engine

Documentation

Index

• func ApplyBackgroundChecks(policyContext *PolicyContext) (resp *response.EngineResponse)
• func ForceMutate(ctx context.Interface, policy kyverno.PolicyInterface, ...) (unstructured.Unstructured, error)
• func GenerateResponse(policyContext *PolicyContext, gr urkyverno.UpdateRequest) (resp *response.EngineResponse)
• func LoadContext(logger logr.Logger, contextEntries []kyverno.ContextEntry, ctx *PolicyContext, ...) error
• func ManagedPodResource(policy kyverno.PolicyInterface, resource unstructured.Unstructured) bool
• func MatchesResourceDescription(resourceRef unstructured.Unstructured, ruleRef kyverno.Rule, ...) error
• func Mutate(policyContext *PolicyContext) (resp *response.EngineResponse)
• func Validate(policyContext *PolicyContext) (resp *response.EngineResponse)
• type APIPath
  • func NewAPIPath(path string) (*APIPath, error)
  • func (a *APIPath) String() string
• type EngineStats
• type ImageVerificationMetadata
  • func VerifyAndPatchImages(policyContext *PolicyContext) (*response.EngineResponse, *ImageVerificationMetadata)
  • func (ivm *ImageVerificationMetadata) IsEmpty() bool
  • func (ivm *ImageVerificationMetadata) Merge(other *ImageVerificationMetadata)
  • func (ivm *ImageVerificationMetadata) Patches(hasAnnotations bool, log logr.Logger) ([][]byte, error)
• type PolicyContext
  • func (pc *PolicyContext) Copy() *PolicyContext

Functions

func ApplyBackgroundChecks

func ApplyBackgroundChecks(policyContext *PolicyContext) (resp *response.EngineResponse)

ApplyBackgroundChecks checks for validity of generate and mutateExisting rules on the resource 1. validate variables to be substitute in the general ruleInfo (match,exclude,condition)

• the caller has to check the ruleResponse to determine whether the path exist

2. returns the list of rules that are applicable on this policy and resource, if 1 succeed

func ForceMutate

func ForceMutate(ctx context.Interface, policy kyverno.PolicyInterface, resource unstructured.Unstructured) (unstructured.Unstructured, error)

ForceMutate does not check any conditions, it simply mutates the given resource It is used to validate mutation logic, and for tests.

func GenerateResponse

func GenerateResponse(policyContext *PolicyContext, gr urkyverno.UpdateRequest) (resp *response.EngineResponse)

GenerateResponse checks for validity of generate rule on the resource

func LoadContext

func LoadContext(logger logr.Logger, contextEntries []kyverno.ContextEntry, ctx *PolicyContext, ruleName string) error

LoadContext - Fetches and adds external data to the Context.

func ManagedPodResource

func ManagedPodResource(policy kyverno.PolicyInterface, resource unstructured.Unstructured) bool

ManagedPodResource returns true: - if the policy has auto-gen annotation && resource == Pod - if the auto-gen contains cronJob && resource == Job

func MatchesResourceDescription

func MatchesResourceDescription(resourceRef unstructured.Unstructured, ruleRef kyverno.Rule, admissionInfoRef urkyverno.RequestInfo, dynamicConfig []string, namespaceLabels map[string]string, policyNamespace string) error

MatchesResourceDescription checks if the resource matches resource description of the rule or not

func Mutate

func Mutate(policyContext *PolicyContext) (resp *response.EngineResponse)

Mutate performs mutation. Overlay first and then mutation patches

func Validate

func Validate(policyContext *PolicyContext) (resp *response.EngineResponse)

Validate applies validation rules from policy on the resource

Types

type APIPath

type APIPath struct {
	Root         string
	Group        string
	Version      string
	ResourceType string
	Name         string
	Namespace    string
}

func NewAPIPath

func NewAPIPath(path string) (*APIPath, error)

NewAPIPath validates and parses an API path. See: https://kubernetes.io/docs/reference/using-api/api-concepts/

func (*APIPath) String

func (a *APIPath) String() string

type EngineStats

type EngineStats struct {
	// average time required to process the policy rules on a resource
	ExecutionTime time.Duration
	// Count of rules that were applied successfully
	RulesAppliedCount int
}

EngineStats stores in the statistics for a single application of resource

type ImageVerificationMetadata

type ImageVerificationMetadata struct {
	Data map[string]bool `json:"data"`
}

func VerifyAndPatchImages

func VerifyAndPatchImages(policyContext *PolicyContext) (*response.EngineResponse, *ImageVerificationMetadata)

func (*ImageVerificationMetadata) IsEmpty

func (ivm *ImageVerificationMetadata) IsEmpty() bool

func (*ImageVerificationMetadata) Merge

func (ivm *ImageVerificationMetadata) Merge(other *ImageVerificationMetadata)

func (*ImageVerificationMetadata) Patches

func (ivm *ImageVerificationMetadata) Patches(hasAnnotations bool, log logr.Logger) ([][]byte, error)

type PolicyContext

type PolicyContext struct {
	// Policy is the policy to be processed
	Policy kyverno.PolicyInterface

	// NewResource is the resource to be processed
	NewResource unstructured.Unstructured

	// OldResource is the prior resource for an update, or nil
	OldResource unstructured.Unstructured

	// Element is set when the context is used for processing a foreach loop
	Element unstructured.Unstructured

	// AdmissionInfo contains the admission request information
	AdmissionInfo urkyverno.RequestInfo

	// Dynamic client - used for api lookups
	Client client.Interface

	// Config handler
	ExcludeGroupRole []string

	ExcludeResourceFunc func(kind, namespace, name string) bool

	// JSONContext is the variable context
	JSONContext context.Interface

	// NamespaceLabels stores the label of namespace to be processed by namespace selector
	NamespaceLabels map[string]string

	// AdmissionOperation represents if the caller is from the webhook server
	AdmissionOperation bool
}

PolicyContext contains the contexts for engine to process

func (*PolicyContext) Copy

func (pc *PolicyContext) Copy() *PolicyContext