feat(helm)!: Update policy-reporter ( 2.24.2 → 3.0.0 ) #813
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
--- HelmRelease: observability/policy-reporter ServiceAccount: observability/policy-reporter-kyverno-plugin
+++ HelmRelease: observability/policy-reporter ServiceAccount: observability/policy-reporter-kyverno-plugin
@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
- name: policy-reporter-kyverno-plugin
- namespace: observability
- labels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: plugin
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
-
--- HelmRelease: observability/policy-reporter ServiceAccount: observability/policy-reporter-ui
+++ HelmRelease: observability/policy-reporter ServiceAccount: observability/policy-reporter-ui
@@ -2,12 +2,11 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: policy-reporter-ui
namespace: observability
labels:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: ui
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
+automountServiceAccountToken: true
--- HelmRelease: observability/policy-reporter ServiceAccount: observability/policy-reporter
+++ HelmRelease: observability/policy-reporter ServiceAccount: observability/policy-reporter
@@ -5,9 +5,9 @@
name: policy-reporter
namespace: observability
labels:
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/component: reporting
+ app.kubernetes.io/part-of: policy-reporter
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
--- HelmRelease: observability/policy-reporter ConfigMap: observability/policy-reporter-ui-config
+++ HelmRelease: observability/policy-reporter ConfigMap: observability/policy-reporter-ui-config
@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: policy-reporter-ui-config
- namespace: observability
- labels:
- app.kubernetes.io/name: ui
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: ui
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
-data:
- config.yaml: "logSize: 200\ndisplayMode: \"\"\nrefreshInterval: 10000\nclusterName:\
- \ \"\"\nviews:\n dashboard:\n policyReports: true\n clusterPolicyReports:\
- \ true\n logs: true\n policyReports: true\n clusterPolicyReports: true\n kyvernoPolicies:\
- \ true\n kyvernoVerifyImages: true\nredis:\n address: \"\"\n database: 0\n\
- \ enabled: false\n password: \"\"\n prefix: policy-reporter-ui\n username:\
- \ \"\"\n\nlogging:\n encoding: console\n logLevel: 0\n development: false\n\
- \napiConfig:\n logging: false\n overwriteHost: true\n basicAuth:\n username:\
- \ \n password: \n secretRef:"
-
--- HelmRelease: observability/policy-reporter ClusterRole: observability/policy-reporter-kyverno-plugin
+++ HelmRelease: observability/policy-reporter ClusterRole: observability/policy-reporter-kyverno-plugin
@@ -1,33 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
- labels:
- rbac.authorization.k8s.io/aggregate-to-admin: 'true'
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: plugin
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
- name: policy-reporter-kyverno-plugin
-rules:
-- apiGroups:
- - '*'
- resources:
- - policies
- - policies/status
- - clusterpolicies
- - clusterpolicies/status
- verbs:
- - get
- - list
- - watch
-- apiGroups:
- - '*'
- resources:
- - policyreports
- - clusterpolicyreports
- verbs:
- - get
- - list
-
--- HelmRelease: observability/policy-reporter ClusterRole: observability/policy-reporter
+++ HelmRelease: observability/policy-reporter ClusterRole: observability/policy-reporter
@@ -4,14 +4,14 @@
metadata:
labels:
rbac.authorization.k8s.io/aggregate-to-admin: 'true'
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/component: reporting
+ app.kubernetes.io/part-of: policy-reporter
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
name: policy-reporter
rules:
- apiGroups:
- '*'
resources:
- policyreports
@@ -19,7 +19,25 @@
- clusterpolicyreports
- clusterpolicyreports/status
verbs:
- get
- list
- watch
+- apiGroups:
+ - ''
+ resources:
+ - namespaces
+ verbs:
+ - list
+- apiGroups:
+ - ''
+ resources:
+ - pods
+ verbs:
+ - get
+- apiGroups:
+ - batch
+ resources:
+ - jobs
+ verbs:
+ - get
--- HelmRelease: observability/policy-reporter ClusterRoleBinding: observability/policy-reporter-kyverno-plugin
+++ HelmRelease: observability/policy-reporter ClusterRoleBinding: observability/policy-reporter-kyverno-plugin
@@ -1,20 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
- name: policy-reporter-kyverno-plugin
- labels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: plugin
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
-roleRef:
- kind: ClusterRole
- name: policy-reporter-kyverno-plugin
- apiGroup: rbac.authorization.k8s.io
-subjects:
-- kind: ServiceAccount
- name: policy-reporter-kyverno-plugin
- namespace: observability
-
--- HelmRelease: observability/policy-reporter ClusterRoleBinding: observability/policy-reporter
+++ HelmRelease: observability/policy-reporter ClusterRoleBinding: observability/policy-reporter
@@ -4,14 +4,14 @@
metadata:
name: policy-reporter
labels:
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/component: reporting
+ app.kubernetes.io/part-of: policy-reporter
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
roleRef:
kind: ClusterRole
name: policy-reporter
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
--- HelmRelease: observability/policy-reporter Role: observability/policy-reporter-kyverno-plugin-secret-reader
+++ HelmRelease: observability/policy-reporter Role: observability/policy-reporter-kyverno-plugin-secret-reader
@@ -1,20 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
- labels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: plugin
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
- name: policy-reporter-kyverno-plugin-secret-reader
- namespace: observability
-rules:
-- apiGroups:
- - ''
- resources:
- - secrets
- verbs:
- - get
-
--- HelmRelease: observability/policy-reporter Role: observability/policy-reporter-ui-secret-reader
+++ HelmRelease: observability/policy-reporter Role: observability/policy-reporter-ui-secret-reader
@@ -1,16 +1,14 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: ui
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
name: policy-reporter-ui-secret-reader
namespace: observability
rules:
- apiGroups:
- ''
resources:
--- HelmRelease: observability/policy-reporter Role: observability/policy-reporter-secret-reader
+++ HelmRelease: observability/policy-reporter Role: observability/policy-reporter-secret-reader
@@ -3,18 +3,20 @@
kind: Role
metadata:
labels:
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/component: reporting
+ app.kubernetes.io/part-of: policy-reporter
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
name: policy-reporter-secret-reader
namespace: observability
rules:
- apiGroups:
- ''
resources:
- secrets
verbs:
- get
+ - list
+ - watch
--- HelmRelease: observability/policy-reporter RoleBinding: observability/policy-reporter-kyverno-plugin-secret-reader
+++ HelmRelease: observability/policy-reporter RoleBinding: observability/policy-reporter-kyverno-plugin-secret-reader
@@ -1,21 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: policy-reporter-kyverno-plugin-secret-reader
- namespace: observability
- labels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: plugin
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
-roleRef:
- kind: Role
- name: policy-reporter-kyverno-plugin-secret-reader
- apiGroup: rbac.authorization.k8s.io
-subjects:
-- kind: ServiceAccount
- name: policy-reporter-kyverno-plugin
- namespace: observability
-
--- HelmRelease: observability/policy-reporter RoleBinding: observability/policy-reporter-ui-secret-reader
+++ HelmRelease: observability/policy-reporter RoleBinding: observability/policy-reporter-ui-secret-reader
@@ -2,17 +2,15 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: policy-reporter-ui-secret-reader
namespace: observability
labels:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: ui
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
roleRef:
kind: Role
name: policy-reporter-ui-secret-reader
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
--- HelmRelease: observability/policy-reporter RoleBinding: observability/policy-reporter-secret-reader
+++ HelmRelease: observability/policy-reporter RoleBinding: observability/policy-reporter-secret-reader
@@ -5,14 +5,14 @@
name: policy-reporter-secret-reader
namespace: observability
labels:
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/component: reporting
+ app.kubernetes.io/part-of: policy-reporter
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
roleRef:
kind: Role
name: policy-reporter-secret-reader
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
--- HelmRelease: observability/policy-reporter Service: observability/policy-reporter-kyverno-plugin
+++ HelmRelease: observability/policy-reporter Service: observability/policy-reporter-kyverno-plugin
@@ -1,23 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
- name: policy-reporter-kyverno-plugin
- namespace: observability
- labels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: plugin
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
-spec:
- type: ClusterIP
- ports:
- - port: 8080
- targetPort: rest
- protocol: TCP
- name: rest
- selector:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
-
--- HelmRelease: observability/policy-reporter Service: observability/policy-reporter-ui
+++ HelmRelease: observability/policy-reporter Service: observability/policy-reporter-ui
@@ -2,22 +2,20 @@
apiVersion: v1
kind: Service
metadata:
name: policy-reporter-ui
namespace: observability
labels:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: ui
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
spec:
type: ClusterIP
ports:
- port: 8080
targetPort: http
protocol: TCP
name: http
selector:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
--- HelmRelease: observability/policy-reporter Service: observability/policy-reporter
+++ HelmRelease: observability/policy-reporter Service: observability/policy-reporter
@@ -5,14 +5,14 @@
name: policy-reporter
namespace: observability
labels:
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/component: reporting
+ app.kubernetes.io/part-of: policy-reporter
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
spec:
type: ClusterIP
ports:
- port: 8080
targetPort: http
protocol: TCP
--- HelmRelease: observability/policy-reporter Deployment: observability/policy-reporter-kyverno-plugin
+++ HelmRelease: observability/policy-reporter Deployment: observability/policy-reporter-kyverno-plugin
@@ -1,82 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: policy-reporter-kyverno-plugin
- namespace: observability
- labels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: plugin
- app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
-spec:
- replicas: 1
- revisionHistoryLimit: 10
- selector:
- matchLabels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- template:
- metadata:
- labels:
- app.kubernetes.io/name: kyverno-plugin
- app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/part-of: policy-reporter
- annotations:
- checksum/secret: 42bfaa10c2f7f2389815bae7b522e2a993d2103ad6f14560968aa18a72ac4a2a
- spec:
- securityContext:
- runAsGroup: 1234
- runAsUser: 1234
- serviceAccountName: policy-reporter-kyverno-plugin
- automountServiceAccountToken: true
- containers:
- - name: kyverno-plugin
- image: ghcr.io/kyverno/policy-reporter-kyverno-plugin:1.6.3
- imagePullPolicy: IfNotPresent
- securityContext:
- allowPrivilegeEscalation: false
- capabilities:
- drop:
- - ALL
- privileged: false
- readOnlyRootFilesystem: true
- runAsNonRoot: true
- runAsUser: 1234
- seccompProfile:
- type: RuntimeDefault
- args:
- - --port=8080
- - --metrics-enabled=true
- - --rest-enabled=true
- - --lease-name=policy-reporter-kyverno-plugin
- ports:
- - name: rest
- containerPort: 8080
- protocol: TCP
- livenessProbe:
- httpGet:
- path: /healthz
- port: rest
- readinessProbe:
- httpGet:
- path: /ready
- port: rest
- resources: {}
- volumeMounts:
- - name: config-file
- mountPath: /app/config.yaml
- subPath: config.yaml
- readOnly: true
- env:
- - name: POD_NAMESPACE
- valueFrom:
- fieldRef:
- fieldPath: metadata.namespace
- volumes:
- - name: config-file
- secret:
- secretName: policy-reporter-kyverno-plugin-config
- optional: true
-
--- HelmRelease: observability/policy-reporter Deployment: observability/policy-reporter-ui
+++ HelmRelease: observability/policy-reporter Deployment: observability/policy-reporter-ui
@@ -2,74 +2,83 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: policy-reporter-ui
namespace: observability
labels:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/component: ui
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
template:
metadata:
+ annotations:
+ checksum/secret: 81a61d95ed5f3bb206398a058c16ca1736b84b915efa95e96251221c6bfece90
+ checksum/cluster-secret: 7ebd70e997a9660c753d2271961838188181989a94d7a7c97c09f13308eed12a
labels:
- app.kubernetes.io/name: ui
+ app.kubernetes.io/name: policy-reporter-ui
app.kubernetes.io/instance: policy-reporter
- app.kubernetes.io/part-of: policy-reporter
+ app.kubernetes.io/managed-by: Helm
spec:
serviceAccountName: policy-reporter-ui
automountServiceAccountToken: true
+ securityContext:
+ runAsGroup: 1234
+ runAsUser: 1234
containers:
- - name: ui
- image: ghcr.io/kyverno/policy-reporter-ui:1.9.2
- imagePullPolicy: IfNotPresent
+ - name: policy-reporter-ui
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1234
seccompProfile:
type: RuntimeDefault
+ image: ghcr.io/kyverno/policy-reporter-ui:2.0.1
+ imagePullPolicy: IfNotPresent
args:
- - -config=/app/config.yaml
- - -policy-reporter=http://policy-reporter:8080
- - -kyverno-plugin=http://policy-reporter-kyverno-plugin:8080
+ - run
+ - --config=/app/config.yaml
+ - --port=8080
ports:
- name: http
containerPort: 8080
protocol: TCP
livenessProbe:
httpGet:
- path: /
+ path: /healthz
port: http
readinessProbe:
httpGet:
- path: /
+ path: /healthz
port: http
+ resources: {}
volumeMounts:
- name: config-file
mountPath: /app/config.yaml
subPath: config.yaml
readOnly: true
- resources: {}
+ - name: tmp
+ mountPath: /tmp
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumes:
- name: config-file
- configMap:
- name: policy-reporter-ui-config
+ secret:
+ secretName: policy-reporter-ui-config
+ optional: true
+ - name: tmp
+ emptyDir: {}
--- HelmRelease: observability/policy-reporter Deployment: observability/policy-reporter
+++ HelmRelease: observability/policy-reporter Deployment: observability/policy-reporter
@@ -5,14 +5,14 @@
name: policy-reporter
namespace: observability
labels:
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/component: reporting
+ app.kubernetes.io/part-of: policy-reporter
app.kubernetes.io/managed-by: Helm
- app.kubernetes.io/part-of: policy-reporter
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app.kubernetes.io/name: policy-reporter
@@ -21,21 +21,21 @@
metadata:
labels:
app.kubernetes.io/name: policy-reporter
app.kubernetes.io/instance: policy-reporter
app.kubernetes.io/part-of: policy-reporter
annotations:
- checksum/secret: 3d53bc054645b4e235bb79833736359c04a3067efde71494c82ae56d70b279fe
+ checksum/secret: 8a7e2b4675407cb1b5d313b2b7167644182bd25d5643b7a365b528b902f60205
spec:
serviceAccountName: policy-reporter
automountServiceAccountToken: true
securityContext:
fsGroup: 1234
containers:
- name: policy-reporter
- image: ghcr.io/kyverno/policy-reporter:2.20.2
+ image: ghcr.io/kyverno/policy-reporter:3.0.0
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
@@ -57,17 +57,17 @@
ports:
- name: http
containerPort: 8080
protocol: TCP
livenessProbe:
httpGet:
- path: /healthz
+ path: /ready
port: http
readinessProbe:
httpGet:
- path: /ready
+ path: /healthz
port: http
resources: {}
volumeMounts:
- name: sqlite
mountPath: /sqlite
- name: config-file |
--- kubernetes/apps/observability/policy-reporter/app Kustomization: flux-system/policy-reporter HelmRelease: observability/policy-reporter
+++ kubernetes/apps/observability/policy-reporter/app Kustomization: flux-system/policy-reporter HelmRelease: observability/policy-reporter
@@ -13,13 +13,13 @@
spec:
chart: policy-reporter
sourceRef:
kind: HelmRepository
name: policy-reporter
namespace: flux-system
- version: 2.24.2
+ version: 3.0.0
driftDetection:
mode: enabled
install:
remediation:
retries: 3
interval: 30m |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.24.2->3.0.0Release Notes
kyverno/policy-reporter (policy-reporter)
v3.0.0Compare Source
Release Notes follow soon ...
What's Changed
New Contributors
Full Changelog: kyverno/policy-reporter@policy-reporter-3.0.0-rc.14...policy-reporter-3.0.0
Configuration
📅 Schedule: Branch creation - "* 0-4,22-23 * * 1-5,* * * * 0,6" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.