Skip to content

fix: high-risk vulnerabilities caused by low version of kustomize #2490

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
fengshunli wants to merge 3 commits into from
Closed

fix: high-risk vulnerabilities caused by low version of kustomize #2490

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8295530
fix: high-risk vulnerabilities caused by low version of kustomize and yq
fengshunli Dec 26, 2022
2e52712
Merge branch 'master' into kustomize
fengshunli Jan 5, 2023
0f939be
Merge branch 'master' into kustomize
fengshunli Jan 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,14 @@ VERSION := v3.12.0-beta.0
KIND_VERSION ?= 0.17.0
# note: k8s version pinned since KIND image availability lags k8s releases
KUBERNETES_VERSION ?= 1.26.0
KUSTOMIZE_VERSION ?= 3.8.9
KUBEBUILDER_VERSION ?= 3.8.0
KUSTOMIZE_VERSION ?= 4.5.7
BATS_VERSION ?= 1.8.2
ORAS_VERSION ?= 0.16.0
BATS_TESTS_FILE ?= test/bats/test.bats
HELM_VERSION ?= 3.7.2
NODE_VERSION ?= 16-bullseye-slim
YQ_VERSION ?= 4.2.0
YQ_VERSION ?= 4.30.6
FRAMEWORKS_VERSION ?= $(shell go list -f '{{ .Version }}' -m github.com/open-policy-agent/frameworks/constraint)
OPA_VERSION ?= $(shell go list -f '{{ .Version }}' -m github.com/open-policy-agent/opa)

Expand Down Expand Up @@ -264,7 +265,7 @@ manifests: __controller-gen
/gatekeeper/config/default -o /gatekeeper/manifest_staging/deploy/gatekeeper.yaml
docker run --rm -v $(shell pwd):/gatekeeper \
k8s.gcr.io/kustomize/kustomize:v${KUSTOMIZE_VERSION} build \
--load_restrictor LoadRestrictionsNone /gatekeeper/cmd/build/helmify | go run cmd/build/helmify/*.go
--load-restrictor LoadRestrictionsNone /gatekeeper/cmd/build/helmify | go run cmd/build/helmify/*.go

# lint runs a dockerized golangci-lint, and should give consistent results
# across systems.
Expand Down Expand Up @@ -447,7 +448,9 @@ __test-image:
-t gatekeeper-test \
--build-arg YQ_VERSION=$(YQ_VERSION) \
--build-arg BATS_VERSION=$(BATS_VERSION) \
--build-arg ORAS_VERSION=$(ORAS_VERSION)
--build-arg ORAS_VERSION=$(ORAS_VERSION) \
--build-arg KUSTOMIZE_VERSION=$(KUSTOMIZE_VERSION) \
--build-arg KUBEBUILDER_VERSION=$(KUBEBUILDER_VERSION)

.PHONY: vendor
vendor:
Expand Down
564 changes: 435 additions & 129 deletions manifest_staging/charts/gatekeeper/crds/assign-customresourcedefinition.yaml
View file
Open in desktop

Large diffs are not rendered by default.

492 changes: 378 additions & 114 deletions manifest_staging/charts/gatekeeper/crds/assignmetadata-customresourcedefinition.yaml
View file
Open in desktop

Large diffs are not rendered by default.

22 changes: 16 additions & 6 deletions manifest_staging/charts/gatekeeper/crds/config-customresourcedefinition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,14 @@ spec:
description: Config is the Schema for the configs API.
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
Expand All @@ -38,7 +42,10 @@ spec:
properties:
excludedNamespaces:
items:
description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.'
description: 'A string that supports globbing at its front
or end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
Expand All @@ -58,7 +65,8 @@ spec:
description: Configuration for syncing k8s objects
properties:
syncOnly:
description: If non-empty, only entries on this list will be replicated into OPA
description: If non-empty, only entries on this list will be replicated
into OPA
items:
properties:
group:
Expand All @@ -74,11 +82,13 @@ spec:
description: Configuration for validation
properties:
traces:
description: List of requests to trace. Both "user" and "kinds" must be specified
description: List of requests to trace. Both "user" and "kinds"
must be specified
items:
properties:
dump:
description: Also dump the state of OPA with the trace. Set to `All` to dump everything.
description: Also dump the state of OPA with the trace.
Set to `All` to dump everything.
type: string
kind:
description: Only trace requests of the following GroupVersionKind
Expand Down
18 changes: 13 additions & 5 deletions manifest_staging/charts/gatekeeper/crds/constraintpodstatus-customresourcedefinition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,27 +19,35 @@ spec:
- name: v1beta1
schema:
openAPIV3Schema:
description: ConstraintPodStatus is the Schema for the constraintpodstatuses API.
description: ConstraintPodStatus is the Schema for the constraintpodstatuses
API.
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
status:
description: ConstraintPodStatusStatus defines the observed state of ConstraintPodStatus.
properties:
constraintUID:
description: Storing the constraint UID allows us to detect drift, such as when a constraint has been recreated after its CRD was deleted out from under it, interrupting the watch
description: Storing the constraint UID allows us to detect drift,
such as when a constraint has been recreated after its CRD was deleted
out from under it, interrupting the watch
type: string
enforced:
type: boolean
errors:
items:
description: Error represents a single error caught while adding a constraint to OPA.
description: Error represents a single error caught while adding
a constraint to OPA.
properties:
code:
type: string
Expand Down
60 changes: 42 additions & 18 deletions manifest_staging/charts/gatekeeper/crds/constrainttemplate-customresourcedefinition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,18 @@ spec:
- name: v1
schema:
openAPIV3Schema:
description: ConstraintTemplate is the Schema for the constrainttemplates API
description: ConstraintTemplate is the Schema for the constrainttemplates
API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
Expand Down Expand Up @@ -77,11 +82,13 @@ spec:
properties:
byPod:
items:
description: ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller
description: ByPodStatus defines the observed state of ConstraintTemplate
as seen by an individual controller
properties:
errors:
items:
description: CreateCRDError represents a single error caught during parsing, compiling, etc.
description: CreateCRDError represents a single error caught
during parsing, compiling, etc.
properties:
code:
type: string
Expand All @@ -95,7 +102,8 @@ spec:
type: object
type: array
id:
description: a unique identifier for the pod that wrote the status
description: a unique identifier for the pod that wrote the
status
type: string
observedGeneration:
format: int64
Expand All @@ -114,13 +122,18 @@ spec:
- name: v1alpha1
schema:
openAPIV3Schema:
description: ConstraintTemplate is the Schema for the constrainttemplates API
description: ConstraintTemplate is the Schema for the constrainttemplates
API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
Expand Down Expand Up @@ -172,11 +185,13 @@ spec:
properties:
byPod:
items:
description: ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller
description: ByPodStatus defines the observed state of ConstraintTemplate
as seen by an individual controller
properties:
errors:
items:
description: CreateCRDError represents a single error caught during parsing, compiling, etc.
description: CreateCRDError represents a single error caught
during parsing, compiling, etc.
properties:
code:
type: string
Expand All @@ -190,7 +205,8 @@ spec:
type: object
type: array
id:
description: a unique identifier for the pod that wrote the status
description: a unique identifier for the pod that wrote the
status
type: string
observedGeneration:
format: int64
Expand All @@ -209,13 +225,18 @@ spec:
- name: v1beta1
schema:
openAPIV3Schema:
description: ConstraintTemplate is the Schema for the constrainttemplates API
description: ConstraintTemplate is the Schema for the constrainttemplates
API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
Expand Down Expand Up @@ -267,11 +288,13 @@ spec:
properties:
byPod:
items:
description: ByPodStatus defines the observed state of ConstraintTemplate as seen by an individual controller
description: ByPodStatus defines the observed state of ConstraintTemplate
as seen by an individual controller
properties:
errors:
items:
description: CreateCRDError represents a single error caught during parsing, compiling, etc.
description: CreateCRDError represents a single error caught
during parsing, compiling, etc.
properties:
code:
type: string
Expand All @@ -285,7 +308,8 @@ spec:
type: object
type: array
id:
description: a unique identifier for the pod that wrote the status
description: a unique identifier for the pod that wrote the
status
type: string
observedGeneration:
format: int64
Expand Down
Loading