constraints

Documentation

Index

• Constants
• Variables
• func GetEnforcementAction(constraint *unstructured.Unstructured) (string, error)
• func GetEnforcementActionsForEP(constraint *unstructured.Unstructured, eps []string) (map[string][]string, error)
• func IsEnforcementActionScoped(action string) bool
• type EnforcementAction
• type EnforcementPoint
• type ScopedEnforcementAction

Constants

const (
	// Group is the API Group of Constraints.
	Group = "constraints.gatekeeper.sh"

	// AllEnforcementPoints is a wildcard to indicate all enforcement points.
	AllEnforcementPoints = "*"
)

Variables

var (
	// ErrInvalidConstraint is a generic error that a Constraint is invalid for
	// some reason.
	ErrInvalidConstraint = errors.New("invalid Constraint")

	// ErrSchema is a specific error that a Constraint failed schema validation.
	ErrSchema = errors.New("schema validation failed")

	// ErrMissingRequiredField is a specific error that a field is missing from a Constraint.
	ErrMissingRequiredField = errors.New("missing required field")

	ErrInvalidSpecEnforcementAction = errors.New("scopedEnforcementActions value must be a [{action: string, enforcementPoints: [{name: string}]}]")
)

Functions

func GetEnforcementAction

func GetEnforcementAction(constraint *unstructured.Unstructured) (string, error)

GetEnforcementAction returns a Constraint's enforcementAction, which indicates what should be done if a review violates a Constraint, or the Constraint fails to run.

Returns an error if spec.enforcementAction is defined and is not a string.

func GetEnforcementActionsForEP

func GetEnforcementActionsForEP(constraint *unstructured.Unstructured, eps []string) (map[string][]string, error)

GetEnforcementActionsForEP returns a map of enforcement actions for enforcement points passed in.

func IsEnforcementActionScoped

func IsEnforcementActionScoped(action string) bool

Types

type EnforcementAction

type EnforcementAction string

const (
	// Deny indicates that if a review fails validation for a
	// Constraint, that it should be rejected. Errors encountered running
	// validation are treated as failing validation.
	//
	// This is the default EnforcementAction.
	Deny   EnforcementAction = "deny"
	Warn   EnforcementAction = "warn"
	Scoped EnforcementAction = "scoped"
)

type EnforcementPoint

type EnforcementPoint struct {
	Name string `json:"name"`
}

type ScopedEnforcementAction

type ScopedEnforcementAction struct {
	Action            string             `json:"action"`
	EnforcementPoints []EnforcementPoint `json:"enforcementPoints"`
}