engine

Documentation

Index

• Constants
• func AddResourceToContext(logger logr.Logger, contextEntries []kyverno.ContextEntry, ...) error
• func ForceMutate(ctx context.EvalInterface, policy kyverno.ClusterPolicy, ...) (unstructured.Unstructured, error)
• func Generate(policyContext PolicyContext) (resp *response.EngineResponse)
• func ManagedPodResource(policy kyverno.ClusterPolicy, resource unstructured.Unstructured) bool
• func MatchesResourceDescription(resourceRef unstructured.Unstructured, ruleRef kyverno.Rule, ...) error
• func Mutate(policyContext *PolicyContext) (resp *response.EngineResponse)
• func Validate(policyContext *PolicyContext) (resp *response.EngineResponse)
• type EngineStats
• type PolicyContext

Constants

const (
	// PodControllerCronJob represent CronJob string
	PodControllerCronJob = "CronJob"
	//PodControllers stores the list of Pod-controllers in csv string
	PodControllers = "DaemonSet,Deployment,Job,StatefulSet,CronJob"
	//PodControllersAnnotation defines the annotation key for Pod-Controllers
	PodControllersAnnotation = "pod-policies.kyverno.io/autogen-controllers"
)

Functions

func AddResourceToContext

func AddResourceToContext(logger logr.Logger, contextEntries []kyverno.ContextEntry, resCache resourcecache.ResourceCacheIface, ctx *context.Context) error

AddResourceToContext - Add the Configmap JSON to Context. it will read configmaps (can be extended to get other type of resource like secrets, namespace etc) from the informer cache and add the configmap data to context

func ForceMutate

func ForceMutate(ctx context.EvalInterface, policy kyverno.ClusterPolicy, resource unstructured.Unstructured) (unstructured.Unstructured, error)

ForceMutate does not check any conditions, it simply mutates the given resource

func Generate

func Generate(policyContext PolicyContext) (resp *response.EngineResponse)

Generate checks for validity of generate rule on the resource 1. validate variables to be substitute in the general ruleInfo (match,exclude,condition)

• the caller has to check the ruleResponse to determine whether the path exist

2. returns the list of rules that are applicable on this policy and resource, if 1 succeed

func ManagedPodResource

func ManagedPodResource(policy kyverno.ClusterPolicy, resource unstructured.Unstructured) bool

ManagedPodResource returns true: - if the policy has auto-gen annotation && resource == Pod - if the auto-gen contains cronJob && resource == Job

func MatchesResourceDescription

func MatchesResourceDescription(resourceRef unstructured.Unstructured, ruleRef kyverno.Rule, admissionInfoRef kyverno.RequestInfo, dynamicConfig []string) error

MatchesResourceDescription checks if the resource matches resource description of the rule or not

func Mutate

func Mutate(policyContext *PolicyContext) (resp *response.EngineResponse)

Mutate performs mutation. Overlay first and then mutation patches

func Validate

func Validate(policyContext *PolicyContext) (resp *response.EngineResponse)

Validate applies validation rules from policy on the resource

Types

type EngineStats

type EngineStats struct {
	// average time required to process the policy rules on a resource
	ExecutionTime time.Duration
	// Count of rules that were applied successfully
	RulesAppliedCount int
}

EngineStats stores in the statistics for a single application of resource

type PolicyContext

type PolicyContext struct {

	// Policy is the policy to be processed
	Policy kyverno.ClusterPolicy

	// NewResource is the resource to be processed
	NewResource unstructured.Unstructured

	// OldResource is the prior resource for an update, or nil
	OldResource unstructured.Unstructured

	// AdmissionInfo contains the admission request information
	AdmissionInfo kyverno.RequestInfo

	// Dynamic client - used by generate
	Client *client.Client

	// Config handler
	ExcludeGroupRole []string

	ExcludeResourceFunc func(kind, namespace, name string) bool

	// ResourceCache provides listers to resources. Currently Supports Configmap
	ResourceCache resourcecache.ResourceCacheIface

	// JSONContext is the variable context
	JSONContext *context.Context
}

PolicyContext contains the contexts for engine to process