diff --git a/cmd/build/helmify/replacements.go b/cmd/build/helmify/replacements.go index 933b97f1ca2..a7dc691ff1f 100644 --- a/cmd/build/helmify/replacements.go +++ b/cmd/build/helmify/replacements.go @@ -292,7 +292,7 @@ var replacements = map[string]string{ resources: - '*' # Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper). - # You can find a rough list of subresources by doing a case-sensitive search in the Kubernetes codebase for 'Subresource("' + # You can find the current list of subresources in the Kubernetes API discovery data. {{- range .Values.validatingWebhookSubResources }} - {{ . }} {{- end }} diff --git a/cmd/build/helmify/static/README.md b/cmd/build/helmify/static/README.md index 74f4d5fafa6..bc766039c61 100644 --- a/cmd/build/helmify/static/README.md +++ b/cmd/build/helmify/static/README.md @@ -145,7 +145,7 @@ information._ | validatingWebhookCheckIgnoreFailurePolicy | The failurePolicy for the check-ignore-label validating webhook | `Fail` | | validatingWebhookExemptNamespacesLabels | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace. | `{}` | | validatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | -| validatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']` | +| validatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['namespaces/finalize', 'pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'serviceaccounts/token', 'services/proxy', 'nodes/proxy', 'certificatesigningrequests/approval', 'services/status']` | | validatingWebhookURL | Custom URL for Kubernetes API server to use to reach the validating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used. | `null` | | validatingWebhookScope | The scope for the validating webhook. Does not work with `validatingWebhookCustomRules` | `*` | | additionalValidatingWebhookConfigsToRotateCerts | The name of additional `ValidatingWebhookConfiguration`s that the gatekeeper cert rotator should manage certs for | `[]` | @@ -169,7 +169,7 @@ information._ | mutatingWebhookMatchConditions | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called | `[]` | | mutatingWebhookTimeoutSeconds | The timeout for the mutating webhook in seconds | `3` | | mutatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | -| mutatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']` | +| mutatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['namespaces/finalize', 'pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'serviceaccounts/token', 'services/proxy', 'nodes/proxy', 'certificatesigningrequests/approval', 'services/status']` | | mutatingWebhookURL | Custom URL for Kubernetes API server to use to reach the mutating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used. | `null` | | mutatingWebhookScope | The scope for the mutating webhook. Does not work with `mutatingWebhookCustomRules` | `*` | | additionalMutatingWebhookConfigsToRotateCerts | The name of additional `MutatingWebhookConfiguration`s that the gatekeeper cert rotator should manage certs for | `[]` | diff --git a/cmd/build/helmify/static/values.yaml b/cmd/build/helmify/static/values.yaml index e51b4a1e804..b5d76b63bd1 100644 --- a/cmd/build/helmify/static/values.yaml +++ b/cmd/build/helmify/static/values.yaml @@ -19,6 +19,7 @@ validatingWebhookCheckIgnoreFailurePolicy: Fail validatingWebhookCustomRules: {} validatingWebhookSubResources: [ + "namespaces/finalize", "pods/ephemeralcontainers", "pods/exec", "pods/log", @@ -32,8 +33,10 @@ validatingWebhookSubResources: "replicasets/scale", "statefulsets/scale", "replicationcontrollers/scale", + "serviceaccounts/token", "services/proxy", "nodes/proxy", + "certificatesigningrequests/approval", "services/status", ] validatingWebhookURL: null @@ -55,6 +58,7 @@ mutatingWebhookTimeoutSeconds: 1 mutatingWebhookCustomRules: {} mutatingWebhookSubResources: [ + "namespaces/finalize", "pods/ephemeralcontainers", "pods/exec", "pods/log", @@ -63,12 +67,15 @@ mutatingWebhookSubResources: "pods/proxy", "pods/attach", "pods/binding", + "pods/resize", "deployments/scale", "replicasets/scale", "statefulsets/scale", "replicationcontrollers/scale", + "serviceaccounts/token", "services/proxy", "nodes/proxy", + "certificatesigningrequests/approval", "services/status", ] mutatingWebhookURL: null diff --git a/config/webhook/manifests.yaml b/config/webhook/manifests.yaml index 965ba731290..f9394c9bf6b 100644 --- a/config/webhook/manifests.yaml +++ b/config/webhook/manifests.yaml @@ -25,6 +25,25 @@ webhooks: - UPDATE resources: - '*' + - namespaces/finalize + - pods/ephemeralcontainers + - pods/exec + - pods/log + - pods/eviction + - pods/portforward + - pods/proxy + - pods/attach + - pods/binding + - pods/resize + - deployments/scale + - replicasets/scale + - statefulsets/scale + - replicationcontrollers/scale + - serviceaccounts/token + - services/proxy + - nodes/proxy + - certificatesigningrequests/approval + - services/status sideEffects: None --- apiVersion: admissionregistration.k8s.io/v1 @@ -75,6 +94,7 @@ webhooks: - UPDATE resources: - '*' + - namespaces/finalize - pods/ephemeralcontainers - pods/exec - pods/log @@ -88,7 +108,9 @@ webhooks: - replicasets/scale - statefulsets/scale - replicationcontrollers/scale + - serviceaccounts/token - services/proxy - nodes/proxy + - certificatesigningrequests/approval - services/status sideEffects: None diff --git a/manifest_staging/charts/gatekeeper/README.md b/manifest_staging/charts/gatekeeper/README.md index 74f4d5fafa6..bc766039c61 100644 --- a/manifest_staging/charts/gatekeeper/README.md +++ b/manifest_staging/charts/gatekeeper/README.md @@ -145,7 +145,7 @@ information._ | validatingWebhookCheckIgnoreFailurePolicy | The failurePolicy for the check-ignore-label validating webhook | `Fail` | | validatingWebhookExemptNamespacesLabels | Additional namespace labels that will be exempt from the validating webhook. Please note that anyone in the cluster capable to manage namespaces will be able to skip all Gatekeeper validation by setting one of these labels for their namespace. | `{}` | | validatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. Mutually exclusive with `enableDeleteOperations`. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | -| validatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']` | +| validatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['namespaces/finalize', 'pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'serviceaccounts/token', 'services/proxy', 'nodes/proxy', 'certificatesigningrequests/approval', 'services/status']` | | validatingWebhookURL | Custom URL for Kubernetes API server to use to reach the validating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used. | `null` | | validatingWebhookScope | The scope for the validating webhook. Does not work with `validatingWebhookCustomRules` | `*` | | additionalValidatingWebhookConfigsToRotateCerts | The name of additional `ValidatingWebhookConfiguration`s that the gatekeeper cert rotator should manage certs for | `[]` | @@ -169,7 +169,7 @@ information._ | mutatingWebhookMatchConditions | The match conditions written in CEL to further refine which resources will be selected by the webhook. All match conditions must evaluate to true for the webhook to be called | `[]` | | mutatingWebhookTimeoutSeconds | The timeout for the mutating webhook in seconds | `3` | | mutatingWebhookCustomRules | Custom rules for selecting which API resources trigger the webhook. NOTE: If you change this, ensure all your constraints are still being enforced. | `{}` | -| mutatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'services/proxy', 'nodes/proxy', 'services/status']` | +| mutatingWebhookSubResources | Rule for selecting which API subresources trigger the webhook. | `['namespaces/finalize', 'pods/ephemeralcontainers', 'pods/exec', 'pods/log', 'pods/eviction', 'pods/portforward', 'pods/proxy', 'pods/attach', 'pods/binding', 'pods/resize', 'deployments/scale', 'replicasets/scale', 'statefulsets/scale', 'replicationcontrollers/scale', 'serviceaccounts/token', 'services/proxy', 'nodes/proxy', 'certificatesigningrequests/approval', 'services/status']` | | mutatingWebhookURL | Custom URL for Kubernetes API server to use to reach the mutating webhook pod. If not set, the default of connecting via the kubernetes service endpoint is used. | `null` | | mutatingWebhookScope | The scope for the mutating webhook. Does not work with `mutatingWebhookCustomRules` | `*` | | additionalMutatingWebhookConfigsToRotateCerts | The name of additional `MutatingWebhookConfiguration`s that the gatekeeper cert rotator should manage certs for | `[]` | diff --git a/manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml b/manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml index d21aa8f8b94..7beaaeca869 100644 --- a/manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml +++ b/manifest_staging/charts/gatekeeper/templates/gatekeeper-validating-webhook-configuration-validatingwebhookconfiguration.yaml @@ -76,7 +76,7 @@ webhooks: resources: - '*' # Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper). - # You can find a rough list of subresources by doing a case-sensitive search in the Kubernetes codebase for 'Subresource("' + # You can find the current list of subresources in the Kubernetes API discovery data. {{- range .Values.validatingWebhookSubResources }} - {{ . }} {{- end }} diff --git a/manifest_staging/charts/gatekeeper/values.yaml b/manifest_staging/charts/gatekeeper/values.yaml index e51b4a1e804..b5d76b63bd1 100644 --- a/manifest_staging/charts/gatekeeper/values.yaml +++ b/manifest_staging/charts/gatekeeper/values.yaml @@ -19,6 +19,7 @@ validatingWebhookCheckIgnoreFailurePolicy: Fail validatingWebhookCustomRules: {} validatingWebhookSubResources: [ + "namespaces/finalize", "pods/ephemeralcontainers", "pods/exec", "pods/log", @@ -32,8 +33,10 @@ validatingWebhookSubResources: "replicasets/scale", "statefulsets/scale", "replicationcontrollers/scale", + "serviceaccounts/token", "services/proxy", "nodes/proxy", + "certificatesigningrequests/approval", "services/status", ] validatingWebhookURL: null @@ -55,6 +58,7 @@ mutatingWebhookTimeoutSeconds: 1 mutatingWebhookCustomRules: {} mutatingWebhookSubResources: [ + "namespaces/finalize", "pods/ephemeralcontainers", "pods/exec", "pods/log", @@ -63,12 +67,15 @@ mutatingWebhookSubResources: "pods/proxy", "pods/attach", "pods/binding", + "pods/resize", "deployments/scale", "replicasets/scale", "statefulsets/scale", "replicationcontrollers/scale", + "serviceaccounts/token", "services/proxy", "nodes/proxy", + "certificatesigningrequests/approval", "services/status", ] mutatingWebhookURL: null diff --git a/manifest_staging/deploy/gatekeeper.yaml b/manifest_staging/deploy/gatekeeper.yaml index 2b3edb3cb41..2c194105a77 100644 --- a/manifest_staging/deploy/gatekeeper.yaml +++ b/manifest_staging/deploy/gatekeeper.yaml @@ -6118,6 +6118,25 @@ webhooks: - UPDATE resources: - '*' + - namespaces/finalize + - pods/ephemeralcontainers + - pods/exec + - pods/log + - pods/eviction + - pods/portforward + - pods/proxy + - pods/attach + - pods/binding + - pods/resize + - deployments/scale + - replicasets/scale + - statefulsets/scale + - replicationcontrollers/scale + - serviceaccounts/token + - services/proxy + - nodes/proxy + - certificatesigningrequests/approval + - services/status sideEffects: None timeoutSeconds: 1 --- @@ -6157,6 +6176,7 @@ webhooks: - UPDATE resources: - '*' + - namespaces/finalize - pods/ephemeralcontainers - pods/exec - pods/log @@ -6170,8 +6190,10 @@ webhooks: - replicasets/scale - statefulsets/scale - replicationcontrollers/scale + - serviceaccounts/token - services/proxy - nodes/proxy + - certificatesigningrequests/approval - services/status sideEffects: None timeoutSeconds: 3 diff --git a/pkg/controller/externaldata/stats_reporter.go b/pkg/controller/externaldata/stats_reporter.go index 31880361748..5a6688e19b6 100644 --- a/pkg/controller/externaldata/stats_reporter.go +++ b/pkg/controller/externaldata/stats_reporter.go @@ -76,10 +76,10 @@ func (r *reporter) reportProviderError(_ context.Context) { } type reporter struct { - mu sync.RWMutex - cache map[types.NamespacedName]metrics.Status - dirty bool - statusReport map[metrics.Status]int64 + mu sync.RWMutex + cache map[types.NamespacedName]metrics.Status + dirty bool + statusReport map[metrics.Status]int64 providerErrorTotal atomic.Int64 } diff --git a/pkg/mutation/system_external_data.go b/pkg/mutation/system_external_data.go index 9b7f11c8595..3eac8b3d597 100644 --- a/pkg/mutation/system_external_data.go +++ b/pkg/mutation/system_external_data.go @@ -104,11 +104,11 @@ func (s *System) sendRequests(ctx context.Context, providerKeys map[string]sets. defer mutex.Unlock() if err != nil { - errors[provider.Name] = fmt.Errorf("failed to send external data request to provider %s: %w", provider.Name, err) + errors[provider.Name] = fmt.Errorf("failed to send external data request to provider %s: %w", provider.Name, err) return } if err := validateExternalDataResponse(resp); err != nil { - errors[provider.Name] = fmt.Errorf("failed to validate external data response from provider %s: %w", provider.Name, err) + errors[provider.Name] = fmt.Errorf("failed to validate external data response from provider %s: %w", provider.Name, err) return } diff --git a/pkg/webhook/mutation.go b/pkg/webhook/mutation.go index d403e097ad5..b2e588a1b78 100644 --- a/pkg/webhook/mutation.go +++ b/pkg/webhook/mutation.go @@ -50,7 +50,9 @@ func init() { } } -// +kubebuilder:webhook:verbs=create;update,path=/v1/mutate,mutating=true,failurePolicy=ignore,groups=*,resources=*,versions=*,name=mutation.gatekeeper.sh,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact +// Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper). Keep the existing "services/status" exception consistent with validation. +// You can find the current list of subresources in the Kubernetes API discovery data. +// +kubebuilder:webhook:verbs=create;update,path=/v1/mutate,mutating=true,failurePolicy=ignore,groups=*,resources=*;namespaces/finalize;pods/ephemeralcontainers;pods/exec;pods/log;pods/eviction;pods/portforward;pods/proxy;pods/attach;pods/binding;pods/resize;deployments/scale;replicasets/scale;statefulsets/scale;replicationcontrollers/scale;serviceaccounts/token;services/proxy;nodes/proxy;certificatesigningrequests/approval;services/status,versions=*,name=mutation.gatekeeper.sh,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact // +kubebuilder:rbac:resourceNames=gatekeeper-mutating-webhook-configuration,groups=admissionregistration.k8s.io,resources=mutatingwebhookconfigurations,verbs=get;list;watch;update;patch // AddMutatingWebhook registers the mutating webhook server with the manager. diff --git a/pkg/webhook/policy.go b/pkg/webhook/policy.go index 0de494b2818..01ad977ac6f 100644 --- a/pkg/webhook/policy.go +++ b/pkg/webhook/policy.go @@ -84,8 +84,8 @@ func init() { } // Explicitly list all known subresources except "status" (to avoid destabilizing the cluster and increasing load on gatekeeper). But include "services/status" for constraints that mitigate CVE-2020-8554. -// You can find a rough list of subresources by doing a case-sensitive search in the Kubernetes codebase for 'Subresource("' -// +kubebuilder:webhook:verbs=create;update,path=/v1/admit,mutating=false,failurePolicy=ignore,groups=*,resources=*;pods/ephemeralcontainers;pods/exec;pods/log;pods/eviction;pods/portforward;pods/proxy;pods/attach;pods/binding;pods/resize;deployments/scale;replicasets/scale;statefulsets/scale;replicationcontrollers/scale;services/proxy;nodes/proxy;services/status,versions=*,name=validation.gatekeeper.sh,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact +// You can find the current list of subresources in the Kubernetes API discovery data. +// +kubebuilder:webhook:verbs=create;update,path=/v1/admit,mutating=false,failurePolicy=ignore,groups=*,resources=*;namespaces/finalize;pods/ephemeralcontainers;pods/exec;pods/log;pods/eviction;pods/portforward;pods/proxy;pods/attach;pods/binding;pods/resize;deployments/scale;replicasets/scale;statefulsets/scale;replicationcontrollers/scale;serviceaccounts/token;services/proxy;nodes/proxy;certificatesigningrequests/approval;services/status,versions=*,name=validation.gatekeeper.sh,sideEffects=None,admissionReviewVersions=v1;v1beta1,matchPolicy=Exact // +kubebuilder:rbac:groups=*,resources=*,verbs=get;list;watch // AddPolicyWebhook registers the policy webhook server with the manager.