mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-29 02:45:06 +00:00
Code Activity

fix: nits in cel context lib (#12333)

Browse source 
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2025-03-09 18:47:11 +01:00 • committed by GitHub
parent 1ac2dd9fa6
commit a9ac540ddc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 53 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
pkg/cel/libs/context/impl.go
View file

@ -27,7 +27,7 @@ func (c *impl) get_configmap_string_string(args ...ref.Val) ref.Val {
} }
} }
func (c *impl) get_globalreference_string(args ...ref.Val) ref.Val { func (c *impl) get_globalreference_string_string(args ...ref.Val) ref.Val {
if len(args) != 3 { if len(args) != 3 {
return types.NewErr("expected 3 arguments, got %d", len(args)) return types.NewErr("expected 3 arguments, got %d", len(args))
} }
@ -77,7 +77,7 @@ func (c *impl) parse_imagereference_string(ctx ref.Val, image ref.Val) ref.Val {
} }
} }
func (c *impl) list_resource_string(args ...ref.Val) ref.Val { func (c *impl) list_resources_string_string_string(args ...ref.Val) ref.Val {
if self, err := utils.ConvertToNative[Context](args[0]); err != nil { if self, err := utils.ConvertToNative[Context](args[0]); err != nil {
return types.WrapErr(err) return types.WrapErr(err)
} else if apiVersion, err := utils.ConvertToNative[string](args[1]); err != nil { } else if apiVersion, err := utils.ConvertToNative[string](args[1]); err != nil {
@ -87,7 +87,7 @@ func (c *impl) list_resource_string(args ...ref.Val) ref.Val {
} else if namespace, err := utils.ConvertToNative[string](args[3]); err != nil { } else if namespace, err := utils.ConvertToNative[string](args[3]); err != nil {
return types.WrapErr(err) return types.WrapErr(err)
} else { } else {
list, err := self.ListResource(apiVersion, resource, namespace) list, err := self.ListResources(apiVersion, resource, namespace)
if err != nil { if err != nil {
// Errors are not expected here since Parse is a more lenient parser than ParseRequestURI. // Errors are not expected here since Parse is a more lenient parser than ParseRequestURI.
return types.NewErr("failed to list resource: %v", err) return types.NewErr("failed to list resource: %v", err)
@ -96,7 +96,7 @@ func (c *impl) list_resource_string(args ...ref.Val) ref.Val {
} }
} }
func (c *impl) get_resource_string(args ...ref.Val) ref.Val { func (c *impl) get_resource_string_string_string_string(args ...ref.Val) ref.Val {
if self, err := utils.ConvertToNative[Context](args[0]); err != nil { if self, err := utils.ConvertToNative[Context](args[0]); err != nil {
return types.WrapErr(err) return types.WrapErr(err)
} else if apiVersion, err := utils.ConvertToNative[string](args[1]); err != nil { } else if apiVersion, err := utils.ConvertToNative[string](args[1]); err != nil {

20
pkg/cel/libs/context/impl_test.go
View file

@ -38,7 +38,7 @@ func (mock *ctx) ParseImageReference(n string) (imagedataloader.ImageReference,
return mock.ParseImageReferenceFunc(n) return mock.ParseImageReferenceFunc(n)
} }
func (mock *ctx) ListResource(apiVersion, resource, namespace string) (*unstructured.UnstructuredList, error) { func (mock *ctx) ListResources(apiVersion, resource, namespace string) (*unstructured.UnstructuredList, error) {
return mock.ListResourcesFunc(apiVersion, resource, namespace) return mock.ListResourcesFunc(apiVersion, resource, namespace)
} }
@ -105,7 +105,7 @@ func (m *mockEntry) Get(_ string) (any, error) {
func (m *mockEntry) Stop() {} func (m *mockEntry) Stop() {}
func Test_impl_get_globalreference_string(t *testing.T) { func Test_impl_get_globalreference_string_string(t *testing.T) {
opts := Lib() opts := Lib()
base, err := cel.NewEnv(opts) base, err := cel.NewEnv(opts)
assert.NoError(t, err) assert.NoError(t, err)
@ -265,7 +265,7 @@ func Test_impl_parse_image_ref_string(t *testing.T) {
assert.Equal(t, img.Image, "ghcr.io/kyverno/kyverno:latest") assert.Equal(t, img.Image, "ghcr.io/kyverno/kyverno:latest")
} }
func Test_impl_get_resource_string(t *testing.T) { func Test_impl_get_resource_string_string_string_string(t *testing.T) {
opts := Lib() opts := Lib()
base, err := cel.NewEnv(opts) base, err := cel.NewEnv(opts)
assert.NoError(t, err) assert.NoError(t, err)
@ -276,7 +276,7 @@ func Test_impl_get_resource_string(t *testing.T) {
env, err := base.Extend(options...) env, err := base.Extend(options...)
assert.NoError(t, err) assert.NoError(t, err)
assert.NotNil(t, env) assert.NotNil(t, env)
ast, issues := env.Compile(`context.GetResource("apps/v1", "Deployment", "default", "nginx")`) ast, issues := env.Compile(`context.GetResource("apps/v1", "deployments", "default", "nginx")`)
assert.Nil(t, issues) assert.Nil(t, issues)
assert.NotNil(t, ast) assert.NotNil(t, ast)
prog, err := env.Program(ast) prog, err := env.Program(ast)
@ -287,8 +287,8 @@ func Test_impl_get_resource_string(t *testing.T) {
GetResourcesFunc: func(apiVersion, resource, namespace, name string) (*unstructured.Unstructured, error) { GetResourcesFunc: func(apiVersion, resource, namespace, name string) (*unstructured.Unstructured, error) {
return &unstructured.Unstructured{ return &unstructured.Unstructured{
Object: map[string]any{ Object: map[string]any{
"apiVersion": apiVersion, "apiVersion": "apps/v1",
"kind": resource, "kind": "Deployment",
"metadata": map[string]any{ "metadata": map[string]any{
"name": name, "name": name,
"namespace": namespace, "namespace": namespace,
@ -305,7 +305,7 @@ func Test_impl_get_resource_string(t *testing.T) {
assert.Equal(t, object["kind"].(string), "Deployment") assert.Equal(t, object["kind"].(string), "Deployment")
} }
func Test_impl_list_resource_string(t *testing.T) { func Test_impl_list_resources_string_string_string(t *testing.T) {
opts := Lib() opts := Lib()
base, err := cel.NewEnv(opts) base, err := cel.NewEnv(opts)
assert.NoError(t, err) assert.NoError(t, err)
@ -316,7 +316,7 @@ func Test_impl_list_resource_string(t *testing.T) {
env, err := base.Extend(options...) env, err := base.Extend(options...)
assert.NoError(t, err) assert.NoError(t, err)
assert.NotNil(t, env) assert.NotNil(t, env)
ast, issues := env.Compile(`context.ListResource("apps/v1", "Deployment", "default")`) ast, issues := env.Compile(`context.ListResources("apps/v1", "deployments", "default")`)
assert.Nil(t, issues) assert.Nil(t, issues)
assert.NotNil(t, ast) assert.NotNil(t, ast)
prog, err := env.Program(ast) prog, err := env.Program(ast)
@ -329,8 +329,8 @@ func Test_impl_list_resource_string(t *testing.T) {
Items: []unstructured.Unstructured{ Items: []unstructured.Unstructured{
{ {
Object: map[string]any{ Object: map[string]any{
"apiVersion": apiVersion, "apiVersion": "apps/v1",
"kind": resource, "kind": "Deployment",
"metadata": map[string]any{ "metadata": map[string]any{
"name": "nginx", "name": "nginx",
"namespace": namespace, "namespace": namespace,

46
pkg/cel/libs/context/lib.go
View file

@ -48,26 +48,54 @@ func (c *lib) extendEnv(env *cel.Env) (*cel.Env, error) {
// build our function overloads // build our function overloads
libraryDecls := map[string][]cel.FunctionOpt{ libraryDecls := map[string][]cel.FunctionOpt{
"GetConfigMap": { "GetConfigMap": {
cel.MemberOverload("get_configmap_string_string", []*cel.Type{ContextType, types.StringType, types.StringType}, configMapType.CelType(), cel.FunctionBinding(impl.get_configmap_string_string)), cel.MemberOverload(
"get_configmap_string_string",
[]*cel.Type{ContextType, types.StringType, types.StringType},
configMapType.CelType(),
cel.FunctionBinding(impl.get_configmap_string_string),
),
}, },
"GetGlobalReference": { "GetGlobalReference": {
// TODO: should not use DynType in return cel.MemberOverload(
cel.MemberOverload("get_globalreference_string", []*cel.Type{ContextType, types.StringType, types.StringType}, types.DynType, cel.FunctionBinding(impl.get_globalreference_string)), "get_globalreference_string_string",
[]*cel.Type{ContextType, types.StringType, types.StringType},
types.DynType,
cel.FunctionBinding(impl.get_globalreference_string_string),
),
}, },
"GetImageData": { "GetImageData": {
// TODO: should not use DynType in return cel.MemberOverload(
cel.MemberOverload("get_imagedata_string", []*cel.Type{ContextType, types.StringType}, imageDataType.CelType(), cel.BinaryBinding(impl.get_imagedata_string)), "get_imagedata_string",
[]*cel.Type{ContextType, types.StringType},
imageDataType.CelType(),
cel.BinaryBinding(impl.get_imagedata_string),
),
}, },
"ParseImageReference": { "ParseImageReference": {
cel.MemberOverload("parse_image_reference_string", []*cel.Type{ContextType, types.StringType}, imageReferenceType.CelType(), cel.BinaryBinding(impl.parse_imagereference_string)), cel.MemberOverload(
"parse_image_reference_string",
[]*cel.Type{ContextType, types.StringType},
imageReferenceType.CelType(),
cel.BinaryBinding(impl.parse_imagereference_string),
),
}, },
"ListResource": { "ListResources": {
// TODO: should not use DynType in return // TODO: should not use DynType in return
cel.MemberOverload("list_resource_string", []*cel.Type{ContextType, types.StringType, types.StringType, types.StringType}, types.DynType, cel.FunctionBinding(impl.list_resource_string)), cel.MemberOverload(
"list_resources_string_string_string",
[]*cel.Type{ContextType, types.StringType, types.StringType, types.StringType},
types.DynType,
cel.FunctionBinding(impl.list_resources_string_string_string),
),
}, },
"GetResource": { "GetResource": {
// TODO: should not use DynType in return // TODO: should not use DynType in return
cel.MemberOverload("get_resource_string", []*cel.Type{ContextType, types.StringType, types.StringType, types.StringType, types.StringType}, types.DynType, cel.FunctionBinding(impl.get_resource_string)), cel.MemberOverload(
"get_resource_string_string_string_string",
[]*cel.Type{ContextType, types.StringType, types.StringType, types.StringType, types.StringType},
types.DynType,
cel.FunctionBinding(impl.get_resource_string_string_string_string),
),
}, },
} }
// create env options corresponding to our function overloads // create env options corresponding to our function overloads

2
pkg/cel/libs/context/types.go
View file

@ -19,7 +19,7 @@ type ContextInterface interface {
GetGlobalReference(string, string) (any, error) GetGlobalReference(string, string) (any, error)
GetImageData(string) (*imagedataloader.ImageData, error) GetImageData(string) (*imagedataloader.ImageData, error)
ParseImageReference(string) (imagedataloader.ImageReference, error) ParseImageReference(string) (imagedataloader.ImageReference, error)
ListResource(apiVersion, resource, namespace string) (*unstructured.UnstructuredList, error) ListResources(apiVersion, resource, namespace string) (*unstructured.UnstructuredList, error)
GetResource(apiVersion, resource, namespace, name string) (*unstructured.Unstructured, error) GetResource(apiVersion, resource, namespace, name string) (*unstructured.Unstructured, error)
} }

2
pkg/cel/policy/context.go
View file

@ -114,7 +114,7 @@ func isLikelyKubernetesObject(data any) bool {
return false return false
} }
func (cp *contextProvider) ListResource(apiVersion, resource, namespace string) (*unstructured.UnstructuredList, error) { func (cp *contextProvider) ListResources(apiVersion, resource, namespace string) (*unstructured.UnstructuredList, error) {
groupVersion, err := schema.ParseGroupVersion(apiVersion) groupVersion, err := schema.ParseGroupVersion(apiVersion)
if err != nil { if err != nil {
return nil, err return nil, err