diff --git a/Makefile b/Makefile index de168c33..8b13c6a4 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ NAME := popeye PACKAGE := github.com/derailed/$(NAME) -VERSION := v0.11.0 +VERSION := v0.11.1 GIT := $(shell git rev-parse --short HEAD) DATE := $(shell date +%FT%T%Z) IMG_NAME := derailed/popeye diff --git a/change_logs/release_v0.11.0.md b/change_logs/release_v0.11.0.md index 6e313cfb..b63f7b27 100644 --- a/change_logs/release_v0.11.0.md +++ b/change_logs/release_v0.11.0.md @@ -18,16 +18,16 @@ Also if you dig this tool, please make some noise on social! [@kitesurfer](https ## Contributed PRs -Please give `Big Thanks!` and `ATTA Girls/Boys!` to all the fine contributors for making K9s better for all of us!! - -* [PR #243](https://github.com/derailed/k9s/pull/243) Invalid value for --force-exit-zero -* [PR #241](https://github.com/derailed/k9s/pull/241) Add a non-root user in docker image -* [PR #240](https://github.com/derailed/k9s/pull/240) Optimize README documents -* [PR #238](https://github.com/derailed/k9s/pull/238) Add arm64 Darwin releases to krew-index -* [PR #233](https://github.com/derailed/k9s/pull/233) Add go install option to readme -* [PR #226](https://github.com/derailed/k9s/pull/226) Fixing CVE issue for client_golang 1.11.0 to 1.12.2 -* [PR #224](https://github.com/derailed/k9s/pull/224) Add check for pods that are managed by multiple pdbs -* [PR #222](https://github.com/derailed/k9s/pull/222) Fix RBAC rules in README.md +Please give `Big Thanks!` and `ATTA Girls/Boys!` to all the fine contributors for making Popeye better for all of us!! + +* [PR #243](https://github.com/derailed/popeye/pull/243) Invalid value for --force-exit-zero +* [PR #241](https://github.com/derailed/popeye/pull/241) Add a non-root user in docker image +* [PR #240](https://github.com/derailed/popeye/pull/240) Optimize README documents +* [PR #238](https://github.com/derailed/popeye/pull/238) Add arm64 Darwin releases to krew-index +* [PR #233](https://github.com/derailed/popeye/pull/233) Add go install option to readme +* [PR #226](https://github.com/derailed/popeye/pull/226) Fixing CVE issue for client_golang 1.11.0 to 1.12.2 +* [PR #224](https://github.com/derailed/popeye/pull/224) Add check for pods that are managed by multiple pdbs +* [PR #222](https://github.com/derailed/popeye/pull/222) Fix RBAC rules in README.md --- diff --git a/change_logs/release_v0.11.1.md b/change_logs/release_v0.11.1.md new file mode 100644 index 00000000..9d0f5a69 --- /dev/null +++ b/change_logs/release_v0.11.1.md @@ -0,0 +1,33 @@ + + +# Release v0.11.1 + +## Notes + +Thank you to all that contributed with flushing out issues and enhancements for Popeye! I'll try to mark some of these issues as fixed. But if you don't mind grab the latest rev and see if we're happier with some of the fixes! If you've filed an issue please help me verify and close. Your support, kindness and awesome suggestions to make Popeye better is as ever very much noticed and appreciated! + +This project offers a GitHub Sponsor button (over here 👆). As you well know this is not pimped out by big corps with deep pockets. If you feel `Popeye` is saving you cycles diagnosing potential cluster issues please consider sponsoring this project!! It does go a long way in keeping our servers lights on and beers in our fridge. + +Also if you dig this tool, please make some noise on social! [@kitesurfer](https://twitter.com/kitesurfer) + +--- + +## Maintenance Release! + +--- + +## Resolved Issues + +* [Issue #245](https://github.com/derailed/popeye/issues/245) Checking Kubernetes clusters fails because v1/PodSecurityPolicy is checked + +--- + +## Contributed Issues + +Please give `Big Thanks!` and `ATTA Girls/Boys!` to all the fine contributors for making Popeye better for all of us!! + +* [PR #247](https://github.com/derailed/popeye/pull/247) Fix deprecated cronjob api + +--- + +  © 2023 Imhotep Software LLC. All materials licensed under [Apache v2.0](http://www.apache.org/licenses/LICENSE-2.0) diff --git a/cmd/root.go b/cmd/root.go index 45b78c6f..aee1c5b1 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -64,8 +64,7 @@ func doIt(cmd *cobra.Command, args []string) { }() clearScreen() - err := checkFlags() - if err != nil { + if err := checkFlags(); err != nil { bomb(fmt.Sprintf("%v", err)) } flags.StandAlone = true diff --git a/internal/cache/pdb.go b/internal/cache/pdb.go index 447b34ef..8189908a 100644 --- a/internal/cache/pdb.go +++ b/internal/cache/pdb.go @@ -1,7 +1,7 @@ package cache import ( - polv1beta1 "k8s.io/api/policy/v1beta1" + policyv1 "k8s.io/api/policy/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) @@ -10,21 +10,21 @@ const PodDisruptionBudgetKey = "pdb" // PodDisruptionBudget represents PodDisruptionBudget cache. type PodDisruptionBudget struct { - cms map[string]*polv1beta1.PodDisruptionBudget + cms map[string]*policyv1.PodDisruptionBudget } // NewPodDisruptionBudget returns a new PodDisruptionBudget cache. -func NewPodDisruptionBudget(cms map[string]*polv1beta1.PodDisruptionBudget) *PodDisruptionBudget { +func NewPodDisruptionBudget(cms map[string]*policyv1.PodDisruptionBudget) *PodDisruptionBudget { return &PodDisruptionBudget{cms: cms} } // ListPodDisruptionBudgets returns all available PodDisruptionBudgets on the cluster. -func (c *PodDisruptionBudget) ListPodDisruptionBudgets() map[string]*polv1beta1.PodDisruptionBudget { +func (c *PodDisruptionBudget) ListPodDisruptionBudgets() map[string]*policyv1.PodDisruptionBudget { return c.cms } // ForLabels returns a pdb whose selector match the given labels. Returns nil if no match. -func (c *PodDisruptionBudget) ForLabels(labels map[string]string) *polv1beta1.PodDisruptionBudget { +func (c *PodDisruptionBudget) ForLabels(labels map[string]string) *policyv1.PodDisruptionBudget { for _, pdb := range c.ListPodDisruptionBudgets() { m, err := metav1.LabelSelectorAsMap(pdb.Spec.Selector) if err != nil { diff --git a/internal/dag/pdb.go b/internal/dag/pdb.go index 0ebe2668..414a3e6e 100644 --- a/internal/dag/pdb.go +++ b/internal/dag/pdb.go @@ -6,24 +6,24 @@ import ( "github.com/derailed/popeye/internal/client" "github.com/derailed/popeye/internal/dao" - polv1beta1 "k8s.io/api/policy/v1beta1" + policyv1 "k8s.io/api/policy/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime" ) // ListPodDisruptionBudgets list all included PodDisruptionBudgets. -func ListPodDisruptionBudgets(ctx context.Context) (map[string]*polv1beta1.PodDisruptionBudget, error) { +func ListPodDisruptionBudgets(ctx context.Context) (map[string]*policyv1.PodDisruptionBudget, error) { return listAllPodDisruptionBudgets(ctx) } // ListAllPodDisruptionBudgets fetch all PodDisruptionBudgets on the cluster. -func listAllPodDisruptionBudgets(ctx context.Context) (map[string]*polv1beta1.PodDisruptionBudget, error) { +func listAllPodDisruptionBudgets(ctx context.Context) (map[string]*policyv1.PodDisruptionBudget, error) { ll, err := fetchPodDisruptionBudgets(ctx) if err != nil { return nil, err } - pdbs := make(map[string]*polv1beta1.PodDisruptionBudget, len(ll.Items)) + pdbs := make(map[string]*policyv1.PodDisruptionBudget, len(ll.Items)) for i := range ll.Items { pdbs[metaFQN(ll.Items[i].ObjectMeta)] = &ll.Items[i] } @@ -32,25 +32,25 @@ func listAllPodDisruptionBudgets(ctx context.Context) (map[string]*polv1beta1.Po } // fetchPodDisruptionBudgets retrieves all PodDisruptionBudgets on the cluster. -func fetchPodDisruptionBudgets(ctx context.Context) (*polv1beta1.PodDisruptionBudgetList, error) { +func fetchPodDisruptionBudgets(ctx context.Context) (*policyv1.PodDisruptionBudgetList, error) { f, cfg := mustExtractFactory(ctx), mustExtractConfig(ctx) if cfg.Flags.StandAlone { dial, err := f.Client().Dial() if err != nil { return nil, err } - return dial.PolicyV1beta1().PodDisruptionBudgets(f.Client().ActiveNamespace()).List(ctx, metav1.ListOptions{}) + return dial.PolicyV1().PodDisruptionBudgets(f.Client().ActiveNamespace()).List(ctx, metav1.ListOptions{}) } var res dao.Resource - res.Init(f, client.NewGVR("policy/v1beta1/poddisruptionbudgets")) + res.Init(f, client.NewGVR("policy/v1/poddisruptionbudgets")) oo, err := res.List(ctx) if err != nil { return nil, err } - var ll polv1beta1.PodDisruptionBudgetList + var ll policyv1.PodDisruptionBudgetList for _, o := range oo { - var pdb polv1beta1.PodDisruptionBudget + var pdb policyv1.PodDisruptionBudget err = runtime.DefaultUnstructuredConverter.FromUnstructured(o.(*unstructured.Unstructured).Object, &pdb) if err != nil { return nil, errors.New("expecting pdb resource") diff --git a/internal/sanitize/pdb.go b/internal/sanitize/pdb.go index 25edaa41..20764f46 100644 --- a/internal/sanitize/pdb.go +++ b/internal/sanitize/pdb.go @@ -6,7 +6,7 @@ import ( "github.com/derailed/popeye/internal" "github.com/derailed/popeye/internal/issues" "github.com/rs/zerolog/log" - polv1beta1 "k8s.io/api/policy/v1beta1" + policyv1 "k8s.io/api/policy/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) @@ -20,7 +20,7 @@ type ( // PodDisruptionBudgetLister list available PodDisruptionBudgets on a cluster. PodDisruptionBudgetLister interface { PodLister - ListPodDisruptionBudgets() map[string]*polv1beta1.PodDisruptionBudget + ListPodDisruptionBudgets() map[string]*policyv1.PodDisruptionBudget } ) @@ -49,7 +49,7 @@ func (p *PodDisruptionBudget) Sanitize(ctx context.Context) error { return nil } -func (p *PodDisruptionBudget) checkDeprecation(ctx context.Context, pdb *polv1beta1.PodDisruptionBudget) { +func (p *PodDisruptionBudget) checkDeprecation(ctx context.Context, pdb *policyv1.PodDisruptionBudget) { const current = "policy/v1" fqn := internal.MustExtractFQN(ctx) @@ -65,7 +65,7 @@ func (p *PodDisruptionBudget) checkDeprecation(ctx context.Context, pdb *polv1be } } -func (p *PodDisruptionBudget) checkInUse(ctx context.Context, pdb *polv1beta1.PodDisruptionBudget) { +func (p *PodDisruptionBudget) checkInUse(ctx context.Context, pdb *policyv1.PodDisruptionBudget) { m, err := metav1.LabelSelectorAsMap(pdb.Spec.Selector) if err != nil { log.Error().Err(err).Msg("No selectors found") diff --git a/internal/sanitize/pdb_test.go b/internal/sanitize/pdb_test.go index c7cf05b0..fdc3b3bb 100644 --- a/internal/sanitize/pdb_test.go +++ b/internal/sanitize/pdb_test.go @@ -7,7 +7,7 @@ import ( "github.com/derailed/popeye/internal/issues" "github.com/stretchr/testify/assert" v1 "k8s.io/api/core/v1" - polv1beta1 "k8s.io/api/policy/v1beta1" + policyv1 "k8s.io/api/policy/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/util/intstr" ) @@ -65,8 +65,8 @@ func makePDBLister(opts pdbOpts) *pdb { } } -func (r *pdb) ListPodDisruptionBudgets() map[string]*polv1beta1.PodDisruptionBudget { - return map[string]*polv1beta1.PodDisruptionBudget{ +func (r *pdb) ListPodDisruptionBudgets() map[string]*policyv1.PodDisruptionBudget { + return map[string]*policyv1.PodDisruptionBudget{ cache.FQN("default", r.name): makePDB(r.name), } } @@ -84,14 +84,14 @@ func (r *pdb) GetPod(ns string, sel map[string]string) *v1.Pod { return makePod("p1") } -func makePDB(n string) *polv1beta1.PodDisruptionBudget { +func makePDB(n string) *policyv1.PodDisruptionBudget { min, max := intstr.FromInt(1), intstr.FromInt(1) - return &polv1beta1.PodDisruptionBudget{ + return &policyv1.PodDisruptionBudget{ ObjectMeta: metav1.ObjectMeta{ Name: n, Namespace: "default", }, - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{}, MinAvailable: &min, MaxUnavailable: &max, diff --git a/internal/sanitize/pod.go b/internal/sanitize/pod.go index 81bcf246..6706d561 100644 --- a/internal/sanitize/pod.go +++ b/internal/sanitize/pod.go @@ -13,7 +13,7 @@ import ( "github.com/derailed/popeye/internal/client" "github.com/derailed/popeye/internal/issues" v1 "k8s.io/api/core/v1" - polv1beta1 "k8s.io/api/policy/v1beta1" + policyv1 "k8s.io/api/policy/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" mv1beta1 "k8s.io/metrics/pkg/apis/metrics/v1beta1" ) @@ -39,8 +39,8 @@ type ( // PdbLister list pdb matching a given selector PdbLister interface { - ListPodDisruptionBudgets() map[string]*polv1beta1.PodDisruptionBudget - ForLabels(labels map[string]string) *polv1beta1.PodDisruptionBudget + ListPodDisruptionBudgets() map[string]*policyv1.PodDisruptionBudget + ForLabels(labels map[string]string) *policyv1.PodDisruptionBudget } // PodLister lists available pods. @@ -293,7 +293,7 @@ func isPartOfJob(po *v1.Pod) bool { return false } -func (p *Pod) checkForMultiplePdbMatches(ctx context.Context, podNamespace string, podLabels map[string]string, pdbs map[string]*polv1beta1.PodDisruptionBudget) { +func (p *Pod) checkForMultiplePdbMatches(ctx context.Context, podNamespace string, podLabels map[string]string, pdbs map[string]*policyv1.PodDisruptionBudget) { var matchedPdbs []string for _, pdb := range pdbs { if podNamespace != pdb.Namespace { diff --git a/internal/sanitize/pod_test.go b/internal/sanitize/pod_test.go index 840722da..d83a1f82 100644 --- a/internal/sanitize/pod_test.go +++ b/internal/sanitize/pod_test.go @@ -9,7 +9,7 @@ import ( "github.com/derailed/popeye/pkg/config" "github.com/stretchr/testify/assert" v1 "k8s.io/api/core/v1" - polv1beta1 "k8s.io/api/policy/v1beta1" + policyv1 "k8s.io/api/policy/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" v1beta1 "k8s.io/metrics/pkg/apis/metrics/v1beta1" ) @@ -232,11 +232,11 @@ func (p *pod) ListPodsMetrics() map[string]*v1beta1.PodMetrics { } } -func (p *pod) ForLabels(l map[string]string) *polv1beta1.PodDisruptionBudget { - return &polv1beta1.PodDisruptionBudget{} +func (p *pod) ForLabels(l map[string]string) *policyv1.PodDisruptionBudget { + return &policyv1.PodDisruptionBudget{} } -func (p *pod) ListPodDisruptionBudgets() map[string]*polv1beta1.PodDisruptionBudget { +func (p *pod) ListPodDisruptionBudgets() map[string]*policyv1.PodDisruptionBudget { return nil } @@ -406,7 +406,7 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { ctx context.Context podLabels map[string]string podNamespace string - pdbs map[string]*polv1beta1.PodDisruptionBudget + pdbs map[string]*policyv1.PodDisruptionBudget } tests := []struct { name string @@ -419,9 +419,9 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { args: args{ podNamespace: "namespace-1", podLabels: map[string]string{"app": "test"}, - pdbs: map[string]*polv1beta1.PodDisruptionBudget{ + pdbs: map[string]*policyv1.PodDisruptionBudget{ "pdb": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test"}, }, @@ -432,7 +432,7 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { }, }, "pdb2": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test"}, }, @@ -457,9 +457,9 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { args: args{ podNamespace: "namespace-1", podLabels: map[string]string{"app": "test"}, - pdbs: map[string]*polv1beta1.PodDisruptionBudget{ + pdbs: map[string]*policyv1.PodDisruptionBudget{ "pdb": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test"}, }, @@ -470,7 +470,7 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { }, }, "pdb2": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test"}, }, @@ -481,7 +481,7 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { }, }, "pdb3": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test"}, }, @@ -506,9 +506,9 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { args: args{ podNamespace: "namespace-1", podLabels: map[string]string{"app": "test", "app2": "test2"}, - pdbs: map[string]*polv1beta1.PodDisruptionBudget{ + pdbs: map[string]*policyv1.PodDisruptionBudget{ "pdb": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test", "app2": "test2"}, }, @@ -519,7 +519,7 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { }, }, "pdb2": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app3": "test3"}, }, @@ -537,9 +537,9 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { name: "pod with no label - no issue expected", args: args{ podLabels: map[string]string{}, - pdbs: map[string]*polv1beta1.PodDisruptionBudget{ + pdbs: map[string]*policyv1.PodDisruptionBudget{ "pdb": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test"}, }, @@ -548,7 +548,7 @@ func TestPodCheckForMultiplePdbMatches(t *testing.T) { Name: "pdb-1"}, }, "pdb2": { - Spec: polv1beta1.PodDisruptionBudgetSpec{ + Spec: policyv1.PodDisruptionBudgetSpec{ Selector: &metav1.LabelSelector{ MatchLabels: map[string]string{"app": "test"}, }, diff --git a/pkg/popeye.go b/pkg/popeye.go index b40cf614..ee03ae69 100644 --- a/pkg/popeye.go +++ b/pkg/popeye.go @@ -134,7 +134,6 @@ func (p *Popeye) scannedGVRs(rev *client.Revision) internal.GVRs { internal.RoGVR: "rbac.authorization.k8s.io/v1/roles", internal.RobGVR: "rbac.authorization.k8s.io/v1/rolebindings", internal.IngGVR: "networking.k8s.io/v1/ingresses", - internal.PspGVR: "policy/v1/podsecuritypolicies", internal.PdbGVR: "policy/v1/poddisruptionbudgets", internal.HpaGVR: "autoscaling/v2/horizontalpodautoscalers", } @@ -142,15 +141,15 @@ func (p *Popeye) scannedGVRs(rev *client.Revision) internal.GVRs { if rev.Minor < 18 { mm[internal.IngGVR] = "networking.k8s.io/v1beta1/ingresses" } - if rev.Minor <= 21 { - mm[internal.PspGVR] = "policy/v1beta1/podsecuritypolicies" - } if rev.Minor < 21 { mm[internal.PdbGVR] = "policy/v1beta1/poddisruptionbudgets" } if rev.Minor < 23 { mm[internal.HpaGVR] = "autoscaling/v1/horizontalpodautoscalers" } + if rev.Minor < 25 { + mm[internal.PspGVR] = "policy/v1beta1/podsecuritypolicies" + } return mm } @@ -227,11 +226,14 @@ func (p *Popeye) sanitizers(rev *client.Revision) map[string]scrubFn { gvrs[internal.CrbGVR]: scrub.NewClusterRoleBinding, gvrs[internal.RoGVR]: scrub.NewRole, gvrs[internal.RobGVR]: scrub.NewRoleBinding, - gvrs[internal.PspGVR]: scrub.NewPodSecurityPolicy, gvrs[internal.PdbGVR]: scrub.NewPodDisruptionBudget, gvrs[internal.HpaGVR]: scrub.NewHorizontalPodAutoscaler, } + if rev.Minor < 25 { + mm[gvrs[internal.PspGVR]] = scrub.NewPodSecurityPolicy + } + return mm }