policy

Documentation

Index

• Constants
• func LoadPoliciesData(policyPath []string) ([]string, error)
• type Loader
  • func NewPolicyLoader(pr string, cache gcache.Cache, opts ...mp.Option) Loader
• type Policies
  • func NewPolicies(data map[string]string, cac configauditreport.ConfigAuditConfig, ...) *Policies
  • func (p *Policies) Applicable(resourceKind string) (bool, string, error)
  • func (p *Policies) Eval(ctx context.Context, resource client.Object, inputs ...[]byte) (scan.Results, error)
  • func (p *Policies) ExternalPoliciesApplicable(resourceKind string) (bool, error)
  • func (r *Policies) GetResultID(result scan.Result) string
  • func (r *Policies) HasSeverity(resultSeverity severity.Severity) bool
  • func (p *Policies) Hash(kind string) (string, error)
  • func (p *Policies) Libraries() map[string]string
  • func (p *Policies) ModulesByKind(kind string) (map[string]string, error)
  • func (p *Policies) PoliciesByKind(kind string) (map[string]string, error)
  • func (p *Policies) SupportedKind(resource client.Object, rbacDEnable bool) (bool, error)

Constants

const (
	PoliciesNotFoundError = "failed to load rego policies from [externalPolicies]: stat externalPolicies: file does not exist"
)

Functions

func LoadPoliciesData

func LoadPoliciesData(policyPath []string) ([]string, error)

Types

type Loader

type Loader interface {
	GetPolicies() ([]string, error)
}

func NewPolicyLoader

func NewPolicyLoader(pr string, cache gcache.Cache, opts ...mp.Option) Loader

type Policies

type Policies struct {
	// contains filtered or unexported fields
}

func NewPolicies

func NewPolicies(data map[string]string, cac configauditreport.ConfigAuditConfig, log logr.Logger, pl Loader, serverVersion string) *Policies

func (*Policies) Applicable

func (p *Policies) Applicable(resourceKind string) (bool, string, error)

Applicable check if policies exist either built in or via policies configmap

func (*Policies) Eval

func (p *Policies) Eval(ctx context.Context, resource client.Object, inputs ...[]byte) (scan.Results, error)

Eval evaluates Rego policies with Kubernetes resource client.Object as input.

func (*Policies) ExternalPoliciesApplicable

func (p *Policies) ExternalPoliciesApplicable(resourceKind string) (bool, error)

func (*Policies) GetResultID

func (r *Policies) GetResultID(result scan.Result) string

GetResultID return the result id found in aliases (legacy) otherwise use AvdID

func (*Policies) HasSeverity

func (r *Policies) HasSeverity(resultSeverity severity.Severity) bool

func (*Policies) Hash

func (p *Policies) Hash(kind string) (string, error)

func (*Policies) Libraries

func (p *Policies) Libraries() map[string]string

func (*Policies) ModulesByKind

func (p *Policies) ModulesByKind(kind string) (map[string]string, error)

func (*Policies) PoliciesByKind

func (p *Policies) PoliciesByKind(kind string) (map[string]string, error)

func (*Policies) SupportedKind

func (p *Policies) SupportedKind(resource client.Object, rbacDEnable bool) (bool, error)

SupportedKind scan policies supported for this kind