Skip to content

feat: add ORCS monitoring #2308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 64 commits into from
Jul 31, 2025
Merged

feat: add ORCS monitoring #2308

merged 64 commits into from
Jul 31, 2025

Conversation

CasLubbers
Copy link
Contributor

@CasLubbers CasLubbers commented Jul 3, 2025 •
edited by Ani1357
Loading

📌 Summary

We want to have a mechanism which allows to see which images are using ORCS when it is enabled.
This PR adds:

  • a new ClusterPolicy (POC) which checks if imaged are pulled from ORCS.
  • a new charts (policy-reporter) which exposes k8s policy reports (produced by the Kyverno Validating Policy)as metrics.
  • grafana dashboards to visualize those metrics

🔍 Reviewer Notes

🧹 Checklist

  • Code is readable, maintainable, and robust.
  • Unit tests added/updated

otomi-admin and others added 30 commits July 2, 2025 15:43
feat: add ORCS compliance policies and alerting rules for supply chai…
60dd66f 
…n security
feat: fix team-ns chart
7bb466e
feat: add cluster wide policy
29c204e
feat: fix kyverno raw
9a593e5
feat: fix kyverno raw
1cf51e8
feat: fix kyverno raw
16f26ef
feat: temporarly delete cluster policy
58b8e55
fix: uncomment clusterpolicy
6c252c3
fix: update policy
b1afa17
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
c3c253d
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
3e9b2d9
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
2284f00
@CasLubbers
fix: remove team-ns orcs compliancy
bf8d4f4
@Ani1357
feat: adding orcs prometheus rule
67dd182
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
4718471
@Ani1357
feat: image capturing expression
a77eea5
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
5e72de4
@CasLubbers
feat: add ORCS compliance policies to alerts configuration
86a750e
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
d863aed
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
7051768
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
4f38ddb
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
64c0cf4
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
63ffa4e
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
7ffb02d
@svcAPLBot
Merge remote-tracking branch 'origin/main' into APL-886
f63e49f
@Ani1357
feat: adding policy-reporter
343cd93
@Ani1357
feat: added defaults and value-schema chages
b204828
@Ani1357
Revert "feat: add ORCS compliance policies to alerts configuration"
0675feb 
This reverts commit 86a750e.
@Ani1357
fix: schema
532a44b
@Ani1357
fix: defaults
b0dc255
@Ani1357 Ani1357 self-requested a review as a code owner July 28, 2025 14:23
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda requested changes Jul 30, 2025
View reviewed changes
Copy link
Contributor

@j-zimnowoda j-zimnowoda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found some inconsistencies around the enabled flag for the policy reporter.
It is good to have an ability to disable it. However the current implementation does not allow for it. On the other hand the scheme suggests that it is possible to do it.

j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
j-zimnowoda
j-zimnowoda reviewed Jul 30, 2025
View reviewed changes
Copy link
Contributor

@j-zimnowoda j-zimnowoda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some additional feedback has been added.

@Ani1357 Ani1357 requested a review from j-zimnowoda July 31, 2025 09:48
j-zimnowoda
j-zimnowoda reviewed Jul 31, 2025
View reviewed changes
@Ani1357 Ani1357 enabled auto-merge (squash) July 31, 2025 11:11
@Ani1357 Ani1357 merged commit f3a53e1 into main Jul 31, 2025
11 checks passed
@Ani1357 Ani1357 deleted the APL-886 branch July 31, 2025 11:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@j-zimnowoda j-zimnowoda j-zimnowoda approved these changes

@Ani1357 Ani1357 Ani1357 approved these changes

@merll merll Awaiting requested review from merll merll is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@CasLubbers @j-zimnowoda @Ani1357 @svcAPLBot