[bot] [main] Automated dependencies update

roboquat · roboquat · commit a7537112ea1b · 2022-08-25T12:19:56.000Z
diff --git a/jsonnetfile.lock.json b/jsonnetfile.lock.json
@@ -8,8 +8,8 @@
           "subdir": "jsonnet"
         }
       },
-      "version": "a686504ded78c3d43debe4c92bd55f301fccf018",
-      "sum": "UbJnz0DmyTPO0qFWbI3f7urPVrMCfCDXUaTM/3bIDjQ=",
+      "version": "005de258286d9f8a4ce76b03b52a85900d2a2341",
+      "sum": "rZ0w4xX6ms2AAFBZPjkuirPZQOsX5eTNFTOB3WrnBzE=",
       "name": "kubescape"
     },
     {
@@ -29,7 +29,7 @@
           "subdir": "contrib/mixin"
         }
       },
-      "version": "c29dbf34005532640875df2b30711399ce3d236f",
+      "version": "f36a8782f03f7e846d5bad25946731f26bdd4507",
       "sum": "IkDHlaE0gvvcPjSNurFT+jQ2aCOAbqHF1WVmXbAgkds="
     },
     {
@@ -39,8 +39,8 @@
           "subdir": "operations/observability/mixins"
         }
       },
-      "version": "7cee528fb83937bd293fa06875f5e67650dcd171",
-      "sum": "moUdpYLFkUuKaAY5tNnR0TQIBlk3uYwqxWwbYXHP7lo=",
+      "version": "803b52a388107e72d90d8f6ed11a14ea87c2b2a4",
+      "sum": "ofmf/heE6uIkoRj4sMCiywjW3lHSNdiIqIPCTBiDTTY=",
       "name": "gitpod"
     },
     {
@@ -100,7 +100,7 @@
           "subdir": "jsonnet/kube-state-metrics"
         }
       },
-      "version": "4c141d5877f1eeaeb3194a79b9c948d7efe72fd7",
+      "version": "ebc0e186877b8c7662563db23ca0c87988eab016",
       "sum": "evJ+PXRzuM1tezCG5WzpAn4Lk3YJfMvDFcs+45fsscU="
     },
     {
@@ -110,7 +110,7 @@
           "subdir": "jsonnet/kube-state-metrics-mixin"
         }
       },
-      "version": "4c141d5877f1eeaeb3194a79b9c948d7efe72fd7",
+      "version": "ebc0e186877b8c7662563db23ca0c87988eab016",
       "sum": "u8gaydJoxEjzizQ8jY8xSjYgWooPmxw+wIWdDxifMAk="
     },
     {
@@ -130,7 +130,7 @@
           "subdir": "jsonnet/mixin"
         }
       },
-      "version": "fb13468008cdebc0ba361a4ce9305774803a7c0d",
+      "version": "200b7410702a603cb813c8643c90ca026e0be0f6",
       "sum": "GQmaVFJwKMiD/P4n3N2LrAZVcwutriWrP8joclDtBYQ=",
       "name": "prometheus-operator-mixin"
     },
@@ -141,7 +141,7 @@
           "subdir": "jsonnet/prometheus-operator"
         }
       },
-      "version": "fb13468008cdebc0ba361a4ce9305774803a7c0d",
+      "version": "200b7410702a603cb813c8643c90ca026e0be0f6",
       "sum": "hV3FK2ekNFLUlKnj5chRp8WKKxZemfbwynYWK5RkY1E="
     },
     {
@@ -172,7 +172,7 @@
           "subdir": "documentation/prometheus-mixin"
         }
       },
-      "version": "a1fcfe62dbe82c6292214f50ee91337566b0d61b",
+      "version": "d521933053bdf68d252e365da9376706d04addcc",
       "sum": "crD6rsagAMJFnVRw4pO63z3LLYfz4QFIiMR14zjjIfY=",
       "name": "prometheus"
     },
@@ -183,7 +183,7 @@
           "subdir": "config/crd/bases"
         }
       },
-      "version": "d1288834c1571731a34a599cf8136a88b65d0d35",
+      "version": "110bd3546a2527b7e11d1e9d7e66c2b14c4f4176",
       "sum": "d1550yhsX4VxdVN7b0gWT0cido/W90P6OGLzLqPwZcs="
     },
     {
@@ -193,7 +193,7 @@
           "subdir": "mixin"
         }
       },
-      "version": "ee512aed1fece177b9257e80ba6c6c5d5986620a",
+      "version": "319ef1500a5c626da0eee76f6e04a51a5afea2e6",
       "sum": "oksO55VdKbsLAVA3vl7b1woE9TLmfvH7sz5+1A7iOBE=",
       "name": "thanos-mixin"
     },
diff --git a/monitoring-satellite/manifests/grafana/dashboardDefinitions.yaml b/monitoring-satellite/manifests/grafana/dashboardDefinitions.yaml
@@ -9667,7 +9667,7 @@ items:
                           "steppedLine": false,
                           "targets": [
                               {
-                                  "expr": "sum(\n  rate(gitpod_ws_manager_workspace_stops_total{cluster=~\"$cluster\", reason=\"failed\"}[5m])\n) by (cluster, type)\n",
+                                  "expr": "sum(\n  rate(gitpod_ws_manager_workspace_stops_total{cluster=~\"$cluster\", reason=\"failed\"}[5m])\n) by (cluster, type) OR on() vector(0)\n",
                                   "format": "time_series",
                                   "intervalFactor": 2,
                                   "legendFormat": "{{type}}",
diff --git a/monitoring-satellite/manifests/kubescape/configMap.yaml b/monitoring-satellite/manifests/kubescape/configMap.yaml
@@ -132,6 +132,121 @@ data:
         "clair-clair"
       ]
     }
+  kubescape-exceptions.json: |
+    [
+      {
+        "name": "exclude-allowed-privileged",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+          "alertOnly"
+        ],
+        "resources": [
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "agent-smith"
+            }
+          },
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "ws-daemon"
+            }
+          },
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "falco"
+            }
+          },
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "calico-node"
+            }
+          },
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "ip-masq-agent"
+            }
+          },
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "kube-proxy"
+            }
+          },
+        {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "metadata-proxy-v0.1"
+            }
+          },
+        {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "nvidia-gpu-device-plugin"
+            }
+          },
+        {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "pdcsi-node"
+            }
+          },
+        ],
+        "posturePolicies": [
+          {
+            "controlID": "C-0057"
+          }
+        ]
+      },
+    {
+        "name": "exclude-allowed-hostPID",
+        "policyType": "postureExceptionPolicy",
+        "actions": [
+          "alertOnly"
+        ],
+        "resources": [
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "node-exporter"
+            }
+          },
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "ws-daemon"
+            }
+          },
+          {
+            "designatorType": "Attributes",
+            "attributes": {
+              "kind": "DaemonSet",
+              "name": "agent-smith"
+            }
+          }
+        ],
+        "posturePolicies": [
+          {
+            "controlID": "C-0038"
+          }
+        ]
+      }
+    ]
 kind: ConfigMap
 metadata:
   labels:
diff --git a/monitoring-satellite/manifests/kubescape/deployment.yaml b/monitoring-satellite/manifests/kubescape/deployment.yaml
@@ -27,6 +27,8 @@ spec:
       - args:
         - --controls-config
         - /home/.kubescape/controls-input.json
+        - --exceptions
+        - /home/.kubescape/kubescape-exceptions.json
         command:
         - kubescape
         env:
diff --git a/vendor/github.com/ArthurSens/kubescape-jsonnet/jsonnet/kubescape.libsonnet b/vendor/github.com/ArthurSens/kubescape-jsonnet/jsonnet/kubescape.libsonnet
diff --git a/vendor/github.com/gitpod-io/gitpod/operations/observability/mixins/cross-teams/dashboards/gitpod-overview.libsonnet b/vendor/github.com/gitpod-io/gitpod/operations/observability/mixins/cross-teams/dashboards/gitpod-overview.libsonnet

Original file line number	Diff line number	Diff line change
`@@ -8,8 +8,8 @@`
`8`	`8`	`"subdir": "jsonnet"`
`9`	`9`	`}`
`10`	`10`	`},`
`11`		`- "version": "a686504ded78c3d43debe4c92bd55f301fccf018",`
`12`		`- "sum": "UbJnz0DmyTPO0qFWbI3f7urPVrMCfCDXUaTM/3bIDjQ=",`
	`11`	`+ "version": "005de258286d9f8a4ce76b03b52a85900d2a2341",`
	`12`	`+ "sum": "rZ0w4xX6ms2AAFBZPjkuirPZQOsX5eTNFTOB3WrnBzE=",`
`13`	`13`	`"name": "kubescape"`
`14`	`14`	`},`
`15`	`15`	`{`
`@@ -29,7 +29,7 @@`
`29`	`29`	`"subdir": "contrib/mixin"`
`30`	`30`	`}`
`31`	`31`	`},`
`32`		`- "version": "c29dbf34005532640875df2b30711399ce3d236f",`
	`32`	`+ "version": "f36a8782f03f7e846d5bad25946731f26bdd4507",`
`33`	`33`	`"sum": "IkDHlaE0gvvcPjSNurFT+jQ2aCOAbqHF1WVmXbAgkds="`
`34`	`34`	`},`
`35`	`35`	`{`
`@@ -39,8 +39,8 @@`
`39`	`39`	`"subdir": "operations/observability/mixins"`
`40`	`40`	`}`
`41`	`41`	`},`
`42`		`- "version": "7cee528fb83937bd293fa06875f5e67650dcd171",`
`43`		`- "sum": "moUdpYLFkUuKaAY5tNnR0TQIBlk3uYwqxWwbYXHP7lo=",`
	`42`	`+ "version": "803b52a388107e72d90d8f6ed11a14ea87c2b2a4",`
	`43`	`+ "sum": "ofmf/heE6uIkoRj4sMCiywjW3lHSNdiIqIPCTBiDTTY=",`
`44`	`44`	`"name": "gitpod"`
`45`	`45`	`},`
`46`	`46`	`{`
`@@ -100,7 +100,7 @@`
`100`	`100`	`"subdir": "jsonnet/kube-state-metrics"`
`101`	`101`	`}`
`102`	`102`	`},`
`103`		`- "version": "4c141d5877f1eeaeb3194a79b9c948d7efe72fd7",`
	`103`	`+ "version": "ebc0e186877b8c7662563db23ca0c87988eab016",`
`104`	`104`	`"sum": "evJ+PXRzuM1tezCG5WzpAn4Lk3YJfMvDFcs+45fsscU="`
`105`	`105`	`},`
`106`	`106`	`{`
`@@ -110,7 +110,7 @@`
`110`	`110`	`"subdir": "jsonnet/kube-state-metrics-mixin"`
`111`	`111`	`}`
`112`	`112`	`},`
`113`		`- "version": "4c141d5877f1eeaeb3194a79b9c948d7efe72fd7",`
	`113`	`+ "version": "ebc0e186877b8c7662563db23ca0c87988eab016",`
`114`	`114`	`"sum": "u8gaydJoxEjzizQ8jY8xSjYgWooPmxw+wIWdDxifMAk="`
`115`	`115`	`},`
`116`	`116`	`{`
`@@ -130,7 +130,7 @@`
`130`	`130`	`"subdir": "jsonnet/mixin"`
`131`	`131`	`}`
`132`	`132`	`},`
`133`		`- "version": "fb13468008cdebc0ba361a4ce9305774803a7c0d",`
	`133`	`+ "version": "200b7410702a603cb813c8643c90ca026e0be0f6",`
`134`	`134`	`"sum": "GQmaVFJwKMiD/P4n3N2LrAZVcwutriWrP8joclDtBYQ=",`
`135`	`135`	`"name": "prometheus-operator-mixin"`
`136`	`136`	`},`
`@@ -141,7 +141,7 @@`
`141`	`141`	`"subdir": "jsonnet/prometheus-operator"`
`142`	`142`	`}`
`143`	`143`	`},`
`144`		`- "version": "fb13468008cdebc0ba361a4ce9305774803a7c0d",`
	`144`	`+ "version": "200b7410702a603cb813c8643c90ca026e0be0f6",`
`145`	`145`	`"sum": "hV3FK2ekNFLUlKnj5chRp8WKKxZemfbwynYWK5RkY1E="`
`146`	`146`	`},`
`147`	`147`	`{`
`@@ -172,7 +172,7 @@`
`172`	`172`	`"subdir": "documentation/prometheus-mixin"`
`173`	`173`	`}`
`174`	`174`	`},`
`175`		`- "version": "a1fcfe62dbe82c6292214f50ee91337566b0d61b",`
	`175`	`+ "version": "d521933053bdf68d252e365da9376706d04addcc",`
`176`	`176`	`"sum": "crD6rsagAMJFnVRw4pO63z3LLYfz4QFIiMR14zjjIfY=",`
`177`	`177`	`"name": "prometheus"`
`178`	`178`	`},`
`@@ -183,7 +183,7 @@`
`183`	`183`	`"subdir": "config/crd/bases"`
`184`	`184`	`}`
`185`	`185`	`},`
`186`		`- "version": "d1288834c1571731a34a599cf8136a88b65d0d35",`
	`186`	`+ "version": "110bd3546a2527b7e11d1e9d7e66c2b14c4f4176",`
`187`	`187`	`"sum": "d1550yhsX4VxdVN7b0gWT0cido/W90P6OGLzLqPwZcs="`
`188`	`188`	`},`
`189`	`189`	`{`
`@@ -193,7 +193,7 @@`
`193`	`193`	`"subdir": "mixin"`
`194`	`194`	`}`
`195`	`195`	`},`
`196`		`- "version": "ee512aed1fece177b9257e80ba6c6c5d5986620a",`
	`196`	`+ "version": "319ef1500a5c626da0eee76f6e04a51a5afea2e6",`
`197`	`197`	`"sum": "oksO55VdKbsLAVA3vl7b1woE9TLmfvH7sz5+1A7iOBE=",`
`198`	`198`	`"name": "thanos-mixin"`
`199`	`199`	`},`
Original file line number	Diff line number	Diff line change
`@@ -9667,7 +9667,7 @@ items:`
`9667`	`9667`	`"steppedLine": false,`
`9668`	`9668`	`"targets": [`
`9669`	`9669`	`{`
`9670`		`- "expr": "sum(\n rate(gitpod_ws_manager_workspace_stops_total{cluster=~\"$cluster\", reason=\"failed\"}[5m])\n) by (cluster, type)\n",`
	`9670`	`+ "expr": "sum(\n rate(gitpod_ws_manager_workspace_stops_total{cluster=~\"$cluster\", reason=\"failed\"}[5m])\n) by (cluster, type) OR on() vector(0)\n",`
`9671`	`9671`	`"format": "time_series",`
`9672`	`9672`	`"intervalFactor": 2,`
`9673`	`9673`	`"legendFormat": "{{type}}",`