Merge branch 'main' into feature/update-deprecated-prometheus-mem-cpu-queries

Author: tjmoyes

.github/workflows/pytest-on-push.yml

@@ -13,7 +13,7 @@ jobs:
     - name: Set up Python
       uses: actions/setup-python@v2
       with:
-        python-version: '3.9'
+        python-version: '3.10'
 
     - name: Install dependencies
       run: |

enforcer/Dockerfile

@@ -4,9 +4,10 @@ ENV PYTHONDONTWRITEBYTECODE=1
 ENV PYTHONUNBUFFERED=1
 ENV PATH="/app/venv/bin:$PATH"
 
-# Patching CVE-2025-6965
+# Patching CVE-2025-6965 (requires sqlite >= 3.50.2)
+# Alpine's current version (3.51.1-r0) already includes the fix
 RUN apk update && apk add --no-cache --upgrade \
-    sqlite-libs=3.49.2-r1 sqlite=3.49.2-r1
+    sqlite-libs sqlite
 
 # Set the working directory
 WORKDIR /app/enforcer
@@ -17,9 +18,8 @@ COPY ./resources/ resources/
 COPY ./requirements.txt requirements.txt
 
 
-RUN pip install --no-cache-dir --upgrade pip
-# Install the project dependencies
-RUN python -m ensurepip --upgrade
+RUN pip install --no-cache-dir "pip>=25.3" \
+    && rm -rf /usr/local/lib/python3.12/ensurepip/_bundled/pip-*.whl
 RUN pip install --no-cache-dir -r requirements.txt
 
 CMD ["python", "enforcer_main.py"]

enforcer/enforcer_main.py

@@ -158,15 +158,18 @@ async def mutate(request: AdmissionReview):
 
         logger.debug("Pod patches %s", patches)
 
+        response = {
+            "uid": request.request.get("uid"),
+            "allowed": True,
+        }
+        if patches:
+            response["patchType"] = "JSONPatch"
+            response["patch"] = base64.b64encode(json.dumps(patches).encode()).decode()
+
         return {
             "apiVersion": "admission.k8s.io/v1",
             "kind": "AdmissionReview",
-            "response": {
-                "uid": request.request.get("uid"),
-                "allowed": True,
-                "patchType": "JSONPatch",
-                "patch": base64.b64encode(json.dumps(patches).encode()).decode() if patches else None
-            }
+            "response": response
         }
 
     except Exception as e:

enforcer/requirements.txt

@@ -1,8 +1,10 @@
-fastapi==0.115.12
+fastapi==0.121.3
 uvicorn==0.27.1
 pydantic==2.6.1
 supabase==2.5
 PyYAML==6.0.1
 cachetools==5.3.3
 prometheus-client==0.20.0
 kubernetes==26.1.0
+pyasn1>=0.6.2
+urllib3==2.6.3

helm/krr-enforcer/Chart.yaml

@@ -3,5 +3,5 @@ name: krr-enforcer
 description: KRR enforcer - auto apply KRR recommendations
 type: application
 
-version: 0.3.4
-appVersion: 0.3.4
+version: 0.3.5
+appVersion: 0.3.5

helm/krr-enforcer/values.yaml

@@ -11,7 +11,7 @@ certJob:
 image:
   repository: us-central1-docker.pkg.dev/genuine-flight-317411/devel
   name: krr-enforcer
-  tag: 0.3.4
+  tag: 0.3.6
 imagePullPolicy: IfNotPresent
 resources:
   requests:

poetry.lock

@@ -23,30 +23,28 @@ plugins = "numpy.typing.mypy_plugin,pydantic.mypy"
 krr = "robusta_krr.main:run"
 
 [tool.poetry.dependencies]
-python = ">=3.9,<=3.12.9"
+python = ">=3.10,<=3.12.9"
 typer = { extras = ["all"], version = "^0.7.0" }
 pydantic = "^1.10.7"
 kubernetes = "^26.1.0"
 prometheus-api-client = "0.5.3"
 numpy = ">=1.26.4,<1.27.0"
 alive-progress = "^3.1.2"
-prometrix = "0.2.5"
+prometrix = "0.2.11"
 slack-sdk = "^3.21.3"
 pandas = "2.2.2"
 requests = ">2.32.4"
 pyyaml = "6.0.1"
 typing-extensions = "4.6.0"
 idna = "3.7"
-urllib3 = "^1.26.20"
+urllib3 = "^2.6.2"
 setuptools = "^80.9.0"
 zipp = "^3.19.1"
 tenacity = "^9.0.0"
-pyinstaller = "^5.9.0"
-
 
 
 [tool.poetry.group.dev.dependencies]
-mypy = "^1.0.1"
+mypy = "^1.18.2"
 black = "^23.1.0"
 isort = "^5.12.0"
 flake8 = "^6.0.0"
@@ -55,7 +53,6 @@ types-cachetools = "^5.3.0.4"
 types-requests = "^2.28.11.15"
 pytest = "^7.2.2"
 pytest-asyncio = ">=0.21,<0.24"
-pyinstaller = "^5.9.0"
 
 [build-system]
 requires = ["poetry-core"]

pyproject.toml

@@ -1,57 +1,57 @@
-about-time==4.2.1 ; python_version >= "3.9" and python_full_version < "3.13"
-alive-progress==3.1.5 ; python_version >= "3.9" and python_full_version < "3.13"
-boto3==1.34.62 ; python_version >= "3.9" and python_full_version < "3.13"
-botocore==1.34.62 ; python_version >= "3.9" and python_full_version < "3.13"
-cachetools==5.3.3 ; python_version >= "3.9" and python_full_version < "3.13"
-certifi==2024.2.2 ; python_version >= "3.9" and python_full_version < "3.13"
-charset-normalizer==3.3.2 ; python_version >= "3.9" and python_full_version < "3.13"
-click==8.1.7 ; python_version >= "3.9" and python_full_version < "3.13"
-colorama==0.4.6 ; python_version >= "3.9" and python_full_version < "3.13"
-commonmark==0.9.1 ; python_version >= "3.9" and python_full_version < "3.13"
-contourpy==1.2.0 ; python_version >= "3.9" and python_full_version < "3.13"
-cycler==0.12.1 ; python_version >= "3.9" and python_full_version < "3.13"
-dateparser==1.2.0 ; python_version >= "3.9" and python_full_version < "3.13"
-fonttools==4.49.0 ; python_version >= "3.9" and python_full_version < "3.13"
-google-auth==2.28.2 ; python_version >= "3.9" and python_full_version < "3.13"
-grapheme==0.6.0 ; python_version >= "3.9" and python_full_version < "3.13"
-httmock==1.4.0 ; python_version >= "3.9" and python_full_version < "3.13"
-idna==3.7 ; python_version >= "3.9" and python_full_version < "3.13"
-importlib-resources==6.3.0 ; python_version == "3.9"
-jmespath==1.0.1 ; python_version >= "3.9" and python_full_version < "3.13"
-kiwisolver==1.4.5 ; python_version >= "3.9" and python_full_version < "3.13"
-kubernetes==26.1.0 ; python_version >= "3.9" and python_full_version < "3.13"
-matplotlib==3.8.3 ; python_version >= "3.9" and python_full_version < "3.13"
-numpy==1.26.4 ; python_version >= "3.9" and python_full_version < "3.13"
-oauthlib==3.2.2 ; python_version >= "3.9" and python_full_version < "3.13"
-packaging==24.0 ; python_version >= "3.9" and python_full_version < "3.13"
-pandas==2.2.2 ; python_version >= "3.9" and python_full_version < "3.13"
-pillow==10.3.0 ; python_version >= "3.9" and python_full_version < "3.13"
-prometheus-api-client==0.5.3 ; python_version >= "3.9" and python_full_version < "3.13"
-prometrix==0.2.5 ; python_version >= "3.9" and python_full_version < "3.13"
-pyasn1-modules==0.3.0 ; python_version >= "3.9" and python_full_version < "3.13"
-pyasn1==0.5.1 ; python_version >= "3.9" and python_full_version < "3.13"
-pydantic==1.10.15 ; python_version >= "3.9" and python_full_version < "3.13"
-pygments==2.17.2 ; python_version >= "3.9" and python_full_version < "3.13"
-pyparsing==3.1.2 ; python_version >= "3.9" and python_full_version < "3.13"
-python-dateutil==2.9.0.post0 ; python_version >= "3.9" and python_full_version < "3.13"
-pytz==2024.1 ; python_version >= "3.9" and python_full_version < "3.13"
-pyyaml==6.0.1 ; python_version >= "3.9" and python_full_version < "3.13"
-regex==2023.12.25 ; python_version >= "3.9" and python_full_version < "3.13"
-requests-oauthlib==1.4.0 ; python_version >= "3.9" and python_full_version < "3.13"
-requests==2.32.5 ; python_version >= "3.9" and python_full_version < "3.13"
-rich==12.6.0 ; python_version >= "3.9" and python_full_version < "3.13"
-rsa==4.9 ; python_version >= "3.9" and python_full_version < "3.13"
-s3transfer==0.10.0 ; python_version >= "3.9" and python_full_version < "3.13"
-setuptools==80.9.0 ; python_version >= "3.9" and python_full_version < "3.13"
-shellingham==1.5.4 ; python_version >= "3.9" and python_full_version < "3.13"
-six==1.16.0 ; python_version >= "3.9" and python_full_version < "3.13"
-slack-sdk==3.27.1 ; python_version >= "3.9" and python_full_version < "3.13"
-tenacity==9.0.0 ; python_version >= "3.9" and python_full_version < "3.13"
-typer==0.7.0 ; python_version >= "3.9" and python_full_version < "3.13"
-typing-extensions==4.6.0 ; python_version >= "3.9" and python_full_version < "3.13"
-tzdata==2024.1 ; python_version >= "3.9" and python_full_version < "3.13"
-tzlocal==5.2 ; python_version >= "3.9" and python_full_version < "3.13"
-urllib3==1.26.20 ; python_version >= "3.9" and python_full_version < "3.13"
-websocket-client==1.7.0 ; python_version >= "3.9" and python_full_version < "3.13"
-zipp==3.20.2 ; python_version >= "3.9" and python_full_version < "3.13"
-pytest-asyncio==0.23.7 ; python_version >= "3.9" and python_full_version < "3.13"
+about-time==4.2.1 ; python_version >= "3.10" and python_full_version < "3.13"
+alive-progress==3.1.5 ; python_version >= "3.10" and python_full_version < "3.13"
+boto3==1.42.19 ; python_version >= "3.10" and python_full_version < "3.13"
+botocore==1.42.19 ; python_version >= "3.10" and python_full_version < "3.13"
+cachetools==5.3.3 ; python_version >= "3.10" and python_full_version < "3.13"
+certifi==2024.2.2 ; python_version >= "3.10" and python_full_version < "3.13"
+charset-normalizer==3.3.2 ; python_version >= "3.10" and python_full_version < "3.13"
+click==8.1.7 ; python_version >= "3.10" and python_full_version < "3.13"
+colorama==0.4.6 ; python_version >= "3.10" and python_full_version < "3.13"
+commonmark==0.9.1 ; python_version >= "3.10" and python_full_version < "3.13"
+contourpy==1.2.0 ; python_version >= "3.10" and python_full_version < "3.13"
+cycler==0.12.1 ; python_version >= "3.10" and python_full_version < "3.13"
+dateparser==1.2.0 ; python_version >= "3.10" and python_full_version < "3.13"
+fonttools==4.60.2 ; python_version >= "3.10" and python_full_version < "3.13"
+google-auth==2.28.2 ; python_version >= "3.10" and python_full_version < "3.13"
+grapheme==0.6.0 ; python_version >= "3.10" and python_full_version < "3.13"
+httmock==1.4.0 ; python_version >= "3.10" and python_full_version < "3.13"
+idna==3.7 ; python_version >= "3.10" and python_full_version < "3.13"
+jmespath==1.0.1 ; python_version >= "3.10" and python_full_version < "3.13"
+kiwisolver==1.4.5 ; python_version >= "3.10" and python_full_version < "3.13"
+kubernetes==26.1.0 ; python_version >= "3.10" and python_full_version < "3.13"
+matplotlib==3.8.3 ; python_version >= "3.10" and python_full_version < "3.13"
+numpy==1.26.4 ; python_version >= "3.10" and python_full_version < "3.13"
+oauthlib==3.2.2 ; python_version >= "3.10" and python_full_version < "3.13"
+packaging==24.0 ; python_version >= "3.10" and python_full_version < "3.13"
+pandas==2.2.2 ; python_version >= "3.10" and python_full_version < "3.13"
+pillow==12.1.1 ; python_version >= "3.10" and python_full_version < "3.13"
+prometheus-api-client==0.5.3 ; python_version >= "3.10" and python_full_version < "3.13"
+prometrix==0.2.11; python_version >= "3.10" and python_full_version < "3.13"
+pyasn1-modules==0.4.2 ; python_version >= "3.10" and python_full_version < "3.13"
+pyasn1==0.6.2 ; python_version >= "3.10" and python_full_version < "3.13"
+pydantic==1.10.15 ; python_version >= "3.10" and python_full_version < "3.13"
+pygments==2.17.2 ; python_version >= "3.10" and python_full_version < "3.13"
+pyparsing==3.1.2 ; python_version >= "3.10" and python_full_version < "3.13"
+python-dateutil==2.9.0.post0 ; python_version >= "3.10" and python_full_version < "3.13"
+pytz==2024.1 ; python_version >= "3.10" and python_full_version < "3.13"
+pyyaml==6.0.1 ; python_version >= "3.10" and python_full_version < "3.13"
+regex==2023.12.25 ; python_version >= "3.10" and python_full_version < "3.13"
+requests-oauthlib==1.4.1 ; python_version >= "3.10" and python_full_version < "3.13"
+requests==2.32.5 ; python_version >= "3.10" and python_full_version < "3.13"
+rich==12.6.0 ; python_version >= "3.10" and python_full_version < "3.13"
+rsa==4.9 ; python_version >= "3.10" and python_full_version < "3.13"
+s3transfer==0.16.0 ; python_version >= "3.10" and python_full_version < "3.13"
+setuptools==80.9.0 ; python_version >= "3.10" and python_full_version < "3.13"
+shellingham==1.5.4 ; python_version >= "3.10" and python_full_version < "3.13"
+six==1.16.0 ; python_version >= "3.10" and python_full_version < "3.13"
+slack-sdk==3.27.1 ; python_version >= "3.10" and python_full_version < "3.13"
+tenacity==9.0.0 ; python_version >= "3.10" and python_full_version < "3.13"
+typer==0.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
+typing-extensions==4.6.0 ; python_version >= "3.10" and python_full_version < "3.13"
+tzdata==2024.1 ; python_version >= "3.10" and python_full_version < "3.13"
+tzlocal==5.2 ; python_version >= "3.10" and python_full_version < "3.13"
+urllib3==2.6.2 ; python_version >= "3.10" and python_full_version < "3.13"
+websocket-client==1.7.0 ; python_version >= "3.10" and python_full_version < "3.13"
+zipp==3.20.2 ; python_version >= "3.10" and python_full_version < "3.13"
+# required for tests
+pytest-asyncio==0.23.7 ; python_version >= "3.10" and python_full_version < "3.13"