kyverno/pkg/engine/mutation.go

package engine

import (
	"reflect"

	"github.com/golang/glog"
	kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1alpha1"
	"github.com/nirmata/kyverno/pkg/info"
	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)

// Mutate performs mutation. Overlay first and then mutation patches
//TODO: check if gvk needs to be passed or can be set in resource
func Mutate(policy kyverno.Policy, resource unstructured.Unstructured) ([][]byte, []info.RuleInfo) {
	//TODO: convert rawResource to unstructured to avoid unmarhalling all the time for get some resource information
	var patches [][]byte
	var ruleInfos []info.RuleInfo

	for _, rule := range policy.Spec.Rules {
		if reflect.DeepEqual(rule.Mutation, kyverno.Mutation{}) {
			continue
		}

		// check if the resource satisfies the filter conditions defined in the rule
		//TODO: this needs to be extracted, to filter the resource so that we can avoid passing resources that
		// dont statisfy a policy rule resource description
		ok := MatchesResourceDescription(resource, rule)
		if !ok {
			glog.V(4).Infof("resource %s/%s does not satisfy the resource description for the rule ", resource.GetNamespace(), resource.GetName())
			continue
		}

		ruleInfo := info.NewRuleInfo(rule.Name, info.Mutation)

		// Process Overlay
		if rule.Mutation.Overlay != nil {
			oPatches, err := processOverlay(resource, rule)
			if err == nil {
				if len(oPatches) == 0 {
					// if array elements dont match then we skip(nil patch, no error)
					// or if acnohor is defined and doenst match
					// policy is not applicable
					glog.V(4).Info("overlay does not match, so skipping applying rule")
					continue
				}

				glog.V(4).Infof("overlay applied succesfully on resource %s/%s", resource.GetNamespace(), resource.GetName())
				ruleInfo.Add("Overlay succesfully applied")

				// update rule information
				// strip slashes from string
				patch := JoinPatches(oPatches)
				ruleInfo.Changes = string(patch)
				patches = append(patches, oPatches...)
			} else {
				glog.V(4).Infof("failed to apply overlay: %v", err)
				ruleInfo.Fail()
				ruleInfo.Addf("failed to apply overlay: %v", err)
			}
		}

		// Process Patches
		if len(rule.Mutation.Patches) != 0 {
			jsonPatches, errs := processPatches(resource, rule)
			if len(errs) > 0 {
				ruleInfo.Fail()
				for _, err := range errs {
					glog.V(4).Infof("failed to apply patches: %v", err)
					ruleInfo.Addf("patches application has failed, err %v.", err)
				}
			} else {
				glog.V(4).Infof("patches applied succesfully on resource %s/%s", resource.GetNamespace(), resource.GetName())
				ruleInfo.Addf("Patches succesfully applied.")
				patches = append(patches, jsonPatches...)
			}
		}
		ruleInfos = append(ruleInfos, ruleInfo)
	}
	return patches, ruleInfos
}