engine

Documentation

Index

• func ApplyPatches(resource []byte, patches [][]byte) ([]byte, error)
• func FormAbsolutePath(referencePath, absolutePath string) string
• func Generate(client *client.Client, policy *v1alpha1.Policy, ns unstructured.Unstructured) []*info.RuleInfo
• func JoinPatches(patches [][]byte) []byte
• func ListResourcesThatApplyToPolicy(client *client.Client, policy *types.Policy, ...) map[string]resourceInfo
• func Mutate(policy kubepolicy.Policy, rawResource []byte, gvk metav1.GroupVersionKind) ([][]byte, []*info.RuleInfo)
• func ParseKindFromObject(bytes []byte) string
• func ParseNameFromObject(bytes []byte) string
• func ParseNamespaceFromObject(bytes []byte) string
• func ParseRegexPolicyResourceName(policyResourceName string) (string, bool)
• func ParseResourceInfoFromObject(rawResource []byte) string
• func ProcessExisting(client *client.Client, policy *types.Policy, ...) []*info.PolicyInfo
• func ProcessOverlay(rule kubepolicy.Rule, rawResource []byte, gvk metav1.GroupVersionKind) ([][]byte, error)
• func ProcessPatches(rule kubepolicy.Rule, resource []byte) (allPatches [][]byte, errs []error)
• func ResourceMeetsDescription(resourceRaw []byte, matches v1alpha1.ResourceDescription, ...) bool
• func Validate(policy kubepolicy.Policy, rawResource []byte, gvk metav1.GroupVersionKind) ([]*info.RuleInfo, error)
• func ValidateValueWithPattern(value, pattern interface{}) bool
• type ConditionAnchorValidationHandler
  • func (cavh *ConditionAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, ...) error
• type ExistanceAnchorValidationHandler
  • func (eavh *ExistanceAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, ...) error
• type NoAnchorValidationHandler
  • func (navh *NoAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, ...) error
• type Operator
• type ValidationAnchorHandler
  • func CreateAnchorHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler
  • func NewConditionAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler
  • func NewExistanceAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler
  • func NewNoAnchorValidationHandler(path string) ValidationAnchorHandler

Functions

func ApplyPatches

func ApplyPatches(resource []byte, patches [][]byte) ([]byte, error)

ApplyPatches patches given resource with given patches and returns patched document

func FormAbsolutePath

func FormAbsolutePath(referencePath, absolutePath string) string

FormAbsolutePath returns absolute path

func Generate

func Generate(client *client.Client, policy *v1alpha1.Policy, ns unstructured.Unstructured) []*info.RuleInfo

Generate apply generation rules on a resource

func JoinPatches

func JoinPatches(patches [][]byte) []byte

JoinPatches joins array of serialized JSON patches to the single JSONPatch array

func ListResourcesThatApplyToPolicy

func ListResourcesThatApplyToPolicy(client *client.Client, policy *types.Policy, filterK8Resources []utils.K8Resource) map[string]resourceInfo

ListResourcesThatApplyToPolicy returns list of resources that are filtered by policy rules

func Mutate

func Mutate(policy kubepolicy.Policy, rawResource []byte, gvk metav1.GroupVersionKind) ([][]byte, []*info.RuleInfo)

Mutate performs mutation. Overlay first and then mutation patches

func ParseKindFromObject

func ParseKindFromObject(bytes []byte) string

ParseKindFromObject get kind from resource

func ParseNameFromObject

func ParseNameFromObject(bytes []byte) string

ParseNameFromObject extracts resource name from JSON obj

func ParseNamespaceFromObject

func ParseNamespaceFromObject(bytes []byte) string

ParseNamespaceFromObject extracts the namespace from the JSON obj

func ParseRegexPolicyResourceName

func ParseRegexPolicyResourceName(policyResourceName string) (string, bool)

ParseRegexPolicyResourceName returns true if policyResourceName is a regexp

func ParseResourceInfoFromObject

func ParseResourceInfoFromObject(rawResource []byte) string

ParseResourceInfoFromObject get kind/namepace/name from resource

func ProcessExisting

func ProcessExisting(client *client.Client, policy *types.Policy, filterK8Resources []utils.K8Resource) []*info.PolicyInfo

ProcessExisting checks for mutation and validation violations of existing resources

func ProcessOverlay

func ProcessOverlay(rule kubepolicy.Rule, rawResource []byte, gvk metav1.GroupVersionKind) ([][]byte, error)

ProcessOverlay handles validating admission request Checks the target resources for rules defined in the policy

func ProcessPatches

func ProcessPatches(rule kubepolicy.Rule, resource []byte) (allPatches [][]byte, errs []error)

ProcessPatches Returns array from separate patches that can be applied to the document Returns error ONLY in case when creation of resource should be denied.

func ResourceMeetsDescription

func ResourceMeetsDescription(resourceRaw []byte, matches v1alpha1.ResourceDescription, exclude v1alpha1.ResourceDescription, gvk metav1.GroupVersionKind) bool

ResourceMeetsDescription checks requests kind, name and labels to fit the policy rule

func Validate

func Validate(policy kubepolicy.Policy, rawResource []byte, gvk metav1.GroupVersionKind) ([]*info.RuleInfo, error)

Validate handles validating admission request Checks the target resources for rules defined in the policy

func ValidateValueWithPattern

func ValidateValueWithPattern(value, pattern interface{}) bool

ValidateValueWithPattern validates value with operators and wildcards

Types

type ConditionAnchorValidationHandler

type ConditionAnchorValidationHandler struct {
	// contains filtered or unexported fields
}

ConditionAnchorValidationHandler performs validation only for array elements that pass condition in the anchor (key): value

func (*ConditionAnchorValidationHandler) Handle

func (cavh *ConditionAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error

Handle performs validation in context of ConditionAnchorValidationHandler

type ExistanceAnchorValidationHandler

type ExistanceAnchorValidationHandler struct {
	// contains filtered or unexported fields
}

ExistanceAnchorValidationHandler performs validation only for array elements that pass condition in the anchor AND requires an existance of at least one element that passes this condition ^(key): value

func (*ExistanceAnchorValidationHandler) Handle

func (eavh *ExistanceAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error

Handle performs validation in context of ExistanceAnchorValidationHandler

type NoAnchorValidationHandler

type NoAnchorValidationHandler struct {
	// contains filtered or unexported fields
}

NoAnchorValidationHandler just calls validateMap because no anchors were found in the pattern map

func (*NoAnchorValidationHandler) Handle

func (navh *NoAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error

Handle performs validation in context of NoAnchorValidationHandler

type Operator

type Operator string

Operator is string alias that represents selection operators enum

const (
	// Equal stands for ==
	Equal Operator = ""
	// MoreEqual stands for >=
	MoreEqual Operator = ">="
	// LessEqual stands for <=
	LessEqual Operator = "<="
	// NotEqual stands for !
	NotEqual Operator = "!"
	// More stands for >
	More Operator = ">"
	// Less stands for <
	Less Operator = "<"
)

type ValidationAnchorHandler

type ValidationAnchorHandler interface {
	Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error
}

ValidationAnchorHandler is an interface that represents a family of anchor handlers for array of maps resourcePart must be an array of dictionaries patternPart must be a dictionary with anchors

func CreateAnchorHandler

func CreateAnchorHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler

CreateAnchorHandler is a factory that create anchor handlers

func NewConditionAnchorValidationHandler

func NewConditionAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler

NewConditionAnchorValidationHandler creates new instance of NoAnchorValidationHandler

func NewExistanceAnchorValidationHandler

func NewExistanceAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler

NewExistanceAnchorValidationHandler creates new instance of NoAnchorValidationHandler

func NewNoAnchorValidationHandler

func NewNoAnchorValidationHandler(path string) ValidationAnchorHandler

NewNoAnchorValidationHandler creates new instance of NoAnchorValidationHandler