Replace, append or create new PolicyReport

kubernetes-sigs / wg-policy-prototypes

A place for policy work group related proposals and prototypes.

Apache License 2.0

64 stars 39 forks source link

Replace, append or create new PolicyReport #134

Closed hardbyte closed 4 months ago

hardbyte commented 7 months ago

Netchecks is an operator which carries out periodic assertions and produces PolicyReports. Up until now I've been appending new results to a PolicyReport after each of these periodic tests.

However this is leading to some confusion in the Kyverno Policy Reporter UI. With assertions both passing and failing (at different points in time). Could you shed any light into the assumptions or designs of PolicyReport CRD (and Kyverno Policy Reporter) with regard to handling historical results?

To be specific, say I have a network assertion CheckDNSFiltering which runs every 5 minutes. Would it be more in keeping with the design to create a new PolicyReport after each test (leaving the old PolicyReport), or updating the previous PolicyReport with the new results. I've come to the conclusion that appending to a single PolicyReport with the new results but still keeping the old is not in keeping with the design.

Thanks!

JimBugwadia commented 7 months ago

Hi @hardbyte - the intent of the API is to allow two styles:

A status of current report results reflecting compliance of resources
A bounded log of report results

In your case, you can periodically update the existing results with the new report result entries replacing the prior entries for the same resources.

k8s-triage-robot commented 4 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

hardbyte commented 4 months ago

Thank you for the clarification.

I've now switched to replacing results in existing PolicyReport resource instead of appending to them.