mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-09 17:37:12 +00:00
79 lines
2.8 KiB
Go
79 lines
2.8 KiB
Go
package mutation
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/go-logr/logr"
|
|
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
|
|
kyvernov2 "github.com/kyverno/kyverno/api/kyverno/v2"
|
|
engineapi "github.com/kyverno/kyverno/pkg/engine/api"
|
|
"github.com/kyverno/kyverno/pkg/engine/handlers"
|
|
"github.com/kyverno/kyverno/pkg/engine/mutate"
|
|
engineutils "github.com/kyverno/kyverno/pkg/engine/utils"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
|
"k8s.io/client-go/tools/cache"
|
|
)
|
|
|
|
type mutateResourceHandler struct{}
|
|
|
|
func NewMutateResourceHandler() (handlers.Handler, error) {
|
|
return mutateResourceHandler{}, nil
|
|
}
|
|
|
|
func (h mutateResourceHandler) Process(
|
|
ctx context.Context,
|
|
logger logr.Logger,
|
|
policyContext engineapi.PolicyContext,
|
|
resource unstructured.Unstructured,
|
|
rule kyvernov1.Rule,
|
|
contextLoader engineapi.EngineContextLoader,
|
|
exceptions []*kyvernov2.PolicyException,
|
|
) (unstructured.Unstructured, []engineapi.RuleResponse) {
|
|
// check if there is a policy exception matches the incoming resource
|
|
exception := engineutils.MatchesException(exceptions, policyContext, logger)
|
|
if exception != nil {
|
|
key, err := cache.MetaNamespaceKeyFunc(exception)
|
|
if err != nil {
|
|
logger.Error(err, "failed to compute policy exception key", "namespace", exception.GetNamespace(), "name", exception.GetName())
|
|
return resource, handlers.WithError(rule, engineapi.Mutation, "failed to compute exception key", err)
|
|
} else {
|
|
logger.V(3).Info("policy rule skipped due to policy exception", "exception", key)
|
|
return resource, handlers.WithResponses(
|
|
engineapi.RuleSkip(rule.Name, engineapi.Mutation, "rule skipped due to policy exception "+key).WithException(exception),
|
|
)
|
|
}
|
|
}
|
|
|
|
_, subresource := policyContext.ResourceKind()
|
|
logger.V(3).Info("processing mutate rule")
|
|
var parentResourceGVR metav1.GroupVersionResource
|
|
if subresource != "" {
|
|
parentResourceGVR = policyContext.RequestResource()
|
|
}
|
|
resourceInfo := resourceInfo{
|
|
unstructured: resource,
|
|
subresource: subresource,
|
|
parentResourceGVR: parentResourceGVR,
|
|
}
|
|
// logger.V(4).Info("apply rule to resource", "resource namespace", patchedResource.unstructured.GetNamespace(), "resource name", patchedResource.unstructured.GetName())
|
|
var mutateResp *mutate.Response
|
|
if rule.Mutation.ForEachMutation != nil {
|
|
m := &forEachMutator{
|
|
rule: rule,
|
|
foreach: rule.Mutation.ForEachMutation,
|
|
policyContext: policyContext,
|
|
resource: resourceInfo,
|
|
logger: logger,
|
|
contextLoader: contextLoader,
|
|
nesting: 0,
|
|
}
|
|
mutateResp = m.mutateForEach(ctx)
|
|
} else {
|
|
mutateResp = mutate.Mutate(&rule, policyContext.JSONContext(), resource, logger)
|
|
}
|
|
if mutateResp == nil {
|
|
return resource, nil
|
|
}
|
|
return mutateResp.PatchedResource, handlers.WithResponses(buildRuleResponse(&rule, mutateResp, resourceInfo))
|
|
}
|