Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add support for emit k8s events for allowed requests #3440

Closed
wants to merge 1 commit into from

Conversation

DorB-P
Copy link
Contributor

@DorB-P DorB-P commented Jul 3, 2024

What this PR does / why we need it:

[ v ] Emit K8s events in gatekeeper namespace (or involved namespace if corresponding flag is on).
[ v ] Update helm flag name of emitAdmissionEvents to emitDenyAdmissionEvents
[ v ] Update e2e to get events with the AllowedAdmission reason
[ v ] Update deployment yaml and chart default emit-allow-admission-events and emit-deny-admission-events to false
[ v ] Update Makefile to enable emit-allow-admission-events and updated emit-admission-events to emit-deny-admission-events
[ v ] Update docs with a new AllowedAdmission reason

Which issue this PR fixes:
This is functionality I want as someone deploying GK with Helm. This helps me monitor the admissions and validate my policies in a similar manner to how OPA decision-logs work.

Special notes for your reviewer:
The idea for the PR derived from #739 and plenty of issues asking about decision logs (such as #1037 )
Sample event outputs for reason AllowedAdmission

kubectl get event -n gatekeeper-system  
                                                                                                                              
LAST SEEN   TYPE      REASON              OBJECT                                   MESSAGE
7m41s         Normal   AllowedAdmission   pod/privileged-nginx   Admission webhook "validation.gatekeeper.sh" allowed request, Resource Namespace: default

@codecov-commenter
Copy link

codecov-commenter commented Jul 3, 2024

Codecov Report

Attention: Patch coverage is 7.40741% with 25 lines in your changes missing coverage. Please review.

Project coverage is 46.63%. Comparing base (3350319) to head (7ac8783).
Report is 86 commits behind head on master.

Files Patch % Lines
pkg/webhook/policy.go 7.40% 22 Missing and 3 partials ⚠️

❗ There is a different number of reports uploaded between BASE (3350319) and HEAD (7ac8783). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (3350319) HEAD (7ac8783)
unittests 2 1
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3440      +/-   ##
==========================================
- Coverage   54.49%   46.63%   -7.86%     
==========================================
  Files         134      218      +84     
  Lines       12329    14805    +2476     
==========================================
+ Hits         6719     6905     +186     
- Misses       5116     7094    +1978     
- Partials      494      806     +312     
Flag Coverage Δ
unittests 46.63% <7.40%> (-7.86%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@DorB-P DorB-P marked this pull request as ready for review July 3, 2024 12:43
@DorB-P DorB-P requested a review from a team as a code owner July 3, 2024 12:43
@DorB-P
Copy link
Contributor Author

DorB-P commented Jul 8, 2024

Closing. We mentioned emitAllowedAdmissionEvents should be repleaced with an array of interesting kinds. May work on this at a later stage

@DorB-P DorB-P closed this Jul 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants