mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-31 03:45:17 +00:00
644 removing commented out unused code
This commit is contained in:
shravan
parent
819ba3fb1b
commit
21abc315f6
5 changed files with 0 additions and 747 deletions
|
|
@ -31,196 +31,6 @@ func TestGetAnchorsFromMap_ThereAreAnchors(t *testing.T) {
|
|||
assert.Equal(t, actualMap["(namespace)"].(string), "kube-?olicy")
|
||||
}
|
||||
|
||||
//func TestValidate_ServiceTest(t *testing.T) {
|
||||
// rawPolicy := []byte(`{
|
||||
// "apiVersion":"kyverno.nirmata.io/v1",
|
||||
// "kind":"ClusterPolicy",
|
||||
// "metadata":{
|
||||
// "name":"policy-service"
|
||||
// },
|
||||
// "spec":{
|
||||
// "rules":[
|
||||
// {
|
||||
// "name":"ps1",
|
||||
// "resource":{
|
||||
// "kinds":[
|
||||
// "Service"
|
||||
// ],
|
||||
// "name":"game-service*"
|
||||
// },
|
||||
// "mutate":{
|
||||
// "patches":[
|
||||
// {
|
||||
// "path":"/metadata/labels/isMutated",
|
||||
// "op":"add",
|
||||
// "value":"true"
|
||||
// },
|
||||
// {
|
||||
// "path":"/metadata/labels/secretLabel",
|
||||
// "op":"replace",
|
||||
// "value":"weKnow"
|
||||
// },
|
||||
// {
|
||||
// "path":"/metadata/labels/originalLabel",
|
||||
// "op":"remove"
|
||||
// },
|
||||
// {
|
||||
// "path":"/spec/selector/app",
|
||||
// "op":"replace",
|
||||
// "value":"mutedApp"
|
||||
// }
|
||||
// ]
|
||||
// },
|
||||
// "validate":{
|
||||
// "message":"This resource is broken",
|
||||
// "pattern":{
|
||||
// "spec":{
|
||||
// "ports":[
|
||||
// {
|
||||
// "name":"hs",
|
||||
// "protocol":32
|
||||
// }
|
||||
// ]
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// ]
|
||||
// }
|
||||
// }`)
|
||||
// rawResource := []byte(`{
|
||||
// "kind":"Service",
|
||||
// "apiVersion":"v1",
|
||||
// "metadata":{
|
||||
// "name":"game-service",
|
||||
// "labels":{
|
||||
// "originalLabel":"isHere",
|
||||
// "secretLabel":"thisIsMySecret"
|
||||
// }
|
||||
// },
|
||||
// "spec":{
|
||||
// "selector":{
|
||||
// "app":"MyApp"
|
||||
// },
|
||||
// "ports":[
|
||||
// {
|
||||
// "name":"http",
|
||||
// "protocol":"TCP",
|
||||
// "port":80,
|
||||
// "targetPort":9376
|
||||
// }
|
||||
// ]
|
||||
// }
|
||||
// }
|
||||
// `)
|
||||
//
|
||||
// var policy kyverno.ClusterPolicy
|
||||
// json.Unmarshal(rawPolicy, &policy)
|
||||
//
|
||||
// resourceUnstructured, err := utils.ConvertToUnstructured(rawResource)
|
||||
// assert.NilError(t, err)
|
||||
//
|
||||
// er := Validate(PolicyContext{Policy: policy, NewResource: *resourceUnstructured})
|
||||
// assert.Assert(t, len(er.PolicyResponse.Rules) == 0)
|
||||
//}
|
||||
//
|
||||
//func TestValidate_MapHasFloats(t *testing.T) {
|
||||
// rawPolicy := []byte(`{
|
||||
// "apiVersion":"kyverno.nirmata.io/v1",
|
||||
// "kind":"ClusterPolicy",
|
||||
// "metadata":{
|
||||
// "name":"policy-deployment-changed"
|
||||
// },
|
||||
// "spec":{
|
||||
// "rules":[
|
||||
// {
|
||||
// "name":"First policy v2",
|
||||
// "resource":{
|
||||
// "kinds":[
|
||||
// "Deployment"
|
||||
// ],
|
||||
// "name":"nginx-*"
|
||||
// },
|
||||
// "mutate":{
|
||||
// "patches":[
|
||||
// {
|
||||
// "path":"/metadata/labels/isMutated",
|
||||
// "op":"add",
|
||||
// "value":"true"
|
||||
// },
|
||||
// {
|
||||
// "path":"/metadata/labels/app",
|
||||
// "op":"replace",
|
||||
// "value":"nginx_is_mutated"
|
||||
// }
|
||||
// ]
|
||||
// },
|
||||
// "validate":{
|
||||
// "message":"replicas number is wrong",
|
||||
// "pattern":{
|
||||
// "metadata":{
|
||||
// "labels":{
|
||||
// "app":"*"
|
||||
// }
|
||||
// },
|
||||
// "spec":{
|
||||
// "replicas":3
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// ]
|
||||
// }
|
||||
// }`)
|
||||
// rawResource := []byte(`{
|
||||
// "apiVersion":"apps/v1",
|
||||
// "kind":"Deployment",
|
||||
// "metadata":{
|
||||
// "name":"nginx-deployment",
|
||||
// "labels":{
|
||||
// "app":"nginx"
|
||||
// }
|
||||
// },
|
||||
// "spec":{
|
||||
// "replicas":3,
|
||||
// "selector":{
|
||||
// "matchLabels":{
|
||||
// "app":"nginx"
|
||||
// }
|
||||
// },
|
||||
// "template":{
|
||||
// "metadata":{
|
||||
// "labels":{
|
||||
// "app":"nginx"
|
||||
// }
|
||||
// },
|
||||
// "spec":{
|
||||
// "containers":[
|
||||
// {
|
||||
// "name":"nginx",
|
||||
// "image":"nginx:1.7.9",
|
||||
// "ports":[
|
||||
// {
|
||||
// "containerPort":80
|
||||
// }
|
||||
// ]
|
||||
// }
|
||||
// ]
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
// `)
|
||||
//
|
||||
// var policy kyverno.ClusterPolicy
|
||||
// json.Unmarshal(rawPolicy, &policy)
|
||||
//
|
||||
// resourceUnstructured, err := utils.ConvertToUnstructured(rawResource)
|
||||
// assert.NilError(t, err)
|
||||
// er := Validate(PolicyContext{Policy: policy, NewResource: *resourceUnstructured})
|
||||
// assert.Assert(t, len(er.PolicyResponse.Rules) == 0)
|
||||
//}
|
||||
|
||||
func TestValidate_image_tag_fail(t *testing.T) {
|
||||
// If image tag is latest then imagepull policy needs to be checked
|
||||
rawPolicy := []byte(`{
|
||||
|
|
|
|||
|
|
@ -1,225 +0,0 @@
|
|||
package namespace
|
||||
|
||||
//const (
|
||||
// // maxRetries is the number of times a Namespace will be processed for a policy before its dropped from the queue
|
||||
// maxRetries = 15
|
||||
//)
|
||||
//
|
||||
////NamespaceController watches the 'Namespace' resource creation/update and applied the generation rules on them
|
||||
//type NamespaceController struct {
|
||||
// client *client.Client
|
||||
// kyvernoClient *kyvernoclient.Clientset
|
||||
// syncHandler func(nsKey string) error
|
||||
// enqueueNs func(ns *v1.Namespace)
|
||||
//
|
||||
// //nsLister provides expansion to the namespace lister to inject GVK for the resource
|
||||
// nsLister NamespaceListerExpansion
|
||||
// // nsSynced returns true if the Namespace store has been synced at least once
|
||||
// nsSynced cache.InformerSynced
|
||||
// // pvLister can list/get policy violation from the shared informer's store
|
||||
// pLister kyvernolister.ClusterPolicyLister
|
||||
// // pSynced retrns true if the Policy store has been synced at least once
|
||||
// pSynced cache.InformerSynced
|
||||
// // API to send policy stats for aggregation
|
||||
// policyStatus policy.PolicyStatusInterface
|
||||
// // eventGen provides interface to generate evenets
|
||||
// eventGen event.Interface
|
||||
// // Namespaces that need to be synced
|
||||
// queue workqueue.RateLimitingInterface
|
||||
// // Resource manager, manages the mapping for already processed resource
|
||||
// rm resourceManager
|
||||
// // helpers to validate against current loaded configuration
|
||||
// configHandler config.Interface
|
||||
// // store to hold policy meta data for faster lookup
|
||||
// pMetaStore policystore.LookupInterface
|
||||
// // policy violation generator
|
||||
// pvGenerator policyviolation.GeneratorInterface
|
||||
//}
|
||||
//
|
||||
////NewNamespaceController returns a new Controller to manage generation rules
|
||||
//func NewNamespaceController(kyvernoClient *kyvernoclient.Clientset,
|
||||
// client *client.Client,
|
||||
// nsInformer v1Informer.NamespaceInformer,
|
||||
// pInformer kyvernoinformer.ClusterPolicyInformer,
|
||||
// policyStatus policy.PolicyStatusInterface,
|
||||
// eventGen event.Interface,
|
||||
// configHandler config.Interface,
|
||||
// pvGenerator policyviolation.GeneratorInterface,
|
||||
// pMetaStore policystore.LookupInterface) *NamespaceController {
|
||||
// //TODO: do we need to event recorder for this controller?
|
||||
// // create the controller
|
||||
// nsc := &NamespaceController{
|
||||
// client: client,
|
||||
// kyvernoClient: kyvernoClient,
|
||||
// eventGen: eventGen,
|
||||
// queue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "namespace"),
|
||||
// configHandler: configHandler,
|
||||
// pMetaStore: pMetaStore,
|
||||
// pvGenerator: pvGenerator,
|
||||
// }
|
||||
//
|
||||
// nsInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
|
||||
// AddFunc: nsc.addNamespace,
|
||||
// UpdateFunc: nsc.updateNamespace,
|
||||
// DeleteFunc: nsc.deleteNamespace,
|
||||
// })
|
||||
//
|
||||
// pInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
|
||||
// AddFunc: nsc.addPolicy,
|
||||
// UpdateFunc: nsc.updatePolicy,
|
||||
// })
|
||||
//
|
||||
// nsc.enqueueNs = nsc.enqueue
|
||||
// nsc.syncHandler = nsc.syncNamespace
|
||||
//
|
||||
// nsc.nsLister = NewNamespaceLister(nsInformer.Lister())
|
||||
// nsc.nsSynced = nsInformer.Informer().HasSynced
|
||||
// nsc.pLister = pInformer.Lister()
|
||||
// nsc.pSynced = pInformer.Informer().HasSynced
|
||||
// nsc.policyStatus = policyStatus
|
||||
//
|
||||
// // resource manager
|
||||
// // rebuild after 300 seconds/ 5 mins
|
||||
// nsc.rm = NewResourceManager(300)
|
||||
//
|
||||
// return nsc
|
||||
//}
|
||||
//func (nsc *NamespaceController) addPolicy(obj interface{}) {
|
||||
// p := obj.(*kyverno.ClusterPolicy)
|
||||
// // check if the policy has generate rule
|
||||
// if generateRuleExists(p) {
|
||||
// // process policy
|
||||
// nsc.processPolicy(p)
|
||||
// }
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) updatePolicy(old, cur interface{}) {
|
||||
// curP := cur.(*kyverno.ClusterPolicy)
|
||||
// // check if the policy has generate rule
|
||||
// if generateRuleExists(curP) {
|
||||
// // process policy
|
||||
// nsc.processPolicy(curP)
|
||||
// }
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) addNamespace(obj interface{}) {
|
||||
// ns := obj.(*v1.Namespace)
|
||||
// glog.V(4).Infof("Adding Namespace %s", ns.Name)
|
||||
// nsc.enqueueNs(ns)
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) updateNamespace(old, cur interface{}) {
|
||||
// oldNs := old.(*v1.Namespace)
|
||||
// curNs := cur.(*v1.Namespace)
|
||||
// if curNs.ResourceVersion == oldNs.ResourceVersion {
|
||||
// // Periodic resync will send update events for all known Namespace.
|
||||
// // Two different versions of the same replica set will always have different RVs.
|
||||
// return
|
||||
// }
|
||||
// glog.V(4).Infof("Updating Namesapce %s", curNs.Name)
|
||||
// //TODO: anything to be done here?
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) deleteNamespace(obj interface{}) {
|
||||
// ns, _ := obj.(*v1.Namespace)
|
||||
// glog.V(4).Infof("Deleting Namespace %s", ns.Name)
|
||||
// //TODO: anything to be done here?
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) enqueue(ns *v1.Namespace) {
|
||||
// key, err := cache.MetaNamespaceKeyFunc(ns)
|
||||
// if err != nil {
|
||||
// glog.Error(err)
|
||||
// return
|
||||
// }
|
||||
// nsc.queue.Add(key)
|
||||
//}
|
||||
//
|
||||
////Run to run the controller
|
||||
//func (nsc *NamespaceController) Run(workers int, stopCh <-chan struct{}) {
|
||||
// defer utilruntime.HandleCrash()
|
||||
// defer nsc.queue.ShutDown()
|
||||
//
|
||||
// glog.Info("Starting namespace controller")
|
||||
// defer glog.Info("Shutting down namespace controller")
|
||||
//
|
||||
// if ok := cache.WaitForCacheSync(stopCh, nsc.nsSynced, nsc.pSynced); !ok {
|
||||
// glog.Error("namespace generator: failed to sync cache")
|
||||
// return
|
||||
// }
|
||||
//
|
||||
// for i := 0; i < workers; i++ {
|
||||
// go wait.Until(nsc.worker, time.Second, stopCh)
|
||||
// }
|
||||
// <-stopCh
|
||||
//}
|
||||
//
|
||||
//// worker runs a worker thread that just dequeues items, processes them, and marks them done.
|
||||
//// It enforces that the syncHandler is never invoked concurrently with the same key.
|
||||
//func (nsc *NamespaceController) worker() {
|
||||
// for nsc.processNextWorkItem() {
|
||||
// }
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) processNextWorkItem() bool {
|
||||
// key, quit := nsc.queue.Get()
|
||||
// if quit {
|
||||
// return false
|
||||
// }
|
||||
// defer nsc.queue.Done(key)
|
||||
//
|
||||
// err := nsc.syncHandler(key.(string))
|
||||
// nsc.handleErr(err, key)
|
||||
//
|
||||
// return true
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) handleErr(err error, key interface{}) {
|
||||
// if err == nil {
|
||||
// nsc.queue.Forget(key)
|
||||
// return
|
||||
// }
|
||||
//
|
||||
// if nsc.queue.NumRequeues(key) < maxRetries {
|
||||
// glog.V(2).Infof("Error syncing namespace %v: %v", key, err)
|
||||
// nsc.queue.AddRateLimited(key)
|
||||
// return
|
||||
// }
|
||||
//
|
||||
// utilruntime.HandleError(err)
|
||||
// glog.V(2).Infof("Dropping namespace %q out of the queue: %v", key, err)
|
||||
// nsc.queue.Forget(key)
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) syncNamespace(key string) error {
|
||||
// startTime := time.Now()
|
||||
// glog.V(4).Infof("Started syncing namespace %q (%v)", key, startTime)
|
||||
// defer func() {
|
||||
// glog.V(4).Infof("Finished syncing namespace %q (%v)", key, time.Since(startTime))
|
||||
// }()
|
||||
// namespace, err := nsc.nsLister.GetResource(key)
|
||||
// if errors.IsNotFound(err) {
|
||||
// glog.V(2).Infof("namespace %v has been deleted", key)
|
||||
// return nil
|
||||
// }
|
||||
// if err != nil {
|
||||
// return err
|
||||
// }
|
||||
// // Deep-copy otherwise we are mutating our cache.
|
||||
// // TODO: Deep-copy only when needed.
|
||||
// n := namespace.DeepCopy()
|
||||
//
|
||||
// // skip processing namespace if its been filtered
|
||||
// // exclude the filtered resources
|
||||
// if nsc.configHandler.ToFilter("", namespace.Name, "") {
|
||||
// //TODO: improve the text
|
||||
// glog.V(4).Infof("excluding namespace %s as its a filtered resource", namespace.Name)
|
||||
// return nil
|
||||
// }
|
||||
//
|
||||
// // process generate rules
|
||||
// engineResponses := nsc.processNamespace(*n)
|
||||
// // report errors
|
||||
// nsc.report(engineResponses)
|
||||
// return nil
|
||||
//}
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
package namespace
|
||||
|
||||
////NamespaceListerExpansion ...
|
||||
//type NamespaceListerExpansion interface {
|
||||
// v1CoreLister.NamespaceLister
|
||||
// // List lists all Namespaces in the indexer.
|
||||
// ListResources(selector labels.Selector) (ret []*v1.Namespace, err error)
|
||||
// // GetsResource and injects gvk
|
||||
// GetResource(name string) (*v1.Namespace, error)
|
||||
//}
|
||||
//
|
||||
////NamespaceLister ...
|
||||
//type NamespaceLister struct {
|
||||
// v1CoreLister.NamespaceLister
|
||||
//}
|
||||
//
|
||||
////NewNamespaceLister returns a new NamespaceLister
|
||||
//func NewNamespaceLister(nsLister v1CoreLister.NamespaceLister) NamespaceListerExpansion {
|
||||
// nsl := NamespaceLister{
|
||||
// nsLister,
|
||||
// }
|
||||
// return &nsl
|
||||
//}
|
||||
//
|
||||
////ListResources is a wrapper to List and adds the resource kind information
|
||||
//// as the lister is specific to a gvk we can harcode the values here
|
||||
//func (nsl *NamespaceLister) ListResources(selector labels.Selector) (ret []*v1.Namespace, err error) {
|
||||
// namespaces, err := nsl.List(selector)
|
||||
// for index := range namespaces {
|
||||
// namespaces[index].SetGroupVersionKind(v1.SchemeGroupVersion.WithKind("Namespace"))
|
||||
// }
|
||||
// return namespaces, err
|
||||
//}
|
||||
//
|
||||
////GetResource is a wrapper to get the resource and inject the GVK
|
||||
//func (nsl *NamespaceLister) GetResource(name string) (*v1.Namespace, error) {
|
||||
// namespace, err := nsl.Get(name)
|
||||
// if err != nil {
|
||||
// return nil, err
|
||||
// }
|
||||
//
|
||||
// namespace.SetGroupVersionKind(v1.SchemeGroupVersion.WithKind("Namespace"))
|
||||
// return namespace, err
|
||||
//}
|
||||
|
|
@ -1,234 +0,0 @@
|
|||
package namespace
|
||||
|
||||
//
|
||||
//type resourceManager interface {
|
||||
// ProcessResource(policy, pv, kind, ns, name, rv string) bool
|
||||
// //TODO removeResource(kind, ns, name string) error
|
||||
// RegisterResource(policy, pv, kind, ns, name, rv string)
|
||||
// // reload
|
||||
// Drop()
|
||||
//}
|
||||
//
|
||||
//// ResourceManager stores the details on already processed resources for caching
|
||||
//type ResourceManager struct {
|
||||
// // we drop and re-build the cache
|
||||
// // based on the memory consumer of by the map
|
||||
// data map[string]interface{}
|
||||
// mux sync.RWMutex
|
||||
// time time.Time
|
||||
// rebuildTime int64 // after how many seconds should we rebuild the cache
|
||||
//}
|
||||
//
|
||||
////NewResourceManager returns a new ResourceManager
|
||||
//func NewResourceManager(rebuildTime int64) *ResourceManager {
|
||||
// rm := ResourceManager{
|
||||
// data: make(map[string]interface{}),
|
||||
// time: time.Now(),
|
||||
// rebuildTime: rebuildTime,
|
||||
// }
|
||||
// // set time it was built
|
||||
// return &rm
|
||||
//}
|
||||
//
|
||||
//var empty struct{}
|
||||
//
|
||||
////RegisterResource stores if the policy is processed on this resource version
|
||||
//func (rm *ResourceManager) RegisterResource(policy, pv, kind, ns, name, rv string) {
|
||||
// rm.mux.Lock()
|
||||
// defer rm.mux.Unlock()
|
||||
// // add the resource
|
||||
// key := buildKey(policy, pv, kind, ns, name, rv)
|
||||
// rm.data[key] = empty
|
||||
//}
|
||||
//
|
||||
////ProcessResource returns true if the policy was not applied on the resource
|
||||
//func (rm *ResourceManager) ProcessResource(policy, pv, kind, ns, name, rv string) bool {
|
||||
// rm.mux.RLock()
|
||||
// defer rm.mux.RUnlock()
|
||||
//
|
||||
// key := buildKey(policy, pv, kind, ns, name, rv)
|
||||
// _, ok := rm.data[key]
|
||||
// return !ok
|
||||
//}
|
||||
//
|
||||
////Drop drop the cache after every rebuild interval mins
|
||||
////TODO: or drop based on the size
|
||||
//func (rm *ResourceManager) Drop() {
|
||||
// timeSince := time.Since(rm.time)
|
||||
// glog.V(4).Infof("time since last cache reset time %v is %v", rm.time, timeSince)
|
||||
// glog.V(4).Infof("cache rebuild time %v", time.Duration(rm.rebuildTime)*time.Second)
|
||||
// if timeSince > time.Duration(rm.rebuildTime)*time.Second {
|
||||
// rm.mux.Lock()
|
||||
// defer rm.mux.Unlock()
|
||||
// rm.data = map[string]interface{}{}
|
||||
// rm.time = time.Now()
|
||||
// glog.V(4).Infof("dropping cache at time %v", rm.time)
|
||||
// }
|
||||
//}
|
||||
//func buildKey(policy, pv, kind, ns, name, rv string) string {
|
||||
// return policy + "/" + pv + "/" + kind + "/" + ns + "/" + name + "/" + rv
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) processNamespace(namespace corev1.Namespace) []response.EngineResponse {
|
||||
// // convert to unstructured
|
||||
// unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&namespace)
|
||||
// if err != nil {
|
||||
// glog.Infof("unable to convert to unstructured, not processing any policies: %v", err)
|
||||
// return nil
|
||||
// }
|
||||
// nsc.rm.Drop()
|
||||
//
|
||||
// ns := unstructured.Unstructured{Object: unstr}
|
||||
//
|
||||
// // get all the policies that have a generate rule and resource description satisfies the namespace
|
||||
// // apply policy on resource
|
||||
// policies := listpolicies(ns, nsc.pMetaStore)
|
||||
// var engineResponses []response.EngineResponse
|
||||
// for _, policy := range policies {
|
||||
// // pre-processing, check if the policy and resource version has been processed before
|
||||
// if !nsc.rm.ProcessResource(policy.Name, policy.ResourceVersion, ns.GetKind(), ns.GetNamespace(), ns.GetName(), ns.GetResourceVersion()) {
|
||||
// glog.V(4).Infof("policy %s with resource version %s already processed on resource %s/%s/%s with resource version %s", policy.Name, policy.ResourceVersion, ns.GetKind(), ns.GetNamespace(), ns.GetName(), ns.GetResourceVersion())
|
||||
// continue
|
||||
// }
|
||||
// engineResponse := applyPolicy(nsc.client, ns, policy, nsc.policyStatus)
|
||||
// engineResponses = append(engineResponses, engineResponse)
|
||||
//
|
||||
// // post-processing, register the resource as processed
|
||||
// nsc.rm.RegisterResource(policy.GetName(), policy.GetResourceVersion(), ns.GetKind(), ns.GetNamespace(), ns.GetName(), ns.GetResourceVersion())
|
||||
// }
|
||||
// return engineResponses
|
||||
//}
|
||||
//
|
||||
//func generateRuleExists(policy *kyverno.ClusterPolicy) bool {
|
||||
// for _, rule := range policy.Spec.Rules {
|
||||
// if rule.Generation != (kyverno.Generation{}) {
|
||||
// return true
|
||||
// }
|
||||
// }
|
||||
// return false
|
||||
//}
|
||||
//
|
||||
//func (nsc *NamespaceController) processPolicy(policy *kyverno.ClusterPolicy) {
|
||||
// filteredNamespaces := []*corev1.Namespace{}
|
||||
// // get namespaces that policy applies on
|
||||
// namespaces, err := nsc.nsLister.ListResources(labels.NewSelector())
|
||||
// if err != nil {
|
||||
// glog.Errorf("failed to get list namespaces: %v", err)
|
||||
// return
|
||||
// }
|
||||
// for _, namespace := range namespaces {
|
||||
// // convert to unstructured
|
||||
// unstr, err := runtime.DefaultUnstructuredConverter.ToUnstructured(namespace)
|
||||
// if err != nil {
|
||||
// glog.Infof("unable to convert to unstructured, not processing any policies: %v", err)
|
||||
// continue
|
||||
// }
|
||||
// ns := unstructured.Unstructured{Object: unstr}
|
||||
// for _, rule := range policy.Spec.Rules {
|
||||
// if rule.Generation == (kyverno.Generation{}) {
|
||||
// continue
|
||||
// }
|
||||
// ok := engine.MatchesResourceDescription(ns, rule)
|
||||
// if !ok {
|
||||
// glog.V(4).Infof("namespace %s does not satisfy the resource description for the policy %s rule %s", ns.GetName(), policy.Name, rule.Name)
|
||||
// continue
|
||||
// }
|
||||
// glog.V(4).Infof("namespace %s satisfies resource description for policy %s rule %s", ns.GetName(), policy.Name, rule.Name)
|
||||
// filteredNamespaces = append(filteredNamespaces, namespace)
|
||||
// }
|
||||
// }
|
||||
// // list of namespaces that the policy applies on
|
||||
// for _, ns := range filteredNamespaces {
|
||||
// glog.V(4).Infof("policy %s with generate rule: namespace %s to be processed ", policy.Name, ns.Name)
|
||||
// nsc.addNamespace(ns)
|
||||
// }
|
||||
//}
|
||||
//
|
||||
//func listpolicies(ns unstructured.Unstructured, pMetaStore policystore.LookupInterface) []kyverno.ClusterPolicy {
|
||||
// var filteredpolicies []kyverno.ClusterPolicy
|
||||
// glog.V(4).Infof("listing policies for namespace %s", ns.GetName())
|
||||
// policies, err := pMetaStore.LookUp(ns.GetKind(), ns.GetNamespace())
|
||||
// if err != nil {
|
||||
// glog.Errorf("failed to get list policies: %v", err)
|
||||
// return nil
|
||||
// }
|
||||
// for _, policy := range policies {
|
||||
// for _, rule := range policy.Spec.Rules {
|
||||
// if rule.Generation == (kyverno.Generation{}) {
|
||||
// continue
|
||||
// }
|
||||
// ok := engine.MatchesResourceDescription(ns, rule)
|
||||
// if !ok {
|
||||
// glog.V(4).Infof("namespace %s does not satisfy the resource description for the policy %s rule %s", ns.GetName(), policy.Name, rule.Name)
|
||||
// continue
|
||||
// }
|
||||
// glog.V(4).Infof("namespace %s satisfies resource description for policy %s rule %s", ns.GetName(), policy.Name, rule.Name)
|
||||
// filteredpolicies = append(filteredpolicies, policy)
|
||||
// }
|
||||
// }
|
||||
// return filteredpolicies
|
||||
//}
|
||||
//
|
||||
//func applyPolicy(client *client.Client, resource unstructured.Unstructured, p kyverno.ClusterPolicy, policyStatus policyctr.PolicyStatusInterface) response.EngineResponse {
|
||||
// var policyStats []policyctr.PolicyStat
|
||||
// // gather stats from the engine response
|
||||
// gatherStat := func(policyName string, policyResponse response.PolicyResponse) {
|
||||
// ps := policyctr.PolicyStat{}
|
||||
// ps.PolicyName = policyName
|
||||
// ps.Stats.GenerationExecutionTime = policyResponse.ProcessingTime
|
||||
// ps.Stats.RulesAppliedCount = policyResponse.RulesAppliedCount
|
||||
// // capture rule level stats
|
||||
// for _, rule := range policyResponse.Rules {
|
||||
// rs := policyctr.RuleStatinfo{}
|
||||
// rs.RuleName = rule.Name
|
||||
// rs.ExecutionTime = rule.RuleStats.ProcessingTime
|
||||
// if rule.Success {
|
||||
// rs.RuleAppliedCount++
|
||||
// } else {
|
||||
// rs.RulesFailedCount++
|
||||
// }
|
||||
// ps.Stats.Rules = append(ps.Stats.Rules, rs)
|
||||
// }
|
||||
// policyStats = append(policyStats, ps)
|
||||
// }
|
||||
// // send stats for aggregation
|
||||
// sendStat := func(blocked bool) {
|
||||
// for _, stat := range policyStats {
|
||||
// stat.Stats.ResourceBlocked = utils.Btoi(blocked)
|
||||
// //SEND
|
||||
// policyStatus.SendStat(stat)
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// startTime := time.Now()
|
||||
// glog.V(4).Infof("Started apply policy %s on resource %s/%s/%s (%v)", p.Name, resource.GetKind(), resource.GetNamespace(), resource.GetName(), startTime)
|
||||
// defer func() {
|
||||
// glog.V(4).Infof("Finished applying %s on resource %s/%s/%s (%v)", p.Name, resource.GetKind(), resource.GetNamespace(), resource.GetName(), time.Since(startTime))
|
||||
// }()
|
||||
// // build context
|
||||
// ctx := context.NewContext()
|
||||
// ctx.AddResource(transformResource(resource))
|
||||
//
|
||||
// policyContext := engine.PolicyContext{
|
||||
// NewResource: resource,
|
||||
// Policy: p,
|
||||
// Client: client,
|
||||
// Context: ctx,
|
||||
// }
|
||||
// engineResponse := engine.Generate(policyContext)
|
||||
// // gather stats
|
||||
// gatherStat(p.Name, engineResponse.PolicyResponse)
|
||||
// //send stats
|
||||
// sendStat(false)
|
||||
//
|
||||
// return engineResponse
|
||||
//}
|
||||
//
|
||||
//func transformResource(resource unstructured.Unstructured) []byte {
|
||||
// data, err := resource.MarshalJSON()
|
||||
// if err != nil {
|
||||
// glog.Errorf("failed to marshall resource %v: %v", resource, err)
|
||||
// return nil
|
||||
// }
|
||||
// return data
|
||||
//}
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
package namespace
|
||||
|
||||
//func (nsc *NamespaceController) report(engineResponses []response.EngineResponse) {
|
||||
// // generate events
|
||||
// eventInfos := generateEvents(engineResponses)
|
||||
// nsc.eventGen.Add(eventInfos...)
|
||||
// // generate policy violations
|
||||
// pvInfos := policyviolation.GeneratePVsFromEngineResponse(engineResponses)
|
||||
// nsc.pvGenerator.Add(pvInfos...)
|
||||
//}
|
||||
//
|
||||
//func generateEvents(ers []response.EngineResponse) []event.Info {
|
||||
// var eventInfos []event.Info
|
||||
// for _, er := range ers {
|
||||
// if er.IsSuccesful() {
|
||||
// continue
|
||||
// }
|
||||
// eventInfos = append(eventInfos, generateEventsPerEr(er)...)
|
||||
// }
|
||||
// return eventInfos
|
||||
//}
|
||||
//
|
||||
//func generateEventsPerEr(er response.EngineResponse) []event.Info {
|
||||
// var eventInfos []event.Info
|
||||
// glog.V(4).Infof("reporting results for policy '%s' application on resource '%s/%s/%s'", er.PolicyResponse.Policy, er.PolicyResponse.Resource.Kind, er.PolicyResponse.Resource.Namespace, er.PolicyResponse.Resource.Name)
|
||||
// for _, rule := range er.PolicyResponse.Rules {
|
||||
// if rule.Success {
|
||||
// continue
|
||||
// }
|
||||
// // generate event on resource for each failed rule
|
||||
// glog.V(4).Infof("generation event on resource '%s/%s' for policy '%s'", er.PolicyResponse.Resource.Kind, er.PolicyResponse.Resource.Name, er.PolicyResponse.Policy)
|
||||
// e := event.Info{}
|
||||
// e.Kind = er.PolicyResponse.Resource.Kind
|
||||
// e.Namespace = "" // event generate on namespace resource
|
||||
// e.Name = er.PolicyResponse.Resource.Name
|
||||
// e.Reason = "Failure"
|
||||
// e.Source = event.GeneratePolicyController
|
||||
// e.Message = fmt.Sprintf("policy '%s' (%s) rule '%s' not satisfied. %v", er.PolicyResponse.Policy, rule.Type, rule.Name, rule.Message)
|
||||
// eventInfos = append(eventInfos, e)
|
||||
// }
|
||||
// if er.IsSuccesful() {
|
||||
// return eventInfos
|
||||
// }
|
||||
// // generate a event on policy for all failed rules
|
||||
// glog.V(4).Infof("generation event on policy '%s'", er.PolicyResponse.Policy)
|
||||
// e := event.Info{}
|
||||
// e.Kind = "ClusterPolicy"
|
||||
// e.Namespace = ""
|
||||
// e.Name = er.PolicyResponse.Policy
|
||||
// e.Reason = "Failure"
|
||||
// e.Source = event.GeneratePolicyController
|
||||
// e.Message = fmt.Sprintf("policy '%s' rules '%v' on resource '%s/%s/%s' not stasified", er.PolicyResponse.Policy, er.GetFailedRules(), er.PolicyResponse.Resource.Kind, er.PolicyResponse.Resource.Namespace, er.PolicyResponse.Resource.Name)
|
||||
// return eventInfos
|
||||
//}
|
||||
Loading…
Add table
Reference in a new issue