arm

README

arm package

policy-engine has some support for evaluating ARM template expressions, but there are some known limitations:

• Not all functions are supported. The source of truth for function support is builtins.go.
  • During resource discovery (the phase in which we figure out the names and types of resources), we support the functions in DiscoveryBuiltinFunctions().
  • During resource processing, we additionally support those in AllBuiltinFunctions().
  • Not all types are supported. These will be added as we add support for functions that make use of these types.
• Template expressions in variables definitions are not evaluated.
• Support for functions that require "deployment context" such as resourceGroup() and resourceId() is limited by definition: policy-engine returns stubs for return value fields that it can't know about.

Failures in expression evaluation are non-fatal, but may lead to false positives/negatives in policy evaluation if the result of the expression would have been significant to the policy.

Documentation

Index

• func AllBuiltinFunctions(variables map[string]interface{}, discoveredResourceSet map[string]struct{}) map[string]Function
• func DiscoveryBuiltinFunctions(variables map[string]interface{}) map[string]Function
• func IsTemplateExpression(input string) bool
• type Error
  • func (e Error) Error() string
  • func (e Error) Kind() ErrorKind
• type ErrorKind
• type EvaluationContext
  • func (e *EvaluationContext) EvaluateTemplateString(input string) (interface{}, error)
• type Function

Functions

func AllBuiltinFunctions

func AllBuiltinFunctions(
	variables map[string]interface{},
	discoveredResourceSet map[string]struct{},
) map[string]Function

AllBuiltinFunctions returns all builtin functions available. This includes DiscoveryBuiltinFunctions().

func DiscoveryBuiltinFunctions

func DiscoveryBuiltinFunctions(
	variables map[string]interface{},
) map[string]Function

DiscoveryBuiltinFunctions returns the functions available during the discovery phase. Functions that retrieve information about resources will not yet be available.

func IsTemplateExpression

func IsTemplateExpression(input string) bool

Types

type Error

type Error struct {
	// contains filtered or unexported fields
}

We have this error type so that we can use its `kind` as a metric label in the future. Since callers in practice do not pass in a metrics collector currently, we do nothing with it yet.

func (Error) Error

func (e Error) Error() string

func (Error) Kind

func (e Error) Kind() ErrorKind

type ErrorKind

type ErrorKind string

const (
	TokenizerError      ErrorKind = "TokenizerError"
	ParserError         ErrorKind = "ParserError"
	EvalError           ErrorKind = "EvalError"
	UnsupportedFunction ErrorKind = "UnsupportedFunction"
)

type EvaluationContext

type EvaluationContext struct {
	Functions map[string]Function
}

Makes state available to ARM template function evaluation. It contains references to implementations of functions, and the other fields exist to pass data to certain function impls other than what is already in their args.

func (*EvaluationContext) EvaluateTemplateString

func (e *EvaluationContext) EvaluateTemplateString(input string) (interface{}, error)

Detects whether an ARM string is an expression (enclosed by []), and tries to evaluate it if so.

type Function

type Function func(args ...interface{}) (interface{}, error)