generate rule for pod controllers

pkg/webhooks/policymutation.go

@@ -3,8 +3,11 @@ package webhooks
 import (
 	"encoding/json"
 	"fmt"
+	"reflect"
+	"strconv"
 	"strings"
 
+	jsonpatch "github.com/evanphx/json-patch"
 	"github.com/golang/glog"
 	kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
 	"github.com/nirmata/kyverno/pkg/utils"
@@ -12,6 +15,11 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+const (
+	podControllers           = "DaemonSet,Deployment,Job,ReplicaSet,StatefulSet"
+	podControllersAnnotation = "policies.kyverno.io/podcontroller.list"
+)
+
 func (ws *WebhookServer) handlePolicyMutation(request *v1beta1.AdmissionRequest) *v1beta1.AdmissionResponse {
 	var policy *kyverno.ClusterPolicy
 	raw := request.Object.Raw
@@ -56,6 +64,17 @@ func generateJSONPatchesForDefaults(policy *kyverno.ClusterPolicy) ([]byte, []st
 		updateMsgs = append(updateMsgs, updateMsg)
 	}
 
+	patch, errs := generatePodControllerRule(*policy)
+	if len(errs) > 0 {
+		var errMsgs []string
+		for _, err := range errs {
+			errMsgs = append(errMsgs, err.Error())
+		}
+		glog.Errorf("failed auto generatig rule for pod controllers: %s", errMsgs)
+		updateMsgs = append(updateMsgs, strings.Join(errMsgs, ";"))
+	}
+
+	patches = append(patches, patch...)
 	return utils.JoinPatches(patches), updateMsgs
 }
 
@@ -82,3 +101,217 @@ func defaultvalidationFailureAction(policy *kyverno.ClusterPolicy) ([]byte, stri
 	}
 	return nil, ""
 }
+
+// podControllersKey annotation could be:
+// scenario A: not exist, set default to "all", which generates on all pod controllers
+//               - if name / selector exist in resource description -> skip
+//                 as these fields may not be applicable to pod controllers
+// scenario B: "null", user explicitely disable this feature -> skip
+// scenario C: some certain controllers that user set -> generate on defined controllers
+//             copy entrie match / exclude block, it's users' responsibility to
+//             make sure all fields are applicable to pod cotrollers
+
+// generatePodControllerRule returns two patches: rulePatches and annotation patch(if necessary)
+func generatePodControllerRule(policy kyverno.ClusterPolicy) (patches [][]byte, errs []error) {
+	ann := policy.GetAnnotations()
+	controllers, ok := ann[podControllersAnnotation]
+
+	// scenario A
+	if !ok {
+		controllers = "all"
+		annPatch, err := defaultPodControllerAnnotation(ann)
+		if err != nil {
+			errs = append(errs, fmt.Errorf("failed to generate pod controller annotation for policy '%s': %v", policy.Name, err))
+		} else {
+			patches = append(patches, annPatch)
+		}
+	}
+
+	// scenario B
+	if controllers == "null" {
+		return nil, nil
+	}
+
+	glog.V(3).Infof("Auto generating rule for pod controller: %s", controllers)
+
+	p, err := generateRulePatches(policy, controllers)
+	patches = append(patches, p...)
+	errs = append(errs, err...)
+	return
+}
+
+// generateRulePatches generates rule for podControllers based on scenario A and C
+func generateRulePatches(policy kyverno.ClusterPolicy, controllers string) (rulePatches [][]byte, errs []error) {
+	var genRule kyvernoRule
+	insertIdx := len(policy.Spec.Rules)
+
+	for _, rule := range policy.Spec.Rules {
+		genRule = generateRuleForControllers(rule, controllers)
+		if reflect.DeepEqual(genRule, kyvernoRule{}) {
+			continue
+		}
+
+		// generate patch bytes
+		jsonPatch := struct {
+			Path  string      `json:"path"`
+			Op    string      `json:"op"`
+			Value interface{} `json:"value"`
+		}{
+			fmt.Sprintf("/spec/rules/%s", strconv.Itoa(insertIdx)),
+			"add",
+			genRule,
+		}
+		pbytes, err := json.Marshal(jsonPatch)
+		if err != nil {
+			errs = append(errs, err)
+			continue
+		}
+
+		// check the patch
+		if _, err := jsonpatch.DecodePatch([]byte("[" + string(pbytes) + "]")); err != nil {
+			errs = append(errs, err)
+			continue
+		}
+
+		rulePatches = append(rulePatches, pbytes)
+		insertIdx++
+	}
+	return
+}
+
+// the kyvernoRule holds the temporary kyverno rule struct
+// each field is a pointer to the the actual object
+// when serilizing data, we would expect to drop the omitempty key
+// otherwise (without the pointer), it will be set to empty value
+// - an empty struct in this case, some may fail the schema validation
+// TODO(shuting) may related to:
+// https://github.com/nirmata/kyverno/pull/549#discussion_r360088556
+// https://github.com/nirmata/kyverno/issues/568
+
+type kyvernoRule struct {
+	Name             string                    `json:"name"`
+	MatchResources   *kyverno.MatchResources   `json:"match"`
+	ExcludeResources *kyverno.ExcludeResources `json:"exclude,omitempty"`
+	Mutation         *kyverno.Mutation         `json:"mutate,omitempty"`
+	Validation       *kyverno.Validation       `json:"validate,omitempty"`
+}
+
+func generateRuleForControllers(rule kyverno.Rule, controllers string) kyvernoRule {
+	match := rule.MatchResources
+	exclude := rule.ExcludeResources
+	if !utils.ContainsString(match.ResourceDescription.Kinds, "Pod") ||
+		(len(exclude.ResourceDescription.Kinds) != 0 && !utils.ContainsString(exclude.ResourceDescription.Kinds, "Pod")) {
+		return kyvernoRule{}
+	}
+
+	if rule.Mutation.Overlay == nil && !rule.HasValidate() {
+		return kyvernoRule{}
+	}
+
+	// scenario A
+	if controllers == "all" {
+		if match.ResourceDescription.Name != "" || match.ResourceDescription.Selector != nil ||
+			exclude.ResourceDescription.Name != "" || exclude.ResourceDescription.Selector != nil {
+			glog.Warningf("Rule '%s' skip generating rule on pod controllers: Name / Selector in resource decription may not be applicable.", rule.Name)
+			return kyvernoRule{}
+		}
+		controllers = podControllers
+	}
+
+	controllerRule := &kyvernoRule{
+		Name:           fmt.Sprintf("autogen-%s", rule.Name),
+		MatchResources: match.DeepCopy(),
+	}
+
+	// overwrite Kinds by pod controllers defined in the annotation
+	controllerRule.MatchResources.Kinds = strings.Split(controllers, ",")
+	if len(exclude.Kinds) != 0 {
+		controllerRule.ExcludeResources = exclude.DeepCopy()
+		controllerRule.ExcludeResources.Kinds = strings.Split(controllers, ",")
+	}
+
+	if rule.Mutation.Overlay != nil {
+		newMutation := &kyverno.Mutation{
+			Overlay: map[string]interface{}{
+				"spec": map[string]interface{}{
+					"template": rule.Mutation.Overlay,
+				},
+			},
+		}
+
+		controllerRule.Mutation = newMutation.DeepCopy()
+		return *controllerRule
+	}
+
+	if rule.Validation.Pattern != nil {
+		newValidate := &kyverno.Validation{
+			Pattern: map[string]interface{}{
+				"spec": map[string]interface{}{
+					"template": rule.Validation.Pattern,
+				},
+			},
+		}
+		controllerRule.Validation = newValidate.DeepCopy()
+		return *controllerRule
+	}
+
+	if len(rule.Validation.AnyPattern) != 0 {
+		var patterns []interface{}
+		for _, pattern := range rule.Validation.AnyPattern {
+			newPattern := map[string]interface{}{
+				"spec": map[string]interface{}{
+					"template": pattern,
+				},
+			}
+
+			patterns = append(patterns, newPattern)
+		}
+
+		controllerRule.Validation = &kyverno.Validation{
+			AnyPattern: patterns,
+		}
+		return *controllerRule
+	}
+
+	return kyvernoRule{}
+}
+
+// defaultPodControllerAnnotation generates annotation "policies.kyverno.io/podcontroller.list=all"
+// ann passes in the annotation of the policy
+func defaultPodControllerAnnotation(ann map[string]string) ([]byte, error) {
+	if ann == nil {
+		ann = make(map[string]string)
+		ann[podControllersAnnotation] = "all"
+		jsonPatch := struct {
+			Path  string      `json:"path"`
+			Op    string      `json:"op"`
+			Value interface{} `json:"value"`
+		}{
+			"/metadata/annotations",
+			"add",
+			ann,
+		}
+
+		patchByte, err := json.Marshal(jsonPatch)
+		if err != nil {
+			return nil, err
+		}
+		return patchByte, nil
+	}
+
+	jsonPatch := struct {
+		Path  string      `json:"path"`
+		Op    string      `json:"op"`
+		Value interface{} `json:"value"`
+	}{
+		"/metadata/annotations/policies.kyverno.io~1podcontroller.list",
+		"add",
+		"all",
+	}
+
+	patchByte, err := json.Marshal(jsonPatch)
+	if err != nil {
+		return nil, err
+	}
+	return patchByte, nil
+}