mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-06 16:06:56 +00:00
3cf9141f4d
* initial commit * background policy validation * correct message * skip non-background policy process for add/update * add Generate Request CR * generate Request Generator Initial * test generate request CR generation * initial commit gr generator * generate controller initial framework * add crd for generate request * gr cleanup controller initial commit * cleanup controller initial * generate mid-commit * generate rule processing * create PV on generate error * embed resource type * testing phase 1- generate resources with variable substitution * fix tests * comment broken test #586 * add printer column for state * return if existing resource for clone * set resync time to 2 mins & remove resource version check in update handler for gr * generate events for reporting * fix logs * initial commit * fix trailing quote in patch * remove comments * initial condition (equal & notequal) * initial support for conditions * initial support fo conditions in generate * support precondition checks * cleanup * re-evaluate GR on namespace update using dynamic informers * add status for generated resources * display loaded variable SA * support delete cleanup of generate request main resources * fix log * remove namespace from SA username * support multiple variables per statement for scalar values * fix fail variables * add check for userInfo * validation checks for conditions * update policy * refactor logs * code review * add openapispec for clusterpolicy preconditions * Update documentation * CR fixes * documentation * CR fixes * update variable * fix logs * update policy * pre-defined variables (serviceAccountName & serviceAccountNamespace) * update test
66 lines
2.1 KiB
Go
66 lines
2.1 KiB
Go
package policy
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
|
|
"github.com/nirmata/kyverno/pkg/engine/variables"
|
|
)
|
|
|
|
//ContainsUserInfo returns error is userInfo is defined
|
|
func ContainsUserInfo(policy kyverno.ClusterPolicy) error {
|
|
// iterate of the policy rules to identify if userInfo is used
|
|
for idx, rule := range policy.Spec.Rules {
|
|
if err := userInfoDefined(rule.MatchResources.UserInfo); err != nil {
|
|
return fmt.Errorf("path: spec/rules[%d]/match/%s", idx, err)
|
|
}
|
|
|
|
if err := userInfoDefined(rule.ExcludeResources.UserInfo); err != nil {
|
|
return fmt.Errorf("path: spec/rules[%d]/exclude/%s", idx, err)
|
|
}
|
|
|
|
// variable defined with user information
|
|
// - condition.key
|
|
// - condition.value
|
|
// - mutate.overlay
|
|
// - validate.pattern
|
|
// - validate.anyPattern[*]
|
|
// variables to filter
|
|
// - request.userInfo
|
|
filterVars := []string{"request.userInfo*"}
|
|
for condIdx, condition := range rule.Conditions {
|
|
if err := variables.CheckVariables(condition.Key, filterVars, "/"); err != nil {
|
|
return fmt.Errorf("path: spec/rules[%d]/condition[%d]/key%s", idx, condIdx, err)
|
|
}
|
|
if err := variables.CheckVariables(condition.Value, filterVars, "/"); err != nil {
|
|
return fmt.Errorf("path: spec/rules[%d]/condition[%d]/value%s", idx, condIdx, err)
|
|
}
|
|
}
|
|
|
|
if err := variables.CheckVariables(rule.Mutation.Overlay, filterVars, "/"); err != nil {
|
|
return fmt.Errorf("path: spec/rules[%d]/mutate/overlay%s", idx, err)
|
|
}
|
|
if err := variables.CheckVariables(rule.Validation.Pattern, filterVars, "/"); err != nil {
|
|
return fmt.Errorf("path: spec/rules[%d]/validate/pattern%s", idx, err)
|
|
}
|
|
for idx2, pattern := range rule.Validation.AnyPattern {
|
|
if err := variables.CheckVariables(pattern, filterVars, "/"); err != nil {
|
|
return fmt.Errorf("path: spec/rules[%d]/validate/anyPattern[%d]%s", idx, idx2, err)
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func userInfoDefined(ui kyverno.UserInfo) error {
|
|
if len(ui.Roles) > 0 {
|
|
return fmt.Errorf("roles")
|
|
}
|
|
if len(ui.ClusterRoles) > 0 {
|
|
return fmt.Errorf("clusterRoles")
|
|
}
|
|
if len(ui.Subjects) > 0 {
|
|
return fmt.Errorf("subjects")
|
|
}
|
|
return nil
|
|
}
|