engine

Documentation

Index

• func ApplyPatches(resource []byte, patches [][]byte) ([]byte, error)
• func ConvertToUnstructured(data []byte) (*unstructured.Unstructured, error)
• func FormAbsolutePath(referencePath, absolutePath string) string
• func JoinPatches(patches [][]byte) []byte
• func MatchesResourceDescription(resource unstructured.Unstructured, rule kyverno.Rule) bool
• func ParseKindFromObject(bytes []byte) string
• func ParseNameFromObject(bytes []byte) string
• func ParseNamespaceFromObject(bytes []byte) string
• func ParseResourceInfoFromObject(rawResource []byte) string
• func ValidateValueWithPattern(value, pattern interface{}) bool
• type ConditionAnchorValidationHandler
  • func (cavh *ConditionAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, ...) error
• type EngineResponse
  • func Generate(client *client.Client, policy kyverno.Policy, ns unstructured.Unstructured) (response EngineResponse)
  • func Mutate(policy kyverno.Policy, resource unstructured.Unstructured) (response EngineResponse)
  • func Validate(policy kyverno.Policy, resource unstructured.Unstructured) (response EngineResponse)
• type EngineStats
• type ExistanceAnchorValidationHandler
  • func (eavh *ExistanceAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, ...) error
• type NoAnchorValidationHandler
  • func (navh *NoAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, ...) error
• type Operator
• type ValidationAnchorHandler
  • func CreateAnchorHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler
  • func NewConditionAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler
  • func NewExistanceAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler
  • func NewNoAnchorValidationHandler(path string) ValidationAnchorHandler

Functions

func ApplyPatches

func ApplyPatches(resource []byte, patches [][]byte) ([]byte, error)

ApplyPatches patches given resource with given patches and returns patched document

func ConvertToUnstructured

func ConvertToUnstructured(data []byte) (*unstructured.Unstructured, error)

func FormAbsolutePath

func FormAbsolutePath(referencePath, absolutePath string) string

FormAbsolutePath returns absolute path

func JoinPatches

func JoinPatches(patches [][]byte) []byte

JoinPatches joins array of serialized JSON patches to the single JSONPatch array

func MatchesResourceDescription

func MatchesResourceDescription(resource unstructured.Unstructured, rule kyverno.Rule) bool

MatchesResourceDescription checks if the resource matches resource desription of the rule or not

func ParseKindFromObject

func ParseKindFromObject(bytes []byte) string

ParseKindFromObject get kind from resource

func ParseNameFromObject

func ParseNameFromObject(bytes []byte) string

ParseNameFromObject extracts resource name from JSON obj

func ParseNamespaceFromObject

func ParseNamespaceFromObject(bytes []byte) string

ParseNamespaceFromObject extracts the namespace from the JSON obj

func ParseResourceInfoFromObject

func ParseResourceInfoFromObject(rawResource []byte) string

ParseResourceInfoFromObject get kind/namepace/name from resource

func ValidateValueWithPattern

func ValidateValueWithPattern(value, pattern interface{}) bool

ValidateValueWithPattern validates value with operators and wildcards

Types

type ConditionAnchorValidationHandler

type ConditionAnchorValidationHandler struct {
	// contains filtered or unexported fields
}

ConditionAnchorValidationHandler performs validation only for array elements that pass condition in the anchor (key): value

func (*ConditionAnchorValidationHandler) Handle

func (cavh *ConditionAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error

Handle performs validation in context of ConditionAnchorValidationHandler

type EngineResponse

type EngineResponse struct {
	Patches         [][]byte
	PatchedResource unstructured.Unstructured
	RuleInfos       []info.RuleInfo
	EngineStats
}

EngineResponse provides the response to the application of a policy rule set on a resource

func Generate

func Generate(client *client.Client, policy kyverno.Policy, ns unstructured.Unstructured) (response EngineResponse)

Generate apply generation rules on a resource

func Mutate

func Mutate(policy kyverno.Policy, resource unstructured.Unstructured) (response EngineResponse)

func Validate

func Validate(policy kyverno.Policy, resource unstructured.Unstructured) (response EngineResponse)

Validate handles validating admission request Checks the target resources for rules defined in the policy

type EngineStats

type EngineStats struct {
	// average time required to process the policy rules on a resource
	ExecutionTime time.Duration
	// Count of rules that were applied succesfully
	RulesAppliedCount int
}

EngineStats stores in the statistics for a single application of resource

type ExistanceAnchorValidationHandler

type ExistanceAnchorValidationHandler struct {
	// contains filtered or unexported fields
}

ExistanceAnchorValidationHandler performs validation only for array elements that pass condition in the anchor AND requires an existance of at least one element that passes this condition ^(key): value

func (*ExistanceAnchorValidationHandler) Handle

func (eavh *ExistanceAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error

Handle performs validation in context of ExistanceAnchorValidationHandler

type NoAnchorValidationHandler

type NoAnchorValidationHandler struct {
	// contains filtered or unexported fields
}

NoAnchorValidationHandler just calls validateMap because no anchors were found in the pattern map

func (*NoAnchorValidationHandler) Handle

func (navh *NoAnchorValidationHandler) Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error

Handle performs validation in context of NoAnchorValidationHandler

type Operator

type Operator string

Operator is string alias that represents selection operators enum

const (
	// Equal stands for ==
	Equal Operator = ""
	// MoreEqual stands for >=
	MoreEqual Operator = ">="
	// LessEqual stands for <=
	LessEqual Operator = "<="
	// NotEqual stands for !
	NotEqual Operator = "!"
	// More stands for >
	More Operator = ">"
	// Less stands for <
	Less Operator = "<"
)

type ValidationAnchorHandler

type ValidationAnchorHandler interface {
	Handle(resourcePart []interface{}, patternPart map[string]interface{}, originPattern interface{}) error
}

ValidationAnchorHandler is an interface that represents a family of anchor handlers for array of maps resourcePart must be an array of dictionaries patternPart must be a dictionary with anchors

func CreateAnchorHandler

func CreateAnchorHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler

CreateAnchorHandler is a factory that create anchor handlers

func NewConditionAnchorValidationHandler

func NewConditionAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler

NewConditionAnchorValidationHandler creates new instance of NoAnchorValidationHandler

func NewExistanceAnchorValidationHandler

func NewExistanceAnchorValidationHandler(anchor string, pattern interface{}, path string) ValidationAnchorHandler

NewExistanceAnchorValidationHandler creates new instance of NoAnchorValidationHandler

func NewNoAnchorValidationHandler

func NewNoAnchorValidationHandler(path string) ValidationAnchorHandler

NewNoAnchorValidationHandler creates new instance of NoAnchorValidationHandler