engine

Documentation

Index

• Constants
• func AddResourceToContext(logger logr.Logger, contextEntries []kyverno.ContextEntry, ...) error
• func ForceMutate(ctx context.EvalInterface, policy kyverno.ClusterPolicy, ...) (unstructured.Unstructured, error)
• func Generate(policyContext PolicyContext) (resp response.EngineResponse)
• func MatchesResourceDescription(resourceRef unstructured.Unstructured, ruleRef kyverno.Rule, ...) error
• func Mutate(policyContext PolicyContext) (resp response.EngineResponse)
• func SkipPolicyApplication(policy kyverno.ClusterPolicy, resource unstructured.Unstructured) bool
• func Validate(policyContext PolicyContext) (resp response.EngineResponse)
• type EngineStats
• type PolicyContext

Constants

const (
	// PodControllerCronJob represent CronJob string
	PodControllerCronJob = "CronJob"
	//PodControllers stores the list of Pod-controllers in csv string
	PodControllers = "DaemonSet,Deployment,Job,StatefulSet,CronJob"
	//PodControllersAnnotation defines the annotation key for Pod-Controllers
	PodControllersAnnotation = "pod-policies.kyverno.io/autogen-controllers"
)

Functions

func AddResourceToContext

func AddResourceToContext(logger logr.Logger, contextEntries []kyverno.ContextEntry, resCache resourcecache.ResourceCacheIface, ctx *context.Context) error

AddResourceToContext - Add the Configmap JSON to Context. it will read configmaps (can be extended to get other type of resource like secrets, namespace etc) from the informer cache and add the configmap data to context

func ForceMutate

func ForceMutate(ctx context.EvalInterface, policy kyverno.ClusterPolicy, resource unstructured.Unstructured) (unstructured.Unstructured, error)

ForceMutate does not check any conditions, it simply mutates the given resource

func Generate

func Generate(policyContext PolicyContext) (resp response.EngineResponse)

Generate checks for validity of generate rule on the resource 1. validate variables to be susbtitute in the general ruleInfo (match,exclude,condition)

• the caller has to check the ruleResponse to determine whether the path exist

2. returns the list of rules that are applicable on this policy and resource, if 1 succeed

func MatchesResourceDescription

func MatchesResourceDescription(resourceRef unstructured.Unstructured, ruleRef kyverno.Rule, admissionInfoRef kyverno.RequestInfo, dynamicConfig []string) error

MatchesResourceDescription checks if the resource matches resource description of the rule or not

func Mutate

func Mutate(policyContext PolicyContext) (resp response.EngineResponse)

Mutate performs mutation. Overlay first and then mutation patches

func SkipPolicyApplication

func SkipPolicyApplication(policy kyverno.ClusterPolicy, resource unstructured.Unstructured) bool

SkipPolicyApplication returns true: - if the policy has auto-gen annotation && resource == Pod - if the auto-gen contains cronJob && resource == Job

func Validate

func Validate(policyContext PolicyContext) (resp response.EngineResponse)

Validate applies validation rules from policy on the resource

Types

type EngineStats

type EngineStats struct {
	// average time required to process the policy rules on a resource
	ExecutionTime time.Duration
	// Count of rules that were applied successfully
	RulesAppliedCount int
}

EngineStats stores in the statistics for a single application of resource

type PolicyContext

type PolicyContext struct {
	// policy to be processed
	Policy kyverno.ClusterPolicy
	// resource to be processed
	NewResource unstructured.Unstructured
	// old Resource - Update operations
	OldResource   unstructured.Unstructured
	AdmissionInfo kyverno.RequestInfo
	// Dynamic client - used by generate
	Client *client.Client
	// Contexts to store resources
	Context context.EvalInterface
	// Config handler
	ExcludeGroupRole []string

	// ResourceCache provides listers to resources
	// Currently Supports Configmap
	ResourceCache resourcecache.ResourceCacheIface
	// JSONContext ...
	JSONContext *context.Context
}

PolicyContext contains the contexts for engine to process