validatingadmissionpolicy

Documentation

Index

• func BuildValidatingAdmissionPolicy(discoveryClient dclient.IDiscovery, ...) error
• func BuildValidatingAdmissionPolicyBinding(vapbinding *admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding, ...) error
• func CanGenerateVAP(spec *kyvernov1.Spec, exceptions []kyvernov2.PolicyException) (bool, string)
• func ConvertMatchConditionsV1(v1beta1conditions []admissionregistrationv1beta1.MatchCondition) []admissionregistrationv1.MatchCondition
• func ConvertValidatingAdmissionPolicy(v1beta1policy admissionregistrationv1beta1.ValidatingAdmissionPolicy) admissionregistrationv1.ValidatingAdmissionPolicy
• func ConvertValidatingAdmissionPolicyBinding(v1beta1binding admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding) admissionregistrationv1.ValidatingAdmissionPolicyBinding
• func GetKinds(policy admissionregistrationv1beta1.ValidatingAdmissionPolicy) []string
• func HasValidatingAdmissionPolicyBindingPermission(s checker.AuthChecker) bool
• func HasValidatingAdmissionPolicyPermission(s checker.AuthChecker) bool
• func IsValidatingAdmissionPolicyRegistered(kubeClient kubernetes.Interface) (bool, error)
• func NewCustomNamespaceLister(dClient dclient.Interface) corev1listers.NamespaceLister
• func Validate(policyData PolicyData, resource unstructured.Unstructured, ...) (engineapi.EngineResponse, error)
• type CustomNamespaceLister
  • func (c *CustomNamespaceLister) Get(name string) (*corev1.Namespace, error)
  • func (c *CustomNamespaceLister) List(selector labels.Selector) (ret []*corev1.Namespace, err error)
• type PolicyData
  • func NewPolicyData(policy admissionregistrationv1beta1.ValidatingAdmissionPolicy) PolicyData
  • func (p *PolicyData) AddBinding(binding admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding)
  • func (p *PolicyData) GetBindings() []admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding
  • func (p *PolicyData) GetDefinition() admissionregistrationv1beta1.ValidatingAdmissionPolicy

Functions

func BuildValidatingAdmissionPolicy

func BuildValidatingAdmissionPolicy(
	discoveryClient dclient.IDiscovery,
	vap *admissionregistrationv1beta1.ValidatingAdmissionPolicy,
	cpol kyvernov1.PolicyInterface,
	exceptions []kyvernov2.PolicyException,
) error

BuildValidatingAdmissionPolicy is used to build a Kubernetes ValidatingAdmissionPolicy from a Kyverno policy

func BuildValidatingAdmissionPolicyBinding

func BuildValidatingAdmissionPolicyBinding(
	vapbinding *admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding,
	cpol kyvernov1.PolicyInterface,
) error

BuildValidatingAdmissionPolicyBinding is used to build a Kubernetes ValidatingAdmissionPolicyBinding from a Kyverno policy

func CanGenerateVAP

func CanGenerateVAP(spec *kyvernov1.Spec, exceptions []kyvernov2.PolicyException) (bool, string)

CanGenerateVAP check if Kyverno policy and a PolicyException can be translated to a Kubernetes ValidatingAdmissionPolicy

func ConvertMatchConditionsV1

func ConvertMatchConditionsV1(v1beta1conditions []admissionregistrationv1beta1.MatchCondition) []admissionregistrationv1.MatchCondition

func ConvertValidatingAdmissionPolicy

func ConvertValidatingAdmissionPolicy(v1beta1policy admissionregistrationv1beta1.ValidatingAdmissionPolicy) admissionregistrationv1.ValidatingAdmissionPolicy

ConvertValidatingAdmissionPolicy is used to convert v1beta1 of ValidatingAdmissionPolicy to v1

func ConvertValidatingAdmissionPolicyBinding

func ConvertValidatingAdmissionPolicyBinding(v1beta1binding admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding) admissionregistrationv1.ValidatingAdmissionPolicyBinding

ConvertValidatingAdmissionPolicyBinding is used to convert v1beta1 of ValidatingAdmissionPolicyBinding to v1.

func GetKinds

func GetKinds(policy admissionregistrationv1beta1.ValidatingAdmissionPolicy) []string

func HasValidatingAdmissionPolicyBindingPermission

func HasValidatingAdmissionPolicyBindingPermission(s checker.AuthChecker) bool

HasValidatingAdmissionPolicyBindingPermission check if the admission controller has the required permissions to generate Kubernetes ValidatingAdmissionPolicyBinding

func HasValidatingAdmissionPolicyPermission

func HasValidatingAdmissionPolicyPermission(s checker.AuthChecker) bool

HasValidatingAdmissionPolicyPermission check if the admission controller has the required permissions to generate Kubernetes ValidatingAdmissionPolicy

func IsValidatingAdmissionPolicyRegistered

func IsValidatingAdmissionPolicyRegistered(kubeClient kubernetes.Interface) (bool, error)

IsValidatingAdmissionPolicyRegistered checks if ValidatingAdmissionPolicies are registered in the API Server

func NewCustomNamespaceLister

func NewCustomNamespaceLister(dClient dclient.Interface) corev1listers.NamespaceLister

func Validate

func Validate(
	policyData PolicyData,
	resource unstructured.Unstructured,
	namespaceSelectorMap map[string]map[string]string,
	client dclient.Interface,
) (engineapi.EngineResponse, error)

Types

type CustomNamespaceLister

type CustomNamespaceLister struct {
	// contains filtered or unexported fields
}

func (*CustomNamespaceLister) Get

func (c *CustomNamespaceLister) Get(name string) (*corev1.Namespace, error)

func (*CustomNamespaceLister) List

func (c *CustomNamespaceLister) List(selector labels.Selector) (ret []*corev1.Namespace, err error)

type PolicyData

type PolicyData struct {
	// contains filtered or unexported fields
}

Everything someone might need to validate a single ValidatingPolicyDefinition against all of its registered bindings.

func NewPolicyData

func NewPolicyData(policy admissionregistrationv1beta1.ValidatingAdmissionPolicy) PolicyData

func (*PolicyData) AddBinding

func (p *PolicyData) AddBinding(binding admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding)

func (*PolicyData) GetBindings

func (p *PolicyData) GetBindings() []admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding

func (*PolicyData) GetDefinition

func (p *PolicyData) GetDefinition() admissionregistrationv1beta1.ValidatingAdmissionPolicy