Changelog💣
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[1.4.0-bb.9]💣
Changed💣
- Removed mTLS exception
[1.4.0-bb.8]💣
Updated💣
- Fixed dashboard check in cypress test
[1.4.0-bb.7]💣
Updated💣
- PrometheusRule resource for OPA constraint alerts
[1.4.0-bb.6]💣
Updated💣
- Cypress test now checks the table with the list of violations and the “violations by kind” bar chart for a “no data” message.
[1.4.0-bb.5]💣
Added💣
- added securityContext: capabilities: drop: ALL
- Updated gluon to 0.2.10
[1.4.0-bb.4]💣
Changed💣
- Updated securityContext user and group to nonroot
[1.4.0-bb.3]💣
Changed💣
- Fixed typo in OSCAL document
[1.4.0-bb.2]💣
Added💣
- CI tests to verify violations index
[1.4.0-bb.1]💣
Added💣
- Added Tempo Zipkin Egress Policy
[1.4.0-bb.0]💣
Added💣
- New Kptfile to follow other package version of kpt
Changed💣
- Image version to v0.0.4
- App version to 0.0.4
[1.3.0-bb.1]💣
Added💣
- Added peerauthentication/mtls support with istio
[1.3.0-bb.0]💣
Added💣
- Added OSCAL component for Cluster Auditor
[1.2.0-bb.1]💣
Changed💣
- Update Chart.yaml to follow new standardization for release automation
- Added renovate check to update new standardization
[1.2.0-bb.0]💣
Changed💣
- Updated docs to reflect new cluster auditor architecture
[1.1.1-bb.0]💣
Changed💣
- Fixed template error for Istio annotation in BigBang
[1.1.0-bb.0]💣
Changed💣
- Add Istio annotation
[1.0.3-bb.0]💣
Changed💣
- Moved bbtest values from test-values.yaml into values.yaml to allow for overrides
[1.0.2-bb.0]💣
Changed💣
- Added networkpolicies to support istio sidecars
- Updated ports/servicemonitor to support scraping metrics properly
[1.0.1-bb.0]💣
Changed💣
- fixed duplicate app.kubernetes/version
[1.0.0-bb.0]💣
Added💣
- Created a new namespace cluster auditor.
- Added opa exporter.
- Added grafana dashboard.
- Removed the old cluster auditor.
[0.3.0-bb.7]💣
Changed💣
- fixed duplicate nodeselector in deployment template.
[0.3.0-bb.6]💣
Changed💣
- Updated config to align watched resources with latest OPA Gatekeeper names
- Turned off apparmor violation in defaults
- Removed unique service selector in defaults
[0.3.0-bb.5]💣
Changed💣
- Switched away from the (unmaintained and oddly behaving) jq fluentd filter.
- Now using the exec_filter to execute jq directly.
- Added in an additional filter to avoid getting duplicates stored to elastic–elasticsearch_genid
[0.3.0-bb.4]💣
Added💣
- Updated Network Policy to allow Openshift DNS Egress
[0.3.0-bb.3]💣
Added💣
- Added Network Policy for Istio Sidecar metrics.
[0.3.0-bb.2]💣
Added💣
- Condititional statement to chart/templates/bigbang/network-policies/kube-system-allow-egress.yaml based on if networkPolicies is enabled.
[0.3.0-bb.1]💣
Changed💣
- Updated configmap to collect
noDefaultServiceAccount
violations.
[0.3.0-bb.0]💣
Removed💣
- Moved all constraints out of cluster-auditor and into OPA gatekeeper package.
- Moved all constraint tests out of cluster-auditor and into OPA gatekeeper package.
[0.2.0-bb.6]💣
Added💣
- Helm function in API Egress Network Policy Template to avoid crashes when non 0.0.0.0/0 CIDR is specified
[0.2.0-bb.5]💣
Added💣
- networkPolicies.enabled toggle to chart values.
- network policy resource templates to cover the following:
- allow in namespace ingress/egress (with release.name appended, otherwise will overlap with existing NP in logging Release namespace)
- allow egress to kube-api and kube-dns ports 443 and 53 respectively.
- allow ingress from opa-collector pod to elasticsearch labeled pods
[0.2.0-bb.4]💣
Added💣
- Added CI test for constraints
- Added Bad k8s objects for testing
- Added Good k8s objects for testing
- Updated helper scripts
[0.2.0-bb.3]💣
Added💣
- Added constraints: K8sImageDigests, K8sUniqueServiceSelector, K8sPSPAllowPrivilegeEscalationContainer, K8sPSPPrvilegedContainer, K8sPSPHostNetworkingPorts, K8sPSPSeccomp, K8sPSPReadOnlyRootFilesystem, K8sPSPSELinuxV2, and K8sContainerRatios.
- Common labels added to all resources
- Metadata for constraints added as annotations to all constrains
Changed💣
- Standardized all constraints for
match
andparameters
values
Fixed💣
- Fixed minor bugs in OPA Gatekeeper configuration to watch PSPAllowPrivilegeEscalationContainer, PSPFlexVolumes, and ContainerLimits
[0.2.0-bb.2]💣
Added💣
- added configmap for new constraint
[0.2.0-bb.1]💣
Added💣
- Added more constraints
[0.2.0-bb.0]💣
Added💣
- Added more constraints, and modified values file.
[0.1.8-bb.2]💣
Added💣
- Affinity and node selector values passthroughs added, documented
Last update:
2022-09-05 by Micah Nagel