Skip to content

Commit 300e807

Browse files
viccuadviccuad
authored
Add job to update policies and kubectl image (#407)
Signed-off-by: Víctor Cuadrado Juan <[email protected]>
1 parent cf8f6bd commit 300e807

18 files changed

+202
-22
lines changed

‎.github/workflows/update-dependencies.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Update policies and kubectl image
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "30 3 * * 1" # 3:30 on Monday
7+
8+
jobs:
9+
update-dependencies:
10+
name: Update policies and kubectl image
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
15+
16+
- name: Install Updatecli in the runner
17+
uses: updatecli/updatecli-action@ecfc21fd2d9e91be2af8b706ea10aea5154f6d5d # v2.54.0
18+
19+
- name: Update policies and images
20+
id: update_policies_images
21+
env:
22+
UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
23+
UPDATECLI_GITHUB_OWNER: ${{ github.repository_owner }}
24+
run: |-
25+
updatecli apply --config ./updatecli/updatecli.d/update-deps.yaml \
26+
--values updatecli/values.yaml

‎charts/kubewarden-controller/values.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ preDeleteJob:
105105
# The registry is defined in the global.cattle.systemDefaultRegistry value
106106
# kubectl image to be used in the pre-delete helm hook
107107
repository: "kubewarden/kubectl"
108-
tag: "v1.27.9"
108+
tag: v1.27.9
109109
# kubewarden-controller deployment settings:
110110
podAnnotations: {}
111111
nodeSelector: {}

‎charts/kubewarden-defaults/templates/allow-privileged-escalation-policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ metadata:
1212
name: {{ $.Values.recommendedPolicies.allowPrivilegeEscalationPolicy.name }}
1313
spec:
1414
mode: {{ $.Values.recommendedPolicies.defaultPolicyMode }}
15-
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.allowPrivilegeEscalationPolicy.module }}
15+
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.allowPrivilegeEscalationPolicy.module.repository }}:{{ .Values.recommendedPolicies.allowPrivilegeEscalationPolicy.module.tag }}
1616
{{ include "policy-namespace-selector" . | indent 2}}
1717
rules:
1818
- apiGroups: [""]

‎charts/kubewarden-defaults/templates/capabilities-policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ metadata:
1212
name: {{ $.Values.recommendedPolicies.capabilitiesPolicy.name }}
1313
spec:
1414
mode: {{ $.Values.recommendedPolicies.defaultPolicyMode }}
15-
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.capabilitiesPolicy.module }}
15+
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.capabilitiesPolicy.module.repository }}:{{ .Values.recommendedPolicies.capabilitiesPolicy.module.tag }}
1616
{{ include "policy-namespace-selector" . | indent 2}}
1717
rules:
1818
- apiGroups: [""]

‎charts/kubewarden-defaults/templates/host-namespace-policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ metadata:
1212
name: {{ $.Values.recommendedPolicies.hostNamespacePolicy.name }}
1313
spec:
1414
mode: {{ $.Values.recommendedPolicies.defaultPolicyMode }}
15-
module: {{ template "policy_default_registry" . }}{{.Values.recommendedPolicies.hostNamespacePolicy.module}}
15+
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.hostNamespacePolicy.module.repository }}:{{ .Values.recommendedPolicies.hostNamespacePolicy.module.tag }}
1616
{{ include "policy-namespace-selector" . | indent 2}}
1717
rules:
1818
- apiGroups: [""]

‎charts/kubewarden-defaults/templates/host-path-policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ metadata:
1212
name: {{ $.Values.recommendedPolicies.hostPathsPolicy.name }}
1313
spec:
1414
mode: {{ $.Values.recommendedPolicies.defaultPolicyMode }}
15-
module: {{ template "policy_default_registry" . }}{{.Values.recommendedPolicies.hostPathsPolicy.module}}
15+
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.hostPathsPolicy.module.repository }}:{{ .Values.recommendedPolicies.hostPathsPolicy.module.tag }}
1616
{{ include "policy-namespace-selector" . | indent 2}}
1717
rules:
1818
- apiGroups: [""]

‎charts/kubewarden-defaults/templates/pod-privileged-policy.yaml

+2-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ metadata:
1212
name: {{ $.Values.recommendedPolicies.podPrivilegedPolicy.name }}
1313
spec:
1414
mode: {{ $.Values.recommendedPolicies.defaultPolicyMode }}
15-
module: {{ template "policy_default_registry" . }}{{.Values.recommendedPolicies.podPrivilegedPolicy.module}}
15+
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.podPrivilegedPolicy.module.repository }}:{{ .Values.recommendedPolicies.podPrivilegedPolicy.module.tag }}
16+
1617
{{ include "policy-namespace-selector" . | indent 2}}
1718
rules:
1819
- apiGroups: [""]

‎charts/kubewarden-defaults/templates/user-group-policy.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ metadata:
1212
name: {{ $.Values.recommendedPolicies.userGroupPolicy.name }}
1313
spec:
1414
mode: {{ $.Values.recommendedPolicies.defaultPolicyMode }}
15-
module: {{ template "policy_default_registry" . }}{{.Values.recommendedPolicies.userGroupPolicy.module}}
15+
module: {{ template "policy_default_registry" . }}{{ .Values.recommendedPolicies.userGroupPolicy.module.repository }}:{{ .Values.recommendedPolicies.userGroupPolicy.module.tag }}
1616
{{ include "policy-namespace-selector" . | indent 2}}
1717
rules:
1818
- apiGroups: [""]

‎charts/kubewarden-defaults/values.yaml

+18-6
Original file line numberDiff line numberDiff line change
@@ -123,25 +123,37 @@ recommendedPolicies:
123123
skipAdditionalNamespaces: []
124124
defaultPolicyMode: "monitor"
125125
allowPrivilegeEscalationPolicy:
126-
module: "kubewarden/policies/allow-privilege-escalation-psp:v0.2.6"
126+
module:
127+
repository: "kubewarden/policies/allow-privilege-escalation-psp"
128+
tag: v0.2.6
127129
name: "no-privilege-escalation"
128130
hostNamespacePolicy:
129-
module: "kubewarden/policies/host-namespaces-psp:v0.1.6"
131+
module:
132+
repository: "kubewarden/policies/host-namespaces-psp"
133+
tag: v0.1.6
130134
name: "no-host-namespace-sharing"
131135
podPrivilegedPolicy:
132-
module: "kubewarden/policies/pod-privileged:v0.3.2"
136+
module:
137+
repository: "kubewarden/policies/pod-privileged"
138+
tag: v0.3.2
133139
name: "no-privileged-pod"
134140
userGroupPolicy:
135-
module: "kubewarden/policies/user-group-psp:v0.5.0"
141+
module:
142+
repository: "kubewarden/policies/user-group-psp"
143+
tag: v0.5.0
136144
name: "do-not-run-as-root"
137145
hostPathsPolicy:
138-
module: "kubewarden/policies/hostpaths-psp:v0.1.10"
146+
module:
147+
repository: "kubewarden/policies/hostpaths-psp"
148+
tag: v0.1.10
139149
name: "do-not-share-host-paths"
140150
paths:
141151
- pathPrefix: "/tmp"
142152
readOnly: true
143153
capabilitiesPolicy:
144-
module: "kubewarden/policies/capabilities-psp:v0.1.15"
154+
module:
155+
repository: "kubewarden/policies/capabilities-psp"
156+
tag: v0.1.15
145157
name: "drop-capabilities"
146158
allowed_capabilities: []
147159
required_drop_capabilities:

‎renovate.json

+6-2
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,14 @@
55
"schedule:earlyMondays",
66
"helpers:pinGitHubActionDigests"
77
],
8-
"labels": ["dependencies"],
8+
"labels": [
9+
"area/dependencies"
10+
],
911
"packageRules": [
1012
{
11-
"matchPackagePatterns": [".*kyverno/policy-reporter-ui"],
13+
"matchPackagePatterns": [
14+
".*kyverno/policy-reporter-ui"
15+
],
1216
"allowedVersions": "!/1.15.1$/"
1317
}
1418
]

‎updatecli/DEVELOP.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
To test the updatecli manifests locally:
2+
3+
```console
4+
export UPDATECLI_GITHUB_TOKEN=<your token>
5+
UPDATECLI_GITHUB_OWNER=<your user> updatecli diff --config updatecli/updatecli.d/update-deps.yaml --values updatecli/values.yaml
6+
```

‎updatecli/updatecli.d/major-kubewarden-update.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,6 @@ targets:
250250
actions:
251251
createUpdatePR:
252252
title: "Helm chart {{ requiredEnv .semverinc }} release"
253-
helm-charts:
254253
kind: "github/pullrequest"
255254
scmid: "default"
256255
spec:

‎updatecli/updatecli.d/patch-kubewarden-controller-with-crds-update.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,6 @@ targets:
136136
actions:
137137
createUpdatePR:
138138
title: "Helm chart patch release"
139-
helm-charts:
140139
kind: "github/pullrequest"
141140
scmid: "default"
142141
spec:

‎updatecli/updatecli.d/patch-kubewarden-controller.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ targets:
6161
actions:
6262
createUpdatePR:
6363
title: "Helm chart patch release"
64-
helm-charts:
6564
kind: "github/pullrequest"
6665
scmid: "default"
6766
spec:

‎updatecli/updatecli.d/patch-kubewarden-defaults.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,6 @@ targets:
4747
actions:
4848
createUpdatePR:
4949
title: "Helm chart patch release"
50-
helm-charts:
5150
kind: "github/pullrequest"
5251
scmid: "default"
5352
spec:

‎updatecli/updatecli.d/prerelease-kubewarden-update-with-crd-update.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,6 @@ targets:
262262
actions:
263263
createUpdatePR:
264264
title: "Helm chart {{ requiredEnv .semverinc }} release"
265-
helm-charts:
266265
kind: "github/pullrequest"
267266
scmid: "default"
268267
spec:

‎updatecli/updatecli.d/prerelease-kubewarden-update.yaml

-2
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,6 @@ conditions:
115115
pattern: "{{ requiredEnv .releaseVersion }}"
116116

117117
targets:
118-
119118
updateControllerAutoInstallAnnotation:
120119
name: "Update kubewarden-controller auto-install annotation"
121120
kind: yaml
@@ -255,7 +254,6 @@ targets:
255254
actions:
256255
createUpdatePR:
257256
title: "Helm chart {{ requiredEnv .semverinc }} release"
258-
helm-charts:
259257
kind: "github/pullrequest"
260258
scmid: "default"
261259
spec:

‎updatecli/updatecli.d/update-deps.yaml

+138
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
name: Update charts with new policy versions, kubectl image
2+
3+
sources:
4+
kubectlImageTag:
5+
kind: dockerimage
6+
spec:
7+
image: ghcr.io/kubewarden/kubectl
8+
versionfilter:
9+
kind: semver
10+
allowPrivilegeEscalationPolicyTag:
11+
kind: dockerimage
12+
spec:
13+
image: ghcr.io/kubewarden/policies/allow-privilege-escalation-psp
14+
versionfilter:
15+
kind: semver
16+
hostNamespacePolicyTag:
17+
kind: dockerimage
18+
spec:
19+
image: ghcr.io/kubewarden/policies/host-namespaces-psp
20+
versionfilter:
21+
kind: semver
22+
podPrivilegedPolicyTag:
23+
kind: dockerimage
24+
spec:
25+
image: ghcr.io/kubewarden/policies/pod-privileged
26+
versionfilter:
27+
kind: semver
28+
userGroupPolicyTag:
29+
kind: dockerimage
30+
spec:
31+
image: ghcr.io/kubewarden/policies/user-group-psp
32+
versionfilter:
33+
kind: semver
34+
hostPathsPolicyTag:
35+
kind: dockerimage
36+
spec:
37+
image: ghcr.io/kubewarden/policies/hostpaths-psp
38+
versionfilter:
39+
kind: semver
40+
capabilitiesPolicyTag:
41+
kind: dockerimage
42+
spec:
43+
image: ghcr.io/kubewarden/policies/capabilities-psp
44+
versionfilter:
45+
kind: semver
46+
47+
targets:
48+
updatekubectlTag:
49+
name: Update kubectl image tag
50+
kind: yaml
51+
sourceid: kubectlImageTag
52+
scmid: "default"
53+
spec:
54+
file: "charts/kubewarden-controller/values.yaml"
55+
key: "$.preDeleteJob.image.tag"
56+
updateAllowPrivilegeEscalationPolicyTag:
57+
name: Update allow-privilege-escalation-psp tag
58+
kind: yaml
59+
sourceid: allowPrivilegeEscalationPolicyTag
60+
scmid: "default"
61+
spec:
62+
file: "charts/kubewarden-defaults/values.yaml"
63+
key: "$.recommendedPolicies.allowPrivilegeEscalationPolicy.module.tag"
64+
updateHostNamespacePolicyTag:
65+
name: Update host-namespaces-psp tag
66+
kind: yaml
67+
sourceid: hostNamespacePolicyTag
68+
scmid: "default"
69+
spec:
70+
file: "charts/kubewarden-defaults/values.yaml"
71+
key: "$.recommendedPolicies.hostNamespacePolicy.module.tag"
72+
updatePodPrivilegedPolicyTag:
73+
name: Update pod-privileged tag
74+
kind: yaml
75+
sourceid: podPrivilegedPolicyTag
76+
scmid: "default"
77+
spec:
78+
file: "charts/kubewarden-defaults/values.yaml"
79+
key: "$.recommendedPolicies.podPrivilegedPolicy.module.tag"
80+
updateUserGroupPolicyTag:
81+
name: Update user-group-psp tag
82+
kind: yaml
83+
sourceid: userGroupPolicyTag
84+
scmid: "default"
85+
spec:
86+
file: "charts/kubewarden-defaults/values.yaml"
87+
key: "$.recommendedPolicies.userGroupPolicy.module.tag"
88+
updateHostPathsPolicyTag:
89+
name: Update hostpaths-psp tag
90+
kind: yaml
91+
sourceid: hostPathsPolicyTag
92+
scmid: "default"
93+
spec:
94+
file: "charts/kubewarden-defaults/values.yaml"
95+
key: "$.recommendedPolicies.hostPathsPolicy.module.tag"
96+
updateCapabilitiesPolicyTag:
97+
name: Update capabilities-psp tag
98+
kind: yaml
99+
sourceid: capabilitiesPolicyTag
100+
scmid: "default"
101+
spec:
102+
file: "charts/kubewarden-defaults/values.yaml"
103+
key: "$.recommendedPolicies.capabilitiesPolicy.module.tag"
104+
105+
actions:
106+
openUpdatePR:
107+
title: "deps: Update policies, kubectl image"
108+
kind: "github/pullrequest"
109+
scmid: "default"
110+
spec:
111+
automerge: false
112+
mergemethod: squash
113+
description: |
114+
Automatic update of dependencies: policies and kubectl image
115+
This PR has been created by automation.
116+
117+
NOTE: REMEMBER TO SQUASH MERGE
118+
draft: false
119+
labels:
120+
- "kind/chore"
121+
- "area/dependencies"
122+
123+
scms:
124+
default:
125+
kind: github
126+
spec:
127+
user: "{{ .github.author }}"
128+
email: "{{ .github.email }}"
129+
directory: "/tmp/helm-charts"
130+
owner: "{{ requiredEnv .github.owner }}"
131+
repository: "helm-charts"
132+
token: "{{ requiredEnv .github.token }}"
133+
username: "{{ requiredEnv .github.user }}"
134+
branch: "{{ .github.branch }}"
135+
commitmessage:
136+
type: "deps"
137+
title: "Update dependencies"
138+
hidecredit: true

0 commit comments

Comments
 (0)