diff --git a/cmd/internal/engine.go b/cmd/internal/engine.go index 42f321e89006..089a88fbecfe 100644 --- a/cmd/internal/engine.go +++ b/cmd/internal/engine.go @@ -67,7 +67,7 @@ func NewExceptionSelector( polexCache, err := exceptioncontroller.NewController( kyvernoInformer.Kyverno().V1().ClusterPolicies(), kyvernoInformer.Kyverno().V1().Policies(), - kyvernoInformer.Kyverno().V2alpha1().PolicyExceptions(), + kyvernoInformer.Kyverno().V2beta1().PolicyExceptions(), exceptionNamespace, ) if err != nil { diff --git a/pkg/controllers/exceptions/controller.go b/pkg/controllers/exceptions/controller.go index 88954ab0868b..cba5d5bc3dc3 100644 --- a/pkg/controllers/exceptions/controller.go +++ b/pkg/controllers/exceptions/controller.go @@ -9,12 +9,12 @@ import ( "github.com/go-logr/logr" kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1" - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" "github.com/kyverno/kyverno/pkg/autogen" kyvernov1informers "github.com/kyverno/kyverno/pkg/client/informers/externalversions/kyverno/v1" - kyvernov2alpha1informers "github.com/kyverno/kyverno/pkg/client/informers/externalversions/kyverno/v2alpha1" + kyvernov2beta1informers "github.com/kyverno/kyverno/pkg/client/informers/externalversions/kyverno/v2beta1" kyvernov1listers "github.com/kyverno/kyverno/pkg/client/listers/kyverno/v1" - kyvernov2alpha1listers "github.com/kyverno/kyverno/pkg/client/listers/kyverno/v2alpha1" + kyvernov2beta1listers "github.com/kyverno/kyverno/pkg/client/listers/kyverno/v2beta1" controllerutils "github.com/kyverno/kyverno/pkg/utils/controller" apierrors "k8s.io/apimachinery/pkg/api/errors" "k8s.io/apimachinery/pkg/labels" @@ -22,7 +22,7 @@ import ( "k8s.io/client-go/util/workqueue" ) -type ruleIndex = map[string][]*kyvernov2alpha1.PolicyException +type ruleIndex = map[string][]*kyvernov2beta1.PolicyException type policyIndex = map[string]ruleIndex @@ -30,7 +30,7 @@ type controller struct { // listers cpolLister kyvernov1listers.ClusterPolicyLister polLister kyvernov1listers.PolicyLister - polexLister kyvernov2alpha1listers.PolicyExceptionLister + polexLister kyvernov2beta1listers.PolicyExceptionLister // queue queue workqueue.RateLimitingInterface @@ -50,7 +50,7 @@ const ( func NewController( cpolInformer kyvernov1informers.ClusterPolicyInformer, polInformer kyvernov1informers.PolicyInformer, - polexInformer kyvernov2alpha1informers.PolicyExceptionInformer, + polexInformer kyvernov2beta1informers.PolicyExceptionInformer, namespace string, ) (*controller, error) { queue := workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), ControllerName) @@ -80,13 +80,13 @@ func (c *controller) Run(ctx context.Context, workers int) { controllerutils.Run(ctx, logger.V(3), ControllerName, time.Second, c.queue, workers, maxRetries, c.reconcile) } -func (c *controller) Find(policyName string, ruleName string) ([]*kyvernov2alpha1.PolicyException, error) { +func (c *controller) Find(policyName string, ruleName string) ([]*kyvernov2beta1.PolicyException, error) { c.lock.RLock() defer c.lock.RUnlock() return c.index[policyName][ruleName], nil } -func (c *controller) addPolex(polex *kyvernov2alpha1.PolicyException) { +func (c *controller) addPolex(polex *kyvernov2beta1.PolicyException) { names := sets.New[string]() for _, ex := range polex.Spec.Exceptions { names.Insert(ex.PolicyName) @@ -96,7 +96,7 @@ func (c *controller) addPolex(polex *kyvernov2alpha1.PolicyException) { } } -func (c *controller) updatePolex(old *kyvernov2alpha1.PolicyException, new *kyvernov2alpha1.PolicyException) { +func (c *controller) updatePolex(old *kyvernov2beta1.PolicyException, new *kyvernov2beta1.PolicyException) { names := sets.New[string]() for _, ex := range old.Spec.Exceptions { names.Insert(ex.PolicyName) @@ -109,7 +109,7 @@ func (c *controller) updatePolex(old *kyvernov2alpha1.PolicyException, new *kyve } } -func (c *controller) deletePolex(polex *kyvernov2alpha1.PolicyException) { +func (c *controller) deletePolex(polex *kyvernov2beta1.PolicyException) { names := sets.New[string]() for _, ex := range polex.Spec.Exceptions { names.Insert(ex.PolicyName) @@ -135,7 +135,7 @@ func (c *controller) getPolicy(namespace, name string) (kyvernov1.PolicyInterfac } } -func (c *controller) listExceptions() ([]*kyvernov2alpha1.PolicyException, error) { +func (c *controller) listExceptions() ([]*kyvernov2beta1.PolicyException, error) { if c.namespace == "" { return c.polexLister.List(labels.Everything()) } @@ -147,7 +147,7 @@ func (c *controller) buildRuleIndex(key string, policy kyvernov1.PolicyInterface if err != nil { return nil, err } - slices.SortFunc(polexList, func(a, b *kyvernov2alpha1.PolicyException) int { + slices.SortFunc(polexList, func(a, b *kyvernov2beta1.PolicyException) int { if cmp := cmp.Compare(a.Namespace, b.Namespace); cmp != 0 { return cmp } diff --git a/pkg/controllers/report/background/controller.go b/pkg/controllers/report/background/controller.go index 627ea99528d0..8aa62d768078 100644 --- a/pkg/controllers/report/background/controller.go +++ b/pkg/controllers/report/background/controller.go @@ -7,7 +7,7 @@ import ( "github.com/go-logr/logr" kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1" kyvernov1alpha2 "github.com/kyverno/kyverno/api/kyverno/v1alpha2" - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" policyreportv1alpha2 "github.com/kyverno/kyverno/api/policyreport/v1alpha2" "github.com/kyverno/kyverno/pkg/client/clientset/versioned" kyvernov1informers "github.com/kyverno/kyverno/pkg/client/informers/externalversions/kyverno/v1" @@ -207,7 +207,7 @@ func (c *controller) getMeta(namespace, name string) (metav1.Object, error) { } } -func (c *controller) needsReconcile(namespace, name, hash string, exceptions []kyvernov2alpha1.PolicyException, policies ...engineapi.GenericPolicy) (bool, bool, error) { +func (c *controller) needsReconcile(namespace, name, hash string, exceptions []kyvernov2beta1.PolicyException, policies ...engineapi.GenericPolicy) (bool, bool, error) { // if the reportMetadata does not exist, we need a full reconcile reportMetadata, err := c.getMeta(namespace, name) if err != nil { @@ -263,7 +263,7 @@ func (c *controller) reconcileReport( uid types.UID, gvk schema.GroupVersionKind, resource resource.Resource, - exceptions []kyvernov2alpha1.PolicyException, + exceptions []kyvernov2beta1.PolicyException, policies ...engineapi.GenericPolicy, ) error { // namespace labels to be used by the scanner @@ -470,16 +470,16 @@ func (c *controller) reconcile(ctx context.Context, log logr.Logger, key, namesp return nil } -func (c *controller) addException(obj *kyvernov2alpha1.PolicyException) { +func (c *controller) addException(obj *kyvernov2beta1.PolicyException) { c.enqueueResources() } -func (c *controller) updateException(old, obj *kyvernov2alpha1.PolicyException) { +func (c *controller) updateException(old, obj *kyvernov2beta1.PolicyException) { if old.GetResourceVersion() != obj.GetResourceVersion() { c.enqueueResources() } } -func (c *controller) deleteException(obj *kyvernov2alpha1.PolicyException) { +func (c *controller) deleteException(obj *kyvernov2beta1.PolicyException) { c.enqueueResources() } diff --git a/pkg/controllers/report/utils/utils.go b/pkg/controllers/report/utils/utils.go index 575a9a5559bf..3a989d9ea03b 100644 --- a/pkg/controllers/report/utils/utils.go +++ b/pkg/controllers/report/utils/utils.go @@ -4,10 +4,10 @@ import ( "github.com/go-logr/logr" kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1" kyvernov1alpha2 "github.com/kyverno/kyverno/api/kyverno/v1alpha2" - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" "github.com/kyverno/kyverno/pkg/autogen" kyvernov1listers "github.com/kyverno/kyverno/pkg/client/listers/kyverno/v1" - kyvernov2alpha1listers "github.com/kyverno/kyverno/pkg/client/listers/kyverno/v2alpha1" + kyvernov2beta1listers "github.com/kyverno/kyverno/pkg/client/listers/kyverno/v2beta1" datautils "github.com/kyverno/kyverno/pkg/utils/data" policyvalidation "github.com/kyverno/kyverno/pkg/validation/policy" admissionregistrationv1alpha1 "k8s.io/api/admissionregistration/v1alpha1" @@ -17,8 +17,8 @@ import ( admissionregistrationv1alpha1listers "k8s.io/client-go/listers/admissionregistration/v1alpha1" ) -func FetchPolicyExceptions(polexLister kyvernov2alpha1listers.PolicyExceptionLister, namespace string) ([]kyvernov2alpha1.PolicyException, error) { - var exceptions []kyvernov2alpha1.PolicyException +func FetchPolicyExceptions(polexLister kyvernov2beta1listers.PolicyExceptionLister, namespace string) ([]kyvernov2beta1.PolicyException, error) { + var exceptions []kyvernov2beta1.PolicyException if polexs, err := polexLister.PolicyExceptions(namespace).List(labels.Everything()); err != nil { return nil, err } else { diff --git a/pkg/engine/api/ruleresponse.go b/pkg/engine/api/ruleresponse.go index d841979347c9..27222ee48359 100644 --- a/pkg/engine/api/ruleresponse.go +++ b/pkg/engine/api/ruleresponse.go @@ -3,7 +3,7 @@ package api import ( "fmt" - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" pssutils "github.com/kyverno/kyverno/pkg/pss/utils" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" @@ -43,7 +43,7 @@ type RuleResponse struct { // podSecurityChecks contains pod security checks (only if this is a pod security rule) podSecurityChecks *PodSecurityChecks // exception is the exception applied (if any) - exception *kyvernov2alpha1.PolicyException + exception *kyvernov2beta1.PolicyException } func NewRuleResponse(name string, ruleType RuleType, msg string, status RuleStatus) *RuleResponse { @@ -78,7 +78,7 @@ func RuleFail(name string, ruleType RuleType, msg string) *RuleResponse { return NewRuleResponse(name, ruleType, msg, RuleStatusFail) } -func (r RuleResponse) WithException(exception *kyvernov2alpha1.PolicyException) *RuleResponse { +func (r RuleResponse) WithException(exception *kyvernov2beta1.PolicyException) *RuleResponse { r.exception = exception return &r } @@ -109,7 +109,7 @@ func (r *RuleResponse) Stats() ExecutionStats { return r.stats } -func (r *RuleResponse) Exception() *kyvernov2alpha1.PolicyException { +func (r *RuleResponse) Exception() *kyvernov2beta1.PolicyException { return r.exception } diff --git a/pkg/engine/api/selector.go b/pkg/engine/api/selector.go index e8a558bf5cfc..2727b06d75f9 100644 --- a/pkg/engine/api/selector.go +++ b/pkg/engine/api/selector.go @@ -1,12 +1,12 @@ package api import ( - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" ) // PolicyExceptionSelector is an abstract interface used to resolve poliicy exceptions type PolicyExceptionSelector interface { // Find returns policy exceptions matching a given policy name and rule name. // Objects returned here must be treated as read-only. - Find(string, string) ([]*kyvernov2alpha1.PolicyException, error) + Find(string, string) ([]*kyvernov2beta1.PolicyException, error) } diff --git a/pkg/engine/exceptions.go b/pkg/engine/exceptions.go index b7a23f1e88aa..aac4cc198883 100644 --- a/pkg/engine/exceptions.go +++ b/pkg/engine/exceptions.go @@ -3,7 +3,7 @@ package engine import ( "github.com/go-logr/logr" kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1" - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" engineapi "github.com/kyverno/kyverno/pkg/engine/api" matched "github.com/kyverno/kyverno/pkg/utils/match" "k8s.io/client-go/tools/cache" @@ -13,7 +13,7 @@ func findExceptions( selector engineapi.PolicyExceptionSelector, policy kyvernov1.PolicyInterface, rule string, -) ([]*kyvernov2alpha1.PolicyException, error) { +) ([]*kyvernov2beta1.PolicyException, error) { if selector == nil { return nil, nil } @@ -25,7 +25,7 @@ func matchesException( selector engineapi.PolicyExceptionSelector, policyContext engineapi.PolicyContext, rule kyvernov1.Rule, -) (*kyvernov2alpha1.PolicyException, error) { +) (*kyvernov2beta1.PolicyException, error) { candidates, err := findExceptions(selector, policyContext.Policy(), rule.Name) if err != nil { return nil, err diff --git a/pkg/exceptions/selector.go b/pkg/exceptions/selector.go index 6b2cb65718e8..486e69691b29 100644 --- a/pkg/exceptions/selector.go +++ b/pkg/exceptions/selector.go @@ -1,12 +1,12 @@ package exceptions import ( - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" "k8s.io/apimachinery/pkg/labels" ) type Lister interface { - List(labels.Selector) ([]*kyvernov2alpha1.PolicyException, error) + List(labels.Selector) ([]*kyvernov2beta1.PolicyException, error) } type selector struct { @@ -19,12 +19,12 @@ func New(lister Lister) selector { } } -func (s selector) Find(policyName string, ruleName string) ([]*kyvernov2alpha1.PolicyException, error) { +func (s selector) Find(policyName string, ruleName string) ([]*kyvernov2beta1.PolicyException, error) { polexs, err := s.lister.List(labels.Everything()) if err != nil { return nil, err } - var results []*kyvernov2alpha1.PolicyException + var results []*kyvernov2beta1.PolicyException for _, polex := range polexs { if polex.Contains(policyName, ruleName) { results = append(results, polex) diff --git a/pkg/utils/report/labels.go b/pkg/utils/report/labels.go index 90138041c3f6..371089b918b9 100644 --- a/pkg/utils/report/labels.go +++ b/pkg/utils/report/labels.go @@ -10,7 +10,7 @@ import ( "github.com/kyverno/kyverno/api/kyverno" kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1" kyvernov1alpha2 "github.com/kyverno/kyverno/api/kyverno/v1alpha2" - kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1" + kyvernov2beta1 "github.com/kyverno/kyverno/api/kyverno/v2beta1" engineapi "github.com/kyverno/kyverno/pkg/engine/api" controllerutils "github.com/kyverno/kyverno/pkg/utils/controller" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" @@ -64,11 +64,11 @@ func PolicyLabelPrefix(policy engineapi.GenericPolicy) string { return LabelPrefixValidatingAdmissionPolicy } -func PolicyExceptionLabel(exception kyvernov2alpha1.PolicyException) string { +func PolicyExceptionLabel(exception kyvernov2beta1.PolicyException) string { return LabelPrefixPolicyException + exception.GetName() } -func SetPolicyExceptionLabel(report kyvernov1alpha2.ReportInterface, exception kyvernov2alpha1.PolicyException) { +func SetPolicyExceptionLabel(report kyvernov1alpha2.ReportInterface, exception kyvernov2beta1.PolicyException) { controllerutils.SetLabel(report, PolicyExceptionLabel(exception), exception.GetResourceVersion()) } diff --git a/pkg/webhooks/resource/fake.go b/pkg/webhooks/resource/fake.go index 431654ae91c7..9601b51514dd 100644 --- a/pkg/webhooks/resource/fake.go +++ b/pkg/webhooks/resource/fake.go @@ -40,7 +40,7 @@ func NewFakeHandlers(ctx context.Context, policyCache policycache.Cache) webhook dclient := dclient.NewEmptyFakeClient() configuration := config.NewDefaultConfiguration(false) urLister := kyvernoInformers.Kyverno().V1beta1().UpdateRequests().Lister().UpdateRequests(config.KyvernoNamespace()) - peLister := kyvernoInformers.Kyverno().V2alpha1().PolicyExceptions().Lister() + peLister := kyvernoInformers.Kyverno().V2beta1().PolicyExceptions().Lister() jp := jmespath.New(configuration) rclient := registryclient.NewOrDie()