Dario Tranchitella
ea88b102e5
feat: pv labelling and preventing cross-tenant mount
2023-01-26 09:31:16 +01:00
Oliver Bähler
ab0fe91c58
feat: add defaults handler
...
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com >
2023-01-14 15:51:01 +01:00
Dario Tranchitella
f73a5b17f4
fix: using embedded struct for selector
2022-12-29 17:49:45 +01:00
Oliver Bähler
628efbb30f
fix: validate pods on update
...
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com >
2022-12-29 17:49:45 +01:00
Oliver Bähler
79391f863a
feat: add runtimeclass control
...
Signed-off-by: Oliver Baehler <oliver.baehler@hotmail.com >
2022-12-28 15:01:28 +01:00
Dario Tranchitella
e964f34086
fix: avoiding nil pointer when empty map for labels and annotations
2022-12-27 17:53:17 +01:00
Dario Tranchitella
93fbca9b18
feat(api): label selector for storage, ingress, podpriority classes
2022-12-27 17:53:17 +01:00
Dario Tranchitella
43bd2491ae
refactor(api): switching to v1beta2 as storage version
2022-12-27 17:53:17 +01:00
Dario Tranchitella
6a380b00ad
style: kubebuilder annotations start with empty space
2022-12-26 14:27:26 +01:00
Dario Tranchitella
503e3fc1d0
feat: globaltenantresource and tenantresource reconciliation
2022-12-26 14:27:26 +01:00
Dario Tranchitella
360a8d2b56
refactor: using interfaces for accessing tenant namespaces
2022-12-26 14:27:26 +01:00
Dario Tranchitella
4835b94839
style: conforming go files headers
2022-12-26 14:27:26 +01:00
Dario Tranchitella
cf52924870
refactor: abstracting types used by several api versions
2022-12-26 14:27:26 +01:00
Dario Tranchitella
1087ea853b
fix: inverted logic in forbidden user namespace metadata
2022-12-23 15:34:28 +01:00
Dario Tranchitella
75525ac192
fix: preventing serviceaccount privilege escalation
2022-12-02 15:19:06 +01:00
Dario Tranchitella
098a74b565
refactor(capsuleconfiguration): allowing to skip tls reconciler
2022-07-26 17:48:58 +02:00
Dario Tranchitella
d84f0be76b
fix: tenant owners cannot replace protected namesapce labels or annotations
2022-07-22 19:29:27 +00:00
Oliver Bähler
cac2920827
feat: grant global patch privileges and add patch handler
2022-06-09 18:32:39 +00:00
Maksim Fedotov
f1dc028649
feat: generate TLS certificates before starting controllers
2022-06-08 11:12:35 +00:00
Maksim Fedotov
82b58d7d53
feat: refactor capsule TLS certificates management
2022-06-08 11:12:35 +00:00
Maksim Fedotov
3c9228d1aa
fix: protectedHandler OnDelete get tenant using client
2022-05-18 18:06:10 +02:00
Maksim Fedotov
23564f8e40
feat: protected tenant annotation
2022-05-18 18:06:10 +02:00
Dario Tranchitella
a8b84c8cb3
fix: using sentinel error for non limited custom resource
2022-05-16 15:51:07 +00:00
Dario Tranchitella
49e76f7f93
style: linters refactoring
2022-05-05 13:33:39 +00:00
Dario Tranchitella
345836630c
refactor: avoiding using background context
2022-05-05 13:33:39 +00:00
Davide Imola
569d803e95
fix: using configuration for mutating and validating webhooks
2022-03-31 13:02:25 +00:00
Davide Imola
7b3b0d6504
fix: using configuration for tls and ca secret names
2022-03-31 13:02:25 +00:00
Pandry
d4a5f3beca
fix: validate regex patterns in annotations #510
2022-02-22 06:11:49 +00:00
Dario Tranchitella
e53911942d
feat: limiting amount of resources deployed in a tenant
2021-12-23 11:39:34 +00:00
Oliver Bähler
5c7804e1bf
fix: add rolebinding validation against rfc-1123 dns for sa subjects
...
Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com >
2021-11-12 11:22:26 +01:00
Maxim Fedotov
14f9686bbb
Forbidden node labels and annotations ( #464 )
...
* feat: forbidden node labels and annotations
* test(e2e): forbidden node labels and annotations
* build(kustomize): forbidden node labels and annotations
* build(helm): forbidden node labels and annotations
* build(installer): forbidden node labels and annotations
* chore(make): forbidden node labels and annotations
* docs: forbidden node labels and annotations
* test(e2e): forbidden node labels and annotations. Use EventuallyCreation func
* feat: forbidden node labels and annotations. Check kubernetes version
* test(e2e): forbidden node labels and annotations. Check kubernetes version
* docs: forbidden node labels and annotations. Version restrictions
* feat: forbidden node labels and annotations. Do not update deepcopy functions
* docs: forbidden node labels and annotations. Use blockquotes for notes
Co-authored-by: Maksim Fedotov <m_fedotov@wargaming.net >
2021-11-02 20:01:53 +03:00
Dario Tranchitella
6ba9826c51
chore(linters): no more need of duplicate check
2021-11-02 17:13:23 +01:00
Dario Tranchitella
e2768dad83
fix!: forcing to use fqci and container registries with no repositories
2021-11-02 17:13:23 +01:00
Tom OBrien
e361e2d424
fix: allowing regex underscore for container registry enforcement
...
While not best practice, underscore can be used and so should be allowed.
2021-10-27 20:55:39 +02:00
Maksim Fedotov
b28b98a7bc
feat: namespace labeling for tenant owners. fix linting issues
2021-09-23 14:10:24 +02:00
Maksim Fedotov
a14c7609df
feat: namespace labeling for tenant owners
2021-09-23 14:10:24 +02:00
alegrey91
196e3c910d
feat: add deny-wildcard annotation
2021-09-21 19:14:49 +02:00
Dario Tranchitella
26965a5ea2
fix: skipping indexer if error is a NoKindMatch
2021-09-17 15:43:42 +02:00
Maksim Fedotov
422b6598ba
fix: check if user is a member of capsuleUserGroup instead of tenantOwner when cordoning a tenant
2021-09-15 11:14:39 +02:00
Dario Tranchitella
94c6a64fcb
fix: validating Tenant owner name when is a ServiceAccount
2021-09-04 14:17:06 +02:00
Dario Tranchitella
60ab33337d
feat: enforcement of LoadBalancer service kind
2021-08-17 17:21:59 +02:00
Dario Tranchitella
a2fda44110
fix: NewIngressHostnameCollision is returning pointer for error parsing
2021-08-12 19:30:27 +02:00
Dario Tranchitella
df08c9e63e
refactor: hostname collision is now managed at Tenant level
2021-08-12 19:30:27 +02:00
Dario Tranchitella
09277e9f3d
feat: Ingress hostname collision scope at Tenant level
2021-08-12 19:30:27 +02:00
Dario Tranchitella
e24394f329
refactor: avoiding init functions for direct registration
2021-08-12 19:30:27 +02:00
Dario Tranchitella
01053d5deb
refactor: renaming struct field names for allowed hostnames and classes
2021-08-12 19:30:27 +02:00
Dario Tranchitella
b749e34547
refactor: grouping Ingress options into defined struct
2021-08-12 19:30:27 +02:00
Dario Tranchitella
57bf3d1c1b
feat: skipping Ingress indexer setup for deprecated APIs
...
Starting from Kubernetes v1.22+, networking.k8s.io/v1beta1 and
extensions/v1beta1 are no more supported and indexers must not be
started, otherwise the manager would panic.
2021-08-10 15:39:43 +02:00
Dario Tranchitella
18912a002b
feat: allowed external IPs is grouped in ServiceOptions
2021-07-23 08:28:20 +02:00
Dario Tranchitella
0e55823a0c
feat: toggling ExternalName service
2021-07-21 14:34:56 +02:00
