diff --git a/chart/chart-index/Chart.yaml b/chart/chart-index/Chart.yaml index 4210fb2d2f..fdabaa0187 100644 --- a/chart/chart-index/Chart.yaml +++ b/chart/chart-index/Chart.yaml @@ -92,7 +92,7 @@ dependencies: version: 0.117.0 repository: https://open-telemetry.github.io/opentelemetry-helm-charts - name: policy-reporter - version: 3.7.4 + version: 3.9.1 repository: https://kyverno.github.io/policy-reporter - name: prometheus-blackbox-exporter version: 11.15.1 diff --git a/charts/policy-reporter/Chart.yaml b/charts/policy-reporter/Chart.yaml index c391b6b71b..c15b50bac7 100644 --- a/charts/policy-reporter/Chart.yaml +++ b/charts/policy-reporter/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -appVersion: 3.7.4 +appVersion: 3.9.0 description: 'Policy Reporter watches for PolicyReport Resources. It creates Prometheus Metrics and can send rule validation events to different targets like Loki, Elasticsearch, Slack or Discord ' @@ -12,4 +12,4 @@ name: policy-reporter sources: - https://github.com/kyverno/policy-reporter type: application -version: 3.7.4 +version: 3.9.1 diff --git a/charts/policy-reporter/README.md b/charts/policy-reporter/README.md index ec84888d40..4b1526138c 100644 --- a/charts/policy-reporter/README.md +++ b/charts/policy-reporter/README.md @@ -3,7 +3,7 @@ Policy Reporter watches for PolicyReport Resources. It creates Prometheus Metrics and can send rule validation events to different targets like Loki, Elasticsearch, Slack or Discord -![Version: 3.7.4](https://img.shields.io/badge/Version-3.7.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.7.4](https://img.shields.io/badge/AppVersion-3.7.4-informational?style=flat-square) +![Version: 3.9.1](https://img.shields.io/badge/Version-3.9.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.9.0](https://img.shields.io/badge/AppVersion-3.9.0-informational?style=flat-square) ## Documentation @@ -110,7 +110,7 @@ Open `http://localhost:8082/` in your browser. | sourceFilters[0].selector.sources | list | `["kyverno","KyvernoValidatingPolicy","KyvernoImageValidatingPolicy"]` | select Report by source | | sourceFilters[0].uncontrolledOnly | bool | `true` | Filter out Reports of controlled Pods and Jobs, only works for Reports with scope resource | | sourceFilters[0].disableClusterReports | bool | `false` | Filter out cluster scoped Reports | -| sourceFilters[0].kinds | object | `{"exclude":["ReplicaSet"]}` | Filter out Reports based on the scope resource kind | +| sourceFilters[0].kinds | object | `{"exclude":[]}` | Filter out Reports based on the scope resource kind | | global.labels | object | `{}` | additional labels added on each resource | | basicAuth.username | string | `""` | HTTP BasicAuth username | | basicAuth.password | string | `""` | HTTP BasicAuth password | @@ -127,6 +127,17 @@ Open `http://localhost:8082/` in your browser. | emailReports.smtp.encryption | string | `""` | SMTP Encryption Default is none, supports ssl/tls and starttls | | emailReports.smtp.skipTLS | bool | `false` | Skip SMTP TLS verification | | emailReports.smtp.certificate | string | `""` | SMTP Server Certificate file path | +| emailReports.graphAPI.enabled | bool | `false` | Enable Microsoft Graph API for E-Mail reports, takes precedence over SMTP | +| emailReports.graphAPI.tenant | string | `""` | Microsoft Graph API Tenant ID | +| emailReports.graphAPI.clientID | string | `""` | Microsoft Graph API Client ID | +| emailReports.graphAPI.clientSecret | string | `""` | Microsoft Graph API Client Secret | +| emailReports.graphAPI.secretRef | optional | `""` | Name of an existing Secret with a `clientSecret` key, used instead of `clientSecret` | +| emailReports.graphAPI.userID | string | `""` | Microsoft Graph API User ID (Sender) | +| emailReports.graphAPI.cc | list | `[]` | Microsoft Graph API CC Recipients | +| emailReports.graphAPI.bcc | list | `[]` | Microsoft Graph API BCC Recipients | +| emailReports.graphAPI.disableSaveToSentItems | bool | `false` | Disable saving sent messages to the Sent Items folder | +| emailReports.graphAPI.azureADEndpoint | string | `"https://login.microsoftonline.com"` | Microsoft Graph API Azure AD Endpoint override | +| emailReports.graphAPI.graphEndpoint | string | `"https://graph.microsoft.com"` | Microsoft Graph API endpoint override | | emailReports.summary.enabled | bool | `false` | Enable Summary E-Mail reports | | emailReports.summary.schedule | string | `"0 8 * * *"` | CronJob schedule | | emailReports.summary.activeDeadlineSeconds | int | `300` | CronJob activeDeadlineSeconds | @@ -379,6 +390,8 @@ Open `http://localhost:8082/` in your browser. | database.mountedSecret | string | `""` | | | periodicSync.enabled | bool | `false` | | | periodicSync.interval | int | `30` | | +| autoMemoryLimit.enabled | bool | `true` | | +| autoMemoryLimit.ratio | float | `0.9` | | | podDisruptionBudget.minAvailable | int | `1` | Configures the minimum available pods for policy-reporter disruptions. Cannot be used if `maxUnavailable` is set. | | podDisruptionBudget.maxUnavailable | string | `nil` | Configures the maximum unavailable pods for policy-reporter disruptions. Cannot be used if `minAvailable` is set. | | nodeSelector | object | `{}` | Node labels for pod assignment ref: https://kubernetes.io/docs/user-guide/node-selection/ | @@ -396,7 +409,7 @@ Open `http://localhost:8082/` in your browser. | ui.image.registry | string | `"ghcr.io"` | Image registry | | ui.image.repository | string | `"kyverno/policy-reporter-ui"` | Image repository | | ui.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy | -| ui.image.tag | string | `"2.5.1"` | Image tag | +| ui.image.tag | string | `"2.7.0"` | Image tag | | ui.crds.customBoard | bool | `false` | Install UI CustomBoard CRDs | | ui.replicaCount | int | `1` | Deployment replica count | | ui.priorityClassName | string | `""` | Deployment priorityClassName | @@ -492,7 +505,7 @@ Open `http://localhost:8082/` in your browser. | plugin.kyverno.image.registry | string | `"ghcr.io"` | Image registry | | plugin.kyverno.image.repository | string | `"kyverno/policy-reporter/kyverno-plugin"` | Image repository | | plugin.kyverno.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy | -| plugin.kyverno.image.tag | string | `"0.6.0"` | Image tag | +| plugin.kyverno.image.tag | string | `"0.7.0"` | Image tag | | plugin.kyverno.replicaCount | int | `1` | Deployment replica count | | plugin.kyverno.priorityClassName | string | `""` | Deployment priorityClassName | | plugin.kyverno.logging.api | bool | `false` | Enables external API request logging | @@ -565,11 +578,11 @@ Open `http://localhost:8082/` in your browser. | plugin.trivy.image.registry | string | `"ghcr.io"` | Image registry | | plugin.trivy.image.repository | string | `"kyverno/policy-reporter/trivy-plugin"` | Image repository | | plugin.trivy.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy | -| plugin.trivy.image.tag | string | `"0.4.12"` | Image tag Defaults to `Chart.AppVersion` if omitted | +| plugin.trivy.image.tag | string | `"0.5.0"` | Image tag Defaults to `Chart.AppVersion` if omitted | | plugin.trivy.cli.image.registry | string | `"ghcr.io"` | Image registry | | plugin.trivy.cli.image.repository | string | `"aquasecurity/trivy"` | Image repository | | plugin.trivy.cli.image.pullPolicy | string | `"IfNotPresent"` | Image PullPolicy | -| plugin.trivy.cli.image.tag | string | `"0.69.3"` | Image tag Defaults to `Chart.AppVersion` if omitted | +| plugin.trivy.cli.image.tag | string | `"0.72.0"` | Image tag Defaults to `Chart.AppVersion` if omitted | | plugin.trivy.extraArgs | object | `{}` | Additional container args. | | plugin.trivy.cveawg.disable | bool | `false` | disable external CVEAWG API calls. | | plugin.trivy.github.disable | bool | `false` | disable GitHub API calls. | @@ -633,6 +646,7 @@ Open `http://localhost:8082/` in your browser. | plugin.trivy.extraConfig | object | `{}` | Extra configuration options appended to trivy plugin settings | | monitoring.enabled | bool | `false` | Enables the Prometheus Operator integration | | monitoring.annotations | object | `{}` | Key/value pairs that are attached to all resources. | +| monitoring.serviceMonitor.enabled | bool | `true` | | | monitoring.serviceMonitor.honorLabels | bool | `false` | HonorLabels chooses the metrics labels on collisions with target labels | | monitoring.serviceMonitor.namespace | string | `nil` | Allow to override the namespace for serviceMonitor | | monitoring.serviceMonitor.labels | object | `{}` | Labels to match the serviceMonitorSelector of the Prometheus Resource | diff --git a/charts/policy-reporter/configs/core.tmpl b/charts/policy-reporter/configs/core.tmpl index 2bf69eb1d0..447fd6403a 100644 --- a/charts/policy-reporter/configs/core.tmpl +++ b/charts/policy-reporter/configs/core.tmpl @@ -209,6 +209,11 @@ periodicSync: {{- toYaml . | nindent 2 }} {{- end }} +{{- with .Values.autoMemoryLimit }} +autoMemoryLimit: + {{- toYaml . | nindent 2 }} +{{- end }} + {{- with .Values.extraConfig }} {{- toYaml . | nindent 0 }} {{- end }} diff --git a/charts/policy-reporter/configs/email-reports.tmpl b/charts/policy-reporter/configs/email-reports.tmpl index 42136f77f4..16ac4689c8 100644 --- a/charts/policy-reporter/configs/email-reports.tmpl +++ b/charts/policy-reporter/configs/email-reports.tmpl @@ -5,6 +5,10 @@ emailReports: smtp: {{- toYaml . | nindent 4 }} {{- end }} + {{- with .Values.emailReports.graphAPI }} + graphAPI: + {{- toYaml . | nindent 4 }} + {{- end }} summary: {{- with .Values.emailReports.summary.to }} diff --git a/charts/policy-reporter/templates/clusterrole.yaml b/charts/policy-reporter/templates/clusterrole.yaml index b9ed089eff..148a031680 100644 --- a/charts/policy-reporter/templates/clusterrole.yaml +++ b/charts/policy-reporter/templates/clusterrole.yaml @@ -59,4 +59,10 @@ rules: - jobs verbs: - get +- apiGroups: + - 'apps' + resources: + - replicasets + verbs: + - get {{- end -}} diff --git a/charts/policy-reporter/templates/cronjob-summary-report.yaml b/charts/policy-reporter/templates/cronjob-summary-report.yaml index cfec66e640..231ee5eafb 100644 --- a/charts/policy-reporter/templates/cronjob-summary-report.yaml +++ b/charts/policy-reporter/templates/cronjob-summary-report.yaml @@ -72,8 +72,12 @@ spec: {{- with .Values.extraVolumes.volumeMounts }} {{ toYaml . | nindent 14 | trim }} {{- end }} - {{- if .Values.emailReports.smtp.secret }} env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.emailReports.smtp.secret }} - name: EMAIL_REPORTS_SMTP_HOST valueFrom: secretKeyRef: diff --git a/charts/policy-reporter/templates/cronjob-violations-report.yaml b/charts/policy-reporter/templates/cronjob-violations-report.yaml index 656d0c853b..194b4b7754 100644 --- a/charts/policy-reporter/templates/cronjob-violations-report.yaml +++ b/charts/policy-reporter/templates/cronjob-violations-report.yaml @@ -72,8 +72,12 @@ spec: {{- with .Values.extraVolumes.volumeMounts }} {{ toYaml . | nindent 14 | trim }} {{- end }} - {{- if .Values.emailReports.smtp.secret }} env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if .Values.emailReports.smtp.secret }} - name: EMAIL_REPORTS_SMTP_HOST valueFrom: secretKeyRef: diff --git a/charts/policy-reporter/templates/httproute.yaml b/charts/policy-reporter/templates/httproute.yaml index 769609679d..3219aedec8 100644 --- a/charts/policy-reporter/templates/httproute.yaml +++ b/charts/policy-reporter/templates/httproute.yaml @@ -42,7 +42,9 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} backendRefs: - - name: {{ $fullName }} + - group: '' + kind: Service + name: {{ $fullName }} port: {{ $svcPort }} weight: 1 {{- end }} diff --git a/charts/policy-reporter/templates/monitoring/servicemonitor.yaml b/charts/policy-reporter/templates/monitoring/servicemonitor.yaml index 130fb82110..5aae1a45b6 100644 --- a/charts/policy-reporter/templates/monitoring/servicemonitor.yaml +++ b/charts/policy-reporter/templates/monitoring/servicemonitor.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.monitoring.enabled }} +{{- if and .Values.monitoring.enabled .Values.monitoring.serviceMonitor.enabled }} apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: diff --git a/charts/policy-reporter/templates/plugins/kyverno/httproute.yaml b/charts/policy-reporter/templates/plugins/kyverno/httproute.yaml index c4863a9700..88a384c8aa 100644 --- a/charts/policy-reporter/templates/plugins/kyverno/httproute.yaml +++ b/charts/policy-reporter/templates/plugins/kyverno/httproute.yaml @@ -36,7 +36,9 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} backendRefs: - - name: {{ $fullName }} + - group: '' + kind: Service + name: {{ $fullName }} port: {{ $svcPort }} weight: 1 {{- end }} diff --git a/charts/policy-reporter/templates/ui/httproute.yaml b/charts/policy-reporter/templates/ui/httproute.yaml index dab4250bc6..fc15e17cb6 100644 --- a/charts/policy-reporter/templates/ui/httproute.yaml +++ b/charts/policy-reporter/templates/ui/httproute.yaml @@ -36,7 +36,9 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} backendRefs: - - name: {{ $fullName }} + - group: '' + kind: Service + name: {{ $fullName }} port: {{ $svcPort }} weight: 1 {{- end }} diff --git a/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml b/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml index 8688ca5bd8..b704791af5 100644 --- a/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml +++ b/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_customboards.yaml @@ -80,7 +80,9 @@ spec: - enabled type: object display: - description: Allowed values are "resources" or "results". + description: |- + Allowed values are "resources" or "results". + NOTE: "Name" is being deprecated in favor of "renderOptions.resultView". type: string filter: properties: @@ -95,6 +97,17 @@ spec: type: string type: array type: object + clusterResources: + properties: + exclude: + items: + type: string + type: array + include: + items: + type: string + type: array + type: object namespaceKinds: properties: exclude: @@ -106,6 +119,17 @@ spec: type: string type: array type: object + resources: + properties: + exclude: + items: + type: string + type: array + include: + items: + type: string + type: array + type: object results: properties: exclude: @@ -153,6 +177,24 @@ spec: additionalProperties: type: string type: object + required: + - labelSelector + type: object + renderOptions: + description: NamespaceSelector allows to select visualized namespaces + properties: + dashboardMode: + default: detailed + enum: + - detailed + - compact + type: string + resultView: + default: resources + enum: + - resources + - results + type: string type: object sources: description: SourceSelector allows to select visualized sources @@ -161,6 +203,8 @@ spec: items: type: string type: array + required: + - list type: object title: type: string diff --git a/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml b/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml index 6379a04fb7..4562cc194e 100644 --- a/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml +++ b/charts/policy-reporter/templates/ui/ui.policyreporter.kyverno.io_namespacecustomboards.yaml @@ -3,7 +3,10 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v2.4.5-0.20250927090338-8022a0e22018+incompatible.dirty + {{- if .Values.annotations }} + annotations: + {{- toYaml .Values.annotations | nindent 4 }} + {{- end }} name: namespacecustomboards.ui.policyreporter.kyverno.io spec: group: ui.policyreporter.kyverno.io @@ -87,6 +90,17 @@ spec: type: string type: array type: object + clusterResources: + properties: + exclude: + items: + type: string + type: array + include: + items: + type: string + type: array + type: object namespaceKinds: properties: exclude: @@ -98,6 +112,17 @@ spec: type: string type: array type: object + resources: + properties: + exclude: + items: + type: string + type: array + include: + items: + type: string + type: array + type: object results: properties: exclude: @@ -128,6 +153,8 @@ spec: additionalProperties: type: string type: object + required: + - labelSelector type: object sources: description: SourceSelector allows to select visualized sources @@ -136,6 +163,8 @@ spec: items: type: string type: array + required: + - list type: object title: type: string diff --git a/charts/policy-reporter/values.yaml b/charts/policy-reporter/values.yaml index d09588d026..a50ac8573d 100644 --- a/charts/policy-reporter/values.yaml +++ b/charts/policy-reporter/values.yaml @@ -241,7 +241,7 @@ sourceFilters: disableClusterReports: false # -- Filter out Reports based on the scope resource kind kinds: - exclude: [ReplicaSet] + exclude: [] global: # -- additional labels added on each resource @@ -283,6 +283,29 @@ emailReports: skipTLS: false # -- SMTP Server Certificate file path certificate: "" + graphAPI: + # -- Enable Microsoft Graph API for E-Mail reports, takes precedence over SMTP + enabled: false + # -- Microsoft Graph API Tenant ID + tenant: "" + # -- Microsoft Graph API Client ID + clientID: "" + # -- Microsoft Graph API Client Secret + clientSecret: "" + # -- (optional) Name of an existing Secret with a `clientSecret` key, used instead of `clientSecret` + secretRef: "" + # -- Microsoft Graph API User ID (Sender) + userID: "" + # -- Microsoft Graph API CC Recipients + cc: [] + # -- Microsoft Graph API BCC Recipients + bcc: [] + # -- Disable saving sent messages to the Sent Items folder + disableSaveToSentItems: false + # -- Microsoft Graph API Azure AD Endpoint override + azureADEndpoint: "https://login.microsoftonline.com" + # -- Microsoft Graph API endpoint override + graphEndpoint: "https://graph.microsoft.com" summary: # -- Enable Summary E-Mail reports @@ -939,6 +962,12 @@ periodicSync: # Interval in minutes for periodic sync interval: 30 +autoMemoryLimit: + # Enable automatic GOMEMLIMIT configuration based on container or system memory + enabled: true + # The ratio of reserved GOMEMLIMIT memory to the detected maximum container or system memory. Must be greater than 0 and less than or equal to 1. + ratio: 0.9 + # enabled if replicaCount > 1 podDisruptionBudget: # -- Configures the minimum available pods for policy-reporter disruptions. @@ -1003,7 +1032,7 @@ ui: # -- (string) Image PullPolicy pullPolicy: IfNotPresent # -- (string) Image tag - tag: "2.5.1" + tag: "2.7.0" crds: # -- Install UI CustomBoard CRDs @@ -1383,7 +1412,7 @@ plugin: # -- (string) Image PullPolicy pullPolicy: IfNotPresent # -- (string) Image tag - tag: "0.6.0" + tag: "0.7.0" # -- Deployment replica count replicaCount: 1 @@ -1633,7 +1662,7 @@ plugin: pullPolicy: IfNotPresent # -- (string) Image tag # Defaults to `Chart.AppVersion` if omitted - tag: "0.4.12" + tag: "0.5.0" cli: image: @@ -1645,7 +1674,7 @@ plugin: pullPolicy: IfNotPresent # -- (string) Image tag # Defaults to `Chart.AppVersion` if omitted - tag: "0.69.3" + tag: "0.72.0" # -- Additional container args. extraArgs: {} @@ -1870,6 +1899,7 @@ monitoring: annotations: {} serviceMonitor: + enabled: true # -- HonorLabels chooses the metrics labels on collisions with target labels honorLabels: false # -- Allow to override the namespace for serviceMonitor