Skip to content

Commit bbdaf33

Browse files
svcAPLBotsvcAPLBot
authored
chore(chart-deps): update policy-reporter to version 3.7.0 (#2746)
1 parent 6ea0183 commit bbdaf33

17 files changed

+666
-29
lines changed

‎chart/chart-index/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ dependencies:
8888
version: 0.99.1
8989
repository: https://open-telemetry.github.io/opentelemetry-helm-charts
9090
- name: policy-reporter
91-
version: 3.5.0
91+
version: 3.7.0
9292
repository: https://kyverno.github.io/policy-reporter
9393
- name: prometheus-blackbox-exporter
9494
version: 11.5.0

‎charts/policy-reporter/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
apiVersion: v2
2-
appVersion: 3.5.0
2+
appVersion: 3.6.0
33
description: 'Policy Reporter watches for PolicyReport Resources. It creates Prometheus
44
Metrics and can send rule validation events to different targets like Loki, Elasticsearch,
55
Slack or Discord '
@@ -12,4 +12,4 @@ name: policy-reporter
1212
sources:
1313
- https://github.com/kyverno/policy-reporter
1414
type: application
15-
version: 3.5.0
15+
version: 3.7.0

‎charts/policy-reporter/README.md‎

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Policy Reporter watches for PolicyReport Resources.
44
It creates Prometheus Metrics and can send rule validation events to different targets like Loki, Elasticsearch, Slack or Discord
55

6-
![Version: 3.5.0](https://img.shields.io/badge/Version-3.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.5.0](https://img.shields.io/badge/AppVersion-3.5.0-informational?style=flat-square)
6+
![Version: 3.7.0](https://img.shields.io/badge/Version-3.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.6.0](https://img.shields.io/badge/AppVersion-3.6.0-informational?style=flat-square)
77

88
## Documentation
99

@@ -87,6 +87,12 @@ Open `http://localhost:8082/` in your browser.
8787
| ingress.annotations | object | `{}` | Annotations for the Ingress |
8888
| ingress.hosts | string | `nil` | Ingress host list |
8989
| ingress.tls | list | `[]` | Ingress tls list |
90+
| httproute.enabled | bool | `false` | Enable HTTPRoute resource (Gateway API alternative to Ingress) Requires Gateway API CRDs (v1) installed in cluster https://gateway-api.sigs.k8s.io/ |
91+
| httproute.labels | object | `{}` | Additional HTTPRoute labels |
92+
| httproute.annotations | object | `{}` | Additional HTTPRoute annotations |
93+
| httproute.parentRefs | list | `[]` | Gateway API parentRefs (list of Gateway references) Must reference an existing Gateway resource |
94+
| httproute.hostnames | list | `[]` | List of hostnames for HTTPRoute |
95+
| httproute.rules | list | `[{"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | HTTPRoute rules configuration Allows advanced routing with matches and filters |
9096
| logging.server | bool | `false` | Enables server access logging |
9197
| logging.encoding | string | `"console"` | Log encoding possible encodings are console and json |
9298
| logging.logLevel | int | `0` | Log level default info |
@@ -99,14 +105,10 @@ Open `http://localhost:8082/` in your browser.
99105
| worker | int | `5` | Amount of queue workers for Report resource processing |
100106
| reportFilter | object | `{}` | Filter Report resources to process |
101107
| sourceConfig | list | `[]` | Customize source specific logic like result ID generation |
102-
| sourceFilters[0].selector.source | string | `"kyverno"` | select Report by source |
108+
| sourceFilters[0].selector.sources | list | `["kyverno","KyvernoValidatingPolicy","KyvernoImageValidatingPolicy"]` | select Report by source |
103109
| sourceFilters[0].uncontrolledOnly | bool | `true` | Filter out Reports of controlled Pods and Jobs, only works for Reports with scope resource |
104110
| sourceFilters[0].disableClusterReports | bool | `false` | Filter out cluster scoped Reports |
105111
| sourceFilters[0].kinds | object | `{"exclude":["ReplicaSet"]}` | Filter out Reports based on the scope resource kind |
106-
| sourceFilters[1].selector.source | string | `"KyvernoValidatingPolicy"` | select Report by source |
107-
| sourceFilters[1].uncontrolledOnly | bool | `true` | Filter out Reports of controlled Pods and Jobs, only works for Reports with scope resource |
108-
| sourceFilters[1].disableClusterReports | bool | `false` | Filter out cluster scoped Reports |
109-
| sourceFilters[1].kinds | object | `{"exclude":["ReplicaSet"]}` | Filter out Reports based on the scope resource kind |
110112
| global.labels | object | `{}` | additional labels added on each resource |
111113
| basicAuth.username | string | `""` | HTTP BasicAuth username |
112114
| basicAuth.password | string | `""` | HTTP BasicAuth password |
@@ -387,7 +389,8 @@ Open `http://localhost:8082/` in your browser.
387389
| ui.image.registry | string | `"ghcr.io"` | Image registry |
388390
| ui.image.repository | string | `"kyverno/policy-reporter-ui"` | Image repository |
389391
| ui.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
390-
| ui.image.tag | string | `"2.4.3"` | Image tag |
392+
| ui.image.tag | string | `"2.5.0"` | Image tag |
393+
| ui.crds.customBoard | bool | `false` | Install UI CustomBoard CRDs |
391394
| ui.replicaCount | int | `1` | Deployment replica count |
392395
| ui.priorityClassName | string | `""` | Deployment priorityClassName |
393396
| ui.logging.api | bool | `false` | Enables external api request logging |
@@ -459,6 +462,12 @@ Open `http://localhost:8082/` in your browser.
459462
| ui.ingress.annotations | object | `{}` | Ingress annotations. |
460463
| ui.ingress.hosts | list | `[]` | List of ingress host configurations. |
461464
| ui.ingress.tls | list | `[]` | List of ingress TLS configurations. |
465+
| ui.httproute.enabled | bool | `false` | Enable HTTPRoute resource (Gateway API alternative to Ingress) Requires Gateway API CRDs (v1) installed in cluster https://gateway-api.sigs.k8s.io/ |
466+
| ui.httproute.labels | object | `{}` | Additional HTTPRoute labels |
467+
| ui.httproute.annotations | object | `{}` | Additional HTTPRoute annotations |
468+
| ui.httproute.parentRefs | list | `[]` | Gateway API parentRefs (list of Gateway references) Must reference an existing Gateway resource |
469+
| ui.httproute.hostnames | list | `[]` | List of hostnames for HTTPRoute |
470+
| ui.httproute.rules | list | `[{"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | HTTPRoute rules configuration Allows advanced routing with matches and filters |
462471
| ui.networkPolicy.enabled | bool | `false` | When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. |
463472
| ui.networkPolicy.egress | list | `[{"ports":[{"port":6443,"protocol":"TCP"}]}]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. Enables Kubernetes API Server by default |
464473
| ui.networkPolicy.ingress | list | `[]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. |
@@ -476,7 +485,7 @@ Open `http://localhost:8082/` in your browser.
476485
| plugin.kyverno.image.registry | string | `"ghcr.io"` | Image registry |
477486
| plugin.kyverno.image.repository | string | `"kyverno/policy-reporter/kyverno-plugin"` | Image repository |
478487
| plugin.kyverno.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
479-
| plugin.kyverno.image.tag | string | `"0.5.1"` | Image tag |
488+
| plugin.kyverno.image.tag | string | `"0.5.2"` | Image tag |
480489
| plugin.kyverno.replicaCount | int | `1` | Deployment replica count |
481490
| plugin.kyverno.priorityClassName | string | `""` | Deployment priorityClassName |
482491
| plugin.kyverno.logging.api | bool | `false` | Enables external API request logging |
@@ -523,6 +532,12 @@ Open `http://localhost:8082/` in your browser.
523532
| plugin.kyverno.networkPolicy.enabled | bool | `false` | When true, use a NetworkPolicy to allow ingress to the webhook This is useful on clusters using Calico and/or native k8s network policies in a default-deny setup. |
524533
| plugin.kyverno.networkPolicy.egress | list | `[{"ports":[{"port":6443,"protocol":"TCP"}]}]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. Enables Kubernetes API Server by default |
525534
| plugin.kyverno.networkPolicy.ingress | list | `[]` | A list of valid from selectors according to https://kubernetes.io/docs/concepts/services-networking/network-policies. |
535+
| plugin.kyverno.httproute.enabled | bool | `false` | Enable HTTPRoute resource (Gateway API alternative to Ingress) Requires Gateway API CRDs (v1) installed in cluster https://gateway-api.sigs.k8s.io/ |
536+
| plugin.kyverno.httproute.labels | object | `{}` | Additional HTTPRoute labels |
537+
| plugin.kyverno.httproute.annotations | object | `{}` | Additional HTTPRoute annotations |
538+
| plugin.kyverno.httproute.parentRefs | list | `[]` | Gateway API parentRefs (list of Gateway references) Must reference an existing Gateway resource |
539+
| plugin.kyverno.httproute.hostnames | list | `[]` | List of hostnames for HTTPRoute |
540+
| plugin.kyverno.httproute.rules | list | `[{"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]` | HTTPRoute rules configuration Allows advanced routing with matches and filters |
526541
| plugin.kyverno.resources | object | `{}` | Resource constraints |
527542
| plugin.kyverno.leaderElection.lockName | string | `"kyverno-plugin"` | Lock Name |
528543
| plugin.kyverno.leaderElection.releaseOnCancel | bool | `true` | Released lock when the run context is cancelled. |
@@ -542,7 +557,7 @@ Open `http://localhost:8082/` in your browser.
542557
| plugin.trivy.image.registry | string | `"ghcr.io"` | Image registry |
543558
| plugin.trivy.image.repository | string | `"kyverno/policy-reporter/trivy-plugin"` | Image repository |
544559
| plugin.trivy.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |
545-
| plugin.trivy.image.tag | string | `"0.4.10"` | Image tag Defaults to `Chart.AppVersion` if omitted |
560+
| plugin.trivy.image.tag | string | `"0.4.11"` | Image tag Defaults to `Chart.AppVersion` if omitted |
546561
| plugin.trivy.cli.image.registry | string | `"ghcr.io"` | Image registry |
547562
| plugin.trivy.cli.image.repository | string | `"aquasecurity/trivy"` | Image repository |
548563
| plugin.trivy.cli.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy |

‎charts/policy-reporter/configs/ui.tmpl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ ui:
2020
path: {{ .Values.ui.logo.path }}
2121
disabled: {{ .Values.ui.logo.disabled }}
2222

23+
crds:
24+
customBoard: {{ .Values.ui.crds.customBoard }}
25+
2326
{{- $default := false -}}
2427
{{- range .Values.ui.clusters }}
2528
{{- if eq .name $.Values.ui.name -}}

‎charts/policy-reporter/templates/cluster-secret.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ data:
2828
{{- if .Values.plugin.kyverno.enabled }}
2929
{{- $host := printf "http://%s:%d" (include "kyverno-plugin.fullname" .) (.Values.plugin.kyverno.service.port | int) }}
3030
plugin.kyverno: {{ (printf "{\"host\":\"%s\", \"name\":\"kyverno\", \"username\":\"%s\", \"password\":\"%s\"}" $host $username $password) | b64enc }}
31+
plugin.kyverno.vpol: {{ (printf "{\"host\":\"%s/vpol\", \"name\":\"KyvernoValidatingPolicy\", \"username\":\"%s\", \"password\":\"%s\"}" $host $username $password) | b64enc }}
32+
plugin.kyverno.ivpol: {{ (printf "{\"host\":\"%s/ivpol\", \"name\":\"KyvernoImageValidatingPolicy\", \"username\":\"%s\", \"password\":\"%s\"}" $host $username $password) | b64enc }}
3133
{{- end }}
3234
{{- if .Values.plugin.trivy.enabled }}
3335
{{- $host := printf "http://%s:%d/vulnr" (include "trivy-plugin.fullname" .) (.Values.plugin.trivy.service.port | int) }}

‎charts/policy-reporter/templates/clusterrole.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ rules:
2323
- list
2424
- watch
2525
- apiGroups:
26-
- '*'
26+
- wgpolicyk8s.io
2727
resources:
2828
- policyreports
2929
- policyreports/status

‎charts/policy-reporter/templates/httproute.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{{- if .Values.httproute.enabled -}}
2+
{{- $fullName := include "policyreporter.fullname" . -}}
3+
{{- $svcPort := .Values.service.port -}}
4+
apiVersion: gateway.networking.k8s.io/v1
5+
kind: HTTPRoute
6+
metadata:
7+
name: {{ $fullName }}
8+
namespace: {{ include "policyreporter.namespace" . }}
9+
labels:
10+
{{- include "policyreporter.labels" . | nindent 4 }}
11+
{{- if .Values.httproute.labels }}
12+
{{- with .Values.httproute.labels }}
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
{{- end }}
16+
{{- if or .Values.annotations .Values.httproute.annotations }}
17+
annotations:
18+
{{- with .Values.httproute.annotations }}
19+
{{- toYaml . | nindent 4 }}
20+
{{- end }}
21+
{{- with .Values.annotations }}
22+
{{- toYaml . | nindent 4 }}
23+
{{- end }}
24+
{{- end }}
25+
spec:
26+
{{- with .Values.httproute.parentRefs }}
27+
parentRefs:
28+
{{- toYaml . | nindent 4 }}
29+
{{- end }}
30+
{{- with .Values.httproute.hostnames }}
31+
hostnames:
32+
{{- toYaml . | nindent 4 }}
33+
{{- end }}
34+
rules:
35+
{{- range .Values.httproute.rules }}
36+
- {{- with .matches }}
37+
matches:
38+
{{- toYaml . | nindent 8 }}
39+
{{- end }}
40+
{{- with .filters }}
41+
filters:
42+
{{- toYaml . | nindent 8 }}
43+
{{- end }}
44+
backendRefs:
45+
- name: {{ $fullName }}
46+
port: {{ $svcPort }}
47+
weight: 1
48+
{{- end }}
49+
{{- end }}

‎charts/policy-reporter/templates/monitoring/overview.dashboard.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -686,6 +686,7 @@ data:
686686
},
687687
"timezone": "",
688688
"title": "PolicyReports",
689+
"uid": "BwFdLVeHJ",
689690
"version": 1
690691
}
691692
{{- end }}

‎charts/policy-reporter/templates/plugins/kyverno/clusterrole.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,17 @@ metadata:
99
name: {{ include "kyverno-plugin.fullname" . }}
1010
rules:
1111
- apiGroups:
12-
- '*'
12+
- policies.kyverno.io
13+
resources:
14+
- validatingpolicies
15+
- validatingpolicies/status
16+
- imagevalidatingpolicies
17+
- imagevalidatingpolicies/status
18+
verbs:
19+
- get
20+
- list
21+
- apiGroups:
22+
- kyverno.io
1323
resources:
1424
- policies
1525
- policies/status
@@ -28,7 +38,7 @@ rules:
2838
- list
2939
- watch
3040
- apiGroups:
31-
- '*'
41+
- wgpolicyk8s.io
3242
resources:
3343
- policyreports
3444
- policyreports/status

‎charts/policy-reporter/templates/plugins/kyverno/httproute.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{{- if .Values.plugin.kyverno.enabled -}}
2+
{{- if .Values.plugin.kyverno.httproute.enabled -}}
3+
{{- $fullName := include "kyverno-plugin.fullname" . -}}
4+
{{- $svcPort := .Values.plugin.kyverno.service.port -}}
5+
apiVersion: gateway.networking.k8s.io/v1
6+
kind: HTTPRoute
7+
metadata:
8+
name: {{ $fullName }}
9+
namespace: {{ include "policyreporter.namespace" . }}
10+
labels:
11+
{{- include "kyverno-plugin.labels" . | nindent 4 }}
12+
{{- with .Values.plugin.kyverno.httproute.labels }}
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
{{- with .Values.plugin.kyverno.httproute.annotations }}
16+
annotations:
17+
{{- toYaml . | nindent 4 }}
18+
{{- end }}
19+
spec:
20+
{{- with .Values.plugin.kyverno.httproute.parentRefs }}
21+
parentRefs:
22+
{{- toYaml . | nindent 4 }}
23+
{{- end }}
24+
{{- with .Values.plugin.kyverno.httproute.hostnames }}
25+
hostnames:
26+
{{- toYaml . | nindent 4 }}
27+
{{- end }}
28+
rules:
29+
{{- range .Values.plugin.kyverno.httproute.rules }}
30+
- {{- with .matches }}
31+
matches:
32+
{{- toYaml . | nindent 8 }}
33+
{{- end }}
34+
{{- with .filters }}
35+
filters:
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
backendRefs:
39+
- name: {{ $fullName }}
40+
port: {{ $svcPort }}
41+
weight: 1
42+
{{- end }}
43+
{{- end }}
44+
{{- end }}

0 commit comments

Comments
 (0)