mirror of
https://github.com/kyverno/kyverno.git
synced 2025-03-09 17:37:12 +00:00
100 lines
3.1 KiB
Go
100 lines
3.1 KiB
Go
package utils
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/go-logr/logr"
|
|
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
|
|
"github.com/kyverno/kyverno/pkg/config"
|
|
"github.com/kyverno/kyverno/pkg/engine"
|
|
engineapi "github.com/kyverno/kyverno/pkg/engine/api"
|
|
"github.com/kyverno/kyverno/pkg/engine/jmespath"
|
|
"go.uber.org/multierr"
|
|
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
|
)
|
|
|
|
type scanner struct {
|
|
logger logr.Logger
|
|
engine engineapi.Engine
|
|
config config.Configuration
|
|
jp jmespath.Interface
|
|
}
|
|
|
|
type ScanResult struct {
|
|
EngineResponse *engineapi.EngineResponse
|
|
Error error
|
|
}
|
|
|
|
type Scanner interface {
|
|
ScanResource(context.Context, unstructured.Unstructured, map[string]string, ...kyvernov1.PolicyInterface) map[kyvernov1.PolicyInterface]ScanResult
|
|
}
|
|
|
|
func NewScanner(
|
|
logger logr.Logger,
|
|
engine engineapi.Engine,
|
|
config config.Configuration,
|
|
jp jmespath.Interface,
|
|
) Scanner {
|
|
return &scanner{
|
|
logger: logger,
|
|
engine: engine,
|
|
config: config,
|
|
jp: jp,
|
|
}
|
|
}
|
|
|
|
func (s *scanner) ScanResource(ctx context.Context, resource unstructured.Unstructured, nsLabels map[string]string, policies ...kyvernov1.PolicyInterface) map[kyvernov1.PolicyInterface]ScanResult {
|
|
results := map[kyvernov1.PolicyInterface]ScanResult{}
|
|
for _, policy := range policies {
|
|
var errors []error
|
|
response, err := s.validateResource(ctx, resource, nsLabels, policy)
|
|
if err != nil {
|
|
s.logger.Error(err, "failed to scan resource")
|
|
errors = append(errors, err)
|
|
}
|
|
spec := policy.GetSpec()
|
|
if spec.HasVerifyImages() {
|
|
ivResponse, err := s.validateImages(ctx, resource, nsLabels, policy)
|
|
if err != nil {
|
|
s.logger.Error(err, "failed to scan images")
|
|
errors = append(errors, err)
|
|
}
|
|
if response == nil {
|
|
response = ivResponse
|
|
} else if ivResponse != nil {
|
|
response.PolicyResponse.Rules = append(response.PolicyResponse.Rules, ivResponse.PolicyResponse.Rules...)
|
|
}
|
|
}
|
|
results[policy] = ScanResult{response, multierr.Combine(errors...)}
|
|
}
|
|
return results
|
|
}
|
|
|
|
func (s *scanner) validateResource(ctx context.Context, resource unstructured.Unstructured, nsLabels map[string]string, policy kyvernov1.PolicyInterface) (*engineapi.EngineResponse, error) {
|
|
policyCtx, err := engine.NewPolicyContext(s.jp, resource, kyvernov1.Create, nil, s.config)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
policyCtx = policyCtx.
|
|
WithNewResource(resource).
|
|
WithPolicy(policy).
|
|
WithNamespaceLabels(nsLabels)
|
|
response := s.engine.Validate(ctx, policyCtx)
|
|
return &response, nil
|
|
}
|
|
|
|
func (s *scanner) validateImages(ctx context.Context, resource unstructured.Unstructured, nsLabels map[string]string, policy kyvernov1.PolicyInterface) (*engineapi.EngineResponse, error) {
|
|
policyCtx, err := engine.NewPolicyContext(s.jp, resource, kyvernov1.Create, nil, s.config)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
policyCtx = policyCtx.
|
|
WithNewResource(resource).
|
|
WithPolicy(policy).
|
|
WithNamespaceLabels(nsLabels)
|
|
response, _ := s.engine.VerifyAndPatchImages(ctx, policyCtx)
|
|
if len(response.PolicyResponse.Rules) > 0 {
|
|
s.logger.Info("validateImages", "policy", policy, "response", response)
|
|
}
|
|
return &response, nil
|
|
}
|