policy

Documentation

Index

• func ContainsVariablesOtherThanObject(policy kyverno.ClusterPolicy) error
• func Validate(policyRaw []byte, client *dclient.Client, mock bool, ...) error
• type Condition
• type PVControlInterface
• type PolicyController
  • func NewPolicyController(kyvernoClient *kyvernoclient.Clientset, client *client.Client, ...) (*PolicyController, error)
  • func (pc *PolicyController) Run(workers int, stopCh <-chan struct{})
• type RealPVControl
  • func (r RealPVControl) DeleteClusterPolicyViolation(name string) error
  • func (r RealPVControl) DeleteNamespacedPolicyViolation(ns, name string) error
• type ResourceManager
  • func NewResourceManager(rebuildTime int64) *ResourceManager
  • func (rm *ResourceManager) Drop()
  • func (rm *ResourceManager) ProcessResource(policy, pv, kind, ns, name, rv string) bool
  • func (rm *ResourceManager) RegisterResource(policy, pv, kind, ns, name, rv string)
• type Validation

Functions

func ContainsVariablesOtherThanObject

func ContainsVariablesOtherThanObject(policy kyverno.ClusterPolicy) error

ContainsVariablesOtherThanObject returns error if variable that does not start from request.object

func Validate

func Validate(policyRaw []byte, client *dclient.Client, mock bool, openAPIController *openapi.Controller) error

Validate does some initial check to verify some conditions - One operation per rule - ResourceDescription mandatory checks

Types

type Condition

type Condition int

Condition defines condition type

const (
	//NotEvaluate to not evaluate condition
	NotEvaluate Condition = 0
	// Process to evaluate condition
	Process Condition = 1
	// Skip to ignore/skip the condition
	Skip Condition = 2
)

type PVControlInterface

type PVControlInterface interface {
	DeleteClusterPolicyViolation(name string) error
	DeleteNamespacedPolicyViolation(ns, name string) error
}

PVControlInterface provides interface to operate on policy violation resource

type PolicyController

type PolicyController struct {
	// contains filtered or unexported fields
}

PolicyController is responsible for synchronizing Policy objects stored in the system with the corresponding policy violations

func NewPolicyController

func NewPolicyController(kyvernoClient *kyvernoclient.Clientset,
	client *client.Client,
	pInformer kyvernoinformer.ClusterPolicyInformer,
	npInformer kyvernoinformer.PolicyInformer,
	cpvInformer kyvernoinformer.ClusterPolicyViolationInformer,
	nspvInformer kyvernoinformer.PolicyViolationInformer,
	grInformer kyvernoinformer.GenerateRequestInformer,
	configHandler config.Interface, eventGen event.Interface,
	pvGenerator policyviolation.GeneratorInterface,
	resourceWebhookWatcher *webhookconfig.ResourceWebhookRegister,
	namespaces informers.NamespaceInformer,
	log logr.Logger,
	resCache resourcecache.ResourceCacheIface,
) (*PolicyController, error)

NewPolicyController create a new PolicyController

func (*PolicyController) Run

func (pc *PolicyController) Run(workers int, stopCh <-chan struct{})

Run begins watching and syncing.

type RealPVControl

type RealPVControl struct {
	Client   kyvernoclient.Interface
	Recorder record.EventRecorder
}

RealPVControl is the default implementation of PVControlInterface.

func (RealPVControl) DeleteClusterPolicyViolation

func (r RealPVControl) DeleteClusterPolicyViolation(name string) error

DeleteClusterPolicyViolation deletes the policy violation

func (RealPVControl) DeleteNamespacedPolicyViolation

func (r RealPVControl) DeleteNamespacedPolicyViolation(ns, name string) error

DeleteNamespacedPolicyViolation deletes the namespaced policy violation

type ResourceManager

type ResourceManager struct {
	// contains filtered or unexported fields
}

ResourceManager stores the details on already processed resources for caching

func NewResourceManager

func NewResourceManager(rebuildTime int64) *ResourceManager

NewResourceManager returns a new ResourceManager

func (*ResourceManager) Drop

func (rm *ResourceManager) Drop()

Drop drop the cache after every rebuild interval mins TODO: or drop based on the size

func (*ResourceManager) ProcessResource

func (rm *ResourceManager) ProcessResource(policy, pv, kind, ns, name, rv string) bool

ProcessResource returns true if the policy was not applied on the resource

func (*ResourceManager) RegisterResource

func (rm *ResourceManager) RegisterResource(policy, pv, kind, ns, name, rv string)

RegisterResource stores if the policy is processed on this resource version

type Validation

type Validation interface {
	Validate() (string, error)
}

Validation provides methods to validate a rule