Changed policy type definition due to the policy-v2 specification

pkg/apis/policy/register.go

@@ -1,5 +1,6 @@
 package policy
 
 const (
-    GroupName = "policy.nirmata.io"
+	// GroupName must be the same as specified in Policy CRD
+	GroupName = "kubepolicy.nirmata.io"
 )

pkg/apis/policy/v1alpha1/deepcopy.go

@@ -0,0 +1,25 @@
+package v1alpha1
+
+// DeepCopyInto is declared because k8s:deepcopy-gen is
+// not able to generate this method for interface{} member
+func (in *Mutation) DeepCopyInto(out *Mutation) {
+	if out != nil {
+		*out = *in
+	}
+}
+
+// DeepCopyInto is declared because k8s:deepcopy-gen is
+// not able to generate this method for interface{} member
+func (in *Patch) DeepCopyInto(out *Patch) {
+	if out != nil {
+		*out = *in
+	}
+}
+
+// DeepCopyInto is declared because k8s:deepcopy-gen is
+// not able to generate this method for interface{} member
+func (in *Validation) DeepCopyInto(out *Validation) {
+	if out != nil {
+		*out = *in
+	}
+}

pkg/apis/policy/v1alpha1/doc.go

@@ -1,4 +1,4 @@
 // +k8s:deepcopy-gen=package
-// +groupName=nirmata.io
+// +groupName=kubepolicy.nirmata.io
 
 package v1alpha1

pkg/apis/policy/v1alpha1/types.go

@@ -7,89 +7,92 @@ import (
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
-// An example of the YAML representation of this structure is here:
+// Policy contains rules to be applied to created resources
-// <project_root>/crd/policy-example.yaml
 type Policy struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
-	Spec              PolicySpec   `json:"spec"`
+	Spec              Spec   `json:"spec"`
-	Status            PolicyStatus `json:"status"`
+	Status            Status `json:"status"`
 }
 
-// Specification of the Policy.
+// Spec describes policy behavior by its rules
-// failurePolicy can have values "continueOnError" and "stopOnError" (default).
+type Spec struct {
-type PolicySpec struct {
+	Rules []Rule `json:"rules"`
-	FailurePolicy *string      `json:"failurePolicy"`
-	Rules         []PolicyRule `json:"rules"`
 }
 
-// The rule of mutation for the single resource definition.
+// Rule is set of mutation, validation and generation actions
-// Details are listed in the description of each of the substructures.
+// for the single resource description
-type PolicyRule struct {
+type Rule struct {
-	Name               string                 `json:"name"`
+	Name                string `json:"name"`
-	Resource           PolicyResource         `json:"resource"`
+	ResourceDescription `json:"resource"`
-	Patches            []PolicyPatch          `json:"patch,omitempty"`
+	Mutation            `json:"mutate"`
-	ConfigMapGenerator *PolicyConfigGenerator `json:"configMapGenerator,omitempty"`
+	Validation          `json:"validate"`
-	SecretGenerator    *PolicyConfigGenerator `json:"secretGenerator,omitempty"`
+	Generation          `json:"generate"`
 }
 
-// Describes the resource to which the PolicyRule will apply.
+// ResourceDescription describes the resource to which the PolicyRule will be applied.
-// Either the name or selector must be specified.
+type ResourceDescription struct {
-// IMPORTANT: If neither is specified, the policy rule will not apply (TBD).
-type PolicyResource struct {
 	Kind     string                `json:"kind"`
 	Name     *string               `json:"name"`
-	Selector *metav1.LabelSelector `json:"selector,omitempty"`
+	Selector *metav1.LabelSelector `json:"selector"`
+}
+
+// Mutation describes the way how Mutating Webhook will react on resource creation
+type Mutation struct {
+	Overlay interface{} `json:"overlay"`
+	Patches []Patch     `json:"patches"`
 }
 
 // +k8s:deepcopy-gen=false
 
-// PolicyPatch declares patch operation for created object according to the JSONPatch spec:
+// Patch declares patch operation for created object according to RFC 6902
-// http://jsonpatch.com/
+type Patch struct {
-type PolicyPatch struct {
 	Path      string      `json:"path"`
 	Operation string      `json:"op"`
 	Value     interface{} `json:"value"`
 }
 
-func (in *PolicyPatch) DeepCopyInto(out *PolicyPatch) {
+// Validation describes the way how Validating Webhook will check the resource on creation
-	if out != nil {
+type Validation struct {
-		*out = *in
+	Message *string     `json:"message"`
-	}
+	Pattern interface{} `json:"pattern"`
 }
 
-// The declaration for a Secret or a ConfigMap, which will be created in the new namespace.
+// Generation describes which resources will be created when other resource is created
-// Can be applied only when PolicyRule.Resource.Kind is "Namespace".
+type Generation struct {
-type PolicyConfigGenerator struct {
+	Kind     string `json:"kind"`
-	Name     string            `json:"name"`
+	Name     string `json:"name"`
-	CopyFrom *PolicyCopyFrom   `json:"copyFrom"`
+	CopyFrom `json:"copyFrom"`
 	Data     map[string]string `json:"data"`
+	Labels   map[string]string `json:"labels"`
 }
 
-// Location of a Secret or a ConfigMap which will be used as source when applying PolicyConfigGenerator
+// CopyFrom - location of a Secret or a ConfigMap
-type PolicyCopyFrom struct {
+// which will be used as source when applying 'generate'
+type CopyFrom struct {
 	Namespace string `json:"namespace"`
 	Name      string `json:"name"`
 }
 
-// Contains logs about policy application
+// Status contains violations for existing resources
-type PolicyStatus struct {
+type Status struct {
-	Logs       []string    `json:"log"`
 	Violations []Violation `json:"violations,omitempty"`
 }
 
-// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-
-// List of Policy resources
-type PolicyList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata"`
-	Items           []Policy `json:"items"`
-}
-
 // Violation for the policy
 type Violation struct {
 	Kind     string `json:"kind,omitempty"`
 	Resource string `json:"resource,omitempty"`
 	Rule     string `json:"rule,omitempty"`
+	Reason   string `json:"reason,omitempty"`
+	Message  string `json:"message,omitempty`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// PolicyList is a list of Policy resources
+type PolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+	Items           []Policy `json:"items"`
 }