mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 10:55:05 +00:00
Code Activity

765 save commit

Browse source
This commit is contained in:
shravan 2020-03-27 19:06:06 +05:30
parent 589f8ece47
commit 6efe0252a3
13 changed files with 323 additions and 550 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
cmd/kyverno/main.go
View file

@ -250,8 +250,14 @@ func main() {
os.Exit(1)
}
openAPIController, err := openapi.NewOpenAPIController()
if err != nil {
setupLog.Error(err, "Failed to create openAPIController")
os.Exit(1)
}
// Sync openAPI definitions of resources
openApiSync := openapi.NewCRDSync(client)
openApiSync := openapi.NewCRDSync(client, openAPIController)
// WEBHOOOK
// - https server to provide endpoints called based on rules defined in Mutating & Validation webhook configuration
@ -276,6 +282,7 @@ func main() {
rWebhookWatcher,
cleanUp,
log.Log.WithName("WebhookServer"),
openAPIController,
)
if err != nil {
setupLog.Error(err, "Failed to create webhook server")

658
go.sum
View file

File diff suppressed because it is too large Load diff

20
pkg/kyverno/apply/command.go
View file

@ -7,6 +7,8 @@ import (
"os"
"path/filepath"
"github.com/nirmata/kyverno/pkg/openapi"
"github.com/nirmata/kyverno/pkg/kyverno/sanitizedError"
policy2 "github.com/nirmata/kyverno/pkg/policy"
@ -67,8 +69,13 @@ func Command() *cobra.Command {
}
}
openAPIController, err := openapi.NewOpenAPIController()
if err != nil {
return err
}
for _, policy := range policies {
err := policy2.Validate(*policy, nil, true)
err := policy2.Validate(*policy, nil, true, openAPIController)
if err != nil {
return sanitizedError.New(fmt.Sprintf("Policy %v is not valid", policy.Name))
}
@ -82,7 +89,7 @@ func Command() *cobra.Command {
}
}
resources, err := getResources(policies, resourcePaths, dClient)
resources, err := getResources(policies, resourcePaths, dClient, openAPIController)
if err != nil {
return sanitizedError.New(fmt.Errorf("Issues fetching resources").Error())
}
@ -110,7 +117,7 @@ func Command() *cobra.Command {
return cmd
}
func getResources(policies []*v1.ClusterPolicy, resourcePaths []string, dClient discovery.CachedDiscoveryInterface) ([]*unstructured.Unstructured, error) {
func getResources(policies []*v1.ClusterPolicy, resourcePaths []string, dClient discovery.CachedDiscoveryInterface, openAPIController *openapi.Controller) ([]*unstructured.Unstructured, error) {
var resources []*unstructured.Unstructured
var err error
@ -129,7 +136,7 @@ func getResources(policies []*v1.ClusterPolicy, resourcePaths []string, dClient
resourceTypes = append(resourceTypes, kind)
}
resources, err = getResourcesOfTypeFromCluster(resourceTypes, dClient)
resources, err = getResourcesOfTypeFromCluster(resourceTypes, dClient, openAPIController)
if err != nil {
return nil, err
}
@ -147,11 +154,12 @@ func getResources(policies []*v1.ClusterPolicy, resourcePaths []string, dClient
return resources, nil
}
func getResourcesOfTypeFromCluster(resourceTypes []string, dClient discovery.CachedDiscoveryInterface) ([]*unstructured.Unstructured, error) {
func getResourcesOfTypeFromCluster(resourceTypes []string, dClient discovery.CachedDiscoveryInterface, openAPIController *openapi.Controller) ([]*unstructured.Unstructured, error) {
var resources []*unstructured.Unstructured
for _, kind := range resourceTypes {
endpoint, err := getListEndpointForKind(kind)
// TODO use lister interface
endpoint, err := getListEndpointForKind(kind, openAPIController)
if err != nil {
return nil, err
}

4
pkg/kyverno/apply/helper.go
View file

@ -7,9 +7,9 @@ import (
"github.com/nirmata/kyverno/pkg/openapi"
)
func getListEndpointForKind(kind string) (string, error) {
func getListEndpointForKind(kind string, openAPIController *openapi.Controller) (string, error) {
definitionName := openapi.GetDefinitionNameFromKind(kind)
definitionName := openAPIController.GetDefinitionNameFromKind(kind)
definitionNameWithoutPrefix := strings.Replace(definitionName, "io.k8s.", "", -1)
parts := strings.Split(definitionNameWithoutPrefix, ".")

9
pkg/kyverno/validate/command.go
View file

@ -7,6 +7,8 @@ import (
"os"
"path/filepath"
"github.com/nirmata/kyverno/pkg/openapi"
"github.com/nirmata/kyverno/pkg/kyverno/sanitizedError"
policyvalidate "github.com/nirmata/kyverno/pkg/policy"
@ -41,8 +43,13 @@ func Command() *cobra.Command {
}
}
openAPIController, err := openapi.NewOpenAPIController()
if err != nil {
return err
}
for _, policy := range policies {
err = policyvalidate.Validate(*policy, nil, true)
err = policyvalidate.Validate(*policy, nil, true, openAPIController)
if err != nil {
fmt.Println("Policy " + policy.Name + " is invalid")
} else {

68
pkg/openapi/crdSync.go
View file

@ -2,6 +2,7 @@ package openapi
import (
"encoding/json"
"fmt"
"time"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@ -17,26 +18,19 @@ import (
"k8s.io/apimachinery/pkg/util/wait"
)
type crdDefinition struct {
Spec struct {
Names struct {
Kind string `json:"kind"`
} `json:"names"`
Versions []struct {
Schema struct {
OpenAPIV3Schema interface{} `json:"openAPIV3Schema"`
} `json:"schema"`
} `json:"versions"`
} `json:"spec"`
}
type crdSync struct {
client *client.Client
client *client.Client
controller *Controller
}
func NewCRDSync(client *client.Client) *crdSync {
func NewCRDSync(client *client.Client, controller *Controller) *crdSync {
if controller == nil {
panic(fmt.Errorf("nil controller sent into crd sync"))
}
return &crdSync{
client: client,
controller: controller,
client: client,
}
}
@ -46,7 +40,7 @@ func (c *crdSync) Run(workers int, stopCh <-chan struct{}) {
log.Log.Error(err, "cannot get openapi schema")
}
err = useOpenApiDocument(newDoc)
err = c.controller.useOpenApiDocument(newDoc)
if err != nil {
log.Log.Error(err, "Could not set custom OpenApi document")
}
@ -58,8 +52,8 @@ func (c *crdSync) Run(workers int, stopCh <-chan struct{}) {
}
func (c *crdSync) sync() {
openApiGlobalState.mutex.Lock()
defer openApiGlobalState.mutex.Unlock()
c.controller.mutex.Lock()
defer c.controller.mutex.Unlock()
crds, err := c.client.ListResource("CustomResourceDefinition", "", nil)
if err != nil {
@ -67,24 +61,36 @@ func (c *crdSync) sync() {
return
}
deleteCRDFromPreviousSync()
c.controller.deleteCRDFromPreviousSync()
for _, crd := range crds.Items {
parseCRD(crd)
c.controller.parseCRD(crd)
}
}
func deleteCRDFromPreviousSync() {
for _, crd := range openApiGlobalState.crdList {
delete(openApiGlobalState.kindToDefinitionName, crd)
delete(openApiGlobalState.definitions, crd)
func (o *Controller) deleteCRDFromPreviousSync() {
for _, crd := range o.crdList {
delete(o.kindToDefinitionName, crd)
delete(o.definitions, crd)
}
openApiGlobalState.crdList = []string{}
o.crdList = []string{}
}
func parseCRD(crd unstructured.Unstructured) {
var crdDefinition crdDefinition
func (o *Controller) parseCRD(crd unstructured.Unstructured) {
var crdDefinition struct {
Spec struct {
Names struct {
Kind string `json:"kind"`
} `json:"names"`
Versions []struct {
Schema struct {
OpenAPIV3Schema interface{} `json:"openAPIV3Schema"`
} `json:"schema"`
} `json:"versions"`
} `json:"spec"`
}
crdRaw, _ := json.Marshal(crd.Object)
_ = json.Unmarshal(crdRaw, &crdDefinition)
@ -104,8 +110,8 @@ func parseCRD(crd unstructured.Unstructured) {
return
}
openApiGlobalState.crdList = append(openApiGlobalState.crdList, crdName)
o.crdList = append(o.crdList, crdName)
openApiGlobalState.kindToDefinitionName[crdName] = crdName
openApiGlobalState.definitions[crdName] = parsedSchema
o.kindToDefinitionName[crdName] = crdName
o.definitions[crdName] = parsedSchema
}

76
pkg/openapi/validation.go
View file

@ -22,7 +22,7 @@ import (
"gopkg.in/yaml.v2"
)
var openApiGlobalState struct {
type Controller struct {
mutex sync.RWMutex
document *openapi_v2.Document
definitions map[string]*openapi_v2.Schema
@ -31,21 +31,25 @@ var openApiGlobalState struct {
models proto.Models
}
func init() {
func NewOpenAPIController() (*Controller, error) {
controller := &Controller{}
defaultDoc, err := getSchemaDocument()
if err != nil {
panic(err)
return nil, err
}
err = useOpenApiDocument(defaultDoc)
err = controller.useOpenApiDocument(defaultDoc)
if err != nil {
panic(err)
return nil, err
}
return controller, nil
}
func ValidatePolicyMutation(policy v1.ClusterPolicy) error {
openApiGlobalState.mutex.RLock()
defer openApiGlobalState.mutex.RUnlock()
func (o *Controller) ValidatePolicyMutation(policy v1.ClusterPolicy) error {
o.mutex.RLock()
defer o.mutex.RUnlock()
var kindToRules = make(map[string][]v1.Rule)
for _, rule := range policy.Spec.Rules {
@ -66,7 +70,7 @@ func ValidatePolicyMutation(policy v1.ClusterPolicy) error {
for kind, rules := range kindToRules {
newPolicy := *policy.DeepCopy()
newPolicy.Spec.Rules = rules
resource, _ := generateEmptyResource(openApiGlobalState.definitions[openApiGlobalState.kindToDefinitionName[kind]]).(map[string]interface{})
resource, _ := o.generateEmptyResource(o.definitions[o.kindToDefinitionName[kind]]).(map[string]interface{})
if resource == nil {
log.Log.V(4).Info(fmt.Sprintf("Cannot Validate policy: openApi definition now found for %v", kind))
return nil
@ -78,7 +82,7 @@ func ValidatePolicyMutation(policy v1.ClusterPolicy) error {
if err != nil {
return err
}
err = ValidateResource(*patchedResource.DeepCopy(), kind)
err = o.ValidateResource(*patchedResource.DeepCopy(), kind)
if err != nil {
return err
}
@ -87,15 +91,15 @@ func ValidatePolicyMutation(policy v1.ClusterPolicy) error {
return nil
}
func ValidateResource(patchedResource unstructured.Unstructured, kind string) error {
openApiGlobalState.mutex.RLock()
defer openApiGlobalState.mutex.RUnlock()
func (o *Controller) ValidateResource(patchedResource unstructured.Unstructured, kind string) error {
o.mutex.RLock()
defer o.mutex.RUnlock()
var err error
kind = openApiGlobalState.kindToDefinitionName[kind]
schema := openApiGlobalState.models.LookupModel(kind)
kind = o.kindToDefinitionName[kind]
schema := o.models.LookupModel(kind)
if schema == nil {
schema, err = getSchemaFromDefinitions(kind)
schema, err = o.getSchemaFromDefinitions(kind)
if err != nil || schema == nil {
return fmt.Errorf("pre-validation: couldn't find model %s", kind)
}
@ -114,28 +118,28 @@ func ValidateResource(patchedResource unstructured.Unstructured, kind string) er
return nil
}
func GetDefinitionNameFromKind(kind string) string {
openApiGlobalState.mutex.RLock()
defer openApiGlobalState.mutex.RUnlock()
return openApiGlobalState.kindToDefinitionName[kind]
func (o *Controller) GetDefinitionNameFromKind(kind string) string {
o.mutex.RLock()
defer o.mutex.RUnlock()
return o.kindToDefinitionName[kind]
}
func useOpenApiDocument(customDoc *openapi_v2.Document) error {
openApiGlobalState.mutex.Lock()
defer openApiGlobalState.mutex.Unlock()
func (o *Controller) useOpenApiDocument(customDoc *openapi_v2.Document) error {
o.mutex.Lock()
defer o.mutex.Unlock()
openApiGlobalState.document = customDoc
o.document = customDoc
openApiGlobalState.definitions = make(map[string]*openapi_v2.Schema)
openApiGlobalState.kindToDefinitionName = make(map[string]string)
for _, definition := range openApiGlobalState.document.GetDefinitions().AdditionalProperties {
openApiGlobalState.definitions[definition.GetName()] = definition.GetValue()
o.definitions = make(map[string]*openapi_v2.Schema)
o.kindToDefinitionName = make(map[string]string)
for _, definition := range o.document.GetDefinitions().AdditionalProperties {
o.definitions[definition.GetName()] = definition.GetValue()
path := strings.Split(definition.GetName(), ".")
openApiGlobalState.kindToDefinitionName[path[len(path)-1]] = definition.GetName()
o.kindToDefinitionName[path[len(path)-1]] = definition.GetName()
}
var err error
openApiGlobalState.models, err = proto.NewOpenAPIData(openApiGlobalState.document)
o.models, err = proto.NewOpenAPIData(o.document)
if err != nil {
return err
}
@ -154,17 +158,17 @@ func getSchemaDocument() (*openapi_v2.Document, error) {
}
// For crd, we do not store definition in document
func getSchemaFromDefinitions(kind string) (proto.Schema, error) {
func (o *Controller) getSchemaFromDefinitions(kind string) (proto.Schema, error) {
path := proto.NewPath(kind)
return (&proto.Definitions{}).ParseSchema(openApiGlobalState.definitions[kind], &path)
return (&proto.Definitions{}).ParseSchema(o.definitions[kind], &path)
}
func generateEmptyResource(kindSchema *openapi_v2.Schema) interface{} {
func (o *Controller) generateEmptyResource(kindSchema *openapi_v2.Schema) interface{} {
types := kindSchema.GetType().GetValue()
if kindSchema.GetXRef() != "" {
return generateEmptyResource(openApiGlobalState.definitions[strings.TrimPrefix(kindSchema.GetXRef(), "#/definitions/")])
return o.generateEmptyResource(o.definitions[strings.TrimPrefix(kindSchema.GetXRef(), "#/definitions/")])
}
if len(types) != 1 {
@ -188,7 +192,7 @@ func generateEmptyResource(kindSchema *openapi_v2.Schema) interface{} {
wg.Add(len(properties))
for _, property := range properties {
go func(property *openapi_v2.NamedSchema) {
prop := generateEmptyResource(property.GetValue())
prop := o.generateEmptyResource(property.GetValue())
mutex.Lock()
props[property.GetName()] = prop
mutex.Unlock()
@ -200,7 +204,7 @@ func generateEmptyResource(kindSchema *openapi_v2.Schema) interface{} {
case "array":
var array []interface{}
for _, schema := range kindSchema.GetItems().GetSchema() {
array = append(array, generateEmptyResource(schema))
array = append(array, o.generateEmptyResource(schema))
}
return array
case "string":

4
pkg/openapi/validation_test.go
View file

@ -47,12 +47,14 @@ func Test_ValidateMutationPolicy(t *testing.T) {
},
}
o, _ := NewOpenAPIController()
for i, tc := range tcs {
policy := v1.ClusterPolicy{}
_ = json.Unmarshal(tc.policy, &policy)
var errMessage string
err := ValidatePolicyMutation(policy)
err := o.ValidatePolicyMutation(policy)
if err != nil {
errMessage = err.Error()
}

4
pkg/policy/validate.go
View file

@ -17,7 +17,7 @@ import (
// Validate does some initial check to verify some conditions
// - One operation per rule
// - ResourceDescription mandatory checks
func Validate(p kyverno.ClusterPolicy, client *dclient.Client, mock bool) error {
func Validate(p kyverno.ClusterPolicy, client *dclient.Client, mock bool, openAPIController *openapi.Controller) error {
if path, err := validateUniqueRuleName(p); err != nil {
return fmt.Errorf("path: spec.%s: %v", path, err)
}
@ -68,7 +68,7 @@ func Validate(p kyverno.ClusterPolicy, client *dclient.Client, mock bool) error
}
}
if err := openapi.ValidatePolicyMutation(p); err != nil {
if err := openAPIController.ValidatePolicyMutation(p); err != nil {
return err
}

10
pkg/policy/validate_test.go
View file

@ -4,6 +4,8 @@ import (
"encoding/json"
"testing"
"github.com/nirmata/kyverno/pkg/openapi"
kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
"gotest.tools/assert"
)
@ -373,7 +375,9 @@ func Test_Validate_Policy(t *testing.T) {
err := json.Unmarshal(rawPolicy, &policy)
assert.NilError(t, err)
err = Validate(policy, nil, true)
openAPIController, _ := openapi.NewOpenAPIController()
err = Validate(policy, nil, true, openAPIController)
assert.NilError(t, err)
}
@ -519,7 +523,9 @@ func Test_Validate_ErrorFormat(t *testing.T) {
err := json.Unmarshal(rawPolicy, &policy)
assert.NilError(t, err)
err = Validate(policy, nil, true)
openAPIController, _ := openapi.NewOpenAPIController()
err = Validate(policy, nil, true, openAPIController)
assert.Assert(t, err != nil)
}

4
pkg/webhooks/mutation.go
View file

@ -5,8 +5,6 @@ import (
"sort"
"time"
"github.com/nirmata/kyverno/pkg/openapi"
kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
v1 "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
"github.com/nirmata/kyverno/pkg/engine"
@ -67,7 +65,7 @@ func (ws *WebhookServer) HandleMutation(request *v1beta1.AdmissionRequest, resou
logger.V(4).Info("failed to apply policy", "policy", policy.Name)
continue
}
err := openapi.ValidateResource(*engineResponse.PatchedResource.DeepCopy(), engineResponse.PatchedResource.GetKind())
err := ws.openAPIController.ValidateResource(*engineResponse.PatchedResource.DeepCopy(), engineResponse.PatchedResource.GetKind())
if err != nil {
logger.Error(err, "failed to validate resource")
continue

2
pkg/webhooks/policyvalidation.go
View file

@ -28,7 +28,7 @@ func (ws *WebhookServer) handlePolicyValidation(request *v1beta1.AdmissionReques
Message: fmt.Sprintf("Failed to unmarshal policy admission request err %v", err),
}}
}
if err := policyvalidate.Validate(*policy, ws.client, false); err != nil {
if err := policyvalidate.Validate(*policy, ws.client, false, ws.openAPIController); err != nil {
admissionResp = &v1beta1.AdmissionResponse{
Allowed: false,
Result: &metav1.Status{

5
pkg/webhooks/server.go
View file

@ -10,6 +10,8 @@ import (
"net/http"
"time"
"github.com/nirmata/kyverno/pkg/openapi"
"github.com/go-logr/logr"
"github.com/nirmata/kyverno/pkg/checker"
kyvernoclient "github.com/nirmata/kyverno/pkg/client/clientset/versioned"
@ -70,6 +72,7 @@ type WebhookServer struct {
grGenerator *generate.Generator
resourceWebhookWatcher *webhookconfig.ResourceWebhookRegister
log logr.Logger
openAPIController *openapi.Controller
}
// NewWebhookServer creates new instance of WebhookServer accordingly to given configuration
@ -91,6 +94,7 @@ func NewWebhookServer(
resourceWebhookWatcher *webhookconfig.ResourceWebhookRegister,
cleanUp chan<- struct{},
log logr.Logger,
openAPIController *openapi.Controller,
) (*WebhookServer, error) {
if tlsPair == nil {
@ -124,6 +128,7 @@ func NewWebhookServer(
grGenerator: grGenerator,
resourceWebhookWatcher: resourceWebhookWatcher,
log: log,
openAPIController: openAPIController,
}
mux := http.NewServeMux()
mux.HandleFunc(config.MutatingWebhookServicePath, ws.serve)