Update middleware-operator image version to 0.2.28

tapr: fix reconciling kvrocks creating event bug
opa: update image restriction to include docker.io prefix for beclab (#2172 )
2025-12-09 16:44:47 +08:00 · 2025-12-09 16:30:38 +08:00 · 2025-12-08 21:38:32 +08:00 · 2025-12-08 21:32:59 +08:00 · 2025-12-08 16:37:12 +08:00 · 2025-12-07 23:12:08 +08:00
16 changed files with 104 additions and 24 deletions
--- a/apps/.olares/config/user/helm-charts/system-apps/templates/olares-app.yaml
+++ b/apps/.olares/config/user/helm-charts/system-apps/templates/olares-app.yaml
@@ -318,7 +318,7 @@ spec:
            chown -R 1000:1000 /uploadstemp && \
            chown -R 1000:1000 /appdata 
        - name: olares-app-init
-          image: beclab/system-frontend:v1.6.15
+          image: beclab/system-frontend:v1.6.16
          imagePullPolicy: IfNotPresent
          command:
            - /bin/sh
--- a/build/base-package/wizard/config/settings/templates/system_namespace.yaml
+++ b/build/base-package/wizard/config/settings/templates/system_namespace.yaml
@@ -28,6 +28,7 @@ metadata:
    kubesphere.io/creator: '{{ .Values.user.name }}'
  labels:
    kubesphere.io/workspace: system-workspace
+    openpolicyagent.org/webhook: ignore
  name: os-framework

 ---
@@ -38,6 +39,7 @@ metadata:
    kubesphere.io/creator: '{{ .Values.user.name }}'
  labels:
    kubesphere.io/workspace: system-workspace
+    openpolicyagent.org/webhook: ignore
  name: os-protected


--- a/cli/pkg/kubesphere/plugins/files/build/ks-config/templates/kubesphere-config.yaml
+++ b/cli/pkg/kubesphere/plugins/files/build/ks-config/templates/kubesphere-config.yaml
@@ -11,5 +11,5 @@ data:
    notification:
      endpoint: http://notification-manager-svc.kubesphere-monitoring-system.svc:19093
    terminal:
-      image: alpine:3.14
+      image: beclab/alpine:3.14
      timeout: 7200
--- a/framework/download-server/.olares/config/cluster/deploy/download_deploy.yaml
+++ b/framework/download-server/.olares/config/cluster/deploy/download_deploy.yaml
@@ -180,7 +180,7 @@ spec:
            memory: 300Mi
            
      - name: download-server
-        image: "beclab/download-server:v0.1.14"
+        image: "beclab/download-server:v0.1.15"
        imagePullPolicy: IfNotPresent
        securityContext:
          runAsUser: 0
--- a/framework/files/.olares/config/cluster/deploy/files_deploy.yaml
+++ b/framework/files/.olares/config/cluster/deploy/files_deploy.yaml
@@ -210,7 +210,7 @@ spec:
          command:
            - /samba_share
        - name: files
-          image: beclab/files-server:v0.2.134
+          image: beclab/files-server:v0.2.135
          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: true
--- a/framework/search3/.olares/config/cluster/deploy/search3_server_deploy.yaml
+++ b/framework/search3/.olares/config/cluster/deploy/search3_server_deploy.yaml
@@ -240,7 +240,7 @@ spec:
            value: os_framework_search3
      containers:
      - name: search3
-        image: beclab/search3:v0.0.79
+        image: beclab/search3:v0.0.84
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8080
@@ -301,7 +301,7 @@ spec:
      priorityClassName: "system-cluster-critical"
      containers:
      - name: search3monitor
-        image: beclab/search3monitor:v0.0.79
+        image: beclab/search3monitor:v0.0.84
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8081
@@ -326,6 +326,8 @@ spec:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
+        - name: LOG_FILE
+          value: "true"
        - name: NATS_HOST
          value: nats.os-platform
        - name: NATS_PORT
--- a/framework/search3/.olares/config/cluster/deploy/search3_validation.yaml
+++ b/framework/search3/.olares/config/cluster/deploy/search3_validation.yaml
@@ -44,7 +44,7 @@ spec:
                    operator: Exists
      containers:
      - name: search3-validation
-        image: beclab/search3validation:v0.0.79
+        image: beclab/search3validation:v0.0.84
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 8443
--- a/framework/system-server/.olares/config/cluster/deploy/system_provider.yaml
+++ b/framework/system-server/.olares/config/cluster/deploy/system_provider.yaml
@@ -26,7 +26,7 @@ spec:
    spec:
      containers:
        - name: provider-proxy
-          image: beclab/provider-proxy:0.1.0
+          image: beclab/provider-proxy:0.1.1
          imagePullPolicy: IfNotPresent
          args:
            - --logtostderr
--- a/framework/system-server/.olares/config/user/helm-charts/systemserver/templates/systemserver_deploy.yaml
+++ b/framework/system-server/.olares/config/user/helm-charts/systemserver/templates/systemserver_deploy.yaml
@@ -82,7 +82,7 @@ spec:
      priorityClassName: "system-cluster-critical"
      containers:
      - name: system-server
-        image: beclab/system-server:0.1.32
+        image: beclab/system-server:0.1.33
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 80
--- a/infrastructure/kubernetes/.olares/Olares.yaml
+++ b/infrastructure/kubernetes/.olares/Olares.yaml
@@ -23,7 +23,7 @@ output:
    -
      name: liangjw/kube-webhook-certgen:v1.1.1
    - 
-      name: alpine:3.14
+      name: beclab/alpine:3.14
    -
      name: beclab/kube-rbac-proxy:0.19.0
    - 
--- a/platform/kubeblocks/.olares/Olares.yaml
+++ b/platform/kubeblocks/.olares/Olares.yaml
@@ -3,8 +3,8 @@ target: prebuilt
 output:
  containers:
    - 
-      name: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.0.1
+      name: beclab/apecloud-kubeblocks-tools:1.0.1
    -
-      name: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks:1.0.1
+      name: beclab/apecloud-kubeblocks:1.0.1
    -
      name: beclab/kubeblock-addon-charts:v1.0.1
--- a/platform/kubeblocks/.olares/config/cluster/deploy/kubeblocks.yaml
+++ b/platform/kubeblocks/.olares/config/cluster/deploy/kubeblocks.yaml
@@ -29,7 +29,7 @@ spec:
        runAsNonRoot: true
      initContainers: # only download tools image to local
        - name: tools
-          image: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.0.1
+          image: beclab/apecloud-kubeblocks-tools:1.0.1
          imagePullPolicy: IfNotPresent
          command:
            - /bin/true
@@ -61,7 +61,7 @@ spec:
            - name: KUBEBLOCKS_IMAGE_PULL_POLICY
              value: IfNotPresent
            - name: KUBEBLOCKS_TOOLS_IMAGE
-              value: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.0.1
+              value: beclab/apecloud-kubeblocks-tools:1.0.1
            - name: KUBEBLOCKS_SERVICEACCOUNT_NAME
              value: kubeblocks
            - name: VOLUMESNAPSHOT_API_BETA
@@ -98,7 +98,7 @@ spec:
            capabilities:
              drop:
                - ALL
-          image: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks:1.0.1
+          image: beclab/apecloud-kubeblocks:1.0.1
          imagePullPolicy: IfNotPresent
          ports:
            - name: webhook-server
@@ -231,7 +231,7 @@ spec:
      restartPolicy: Never
      containers:
        - name: pre-upgrade-job
-          image: apecloud-registry.cn-zhangjiakou.cr.aliyuncs.com/apecloud/kubeblocks-tools:1.0.1
+          image: beclab/apecloud-kubeblocks-tools:1.0.1
          imagePullPolicy: IfNotPresent
          command:
            - sh
--- a/platform/open-policy-agent/.olares/config/cluster/deploy/deployment.yaml
+++ b/platform/open-policy-agent/.olares/config/cluster/deploy/deployment.yaml
@@ -72,6 +72,14 @@ spec:
      name: opa
    spec:
      serviceAccountName: opa-sa
+      priorityClassName: "system-cluster-critical"
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: Exists
      containers:
        - name: opa
          image: openpolicyagent/opa:1.11.0
@@ -120,6 +128,7 @@ webhooks:
          - os-network
          - os-platform
          - os-protected
+          - kubesphere-controls-system
        - key: bytetrade.io/ns-type
          operator: NotIn
          values:
@@ -160,12 +169,79 @@ metadata:
 data:
  main: |
    package system
-    
-    default uid := ""
-    uid := input.request.uid

-    main = {
+    import data.kubernetes.admission
+
+    main := {
      "apiVersion": "admission.k8s.io/v1",
      "kind": "AdmissionReview",
-      "response": {"allowed": true, "uid": uid},
+      "response": response,
    }
+
+    default uid := ""
+
+    uid := input.request.uid
+
+    response := {
+      "allowed": false,
+      "uid": uid,
+      "status": {"message": reason},
+    } if {
+      reason := concat(", ", admission.deny)
+      reason != ""
+    }
+    else := {"allowed": true, "uid": uid}
+
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: untrusted-pod-check
+  namespace: {{ .Release.Namespace }}
+  labels:
+    openpolicyagent.org/policy: rego
+data:
+  main: |
+    package kubernetes.admission
+    
+    deny contains msg if {
+        some container
+        input_containers[container]
+        not startswith(container.image, "beclab/")
+
+        is_root_user(container.securityContext)
+    
+        msg := sprintf("Container '%s' uses an untrusted image registry and is configured to run as root user (UID 0) or privileged. This is not allowed.", [container.name])
+    }
+
+    deny contains msg if {
+        some container
+        input_containers[container]
+        not startswith(container.image, "beclab/")
+        not startswith(container.image, "docker.io/beclab/")
+
+        is_root_user(input.request.object.spec.securityContext)
+    
+        msg := sprintf("Pod '%s' uses an untrusted image registry and is configured to run as root user (UID 0) or privileged. This is not allowed.", [input.request.object.metadata.name])
+    }
+
+    input_containers contains container if {
+      container := input.request.object.spec.containers[_]
+    }    
+        
+    input_containers contains container if {
+      container := input.request.object.spec.initContainers[_]
+    }    
+        
+    is_root_user(ctx) if {
+        ctx.runAsNonRoot == false
+    }
+    
+    is_root_user(ctx) if {
+        ctx.runAsUser == 0
+    }    
+
+    is_root_user(ctx) if {
+        ctx.privileged == true
+    }    
+
--- a/platform/redis/kvrocks/.olares/Olares.yaml
+++ b/platform/redis/kvrocks/.olares/Olares.yaml
@@ -3,7 +3,7 @@ target: prebuilt
 output:
  containers:
    - 
-      name: beclab/kvrocks:0.1.0
+      name: beclab/kvrocks:0.1.1



--- a/platform/tapr/.olares/config/cluster/deploy/middleware_deploy.yaml
+++ b/platform/tapr/.olares/config/cluster/deploy/middleware_deploy.yaml
@@ -57,7 +57,7 @@ spec:
          path: '{{ $dbbackup_rootpath }}/pg_backup'
      containers:
      - name: operator-api
-        image: beclab/middleware-operator:0.2.22
+        image: beclab/middleware-operator:0.2.28
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 9080
--- a/platform/tapr/.olares/config/cluster/deploy/redixcluster_deploy.yaml
+++ b/platform/tapr/.olares/config/cluster/deploy/redixcluster_deploy.yaml
@@ -64,7 +64,7 @@ spec:
  kvrocks:
    owner: system
    backupStorage: '{{ $redix_backuppath }}/kvrocks_backup'
-    image: beclab/kvrocks:0.1.0
+    image: beclab/kvrocks:0.1.1
    imagePullPolicy: IfNotPresent
    password: 
      valueFrom:
Author	SHA1	Message	Date
eball	573d60c071	Update middleware-operator image version to 0.2.28	2025-12-09 16:44:47 +08:00
eball	0b5f927034	tapr: fix reconciling kvrocks creating event bug	2025-12-09 16:30:38 +08:00
eball	605b862937	opa: update image restriction to include docker.io prefix for beclab (#2172 ) fix: update image restriction to include docker.io prefix for beclab	2025-12-08 21:38:32 +08:00
hysyeah	0110413528	tapr: kvrocks upgrade (#2173 )	2025-12-08 21:32:59 +08:00
eball	0726d70b58	systemserver: remove default rbac authz	2025-12-08 16:37:12 +08:00
simon	8abf6d8b65	download-server: feat add download file remove api (#2168 ) download server	2025-12-07 23:12:08 +08:00
salt	b0f495c37a	feat: optimize highlight (#2167 ) Co-authored-by: ubuntu <you@example.com>	2025-12-06 14:51:52 +08:00
wiy	4e9b8d840d	feat(olares-app): update olares new version to v1.6.16 (#2166 )	2025-12-05 23:41:42 +08:00
salt	57579813de	feat: search scope change (#2159 ) * Update search3-validation image to v0.0.80 * Update search3 and search3monitor images to v0.0.80 * Change LOG_FILE value to string 'true' * Update search3-validation image version to v0.0.81 * Update search3 and search3monitor images to v0.0.81 * Update search3 and search3monitor images to v0.0.83 * Update search3-validation image to v0.0.83	2025-12-05 23:41:15 +08:00
hysyeah	97dd238c44	tapr: new middleware list api (#2165 ) * tapr: new middleware list api * Update middleware operator image version to 0.2.25 --------- Co-authored-by: eball <liuy102@hotmail.com>	2025-12-05 22:49:29 +08:00
eball	3095530d0d	opa: add untrusted image policy (#2135 ) * feat(opa): add untrusted image check and update webhook configuration * fix: add separator before untrusted pod check ConfigMap * fix: remove specific image checks from untrusted pod validation * fix: remove specific image checks from untrusted pod validation * feat: add priority class and node affinity for OPA deployment	2025-12-05 20:20:03 +08:00