Merge pull request #142 from fluxcd/update-kyverno

Update kyverno to v1.14.4

README.md

@@ -180,7 +180,7 @@ flux create kustomization dev-team \
 Create the base `kustomization.yaml` file:
 
 ```sh
-cd ./tenants/base/dev-team/ && kustomize create --autodetect
+cd ./tenants/base/dev-team/ && kustomize create --autodetect --namespace apps 
 ```
 
 Create the staging overlay and set the path to the staging dir inside the tenant repository:
@@ -199,6 +199,7 @@ EOF
 cat << EOF | tee ./tenants/staging/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: apps
 resources:
   - ../base/dev-team
 patches:
@@ -523,7 +524,7 @@ flux -n apps create secret git dev-team-auth \
 Print the SSH public key and add it as a read-only deploy key to the dev-team repository:
 
 ```sh
-yq eval 'data."identity.pub"' git-auth.yaml | base64 --decode
+yq eval '.stringData."identity.pub"' ./tenants/base/dev-team/auth.yaml
 ```
 
 ### Git over HTTP/S

infrastructure/kyverno-policies/verify-flux-images.yaml

@@ -29,6 +29,7 @@ spec:
             - "docker.io/fluxcd/image-reflector-controller:*"
             - "docker.io/fluxcd/image-automation-controller:*"
           mutateDigest: false
+          verifyDigest: false
           attestors:
             - entries:
                 - keyless:

infrastructure/kyverno-policies/verify-git-repositories.yaml

@@ -9,19 +9,18 @@ spec:
   validationFailureAction: Audit # Change to 'Enforce' once the specific org url is set.
   rules:
     - name: github-repositories-only
-      exclude:
-        resources:
-          namespaces:
-            - flux-system
       match:
         any:
         - resources:
             kinds:
               - GitRepository
+      exclude:
+        any:
+        - resources:
+            namespaces:
+              - flux-system
       validate:
         message: ".spec.url must be from a repository within the organisation X"
-        anyPattern:
+        pattern:
-        - spec:
+          spec:
-            url: "https://github.com/fluxcd/?*" # repositories in fluxcd via https
+            url: https://github.com/fluxcd/?* | ssh://git@github.com:fluxcd/?*
-        - spec:
-            url: "ssh://git@github.com:fluxcd/?*" # repositories in fluxcd via ssh

infrastructure/kyverno/source.yaml

@@ -8,6 +8,6 @@ spec:
   provider: generic
   url: oci://ghcr.io/kyverno/manifests/kyverno
   ref:
-    tag: "v1.10.2"
+    tag: "v1.14.4"
   verify:
     provider: cosign

tenants/base/dev-team/kustomization.yaml

@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: apps
 resources:
   - rbac.yaml
   - sync.yaml

tenants/production/kustomization.yaml

@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: apps
 resources:
   - ../base/dev-team
 patches:

tenants/staging/kustomization.yaml

@@ -1,5 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: apps
 resources:
   - ../base/dev-team
 patches: