1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-09 17:37:12 +00:00
kyverno/cmd/cli/kubectl-kyverno/data/crds/cli.kyverno.io_values.yaml
Ammar Yasser 739e6a21c4
Mutate existing CLI support (#11453)
* feat: Add flags for target resources and add fake client initialization

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add fake discovery client and cluster bool in the policy processor

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use the full mutation engine policy response in the engine response

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Extract mutated targets from the policy responses and print them out

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add TargetResources field in the cli test schema

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Generate CLI crds

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: modify checkResult to take an arbitrary actual resource and resource name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: change getAndCompareResource to take a resource name and cascade it to GetResourceFromPath

Signed-off-by: aerosouund <aerosound161@gmail.com>

* test: Create a simple test to test mutate existing in the CLI

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Allow GetResourceFromPath to select a resource with a name from a multi resource yaml

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Modify the runTest command to return the TestResponse type

- Create a fake client, load the target resources in it and use it in the PolicyProcessor.
- Create the TestResponse which contains Trigger and Target fields, each is a map of gvk/name to the responses corresponding to that resource.

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Rewrite output.go to use the TestResponse type

- Check for both target and trigger
- Create logic for appending the resource array in case no resources are passed
- Move row creation logic into a separate method to avoid code duplication
- Extract the proper target resource based on rule type
- Create a function to extract mutated target from the engine response

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Move tests to the correct folder

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use apiVersion/Kind/Name as the key in the test responses

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Use the apiVersion/Kind/name key schema in checking results and fix invalid resource name checking for generate policies

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use better variable names for rows

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Account for Generate resources being an array

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use generated resource name in checking the results and printing output

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Uncomment checks printing

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Remove bug in engine response creation

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Move the generate logic into an else block

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix namespace fetching bug in cel validator

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use pointer to int in the test counter

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Remove redundant method

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Skip resources not being found in the manifests

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Create another field in the engine to denote if this is a cluster engine or an offline engine

Simply checking for the client being nil is no longer enough because for cli operations the client will be a fake client
A pointer to bool is chosen because callers who don't necessarily know what to pass should be able to pass nil

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Add extra argument in fake client initiation

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: add extra argument in fuzz test

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Add extra arg

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Handle resources specified as ns/name as this schema will be deprecated in favor of apiVersion/Kind/Name

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Fix linter complaints

Signed-off-by: ammar <ammar.yasser@vodafone.com>

* fix: Use comma separation as array separators as kubernetes names don't support commas

To avoid undefined array length on splitting on /
using commas will result in a fixed length since all resources will have an apiVersion, kind, namespace and name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Change resource array type to an array of any instead of array of string

To support the use of a string or a TestResourceSpec

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Expect the resource array to be an array of string or array of TestResourceSpec

Assert that an array element is either of these types and match the resources in both cases according to the element type
Expect that the key in responses is now separated by commas instead of slashes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Expect that the resource array is now of type array of any and modify tests that use it

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Skip response check if the policy name isnt whats in the result

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Match the name if its specified as ns/name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Create CLI CRDs

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Fix linter complaints

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Cleanup invalid code used in FixTest to adapt it to the schema changes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Check if resource is nil before extracting

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: use the loadResources method to open targets in a directory

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Account for target resources with the same name but different namespaces

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Add CLI test for mutate existing with the same name

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Infer resource name and namespace from the actual resource and account for resources with the same name and namespace but different kinds

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: remove extra line

Signed-off-by: aerosouund <aerosound161@gmail.com>

* feat: Add printing mutate existing resources to the output or to a file

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Minor fixes

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: codegen

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Revert result back to error

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Use io discard to not print resources in the test command

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Update vague comments and remove outdated ones

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Integrate mutate existing changes with diff generation

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Move resource key generation into a function

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Add a mutate existing test that fails

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: fix linter complaint

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Remove redundant comment

Signed-off-by: aerosouund <aerosound161@gmail.com>

* refactor: Fix array of any assignment in cli test

Signed-off-by: aerosouund <aerosound161@gmail.com>

* fix: Dont check duplicate strings for field that is an array of any

Signed-off-by: aerosouund <aerosound161@gmail.com>

* bug: Fix appending to the wrong array

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: run fix tests

Signed-off-by: aerosouund <aerosound161@gmail.com>

* chore: Run fix tests

Signed-off-by: aerosouund <aerosound161@gmail.com>

---------

Signed-off-by: aerosouund <aerosound161@gmail.com>
Signed-off-by: ammar <ammar.yasser@vodafone.com>
Signed-off-by: Ammar Yasser <aerosound161@gmail.com>
Co-authored-by: ammar <ammar.yasser@vodafone.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-12-19 07:42:54 +00:00

258 lines
12 KiB
YAML

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: (devel)
name: values.cli.kyverno.io
spec:
group: cli.kyverno.io
names:
kind: Values
listKind: ValuesList
plural: values
singular: values
scope: Cluster
versions:
- name: v1alpha1
schema:
openAPIV3Schema:
description: Values declares values to be loaded by the Kyverno CLI
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
globalValues:
description: GlobalValues are the global values
type: object
x-kubernetes-preserve-unknown-fields: true
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
namespaceSelector:
description: NamespaceSelectors are the namespace labels
items:
description: NamespaceSelector declares labels for a given namespace
properties:
labels:
additionalProperties:
type: string
description: Labels are the labels for the given namespace
type: object
name:
description: Name is the namespace name
type: string
required:
- labels
- name
type: object
type: array
policies:
description: Policies are the policy values
items:
description: Policy declares values for a given policy
properties:
name:
description: Name is the policy name
type: string
resources:
description: Resources are values for specific resources
items:
description: Resource declares values for a given resource
properties:
name:
description: Name is the name of the resource
type: string
values:
description: Values are the values for the given resource
type: object
x-kubernetes-preserve-unknown-fields: true
required:
- name
type: object
type: array
rules:
description: Rules are values for specific policy rules
items:
description: Rule declares values for a given policy rule
properties:
foreachValues:
description: ForeachValues are the foreach values for the
given policy rule
type: object
x-kubernetes-preserve-unknown-fields: true
name:
description: Name is the name of the ppolicy rule
type: string
values:
description: Values are the values for the given policy rule
type: object
x-kubernetes-preserve-unknown-fields: true
required:
- name
type: object
type: array
required:
- name
type: object
type: array
subresources:
description: Subresources are the subresource/parent resource mappings
items:
description: Subresource declares subresource/parent resource mapping
properties:
parentResource:
description: ParentResource declares the parent resource api
properties:
categories:
description: categories is a list of the grouped resources this
resource belongs to (e.g. 'all')
items:
type: string
type: array
x-kubernetes-list-type: atomic
group:
description: |-
group is the preferred group of the resource. Empty implies the group of the containing resource list.
For subresources, this may have a different value, for example: Scale".
type: string
kind:
description: kind is the kind for the resource (e.g. 'Foo' is
the kind for a resource 'foo')
type: string
name:
description: name is the plural name of the resource.
type: string
namespaced:
description: namespaced indicates if a resource is namespaced
or not.
type: boolean
shortNames:
description: shortNames is a list of suggested short names of
the resource.
items:
type: string
type: array
x-kubernetes-list-type: atomic
singularName:
description: |-
singularName is the singular name of the resource. This allows clients to handle plural and singular opaquely.
The singularName is more correct for reporting status on a single item and both singular and plural are allowed
from the kubectl CLI interface.
type: string
storageVersionHash:
description: |-
The hash value of the storage version, the version this resource is
converted to when written to the data store. Value must be treated
as opaque by clients. Only equality comparison on the value is valid.
This is an alpha feature and may change or be removed in the future.
The field is populated by the apiserver only if the
StorageVersionHash feature gate is enabled.
This field will remain optional even if it graduates.
type: string
verbs:
description: |-
verbs is a list of supported kube verbs (this includes get, list, watch, create,
update, patch, delete, deletecollection, and proxy)
items:
type: string
type: array
version:
description: |-
version is the preferred version of the resource. Empty implies the version of the containing resource list
For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
type: string
required:
- kind
- name
- namespaced
- singularName
- verbs
type: object
subresource:
description: Subresource declares the subresource api
properties:
categories:
description: categories is a list of the grouped resources this
resource belongs to (e.g. 'all')
items:
type: string
type: array
x-kubernetes-list-type: atomic
group:
description: |-
group is the preferred group of the resource. Empty implies the group of the containing resource list.
For subresources, this may have a different value, for example: Scale".
type: string
kind:
description: kind is the kind for the resource (e.g. 'Foo' is
the kind for a resource 'foo')
type: string
name:
description: name is the plural name of the resource.
type: string
namespaced:
description: namespaced indicates if a resource is namespaced
or not.
type: boolean
shortNames:
description: shortNames is a list of suggested short names of
the resource.
items:
type: string
type: array
x-kubernetes-list-type: atomic
singularName:
description: |-
singularName is the singular name of the resource. This allows clients to handle plural and singular opaquely.
The singularName is more correct for reporting status on a single item and both singular and plural are allowed
from the kubectl CLI interface.
type: string
storageVersionHash:
description: |-
The hash value of the storage version, the version this resource is
converted to when written to the data store. Value must be treated
as opaque by clients. Only equality comparison on the value is valid.
This is an alpha feature and may change or be removed in the future.
The field is populated by the apiserver only if the
StorageVersionHash feature gate is enabled.
This field will remain optional even if it graduates.
type: string
verbs:
description: |-
verbs is a list of supported kube verbs (this includes get, list, watch, create,
update, patch, delete, deletecollection, and proxy)
items:
type: string
type: array
version:
description: |-
version is the preferred version of the resource. Empty implies the version of the containing resource list
For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
type: string
required:
- kind
- name
- namespaced
- singularName
- verbs
type: object
required:
- parentResource
- subresource
type: object
type: array
type: object
served: true
storage: true