fix: do a audit run when we deploy #1901
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
grosser
changed the title
Signed-off-by: Michael Grosser <michael@grosser.it>
Codecov Report
@@ Coverage Diff @@
## master #1901 +/- ##
==========================================
- Coverage 52.28% 52.09% -0.20%
==========================================
Files 100 100
Lines 8952 8958 +6
==========================================
- Hits 4681 4667 -14
- Misses 3898 3914 +16
- Partials 373 377 +4
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
|
@grosser Thanks for the PR! |
davis-haba
pushed a commit
to davis-haba/gatekeeper
that referenced
this pull request
Mar 14, 2022
Signed-off-by: Michael Grosser <michael@grosser.it> Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Co-authored-by: Rita Zhang <rita.z.zhang@gmail.com> Signed-off-by: davis-haba <davishaba@google.com>
willbeason
pushed a commit
that referenced
this pull request
Mar 16, 2022
* Cache namespaces in targethandler Signed-off-by: davis-haba <davishaba@google.com> * chore: bump actions/checkout from 2 to 3 (#1888) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: davis-haba <davishaba@google.com> * fix uninstall version typo (#1890) Signed-off-by: Avinash Desireddy <avinashr.desireddy@gmail.com> Signed-off-by: davis-haba <davishaba@google.com> * chore: Remove unneeded spaces in helm chart (#1885) Signed-off-by: Manuel Rüger <manuel@rueg.eu> Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Signed-off-by: davis-haba <davishaba@google.com> * chore: bump @docusaurus/core from 2.0.0-beta.16 to 2.0.0-beta.17 in /website (#1892) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: davis-haba <davishaba@google.com> * chore: bump @docusaurus/preset-classic from 2.0.0-beta.16 to 2.0.0-beta.17 in /website (#1893) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: davis-haba <davishaba@google.com> * docs: add instructions on how to use tilt for development (#1895) Signed-off-by: davis-haba <davishaba@google.com> * test: Fix `BenchmarkValidationHandler` was broken (#1896) Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Signed-off-by: davis-haba <davishaba@google.com> * Integration test for referential data in `gator test` (#1899) Signed-off-by: juliankatz <juliankatz@google.com> Signed-off-by: davis-haba <davishaba@google.com> * test: Fix `BenchmarkModifySetMutator_Mutate` was broken (#1897) Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Signed-off-by: davis-haba <davishaba@google.com> * gofmt target.go Signed-off-by: davis-haba <davishaba@google.com> * Add type assertion when pulling namespace from cache Signed-off-by: davis-haba <davishaba@google.com> * Do not use pointers for nsCache and RWLock when not necessary Signed-off-by: davis-haba <davishaba@google.com> * return error when unsuccesful reading from nscache Signed-off-by: davis-haba <davishaba@google.com> * Revert "return error when unsuccesful reading from nscache" This reverts commit 95bab77. Signed-off-by: davis-haba <davishaba@google.com> * Add tests for nsCache Signed-off-by: davis-haba <davishaba@google.com> * remove unused helpers in target_test.go Signed-off-by: davis-haba <davishaba@google.com> * remove commented code Signed-off-by: davis-haba <davishaba@google.com> * gofumpt target.go and target_test.go Signed-off-by: davis-haba <davishaba@google.com> * re-add accidently deleted test Signed-off-by: davis-haba <davishaba@google.com> * add helpers to original code location to clean up diff Signed-off-by: davis-haba <davishaba@google.com> * gofumpt target.go Signed-off-by: davis-haba <davishaba@google.com> * Add remove cache tests. Change nsCache.Get/Add API to take a namespace instead of interface. Properly wrap caching errors Signed-off-by: davis-haba <davishaba@google.com> * namespace cache tests verifies extranious elements do not exist Signed-off-by: davis-haba <davishaba@google.com> * increment with ++ instead of += Signed-off-by: davis-haba <davishaba@google.com> * Replace deprecated Ingress with new Ingress (#1906) Signed-off-by: Zhimin Xiang <zhiminx@google.com> Signed-off-by: davis-haba <davishaba@google.com> * do a audit run when we deploy (#1901) Signed-off-by: Michael Grosser <michael@grosser.it> Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Co-authored-by: Rita Zhang <rita.z.zhang@gmail.com> Signed-off-by: davis-haba <davishaba@google.com> * Do not add to cache within targethandler Signed-off-by: davis-haba <davishaba@google.com> * use gkReq.Namespace as key when writing to cache Signed-off-by: davis-haba <davishaba@google.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Avinash Desireddy <47186096+avinashdesireddy@users.noreply.github.com> Co-authored-by: Manuel Rüger <manuel@rueg.eu> Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Co-authored-by: Ernest Wong <chuwon@microsoft.com> Co-authored-by: Huang Huang <mozillazg101@gmail.com> Co-authored-by: Julian Katz <juliankatz@google.com> Co-authored-by: Zhimin Xiang <zhiminx@google.com> Co-authored-by: Michael Grosser <michael@grosser.it> Co-authored-by: Rita Zhang <rita.z.zhang@gmail.com> Co-authored-by: Will Beason <willbeason@google.com>
|
need to revert this or someone needs to debug what is going on with #1927 |
maxsmythe
added a commit
to maxsmythe/gatekeeper
that referenced
this pull request
Mar 23, 2022
Reverting due to open-policy-agent#1927 This reverts commit a3d8a0d. Signed-off-by: Max Smythe <smythe@google.com>
ritazh
pushed a commit
that referenced
this pull request
Mar 23, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
when we deploy we have to wait 15 min to get a new audit, that is a long time to wait and means that our feedback loop for "you deployed something bad" does not kick in fast enough and causes 15min of pain to our end-users if a new constraint was bad (we deploy web+audit together)
so fix this by running the audit once on start
ticker does not have an option to do an initial runs as per golang/go#17601
/cc @ritazh @sozercan @ctab