dev to alpha #8520

k8s-on-aws-manager-app · 2024-11-08T13:03:16Z

Register generic admitter for write protection behind a feature flag (#⁠8519) - minor Minor changes, e.g. low risk config updates, changes that do not introduce a new API call.
update deployment-service components (#⁠8514) - bugfix Bug fixes and patches, e.g. fixing of a production issue that is affecting the customer experience.
make kube-janitor opt-in for production clusters (#⁠8524) - minor Minor changes, e.g. low risk config updates, changes that do not introduce a new API call.
update role-sync-controller and use CLI parameters for subjects (#⁠8528) - minor Minor changes, e.g. low risk config updates, changes that do not introduce a new API call.
[e2e] Refactor RBAC tests to use client-go instead of raw HTTP (#⁠8532) - major Major feature changes or updates, e.g. feature rollout to a new country, new API calls.
[RBAC] drop secret read permission from poweruser ClusterRole (#⁠8537) - minor Minor changes, e.g. low risk config updates, changes that do not introduce a new API call.
[e2e] Improvements on the RBAC e2es (#⁠8536) - minor Minor changes, e.g. low risk config updates, changes that do not introduce a new API call.
[e2e] Skip authz test for access handled by admission-controller (#⁠8539) - minor Minor changes, e.g. low risk config updates, changes that do not introduce a new API call.
Update custom metrics image to work with ipv6 (#⁠8541) - bugfix Bug fixes and patches, e.g. fixing of a production issue that is affecting the customer experience.

Register generic admitter for write protection behind a feature flag

…vice update deployment-service components

…roduction

make kube-janitor opt-in for production clusters

…roller update role-sync-controller and use CLI parameters for subjects

… from testCaseData

We now match each SubjectAccessReview object with the expected result. We then populate a list of all those that didn't meet expectation. If a test fails, we use the String() function on the testCaseOutput to print all these violating SARs. If there are not such SARs, we consider the test passed.

… e2e

[e2e] Refactor RBAC tests to use client-go instead of raw HTTP

Refactor allNamespaces as a global slice Add clarification comments on the global slices Replace all instances of "resource not a secret" with a wider list of namespacedResources

[RBAC] drop secret read permission from poweruser ClusterRole

[e2e] Improvements on the RBAC e2es

…mergency groups

Signed-off-by: Mikkel Oscar Lyderik Larsen <[email protected]>

[e2e] Skip authz test for access handled by admission-controller

…ler-e2e Update custom metrics image to work with ipv6

linki and others added 3 commits November 8, 2024 11:14

register generic admitter for write protection behind a feature flag

4b51864

Merge pull request #8519 from zalando-incubator/write-protection

aa7f9e5

Register generic admitter for write protection behind a feature flag

Merge dev to dev-to-alpha

bc60ef8

k8s-on-aws-manager-app bot added updates/master-nodes updates/defaults minor Minor changes, e.g. low risk config updates, changes that do not introduce a new API call. labels Nov 8, 2024

demonCoder95 and others added 5 commits November 8, 2024 15:25

update deployment-service

03da97b

make kube-janitor opt-in for production clusters

1664dbc

fix templating

c009bbe

Merge pull request #8514 from zalando-incubator/update-deployment-ser…

fa229df

…vice update deployment-service components

Merge dev to dev-to-alpha

fd551cd

k8s-on-aws-manager-app bot added the bugfix Bug fixes and patches, e.g. fixing of a production issue that is affecting the customer experience. label Nov 8, 2024

demonCoder95 and others added 18 commits November 11, 2024 11:24

add note of caution on the config-item that enables kube-janitor in p…

60eb9d8

…roduction

Merge pull request #8524 from zalando-incubator/kube-janitor-config

edddb61

make kube-janitor opt-in for production clusters

Merge dev to dev-to-alpha

8d11e8f

update role-sync-controller and use CLI parameters for subjects

58f691a

use correct image from production registry

6bf4d6c

Merge pull request #8528 from zalando-incubator/update-role-sync-cont…

8d759de

…roller update role-sync-controller and use CLI parameters for subjects

Merge dev to dev-to-alpha

9fba4e2

add the rbac test suite description

80b7ff1

add rbac e2e utils

7ed7c87

setup the testing interface between test cases and utils backend

e1040a7

implement logic to evaluate output of a testcase

d3c1578

add logic to expand into resourceAttributes and nonResourceAttributes…

6bfbe46

… from testCaseData

enable role-sync-controller

183cff9

add test cases for ReadOnly group

21d9068

resolve TODO about handling subresources

b845d03

fix bug in resource attribute expansion

a53f942

add test cases for PowerUser, Manual and Emergency groups

0566c2a

demonCoder95 and others added 6 commits November 22, 2024 02:59

cleanup pretty printing, add a comment

66e2269

fix test cases

06b4c4f

remove write e2e tests that are to be covered by admission-controller…

2b71b45

… e2e

enable role-sync-controller by default only on EKS

444b75a

Merge pull request #8532 from zalando-incubator/refactor-rbac-e2e

0b3171b

[e2e] Refactor RBAC tests to use client-go instead of raw HTTP

Merge dev to dev-to-alpha

062debe

k8s-on-aws-manager-app bot added the major Major feature changes or updates, e.g. feature rollout to a new country, new API calls. label Nov 22, 2024

demonCoder95 and others added 23 commits November 22, 2024 18:51

use global slices for verbs and resources

1b13def

re-introduce write protection test cases and add skip rules for them

6f7f8c9

combine default service-account test cases

4eba59b

add new tests for credentials-provider user

39e6e18

add test case for secret write access for administrators

04827d6

Unify read and write test cases into a single and other nits

1646c06

Refactor allNamespaces as a global slice Add clarification comments on the global slices Replace all instances of "resource not a secret" with a wider list of namespacedResources

drop secret read permission from poweruser ClusterRole

cba3a81

add secret reading permisisons to collaborator Roles

c8b3679

fix default namespace and pv as global resource

4962df7

test that poweruser can also read secrets in non-system namespaces

19b2daf

make RBAC changes only when role-sync-controller is enabled

6bda2f6

remove persistentvolumes from global resource slice

cbce361

Merge pull request #8537 from zalando-incubator/drop-secret-read

f94d6df

[RBAC] drop secret read permission from poweruser ClusterRole

handle skipped tests better

acd2bdf

Merge dev to dev-to-alpha

bf90f0a

Merge pull request #8536 from zalando-incubator/review-nits-rbac-e2e

fd4ff9f

[e2e] Improvements on the RBAC e2es

Merge dev to dev-to-alpha

b7eb73d

skip test for delete deny for system namespace for poweruser,manual,e…

3931435

…mergency groups

Update custom metrics image to work with ipv6

27dcc32

Signed-off-by: Mikkel Oscar Lyderik Larsen <[email protected]>

Merge pull request #8539 from zalando-incubator/remove-test

2649d9d

[e2e] Skip authz test for access handled by admission-controller

Merge dev to dev-to-alpha

2c44092

Merge pull request #8541 from zalando-incubator/update-custom-autosca…

b077696

…ler-e2e Update custom metrics image to work with ipv6

Merge dev to dev-to-alpha

934eef5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dev to alpha #8520

dev to alpha #8520

k8s-on-aws-manager-app bot commented Nov 8, 2024 •

edited

Loading

dev to alpha #8520

Are you sure you want to change the base?

dev to alpha #8520

Conversation

k8s-on-aws-manager-app bot commented Nov 8, 2024 • edited Loading

k8s-on-aws-manager-app bot commented Nov 8, 2024 •

edited

Loading