Commit Graph

35 Commits

Author SHA1 Message Date
Tim Ramlot
d5659b9217
upgrade test dependencies
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
2024-06-17 08:41:32 +02:00
Tim Ramlot
8ea7cbc362
fix forbidigo linter
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
2024-04-30 10:01:34 +02:00
Tim Ramlot
ae98ba806b
fix gocritic linter
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
2024-04-29 15:50:47 +02:00
Richard Wall
541798c9e2 kustomize build . > policy.yaml
Signed-off-by: Richard Wall <richard.wall@venafi.com>
2024-02-20 14:49:12 +00:00
Richard Wall
bbc006760f Add e2e-vault-mtls to the list of excluded namespaces
Signed-off-by: Richard Wall <richard.wall@venafi.com>
2024-02-20 14:48:53 +00:00
Richard Wall
0ffc3c2550 Fix broken upstream Kyverno policy link
Signed-off-by: Richard Wall <richard.wall@venafi.com>
2024-02-20 14:46:56 +00:00
Richard Wall
80896bce36 Update documentation of the Kyverno policies Kustomization file
Signed-off-by: Richard Wall <richard.wall@venafi.com>
2023-10-31 15:44:10 +00:00
Richard Wall
c8640908e7 Apply Kyverno policies to E2E test namespaces too
By using ClusterPolicy with exlusion rules for the namespaces of non-compliant E2E test tools.

Signed-off-by: Richard Wall <richard.wall@venafi.com>
2023-10-31 14:11:41 +00:00
Richard Wall
9dfb7c3ecf Enable readOnlyRootFilesystem policy in Kyverno
Signed-off-by: Richard Wall <richard.wall@venafi.com>
2023-10-27 16:03:17 +01:00
Richard Wall
c3a8144da8 Update the Kyverno policy file
Signed-off-by: Richard Wall <richard.wall@venafi.com>
2023-10-27 15:58:11 +01:00
Tim Ramlot
7d0178f27d
fix small bugs and make small improvements
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
2023-05-09 15:22:21 +02:00
Ashley Davis
f3a051d94f
add license preludes for a variety of files
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
2023-03-14 15:46:10 +00:00
Richard Wall
18990707a4 Use the restrict automount sa token policy
https://kyverno.io/policies/other/restrict_automount_sa_token/restrict_automount_sa_token/

Signed-off-by: Richard Wall <richard.wall@jetstack.io>
2023-01-25 21:53:57 +00:00
Richard Wall
45eeb4acd3 Regenerate existing policy file
Signed-off-by: Richard Wall <richard.wall@jetstack.io>
2023-01-25 20:13:02 +00:00
Ashley Davis
f8bee19c04
various ginkgo tweaks
1. Remove deprecated args (progress, slow spec threshold)
2. Disable colors in CI

Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
2023-01-03 16:47:56 +00:00
irbekrm
c60a181baf Gateway and GatewayClass for tests are created against beta Gateway API
Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-12-05 15:05:47 +00:00
Martin Schimandl
e24ff641c6 Deploy contour from HELM chart instead of plain yaml
Signed-off-by: Martin Schimandl <martin.schimandl@gmail.com>
2022-10-01 11:22:31 +01:00
Tim Ramlot
37f64ca5a0 partial undo of replace-all for contour-gateway.yaml
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
2022-08-19 07:36:43 +00:00
Tim Ramlot
836793e7e3 upgrade gateway api to v0.5.0
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
2022-08-08 08:52:59 +00:00
Joe Bowbeer
1dc252e27e update kyverno version and policy
Signed-off-by: Joe Bowbeer <joe.bowbeer@gmail.com>
2022-07-06 10:11:37 -07:00
irbekrm
a76d85eab3 Allows kind to choose API version for kubeadm Cluster config
To be able to use single kind config for different Kubernetes versions

Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-06-08 18:29:40 +01:00
irbekrm
3720950975 Remove kind config for kube 1.18 and 1.19
As we no longer need to create 1.18 and 1.19 clusters

Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-06-08 18:02:31 +01:00
irbekrm
a0d3d8eb0a Predefine what service IP range kind should use
Instead of trying to retrieve it after creating the cluster

Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-06-08 17:40:08 +01:00
irbekrm
289d082fbd Removes the unused traefik and haproxy addons config
Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-06-08 13:08:08 +01:00
irbekrm
eeb300894f Ensure that flags are actually passed to etcd
Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-06-07 13:05:43 +01:00
irbekrm
5f1dfa8c2b Bumps Contour v1.20.0 -> v1.20.1
Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-05-11 11:30:20 +01:00
irbekrm
8dbd9a619f Removes duplicated Gateway CRDs
Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-05-11 11:29:47 +01:00
irbekrm
6cb826833e Ensures Envoy ClusterIP is parameterized consistently
Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-05-10 12:02:16 +01:00
irbekrm
d720d8e02b Fix kind cluster creation with kube 1.19 and 1.18
By specifying a different kind config that does not use an etcd flag that was only add in later etcd versions

Signed-off-by: irbekrm <irbekrm@gmail.com>
2022-04-21 12:36:33 +01:00
Maël Valais
ae0632c1f0 make: add "make e2e-setup-kind-update-images"
I think having a separate file for storing the various kind image
digest isn't necessary. From now on, make/cluster.sh is the "source of
truth" for everything related to kind. If you would like to see the
image that is going to be used for creating the kind cluster, you can
run:

  make/cluster.sh --show-image

To self-update the digests with the latest available digests, run:

  make/cluster.sh --update-images

Signed-off-by: Maël Valais <mael@vls.dev>
2022-03-29 11:26:37 +02:00
Maël Valais
c4e6ebd1a8 make/cluster.sh: remove the fixed clusterIP CIDR 10.0.0.0
The fixed CIDR isn't necessary anymore since the makefile figures the
ClusterIP dynamically. This change also enables you to run
make/cluster.sh with an existing kind cluster.

Signed-off-by: Maël Valais <mael@vls.dev>
2022-03-29 11:26:37 +02:00
Maël Valais
6c57633884 make: remove the not-really-needed system dependency "perl"
Signed-off-by: Maël Valais <mael@vls.dev>
2022-03-29 10:54:26 +02:00
Maël Valais
057ce50ace make/cluster.sh: speedup etcd by using --unsafe-no-fsync
Using --unsafe-no-fsync is OK for development deployments of etcd [1].
etcd relies on fsync for its consensus protocol.

 [1]: https://github.com/etcd-io/etcd/pull/11946
 [2]: https://etcd.io/docs/v3.5/tuning/#disk
 [3]: https://etcd.io/docs/v3.5/faq/

Signed-off-by: Maël Valais <mael@vls.dev>
Co-authored-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
2022-03-29 10:54:26 +02:00
Maël Valais
56888639fd make: e2e-setup-traefik: fix dditionalArguments -> additionalArguments
Signed-off-by: Maël Valais <mael@vls.dev>
2022-03-16 14:06:55 +01:00
Maël Valais
3405edf821 make: add the targets 'e2e-setup-kind', 'e2e-setup-kind', and 'e2e'
The commands can be run concurrently, with the exception of e2e that
has to be run after e2e-setup is done. The e2e target does not check
whether cert-manager and the addons are installed.

The two only scripts that were kept are:

- make/e2e.sh      (previously called ./devel/run-e2e.sh)
- make/cluster.sh  (previsouly called ./devel/cluster/create.sh)

The reason for the removal of the other scripts is that they didn't
have that much logic and could easily ported to Make, improving greatly
the execution speed thanks to make's concurrency.

make/e2e.sh now behaves "as expected" when using -ginkgo.focus or
GINKGO_FOCUS; previously, the logs would not be shown before the end
of the test.

make/cluster.sh has lost the ability to create an OpenShift 3.11 cluster.
for running the end-to-end tests. The two reasons are that OpenShift 4
wasn't supported by the script devel/cluster/create.sh, and OpenShift
3.11 is not supported by cert-manager anymore.

The Makefile targets that were used in the Prow jobs (verify, verify_deps,
verify_chart, verify_upgrade, and cluster) have been kept around. They
now show a warning to encourage people to use the new Make-based targets.
When running one of the deprecated targets the Makefile won't check the
presence of the system tools such as Go and jq, since Bazel takes care of
these dependencies.

On version change, downloaded tools and images are re-downloaded. The
command 'make clean' now keeps the downloaded images and tools.

Note that a lot of attention has been put into having a Make system that works
flawlessly both on Linux and on BSDs (such as macOS).

You will note that some recursive calls to make are made, and $(MAKE)
instead of plain "make" is used in that case. If we didn't use $(MAKE),
we would have concurrency issues, and warnings such as:

  make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule.

Signed-off-by: Maël Valais <mael@vls.dev>
2022-03-13 12:32:08 +01:00