues := get .Values.policyCategories $category }}
 
@@ -13,7 +13,7 @@ metadata:
     pod-policies.kyverno.io/autogen-controllers: {{ . }}
 {{- end }}
     policies.kyverno.io/title: Disable Service Discovery
-    policies.kyverno.io/category: {{ $category }}, EKS Best Practices
+    policies.kyverno.io/category: {{ $category }}
     policies.kyverno.io/subject: Pod
     kyverno.io/kyverno-version: 1.8.0-rc2
     kyverno.io/kubernetes-version: "1.24"