policy

Documentation

Index

• func MergeResources(a, b map[string]unstructured.Unstructured)
• func ParseNamespacedPolicy(key string) (string, string, bool)
• func Validate(policy kyvernov1.PolicyInterface, client dclient.Interface, mock bool, ...) (*admissionv1.AdmissionResponse, error)
• func ValidateOnPolicyUpdate(p kyvernov1.PolicyInterface, onPolicyUpdate bool) error
• func ValidateVariables(p kyvernov1.PolicyInterface, backgroundMode bool) error
• type Condition
• type PolicyController
  • func NewPolicyController(kyvernoClient versioned.Interface, client dclient.Interface, ...) (*PolicyController, error)
  • func (pc *PolicyController) Run(workers int, stopCh <-chan struct{})
• type ResourceManager
  • func NewResourceManager(rebuildTime int64) *ResourceManager
  • func (rm *ResourceManager) Drop()
  • func (rm *ResourceManager) GetScope(kind string) (bool, error)
  • func (rm *ResourceManager) ProcessResource(policy, pv, kind, ns, name, rv string) bool
  • func (rm *ResourceManager) RegisterResource(policy, pv, kind, ns, name, rv string)
  • func (rm *ResourceManager) RegisterScope(kind string, namespaced bool)
• type Validation

Functions

func MergeResources

func MergeResources(a, b map[string]unstructured.Unstructured)

MergeResources merges b into a map

func ParseNamespacedPolicy

func ParseNamespacedPolicy(key string) (string, string, bool)

func Validate

func Validate(policy kyvernov1.PolicyInterface, client dclient.Interface, mock bool, openAPIController *openapi.Controller) (*admissionv1.AdmissionResponse, error)

Validate checks the policy and rules declarations for required configurations

func ValidateOnPolicyUpdate

func ValidateOnPolicyUpdate(p kyvernov1.PolicyInterface, onPolicyUpdate bool) error

func ValidateVariables

func ValidateVariables(p kyvernov1.PolicyInterface, backgroundMode bool) error

Types

type Condition

type Condition int

Condition defines condition type

const (
	// NotEvaluate to not evaluate condition
	NotEvaluate Condition = 0
	// Process to evaluate condition
	Process Condition = 1
	// Skip to ignore/skip the condition
	Skip Condition = 2
)

type PolicyController

type PolicyController struct {
	// contains filtered or unexported fields
}

PolicyController is responsible for synchronizing Policy objects stored in the system with the corresponding policy violations

func NewPolicyController

func NewPolicyController(
	kyvernoClient versioned.Interface,
	client dclient.Interface,
	pInformer kyvernov1informers.ClusterPolicyInformer,
	npInformer kyvernov1informers.PolicyInformer,
	urInformer kyvernov1beta1informers.UpdateRequestInformer,
	configHandler config.Configuration,
	eventGen event.Interface,
	namespaces corev1informers.NamespaceInformer,
	log logr.Logger,
	reconcilePeriod time.Duration,
	metricsConfig *metrics.MetricsConfig,
) (*PolicyController, error)

NewPolicyController create a new PolicyController

func (*PolicyController) Run

func (pc *PolicyController) Run(workers int, stopCh <-chan struct{})

Run begins watching and syncing.

type ResourceManager

type ResourceManager struct {
	// contains filtered or unexported fields
}

ResourceManager stores the details on already processed resources for caching

func NewResourceManager

func NewResourceManager(rebuildTime int64) *ResourceManager

NewResourceManager returns a new ResourceManager

func (*ResourceManager) Drop

func (rm *ResourceManager) Drop()

Drop drop the cache after every rebuild interval mins

func (*ResourceManager) GetScope

func (rm *ResourceManager) GetScope(kind string) (bool, error)

GetScope gets the scope of the given kind return error if kind is not registered

func (*ResourceManager) ProcessResource

func (rm *ResourceManager) ProcessResource(policy, pv, kind, ns, name, rv string) bool

ProcessResource returns true if the policy was not applied on the resource

func (*ResourceManager) RegisterResource

func (rm *ResourceManager) RegisterResource(policy, pv, kind, ns, name, rv string)

RegisterResource stores if the policy is processed on this resource version

func (*ResourceManager) RegisterScope

func (rm *ResourceManager) RegisterScope(kind string, namespaced bool)

RegisterScope stores the scope of the given kind

type Validation

type Validation interface {
	Validate() (string, error)
}

Validation provides methods to validate a rule