mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-31 03:45:17 +00:00
refactor: imported pkg redeclared and a few other unused func (#3827)
* Removes paths redeclared Signed-off-by: afzal442 <afzal442@gmail.com> * fixes v1 redeclared Signed-off-by: afzal442 <afzal442@gmail.com> * fixes mergeSucceededResults func never used Signed-off-by: afzal442 <afzal442@gmail.com> * fixes func unused Signed-off-by: afzal442 <afzal442@gmail.com> * refactors unused func Signed-off-by: afzal442 <afzal442@gmail.com> * refactors unused func Signed-off-by: afzal442 <afzal442@gmail.com> * refactors getNamespacesForRule unused Signed-off-by: afzal442 <afzal442@gmail.com> * refactors policyNamespace unused Signed-off-by: afzal442 <afzal442@gmail.com> * refactors replacing loop with ... Signed-off-by: afzal442 <afzal442@gmail.com> * refactors func buildPolicyLabel unused Signed-off-by: afzal442 <afzal442@gmail.com> * removes unused func Signed-off-by: afzal442 <afzal442@gmail.com> * removes unused comment Signed-off-by: afzal442 <afzal442@gmail.com> Co-authored-by: Sambhav Kothari <sambhavs.email@gmail.com>
This commit is contained in:
parent
5262ed9225
commit
3845225db1
9 changed files with 5 additions and 196 deletions
|
@ -119,47 +119,6 @@ func buildPolicyResults(infos []policyreport.Info) map[string][]report.PolicyRep
|
||||||
return results
|
return results
|
||||||
}
|
}
|
||||||
|
|
||||||
func mergeSucceededResults(results map[string][]*report.PolicyReportResult) map[string][]*report.PolicyReportResult {
|
|
||||||
resultsNew := make(map[string][]*report.PolicyReportResult)
|
|
||||||
|
|
||||||
for scope, scopedResults := range results {
|
|
||||||
|
|
||||||
resourcesMap := make(map[string]*report.PolicyReportResult)
|
|
||||||
for _, result := range scopedResults {
|
|
||||||
if result.Result != report.PolicyResult("pass") {
|
|
||||||
resultsNew[scope] = append(resultsNew[scope], result)
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
key := fmt.Sprintf("%s/%s", result.Policy, result.Rule)
|
|
||||||
if r, ok := resourcesMap[key]; !ok {
|
|
||||||
resourcesMap[key] = &report.PolicyReportResult{}
|
|
||||||
resourcesMap[key] = result
|
|
||||||
} else {
|
|
||||||
r.Resources = append(r.Resources, result.Resources...)
|
|
||||||
resourcesMap[key] = r
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
for k, v := range resourcesMap {
|
|
||||||
names := strings.Split(k, "/")
|
|
||||||
if len(names) != 2 {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
r := &report.PolicyReportResult{
|
|
||||||
Policy: names[0],
|
|
||||||
Rule: names[1],
|
|
||||||
Resources: v.Resources,
|
|
||||||
Result: report.PolicyResult(v.Result),
|
|
||||||
}
|
|
||||||
|
|
||||||
resultsNew[scope] = append(resultsNew[scope], r)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return resultsNew
|
|
||||||
}
|
|
||||||
|
|
||||||
func calculateSummary(results []report.PolicyReportResult) (summary report.PolicyReportSummary) {
|
func calculateSummary(results []report.PolicyReportResult) (summary report.PolicyReportSummary) {
|
||||||
for _, res := range results {
|
for _, res := range results {
|
||||||
switch string(res.Result) {
|
switch string(res.Result) {
|
||||||
|
|
|
@ -154,9 +154,8 @@ func GetResourcesWithTest(fs billy.Filesystem, policies []v1.PolicyInterface, re
|
||||||
return nil, err
|
return nil, err
|
||||||
}
|
}
|
||||||
|
|
||||||
for _, resource := range getResources {
|
resources = append(resources, getResources...)
|
||||||
resources = append(resources, resource)
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return resources, nil
|
return resources, nil
|
||||||
|
|
|
@ -200,19 +200,6 @@ func TestProcessPatches_RemovePathDoesntExist_NotEmptyResult(t *testing.T) {
|
||||||
assertEqStringAndData(t, `{"path":"/metadata/labels/label2","op":"add","value":"label2Value"}`, rr.Patches[0])
|
assertEqStringAndData(t, `{"path":"/metadata/labels/label2","op":"add","value":"label2Value"}`, rr.Patches[0])
|
||||||
}
|
}
|
||||||
|
|
||||||
func assertEqDataImpl(t *testing.T, expected, actual []byte, formatModifier string) {
|
|
||||||
if len(expected) != len(actual) {
|
|
||||||
t.Errorf("len(expected) != len(actual): %d != %d\n1:"+formatModifier+"\n2:"+formatModifier, len(expected), len(actual), expected, actual)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
for idx, val := range actual {
|
|
||||||
if val != expected[idx] {
|
|
||||||
t.Errorf("Slices not equal at index %d:\n1:"+formatModifier+"\n2:"+formatModifier, idx, expected, actual)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func assertEqStringAndData(t *testing.T, str string, data []byte) {
|
func assertEqStringAndData(t *testing.T, str string, data []byte) {
|
||||||
var p1 jsonPatch
|
var p1 jsonPatch
|
||||||
json.Unmarshal([]byte(str), &p1)
|
json.Unmarshal([]byte(str), &p1)
|
||||||
|
|
|
@ -1,20 +0,0 @@
|
||||||
package mutate
|
|
||||||
|
|
||||||
import (
|
|
||||||
commonAnchors "github.com/kyverno/kyverno/pkg/engine/anchor"
|
|
||||||
)
|
|
||||||
|
|
||||||
// getAnchorAndElementsFromMap gets the condition anchor map and resource map without anchor
|
|
||||||
func getAnchorAndElementsFromMap(anchorsMap map[string]interface{}) (map[string]interface{}, map[string]interface{}) {
|
|
||||||
anchors := make(map[string]interface{})
|
|
||||||
elementsWithoutanchor := make(map[string]interface{})
|
|
||||||
for key, value := range anchorsMap {
|
|
||||||
if commonAnchors.IsConditionAnchor(key) {
|
|
||||||
anchors[key] = value
|
|
||||||
} else if !commonAnchors.IsAddIfNotPresentAnchor(key) {
|
|
||||||
elementsWithoutanchor[key] = value
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return anchors, elementsWithoutanchor
|
|
||||||
}
|
|
|
@ -1,16 +1,11 @@
|
||||||
package policy
|
package policy
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"encoding/json"
|
|
||||||
"fmt"
|
"fmt"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
|
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
|
||||||
"github.com/kyverno/kyverno/pkg/autogen"
|
"github.com/kyverno/kyverno/pkg/autogen"
|
||||||
"github.com/kyverno/kyverno/pkg/engine/context"
|
|
||||||
"github.com/kyverno/kyverno/pkg/engine/variables"
|
|
||||||
"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions"
|
|
||||||
"sigs.k8s.io/controller-runtime/pkg/log"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
//ContainsUserVariables returns error if variable that does not start from request.object
|
//ContainsUserVariables returns error if variable that does not start from request.object
|
||||||
|
@ -92,33 +87,3 @@ func userInfoDefined(ui kyverno.UserInfo) string {
|
||||||
}
|
}
|
||||||
return ""
|
return ""
|
||||||
}
|
}
|
||||||
|
|
||||||
func substituteVarsInJSON(ctx context.EvalInterface, document apiextensions.JSON) (apiextensions.JSON, error) {
|
|
||||||
jsonByte, err := json.Marshal(document)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
var jsonInterface interface{}
|
|
||||||
err = json.Unmarshal(jsonByte, &jsonInterface)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
jsonInterface, err = variables.SubstituteAll(log.Log, ctx, jsonInterface)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
jsonByte, err = json.Marshal(jsonInterface)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
err = json.Unmarshal(jsonByte, &document)
|
|
||||||
if err != nil {
|
|
||||||
return nil, err
|
|
||||||
}
|
|
||||||
|
|
||||||
return document, nil
|
|
||||||
}
|
|
||||||
|
|
|
@ -1,7 +1,6 @@
|
||||||
package policy
|
package policy
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"fmt"
|
|
||||||
"reflect"
|
"reflect"
|
||||||
"strings"
|
"strings"
|
||||||
|
|
||||||
|
@ -10,29 +9,12 @@ import (
|
||||||
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
|
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
|
||||||
"github.com/kyverno/kyverno/pkg/config"
|
"github.com/kyverno/kyverno/pkg/config"
|
||||||
"github.com/kyverno/kyverno/pkg/utils"
|
"github.com/kyverno/kyverno/pkg/utils"
|
||||||
stringutils "github.com/kyverno/kyverno/pkg/utils/string"
|
|
||||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
||||||
"k8s.io/apimachinery/pkg/labels"
|
"k8s.io/apimachinery/pkg/labels"
|
||||||
listerv1 "k8s.io/client-go/listers/core/v1"
|
|
||||||
"sigs.k8s.io/controller-runtime/pkg/log"
|
"sigs.k8s.io/controller-runtime/pkg/log"
|
||||||
)
|
)
|
||||||
|
|
||||||
func buildPolicyLabel(policyName string) (labels.Selector, error) {
|
|
||||||
policyLabelmap := map[string]string{"policy": policyName}
|
|
||||||
//NOt using a field selector, as the match function will have to cast the runtime.object
|
|
||||||
// to get the field, while it can get labels directly, saves the cast effort
|
|
||||||
ls := &metav1.LabelSelector{}
|
|
||||||
if err := metav1.Convert_Map_string_To_string_To_v1_LabelSelector(&policyLabelmap, ls, nil); err != nil {
|
|
||||||
return nil, fmt.Errorf("failed to generate label sector of Policy name %s: %v", policyName, err)
|
|
||||||
}
|
|
||||||
policySelector, err := metav1.LabelSelectorAsSelector(ls)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("Policy %s has invalid label selector: %v", policyName, err)
|
|
||||||
}
|
|
||||||
return policySelector, nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func transformResource(resource unstructured.Unstructured) []byte {
|
func transformResource(resource unstructured.Unstructured) []byte {
|
||||||
data, err := resource.MarshalJSON()
|
data, err := resource.MarshalJSON()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
@ -60,65 +42,6 @@ func MergeResources(a, b map[string]unstructured.Unstructured) {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// getNamespacesForRule gets the matched namespaces list for the given rule
|
|
||||||
func (pc *PolicyController) getNamespacesForRule(rule *kyverno.Rule, log logr.Logger) []string {
|
|
||||||
var matchedNS []string
|
|
||||||
if len(rule.MatchResources.Namespaces) == 0 {
|
|
||||||
matchedNS = GetAllNamespaces(pc.nsLister, log)
|
|
||||||
return pc.configHandler.FilterNamespaces(matchedNS)
|
|
||||||
}
|
|
||||||
|
|
||||||
var wildcards []string
|
|
||||||
for _, nsName := range rule.MatchResources.Namespaces {
|
|
||||||
if stringutils.ContainsWildcard(nsName) {
|
|
||||||
wildcards = append(wildcards, nsName)
|
|
||||||
}
|
|
||||||
|
|
||||||
matchedNS = append(matchedNS, nsName)
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(wildcards) > 0 {
|
|
||||||
wildcardMatches := GetMatchingNamespaces(wildcards, pc.nsLister, log)
|
|
||||||
matchedNS = append(matchedNS, wildcardMatches...)
|
|
||||||
}
|
|
||||||
|
|
||||||
return pc.configHandler.FilterNamespaces(matchedNS)
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetMatchingNamespaces ...
|
|
||||||
func GetMatchingNamespaces(wildcards []string, nslister listerv1.NamespaceLister, log logr.Logger) []string {
|
|
||||||
all := GetAllNamespaces(nslister, log)
|
|
||||||
if len(all) == 0 {
|
|
||||||
return all
|
|
||||||
}
|
|
||||||
|
|
||||||
var results []string
|
|
||||||
for _, wc := range wildcards {
|
|
||||||
for _, ns := range all {
|
|
||||||
if wildcard.Match(wc, ns) {
|
|
||||||
results = append(results, ns)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return results
|
|
||||||
}
|
|
||||||
|
|
||||||
// GetAllNamespaces gets all namespaces in the cluster
|
|
||||||
func GetAllNamespaces(nslister listerv1.NamespaceLister, log logr.Logger) []string {
|
|
||||||
var results []string
|
|
||||||
namespaces, err := nslister.List(labels.NewSelector())
|
|
||||||
if err != nil {
|
|
||||||
log.Error(err, "Failed to list namespaces")
|
|
||||||
}
|
|
||||||
for _, n := range namespaces {
|
|
||||||
name := n.GetName()
|
|
||||||
results = append(results, name)
|
|
||||||
}
|
|
||||||
|
|
||||||
return results
|
|
||||||
}
|
|
||||||
|
|
||||||
func (pc *PolicyController) getResourceList(kind, namespace string, labelSelector *metav1.LabelSelector, log logr.Logger) interface{} {
|
func (pc *PolicyController) getResourceList(kind, namespace string, labelSelector *metav1.LabelSelector, log logr.Logger) interface{} {
|
||||||
resourceList, err := pc.client.ListResource("", kind, namespace, labelSelector)
|
resourceList, err := pc.client.ListResource("", kind, namespace, labelSelector)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
|
|
@ -5,7 +5,6 @@ import (
|
||||||
"encoding/json"
|
"encoding/json"
|
||||||
"io/ioutil"
|
"io/ioutil"
|
||||||
"os"
|
"os"
|
||||||
"path"
|
|
||||||
ospath "path"
|
ospath "path"
|
||||||
"path/filepath"
|
"path/filepath"
|
||||||
"reflect"
|
"reflect"
|
||||||
|
@ -74,7 +73,7 @@ type Generation struct {
|
||||||
// it may not work as expected.
|
// it may not work as expected.
|
||||||
func RootDir() string {
|
func RootDir() string {
|
||||||
_, b, _, _ := runtime.Caller(0)
|
_, b, _, _ := runtime.Caller(0)
|
||||||
d := path.Join(path.Dir(b))
|
d := ospath.Join(ospath.Dir(b))
|
||||||
d = filepath.Dir(d)
|
d = filepath.Dir(d)
|
||||||
return filepath.Dir(d)
|
return filepath.Dir(d)
|
||||||
}
|
}
|
||||||
|
|
|
@ -5,7 +5,6 @@ import (
|
||||||
|
|
||||||
"github.com/go-logr/logr"
|
"github.com/go-logr/logr"
|
||||||
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
|
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
|
||||||
v1 "github.com/kyverno/kyverno/api/kyverno/v1"
|
|
||||||
"github.com/kyverno/kyverno/pkg/engine/response"
|
"github.com/kyverno/kyverno/pkg/engine/response"
|
||||||
"github.com/kyverno/kyverno/pkg/metrics"
|
"github.com/kyverno/kyverno/pkg/metrics"
|
||||||
admissionRequests "github.com/kyverno/kyverno/pkg/metrics/admissionrequests"
|
admissionRequests "github.com/kyverno/kyverno/pkg/metrics/admissionrequests"
|
||||||
|
@ -77,7 +76,7 @@ func (ws *WebhookServer) registerPolicyResultsMetricMutation(logger logr.Logger,
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
func registerPolicyResultsMetricValidation(logger logr.Logger, promConfig *metrics.PromConfig, requestOperation string, policy v1.PolicyInterface, engineResponse response.EngineResponse) {
|
func registerPolicyResultsMetricValidation(logger logr.Logger, promConfig *metrics.PromConfig, requestOperation string, policy kyverno.PolicyInterface, engineResponse response.EngineResponse) {
|
||||||
registerMetric(logger, "kyverno_policy_results_total", requestOperation, func(op metrics.ResourceRequestOperation) error {
|
registerMetric(logger, "kyverno_policy_results_total", requestOperation, func(op metrics.ResourceRequestOperation) error {
|
||||||
return policyResults.ProcessEngineResponse(promConfig, policy, engineResponse, metrics.AdmissionRequest, op)
|
return policyResults.ProcessEngineResponse(promConfig, policy, engineResponse, metrics.AdmissionRequest, op)
|
||||||
})
|
})
|
||||||
|
@ -97,7 +96,7 @@ func (ws *WebhookServer) registerPolicyExecutionDurationMetricMutate(logger logr
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
func registerPolicyExecutionDurationMetricValidate(logger logr.Logger, promConfig *metrics.PromConfig, requestOperation string, policy v1.PolicyInterface, engineResponse response.EngineResponse) {
|
func registerPolicyExecutionDurationMetricValidate(logger logr.Logger, promConfig *metrics.PromConfig, requestOperation string, policy kyverno.PolicyInterface, engineResponse response.EngineResponse) {
|
||||||
registerMetric(logger, "kyverno_policy_execution_duration_seconds", requestOperation, func(op metrics.ResourceRequestOperation) error {
|
registerMetric(logger, "kyverno_policy_execution_duration_seconds", requestOperation, func(op metrics.ResourceRequestOperation) error {
|
||||||
return policyExecutionDuration.ProcessEngineResponse(promConfig, policy, engineResponse, metrics.AdmissionRequest, "", op)
|
return policyExecutionDuration.ProcessEngineResponse(promConfig, policy, engineResponse, metrics.AdmissionRequest, "", op)
|
||||||
})
|
})
|
||||||
|
|
|
@ -20,8 +20,6 @@ var (
|
||||||
|
|
||||||
crdGVR = e2e.GetGVR("apiextensions.k8s.io", "v1", "customresourcedefinitions")
|
crdGVR = e2e.GetGVR("apiextensions.k8s.io", "v1", "customresourcedefinitions")
|
||||||
|
|
||||||
// ClusterPolicy Namespace
|
|
||||||
policyNamespace = ""
|
|
||||||
// Namespace Name
|
// Namespace Name
|
||||||
// Hardcoded in YAML Definition
|
// Hardcoded in YAML Definition
|
||||||
nspace = "test-image-verify"
|
nspace = "test-image-verify"
|
||||||
|
|
Loading…
Add table
Reference in a new issue