kyverno-1.13.yaml

package:
  name: kyverno-1.13
  version: "1.13.4"
  epoch: 6
  description: Kubernetes Native Policy Management
  copyright:
    - license: Apache-2.0
  dependencies:
    runtime:
      - ca-certificates-bundle
    provides:
      - kyverno=${{package.full-version}}

var-transforms:
  - from: ${{package.name}}
    match: '.*-(\d+\.\d+).*'
    replace: '$1'
    to: major-minor-version

environment:
  contents:
    packages:
      - build-base
      - busybox
      - ca-certificates-bundle
      - git
      - go
      - wolfi-baselayout

pipeline:
  - uses: git-checkout
    with:
      expected-commit: c6e3bcddee8648b95ab717e658e541809705f9bb
      repository: https://github.com/kyverno/kyverno
      tag: v${{package.version}}

  - uses: go/bump
    with:
      deps: |-
        github.com/go-git/go-git/v5@v5.13.0
        github.com/go-jose/go-jose/v4@v4.0.5
        github.com/go-jose/go-jose/v3@v3.0.4
        golang.org/x/crypto@v0.35.0
        golang.org/x/oauth2@v0.27.0
        golang.org/x/net@v0.36.0

  - uses: patch
    # This patch (ideally) can be removed when a new release is cut by the kyverno maintainers.
    with:
      patches: update-otel-semconv-to-1.26.0.patch disable-vet-printf-checks.patch

  - runs: |
      make build-all
      mkdir -p ${{targets.destdir}}/usr/bin
      install -Dm755 cmd/kyverno/kyverno ${{targets.destdir}}/usr/bin/kyverno

  - uses: strip

subpackages:
  - name: kyverno-init-container-${{vars.major-minor-version}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          install -Dm755 cmd/kyverno-init/kyvernopre ${{targets.subpkgdir}}/usr/bin/kyvernopre
    dependencies:
      provides:
        - kyverno-init-container=${{package.full-version}}
    test:
      pipeline:
        - runs: |
            kyvernopre --help

  - name: kyverno-reports-controller-${{vars.major-minor-version}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          install -Dm755 cmd/reports-controller/reports-controller ${{targets.subpkgdir}}/usr/bin/reports-controller
    dependencies:
      provides:
        - kyverno-reports-controller=${{package.full-version}}
    test:
      pipeline:
        - runs: |
            reports-controller --help

  - name: kyverno-background-controller-${{vars.major-minor-version}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          install -Dm755 cmd/background-controller/background-controller ${{targets.subpkgdir}}/usr/bin/background-controller
    dependencies:
      provides:
        - kyverno-background-controller=${{package.full-version}}
    test:
      pipeline:
        - runs: |
            background-controller --help

  - name: kyverno-cleanup-controller-${{vars.major-minor-version}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          install -Dm755 cmd/cleanup-controller/cleanup-controller ${{targets.subpkgdir}}/usr/bin/cleanup-controller
    dependencies:
      provides:
        - kyverno-cleanup-controller=${{package.full-version}}
    test:
      pipeline:
        - runs: |
            cleanup-controller --help

  - name: kyverno-cli-${{vars.major-minor-version}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          install -Dm755 cmd/cli/kubectl-kyverno/kubectl-kyverno ${{targets.subpkgdir}}/usr/bin/kubectl-kyverno
    dependencies:
      provides:
        - kyverno-cli=${{package.full-version}}
    test:
      pipeline:
        - runs: |
            kubectl-kyverno version
            kubectl-kyverno --help

update:
  enabled: true
  ignore-regex-patterns:
    - "-beta"
    - "-rc"
  github:
    identifier: kyverno/kyverno
    strip-prefix: v
    tag-filter: v1.13.

test:
  environment:
    environment:
      KYVERNO_NAMESPACE: kyverno-ns
      KYVERNO_SERVICEACCOUNT_NAME: example-serviceaccount
      KYVERNO_DEPLOYMENT: kyverno-deployment
      KYVERNO_POD_NAME: kyverno-pod
      INIT_CONFIG: kyverno-init-config
      METRICS_CONFIG: kyverno-metrics-config
      KUBERNETES_SERVICE_HOST: test-example.net
      KUBERNETES_SERVICE_PORT: 8081
  pipeline:
    - name: "Test kyverno responds to --help without throwing an error"
      runs: |
        kyverno --help
    - name: "Partially mock kyverno and look for known logs"
      runs: |
        mkdir -p /var/run/secrets/kubernetes.io/serviceaccount
        echo "dummy-token" > /var/run/secrets/kubernetes.io/serviceaccount/token

        # Start kyverno in the background and redirect logs to a file
        kyverno > kyverno.log 2>&1 &
        KYVERNO_PID=$!

        # Terminate the kyverno process after we've grabbed some logs
        sleep 5
        kill $KYVERNO_PID
        wait $KYVERNO_PID 2>/dev/null || true

        # Even though kyverno won't be operational, check that it attempted
        # to connect, using the example data.
        if grep -q 'Get "https://test-example.net:8081/api/v1/namespaces/kyverno-ns/' kyverno.log; then
          echo "Test passed: Found expected log output."
        else
          echo "Test failed: Did not find expected log output."
          echo "Kyverno logs:"
          cat kyverno.log
          exit 1
        fi