[Security Hardened Shoot Cluster] Rule 1001 Implementation #462
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…rdened Shoot Cluster ruleset. Fix typos
gardener-robot
added
needs/review
gardener-robot-ci-1
added
reviewed/ok-to-test
AleksandarSavchev
requested changes
Mar 24, 2025
pkg/provider/garden/ruleset/securityhardenedshoot/rules/1001.go
Outdated
Show resolved
Hide resolved
pkg/provider/garden/ruleset/securityhardenedshoot/rules/1001_test.go
Outdated
Show resolved
Hide resolved
pkg/provider/garden/ruleset/securityhardenedshoot/rules/options.go
Outdated
Show resolved
Hide resolved
gardener-robot-ci-2
added
the
reviewed/ok-to-test
gardener-robot-ci-1
removed
the
reviewed/ok-to-test
pkg/provider/garden/ruleset/securityhardenedshoot/rules/1001.go
Outdated
Show resolved
Hide resolved
gardener-robot-ci-1
added
reviewed/ok-to-test
gardener-robot
added
reviewed/lgtm
gardener-robot
removed
the
needs/second-opinion
gardener-robot-ci-2
added
the
reviewed/ok-to-test
dimityrmirchev
requested changes
Mar 25, 2025
| return rule.Result(r, checkResult), nil | ||
| } | ||
| return rule.Result(r, rule.ErroredCheckResult("kubernetes version not found in cloudProfile", target)), nil | ||
| } else { |
There was a problem hiding this comment.
No need for additional nesting here - else can be removed
| case slices.Contains(r.acceptedClassifications(), *version.Classification): | ||
| return rule.PassedCheckResult("Shoot uses a Kubernetes version with an allowed classification.", target.With("classification", string(*version.Classification))), true | ||
| default: | ||
| return rule.FailedCheckResult("Shoot uses a Kubernetes version with a non-allowed classification.", target.With("classification", string(*version.Classification))), true |
There was a problem hiding this comment.
Suggested change
| return rule.FailedCheckResult("Shoot uses a Kubernetes version with a non-allowed classification.", target.With("classification", string(*version.Classification))), true | |
| return rule.FailedCheckResult("Shoot uses a Kubernetes version with a forbidden classification.", target.With("classification", string(*version.Classification))), true |
gardener-robot
added
needs/changes
gardener-robot-ci-2
removed
the
reviewed/ok-to-test
gardener-robot
added
reviewed/lgtm
gardener-robot-ci-2
added
the
reviewed/ok-to-test
gardener-robot
added
the
status/closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
This PR implements and registers rule 1001 of the
Security Hardened Shootruleset for theGardenprovider. The rule checks the shoot spec for it's Kubernetes version and evaluates it's support based on theCloudProfile/NamespacedCloudProfilein the projectWhich issue(s) this PR fixes:
Fixes #432
Special notes for your reviewer:
Release note: