package engine import ( "reflect" "time" "github.com/golang/glog" kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1alpha1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" ) // Mutate performs mutation. Overlay first and then mutation patches // func Mutate(policy kyverno.Policy, resource unstructured.Unstructured) (response EngineResponse) { // // var response EngineResponse // var allPatches, rulePatches [][]byte // var err error // var errs []error // ris := []info.RuleInfo{} // startTime := time.Now() // glog.V(4).Infof("started applying mutation rules of policy %q (%v)", policy.Name, startTime) // defer func() { // response.ExecutionTime = time.Since(startTime) // glog.V(4).Infof("finished applying mutation rules policy %v (%v)", policy.Name, response.ExecutionTime) // glog.V(4).Infof("Mutation Rules appplied succesfully count %v for policy %q", response.RulesAppliedCount, policy.Name) // }() // incrementAppliedRuleCount := func() { // // rules applied succesfully count // response.RulesAppliedCount++ // } // patchedDocument, err := resource.MarshalJSON() // if err != nil { // glog.Errorf("unable to marshal resource : %v\n", err) // } // if err != nil { // glog.V(4).Infof("unable to marshal resource : %v", err) // response.PatchedResource = resource // return response // } // for _, rule := range policy.Spec.Rules { // if reflect.DeepEqual(rule.Mutation, kyverno.Mutation{}) { // continue // } // // check if the resource satisfies the filter conditions defined in the rule // //TODO: this needs to be extracted, to filter the resource so that we can avoid passing resources that // // dont statisfy a policy rule resource description // ok := MatchesResourceDescription(resource, rule) // if !ok { // glog.V(4).Infof("resource %s/%s does not satisfy the resource description for the rule ", resource.GetNamespace(), resource.GetName()) // continue // } // ruleInfo := info.NewRuleInfo(rule.Name, info.Mutation) // // Process Overlay // if rule.Mutation.Overlay != nil { // // ruleRespone := processOverlay(rule, res) // rulePatches, err = processOverlay(rule, patchedDocument) // if err == nil { // if len(rulePatches) == 0 { // // if array elements dont match then we skip(nil patch, no error) // // or if acnohor is defined and doenst match // // policy is not applicable // glog.V(4).Info("overlay does not match, so skipping applying rule") // continue // } // ruleInfo.Addf("Rule %s: Overlay succesfully applied.", rule.Name) // // strip slashes from string // ruleInfo.Patches = rulePatches // allPatches = append(allPatches, rulePatches...) // glog.V(4).Infof("overlay applied succesfully on resource %s/%s", resource.GetNamespace(), resource.GetName()) // } else { // glog.V(4).Infof("failed to apply overlay: %v", err) // ruleInfo.Fail() // ruleInfo.Addf("failed to apply overlay: %v", err) // } // incrementAppliedRuleCount() // } // // Process Patches // if len(rule.Mutation.Patches) != 0 { // rulePatches, errs = processPatches(rule, patchedDocument) // if len(errs) > 0 { // ruleInfo.Fail() // for _, err := range errs { // glog.V(4).Infof("failed to apply patches: %v", err) // ruleInfo.Addf("patches application has failed, err %v.", err) // } // } else { // glog.V(4).Infof("patches applied succesfully on resource %s/%s", resource.GetNamespace(), resource.GetName()) // ruleInfo.Addf("Patches succesfully applied.") // ruleInfo.Patches = rulePatches // allPatches = append(allPatches, rulePatches...) // } // incrementAppliedRuleCount() // } // patchedDocument, err = ApplyPatches(patchedDocument, rulePatches) // if err != nil { // glog.Errorf("Failed to apply patches on ruleName=%s, err%v\n:", rule.Name, err) // } // ris = append(ris, ruleInfo) // } // patchedResource, err := ConvertToUnstructured(patchedDocument) // if err != nil { // glog.Errorf("Failed to convert patched resource to unstructuredtype, err%v\n:", err) // response.PatchedResource = resource // return response // } // response.Patches = allPatches // response.PatchedResource = *patchedResource // response.RuleInfos = ris // return response // } //MutateNew ... func MutateNew(policy kyverno.Policy, resource unstructured.Unstructured) (response EngineResponseNew) { startTime := time.Now() // policy information func() { // set policy information response.PolicyResponse.Policy = policy.Name // resource details response.PolicyResponse.Resource.Name = resource.GetName() response.PolicyResponse.Resource.Namespace = resource.GetNamespace() response.PolicyResponse.Resource.Kind = resource.GetKind() response.PolicyResponse.Resource.APIVersion = resource.GetAPIVersion() }() glog.V(4).Infof("started applying mutation rules of policy %q (%v)", policy.Name, startTime) defer func() { response.PolicyResponse.ProcessingTime = time.Since(startTime) glog.V(4).Infof("finished applying mutation rules policy %v (%v)", policy.Name, response.PolicyResponse.ProcessingTime) glog.V(4).Infof("Mutation Rules appplied succesfully count %v for policy %q", response.PolicyResponse.RulesAppliedCount, policy.Name) }() incrementAppliedRuleCount := func() { // rules applied succesfully count response.PolicyResponse.RulesAppliedCount++ } var patchedResource unstructured.Unstructured for _, rule := range policy.Spec.Rules { //TODO: to be checked before calling the resources as well if reflect.DeepEqual(rule.Mutation, kyverno.Mutation{}) { continue } // check if the resource satisfies the filter conditions defined in the rule //TODO: this needs to be extracted, to filter the resource so that we can avoid passing resources that // dont statisfy a policy rule resource description ok := MatchesResourceDescription(resource, rule) if !ok { glog.V(4).Infof("resource %s/%s does not satisfy the resource description for the rule ", resource.GetNamespace(), resource.GetName()) continue } // Process Overlay if rule.Mutation.Overlay != nil { var ruleResponse RuleResponse ruleResponse, patchedResource = processOverlayNew(rule, resource) if reflect.DeepEqual(ruleResponse, (RuleResponse{})) { // overlay pattern does not match the resource conditions continue } response.PolicyResponse.Rules = append(response.PolicyResponse.Rules, ruleResponse) incrementAppliedRuleCount() } // Process Patches if rule.Mutation.Patches != nil { var ruleResponse RuleResponse ruleResponse, patchedResource = processPatchesNew(rule, resource) response.PolicyResponse.Rules = append(response.PolicyResponse.Rules, ruleResponse) incrementAppliedRuleCount() } } // send the patched resource response.PatchedResource = patchedResource return response }