mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-15 17:51:20 +00:00
Code Activity

fix: simplify cli autogen and labels selector check (#8325)

Browse source 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2023-09-10 21:10:02 +02:00 committed by GitHub
parent 5beaec677f
commit 74fed89a17
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 35 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
cmd/cli/kubectl-kyverno/processor/policy_processor.go
View file

@ -57,42 +57,9 @@ func (p *PolicyProcessor) ApplyPolicyOnResource() ([]engineapi.EngineResponse, e
if p.Variables["request.operation"] == "DELETE" {
operation = kyvernov1.Delete
}
rules := autogen.ComputeRules(p.Policy)
policyWithNamespaceSelector := false
OuterLoop:
for _, p := range autogen.ComputeRules(p.Policy) {
if p.MatchResources.ResourceDescription.NamespaceSelector != nil ||
p.ExcludeResources.ResourceDescription.NamespaceSelector != nil {
policyWithNamespaceSelector = true
break
}
for _, m := range p.MatchResources.Any {
if m.ResourceDescription.NamespaceSelector != nil {
policyWithNamespaceSelector = true
break OuterLoop
}
}
for _, m := range p.MatchResources.All {
if m.ResourceDescription.NamespaceSelector != nil {
policyWithNamespaceSelector = true
break OuterLoop
}
}
for _, e := range p.ExcludeResources.Any {
if e.ResourceDescription.NamespaceSelector != nil {
policyWithNamespaceSelector = true
break OuterLoop
}
}
for _, e := range p.ExcludeResources.All {
if e.ResourceDescription.NamespaceSelector != nil {
policyWithNamespaceSelector = true
break OuterLoop
}
}
}
if policyWithNamespaceSelector {
if needsNamespaceLabels(rules...) {
resourceNamespace := p.Resource.GetNamespace()
namespaceLabels = p.NamespaceSelectorMap[p.Resource.GetNamespace()]
if resourceNamespace != "default" && len(namespaceLabels) < 1 {
@ -195,7 +162,7 @@ OuterLoop:
}
var policyHasValidate bool
for _, rule := range autogen.ComputeRules(p.Policy) {
for _, rule := range rules {
if rule.HasValidate() || rule.HasVerifyImageChecks() {
policyHasValidate = true
}
@ -214,7 +181,7 @@ OuterLoop:
}
var policyHasGenerate bool
for _, rule := range autogen.ComputeRules(p.Policy) {
for _, rule := range rules {
if rule.HasGenerate() {
policyHasGenerate = true
}

31
cmd/cli/kubectl-kyverno/processor/utils.go
View file

@ -3,6 +3,7 @@ package processor
import (
"strings"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
engineapi "github.com/kyverno/kyverno/pkg/engine/api"
)
@ -77,3 +78,33 @@ func combineRuleResponses(imageResponse engineapi.EngineResponse) engineapi.Engi
imageResponse.PolicyResponse.Rules = combineRuleResponses
return imageResponse
}
func needsNamespaceLabels(rules ...kyvernov1.Rule) bool {
for _, p := range rules {
if p.MatchResources.ResourceDescription.NamespaceSelector != nil ||
p.ExcludeResources.ResourceDescription.NamespaceSelector != nil {
return true
}
for _, m := range p.MatchResources.Any {
if m.ResourceDescription.NamespaceSelector != nil {
return true
}
}
for _, m := range p.MatchResources.All {
if m.ResourceDescription.NamespaceSelector != nil {
return true
}
}
for _, e := range p.ExcludeResources.Any {
if e.ResourceDescription.NamespaceSelector != nil {
return true
}
}
for _, e := range p.ExcludeResources.All {
if e.ResourceDescription.NamespaceSelector != nil {
return true
}
}
}
return false
}