validation

Documentation

Index

• func CountsByStatus(results []ResourceResult) map[Status]int
• func ResultTable(result ResourceResult, clusterName string, baseDir string, verbose bool) string
• type CheckResult
• type CheckType
• type Checker
• type KubeValidator
  • func NewKubeValidator(config KubeValidatorConfig) *KubeValidator
  • func (k *KubeValidator) RunChecks(ctx context.Context, path string) ([]ResourceResult, error)
• type KubeValidatorConfig
• type KubeconformChecker
  • func NewKubeconformChecker() (*KubeconformChecker, error)
  • func (k *KubeconformChecker) Check(_ context.Context, resource Resource) CheckResult
• type PolicyChecker
  • func DefaultPoliciesFromGlobs(ctx context.Context, globs []string, extraFields map[string]interface{}) ([]*PolicyChecker, error)
  • func NewPolicyChecker(ctx context.Context, module PolicyModule) (*PolicyChecker, error)
  • func (p *PolicyChecker) Check(ctx context.Context, resource Resource) CheckResult
• type PolicyModule
• type Resource
  • func MakeResource(path string, contents []byte, index int) Resource
  • func (r Resource) PrettyName() string
  • func (r Resource) TokResource() kresource.Resource
• type ResourceResult
  • func ResultsWithIssues(results []ResourceResult) []ResourceResult
  • func (r ResourceResult) HasIssues() bool
• type Status

Functions

func CountsByStatus

func CountsByStatus(results []ResourceResult) map[Status]int

CountsByStatus returns the number of check results for each status type.

func ResultTable

func ResultTable(
	result ResourceResult,
	clusterName string,
	baseDir string,
	verbose bool,
) string

Types

type CheckResult

type CheckResult struct {
	CheckType CheckType
	CheckName string
	Status    Status
	Message   string
	Reasons   []string
}

CheckResult contains the detailed results of a single check.

type CheckType

type CheckType string

CheckType represents the type of check that has been done.

const (
	CheckTypeKubeconform CheckType = "kubeconform"
	CheckTypeOPA         CheckType = "opa"
)

type Checker

type Checker interface {
	Check(context.Context, Resource) CheckResult
}

Checker is an interface that checks a resource and then returns a CheckResult.

type KubeValidator

type KubeValidator struct {
	// contains filtered or unexported fields
}

KubeValidator is a struct that validates the kube configs associated with a cluster.

func NewKubeValidator

func NewKubeValidator(config KubeValidatorConfig) *KubeValidator

NewKubeValidator returns a new KubeValidator instance.

func (*KubeValidator) RunChecks

func (k *KubeValidator) RunChecks(
	ctx context.Context,
	path string,
) ([]ResourceResult, error)

RunChecks runs all checks over all resources in the path and returns the results.

type KubeValidatorConfig

type KubeValidatorConfig struct {
	NumWorkers int
	Checkers   []Checker
}

KubeValidatorConfig is the configuration used to construct a KubeValidator.

type KubeconformChecker

type KubeconformChecker struct {
	// contains filtered or unexported fields
}

KubeconformChecker is a Checker implementation that runs kubeconform over all Kubernetes resources.

func NewKubeconformChecker

func NewKubeconformChecker() (*KubeconformChecker, error)

NewKubeconformChecker creates a new KubeconformChecker instance.

func (*KubeconformChecker) Check

func (k *KubeconformChecker) Check(_ context.Context, resource Resource) CheckResult

Check runs Kubeconform over the argument resource.

type PolicyChecker

type PolicyChecker struct {
	Module      PolicyModule
	Query       rego.PreparedEvalQuery
	ExtraFields map[string]interface{}
}

Policy wraps a policy module and a prepared query.

func DefaultPoliciesFromGlobs

func DefaultPoliciesFromGlobs(
	ctx context.Context,
	globs []string,
	extraFields map[string]interface{},
) ([]*PolicyChecker, error)

DefaultPoliciesFromGlobs creates policy checkers from one or more file policy globs, using the default package and result values.

func NewPolicyChecker

func NewPolicyChecker(ctx context.Context, module PolicyModule) (*PolicyChecker, error)

NewPolicyChecker creates a new PolicyChecker from the given module.

func (*PolicyChecker) Check

func (p *PolicyChecker) Check(ctx context.Context, resource Resource) CheckResult

Check runs a check against the argument resource using the current policy.

type PolicyModule

type PolicyModule struct {
	Name string

	// Contents is a string that stores the policy in rego format.
	Contents string

	// Package is the name of the package in the rego contents.
	Package string

	// Result is the variable that should be accessed to get the evaluation results.
	Result string

	// ExtraFields are added into the input and usable for policy evaluation.
	ExtraFields map[string]interface{}
}

PolicyModule contains information about a policy.

type Resource

type Resource struct {
	Path      string
	Contents  []byte
	Name      string
	Namespace string
	Version   string
	Kind      string
	// contains filtered or unexported fields
}

Resource is a Kubernetes resource from a file that we want to do checks on.

func MakeResource

func MakeResource(path string, contents []byte, index int) Resource

MakeResource constructs a resource from a path, contents, and index.

func (Resource) PrettyName

func (r Resource) PrettyName() string

PrettyName returns a pretty, compact name for a resource.

func (Resource) TokResource

func (r Resource) TokResource() kresource.Resource

TokResource converts a Resource to a Kubeconform resource (useful for running the latter).

type ResourceResult

type ResourceResult struct {
	Resource     Resource
	CheckResults []CheckResult
}

Result stores the results of validating a single resource in a single file, for all checks.

func ResultsWithIssues

func ResultsWithIssues(results []ResourceResult) []ResourceResult

ResultsWithIssues filters the argument resource results to just those with potential issues.

func (ResourceResult) HasIssues

func (r ResourceResult) HasIssues() bool

HasIssues returns whether a ResourceResult has at least one check result with an error or warning.

type Status

type Status string

Status stores the result of validating a single file or resource.

const (
	StatusValid   Status = "valid"
	StatusInvalid Status = "invalid"
	StatusWarning Status = "warning"
	StatusError   Status = "error"
	StatusSkipped Status = "skipped"
	StatusEmpty   Status = "empty"
)