mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-04-15 16:56:56 +00:00
Code Activity

refactor: move controller autogen annotation in api package (#3364)

Browse source 
* fix: configmap resource filters generated by helm does not account for namespace

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* refator: move controller autogen annotation in api package

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
This commit is contained in:
Charles-Edouard Brétéché 2022-03-09 14:48:04 +01:00 • committed by GitHub
parent 4c1a8336b0
commit ea977b259c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 41 additions and 42 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
api/kyverno/v1/constants.go Normal file
View file

@ -0,0 +1,6 @@
package v1
const (
//PodControllersAnnotation defines the annotation key for Pod-Controllers
PodControllersAnnotation = "pod-policies.kyverno.io/autogen-controllers"
)

10
pkg/autogen/autogen.go
View file

@ -8,7 +8,13 @@ import (
jsonpatch "github.com/evanphx/json-patch"
"github.com/go-logr/logr"
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/engine"
)
const (
// PodControllerCronJob represent CronJob string
PodControllerCronJob = "CronJob"
//PodControllers stores the list of Pod-controllers in csv string
PodControllers = "DaemonSet,Deployment,Job,StatefulSet,CronJob"
)
// CanAutoGen checks whether the rule(s) (in policy) can be applied to Pod controllers
@ -95,7 +101,7 @@ func CanAutoGen(spec *kyverno.Spec, log logr.Logger) (applyAutoGen bool, control
return false, ""
}
return true, engine.PodControllers
return true, PodControllers
}
// podControllersKey annotation could be:

31
pkg/autogen/autogen_test.go
View file

@ -10,7 +10,6 @@ import (
"testing"
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/engine"
"github.com/kyverno/kyverno/pkg/utils"
"gotest.tools/assert"
"sigs.k8s.io/controller-runtime/pkg/log"
@ -45,7 +44,7 @@ func Test_getControllers(t *testing.T) {
{
name: "rule-with-deny",
policy: []byte(`{"apiVersion":"kyverno.io/v1","kind":"ClusterPolicy","metadata":{"name":"test"},"spec":{"rules":[{"name":"require-network-policy","match":{"resources":{"kinds":["Pod"]}},"validate":{"message":"testpolicy","deny":{"conditions":[{"key":"{{request.object.metadata.labels.foo}}","operator":"Equals","value":"bar"}]}}}]}}`),
expectedControllers: engine.PodControllers,
expectedControllers: PodControllers,
},
{
name: "rule-with-match-mixed-kinds-pod-podcontrollers",
@ -60,12 +59,12 @@ func Test_getControllers(t *testing.T) {
{
name: "rule-with-match-kinds-pod-only",
policy: []byte(`{"apiVersion":"kyverno.io/v1","kind":"ClusterPolicy","metadata":{"name":"test"},"spec":{"rules":[{"name":"require-network-policy","match":{"resources":{"kinds":["Pod"]}},"validate":{"message":"testpolicy","pattern":{"metadata":{"labels":{"foo":"bar"}}}}}]}}`),
expectedControllers: engine.PodControllers,
expectedControllers: PodControllers,
},
{
name: "rule-with-exclude-kinds-pod-only",
policy: []byte(`{"apiVersion":"kyverno.io/v1","kind":"ClusterPolicy","metadata":{"name":"test"},"spec":{"rules":[{"name":"require-network-policy","match":{"resources":{"kinds":["Pod"]}},"exclude":{"resources":{"kinds":["Pod"],"namespaces":["test"]}},"validate":{"message":"testpolicy","pattern":{"metadata":{"labels":{"foo":"bar"}}}}}]}}`),
expectedControllers: engine.PodControllers,
expectedControllers: PodControllers,
},
{
name: "rule-with-mutate-patches",
@ -129,7 +128,7 @@ func Test_Any(t *testing.T) {
},
}
rulePatches, errs := GenerateRulePatches(&policy.Spec, engine.PodControllers, log.Log)
rulePatches, errs := GenerateRulePatches(&policy.Spec, PodControllers, log.Log)
fmt.Println("utils.JoinPatches(patches)erterter", string(utils.JoinPatches(rulePatches)))
if len(errs) != 0 {
t.Log(errs)
@ -167,7 +166,7 @@ func Test_All(t *testing.T) {
},
}
rulePatches, errs := GenerateRulePatches(&policy.Spec, engine.PodControllers, log.Log)
rulePatches, errs := GenerateRulePatches(&policy.Spec, PodControllers, log.Log)
if len(errs) != 0 {
t.Log(errs)
}
@ -199,7 +198,7 @@ func Test_Exclude(t *testing.T) {
policy := policies[0]
policy.Spec.Rules[0].ExcludeResources.Namespaces = []string{"fake-namespce"}
rulePatches, errs := GenerateRulePatches(&policy.Spec, engine.PodControllers, log.Log)
rulePatches, errs := GenerateRulePatches(&policy.Spec, PodControllers, log.Log)
if len(errs) != 0 {
t.Log(errs)
}
@ -217,7 +216,7 @@ func Test_Exclude(t *testing.T) {
func Test_CronJobOnly(t *testing.T) {
controllers := engine.PodControllerCronJob
controllers := PodControllerCronJob
dir, err := os.Getwd()
baseDir := filepath.Dir(filepath.Dir(dir))
assert.NilError(t, err)
@ -232,7 +231,7 @@ func Test_CronJobOnly(t *testing.T) {
policy := policies[0]
policy.SetAnnotations(map[string]string{
engine.PodControllersAnnotation: controllers,
kyverno.PodControllersAnnotation: controllers,
})
rulePatches, errs := GenerateRulePatches(&policy.Spec, controllers, log.Log)
@ -263,7 +262,7 @@ func Test_ForEachPod(t *testing.T) {
policy := policies[0]
policy.Spec.Rules[0].ExcludeResources.Namespaces = []string{"fake-namespce"}
rulePatches, errs := GenerateRulePatches(&policy.Spec, engine.PodControllers, log.Log)
rulePatches, errs := GenerateRulePatches(&policy.Spec, PodControllers, log.Log)
if len(errs) != 0 {
t.Log(errs)
}
@ -281,7 +280,7 @@ func Test_ForEachPod(t *testing.T) {
func Test_CronJob_hasExclude(t *testing.T) {
controllers := engine.PodControllerCronJob
controllers := PodControllerCronJob
dir, err := os.Getwd()
baseDir := filepath.Dir(filepath.Dir(dir))
assert.NilError(t, err)
@ -297,7 +296,7 @@ func Test_CronJob_hasExclude(t *testing.T) {
policy := policies[0]
policy.SetAnnotations(map[string]string{
engine.PodControllersAnnotation: controllers,
kyverno.PodControllersAnnotation: controllers,
})
rule := policy.Spec.Rules[0].DeepCopy()
@ -318,7 +317,7 @@ func Test_CronJob_hasExclude(t *testing.T) {
}
func Test_CronJobAndDeployment(t *testing.T) {
controllers := strings.Join([]string{engine.PodControllerCronJob, "Deployment"}, ",")
controllers := strings.Join([]string{PodControllerCronJob, "Deployment"}, ",")
dir, err := os.Getwd()
baseDir := filepath.Dir(filepath.Dir(dir))
assert.NilError(t, err)
@ -333,7 +332,7 @@ func Test_CronJobAndDeployment(t *testing.T) {
policy := policies[0]
policy.SetAnnotations(map[string]string{
engine.PodControllersAnnotation: controllers,
kyverno.PodControllersAnnotation: controllers,
})
rulePatches, errs := GenerateRulePatches(&policy.Spec, controllers, log.Log)
@ -364,7 +363,7 @@ func Test_UpdateVariablePath(t *testing.T) {
policy := policies[0]
rulePatches, errs := GenerateRulePatches(&policy.Spec, engine.PodControllers, log.Log)
rulePatches, errs := GenerateRulePatches(&policy.Spec, PodControllers, log.Log)
if len(errs) != 0 {
t.Log(errs)
}
@ -398,7 +397,7 @@ func Test_Deny(t *testing.T) {
},
}
rulePatches, errs := GenerateRulePatches(&policy.Spec, engine.PodControllers, log.Log)
rulePatches, errs := GenerateRulePatches(&policy.Spec, PodControllers, log.Log)
fmt.Println("utils.JoinPatches(patches)erterter", string(utils.JoinPatches(rulePatches)))
if len(errs) != 0 {
t.Log(errs)

7
pkg/autogen/rule.go
View file

@ -8,7 +8,6 @@ import (
"github.com/go-logr/logr"
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/engine"
"github.com/kyverno/kyverno/pkg/engine/variables"
"github.com/kyverno/kyverno/pkg/utils"
apiextensions "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@ -262,7 +261,7 @@ func generateRuleForControllers(rule kyverno.Rule, controllers string, log logr.
func generateCronJobRule(rule kyverno.Rule, controllers string, log logr.Logger) *kyvernoRule {
logger := log.WithName("handleCronJob")
hasCronJob := strings.Contains(controllers, engine.PodControllerCronJob) || strings.Contains(controllers, "all")
hasCronJob := strings.Contains(controllers, PodControllerCronJob) || strings.Contains(controllers, "all")
if !hasCronJob {
return nil
}
@ -289,7 +288,7 @@ func generateCronJobRule(rule kyverno.Rule, controllers string, log logr.Logger)
rule := cronJobAnyAllAutogenRule(cronJobRule.MatchResources.All)
cronJobRule.MatchResources.All = rule
} else {
cronJobRule.MatchResources.Kinds = []string{engine.PodControllerCronJob}
cronJobRule.MatchResources.Kinds = []string{PodControllerCronJob}
}
if (jobRule.ExcludeResources) != nil && len(jobRule.ExcludeResources.Any) > 0 {
@ -300,7 +299,7 @@ func generateCronJobRule(rule kyverno.Rule, controllers string, log logr.Logger)
cronJobRule.ExcludeResources.All = rule
} else {
if (jobRule.ExcludeResources) != nil && (len(jobRule.ExcludeResources.Kinds) > 0) {
cronJobRule.ExcludeResources.Kinds = []string{engine.PodControllerCronJob}
cronJobRule.ExcludeResources.Kinds = []string{PodControllerCronJob}
}
}

7
pkg/autogen/utils.go
View file

@ -4,7 +4,6 @@ import (
"strings"
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/engine"
"github.com/kyverno/kyverno/pkg/utils"
)
@ -17,7 +16,7 @@ func isKindOtherthanPod(kinds []string) bool {
func hasAutogenKinds(kind []string) bool {
for _, v := range kind {
if v == "Pod" || strings.Contains(engine.PodControllers, v) {
if v == "Pod" || strings.Contains(PodControllers, v) {
return true
}
}
@ -52,7 +51,7 @@ func stripCronJob(controllers string) string {
var newControllers []string
controllerArr := strings.Split(controllers, ",")
for _, c := range controllerArr {
if c == engine.PodControllerCronJob {
if c == PodControllerCronJob {
continue
}
newControllers = append(newControllers, c)
@ -67,7 +66,7 @@ func cronJobAnyAllAutogenRule(v kyverno.ResourceFilters) kyverno.ResourceFilters
anyKind := v.DeepCopy()
for i, value := range v {
if utils.ContainsPod(value.Kinds, "Job") {
anyKind[i].Kinds = []string{engine.PodControllerCronJob}
anyKind[i].Kinds = []string{PodControllerCronJob}
}
}
return anyKind

9
pkg/engine/mutation.go
View file

@ -17,15 +17,6 @@ import (
"sigs.k8s.io/controller-runtime/pkg/log"
)
const (
// PodControllerCronJob represent CronJob string
PodControllerCronJob = "CronJob"
//PodControllers stores the list of Pod-controllers in csv string
PodControllers = "DaemonSet,Deployment,Job,StatefulSet,CronJob"
//PodControllersAnnotation defines the annotation key for Pod-Controllers
PodControllersAnnotation = "pod-policies.kyverno.io/autogen-controllers"
)
// Mutate performs mutation. Overlay first and then mutation patches
func Mutate(policyContext *PolicyContext) (resp *response.EngineResponse) {
resp = &response.EngineResponse{}

2
pkg/engine/utils.go
View file

@ -428,7 +428,7 @@ func excludeResource(podControllers string, resource unstructured.Unstructured)
// - if the policy has auto-gen annotation && resource == Pod
// - if the auto-gen contains cronJob && resource == Job
func ManagedPodResource(policy kyverno.ClusterPolicy, resource unstructured.Unstructured) bool {
podControllers, ok := policy.GetAnnotations()[PodControllersAnnotation]
podControllers, ok := policy.GetAnnotations()[kyverno.PodControllersAnnotation]
if !ok || strings.ToLower(podControllers) == "none" {
return false
}

4
pkg/kyverno/common/common.go
View file

@ -566,8 +566,8 @@ OuterLoop:
if resource.GetKind() == "Pod" && len(resource.GetOwnerReferences()) > 0 {
if policy.HasAutoGenAnnotation() {
if _, ok := policy.GetAnnotations()[engine.PodControllersAnnotation]; ok {
delete(policy.Annotations, engine.PodControllersAnnotation)
if _, ok := policy.GetAnnotations()[v1.PodControllersAnnotation]; ok {
delete(policy.Annotations, v1.PodControllersAnnotation)
}
}
}

2
pkg/policy/policy_controller.go
View file

@ -571,7 +571,7 @@ func missingAutoGenRules(policy *kyverno.ClusterPolicy, log logr.Logger) bool {
if len(podRuleName) > 0 {
annotations := policy.GetAnnotations()
val, ok := annotations["pod-policies.kyverno.io/autogen-controllers"]
val, ok := annotations[kyverno.PodControllersAnnotation]
if !ok {
return true
}

5
pkg/policymutation/policymutation.go
View file

@ -10,7 +10,6 @@ import (
kyverno "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/autogen"
"github.com/kyverno/kyverno/pkg/common"
"github.com/kyverno/kyverno/pkg/engine"
"github.com/kyverno/kyverno/pkg/utils"
)
@ -257,7 +256,7 @@ func GeneratePodControllerRule(policy kyverno.ClusterPolicy, log logr.Logger) (p
}
ann := policy.GetAnnotations()
actualControllers, ok := ann[engine.PodControllersAnnotation]
actualControllers, ok := ann[kyverno.PodControllersAnnotation]
// - scenario A
// - predefined controllers are invalid, overwrite the value
@ -293,7 +292,7 @@ func GeneratePodControllerRule(policy kyverno.ClusterPolicy, log logr.Logger) (p
func defaultPodControllerAnnotation(ann map[string]string, controllers string) ([]byte, error) {
if ann == nil {
ann = make(map[string]string)
ann[engine.PodControllersAnnotation] = controllers
ann[kyverno.PodControllersAnnotation] = controllers
jsonPatch := struct {
Path string `json:"path"`
Op string `json:"op"`