mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-15 17:51:20 +00:00
f401071bb3
* refactor: propagate exception in rule response Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> * fix Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com> --------- Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
64 lines
2.2 KiB
Go
64 lines
2.2 KiB
Go
package api
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
kyvernov2alpha1 "github.com/kyverno/kyverno/api/kyverno/v2alpha1"
|
|
pssutils "github.com/kyverno/kyverno/pkg/pss/utils"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
|
"k8s.io/pod-security-admission/api"
|
|
)
|
|
|
|
// PodSecurityChecks details about pod securty checks
|
|
type PodSecurityChecks struct {
|
|
// Level is the pod security level
|
|
Level api.Level
|
|
// Version is the pod security version
|
|
Version string
|
|
// Checks contains check result details
|
|
Checks []pssutils.PSSCheckResult
|
|
}
|
|
|
|
// RuleResponse details for each rule application
|
|
type RuleResponse struct {
|
|
// Name is the rule name specified in policy
|
|
Name string
|
|
// Type is the rule type (Mutation,Generation,Validation) for Kyverno Policy
|
|
Type RuleType
|
|
// Message is the message response from the rule application
|
|
Message string
|
|
// Patches are JSON patches, for mutation rules
|
|
Patches [][]byte
|
|
// GeneratedResource is the generated by the generate rules of a policy
|
|
GeneratedResource unstructured.Unstructured
|
|
// Status rule status
|
|
Status RuleStatus
|
|
// Stats contains rule statistics
|
|
Stats ExecutionStats
|
|
// PatchedTarget is the patched resource for mutate.targets
|
|
PatchedTarget *unstructured.Unstructured
|
|
// PatchedTargetSubresourceName is the name of the subresource which is patched, empty if the resource patched is not a subresource.
|
|
PatchedTargetSubresourceName string
|
|
// PatchedTargetParentResourceGVR is the GVR of the parent resource of the PatchedTarget. This is only populated when PatchedTarget is a subresource.
|
|
PatchedTargetParentResourceGVR metav1.GroupVersionResource
|
|
// PodSecurityChecks contains pod security checks (only if this is a pod security rule)
|
|
PodSecurityChecks *PodSecurityChecks
|
|
// Exception is the exception applied (if any)
|
|
Exception *kyvernov2alpha1.PolicyException
|
|
}
|
|
|
|
// HasStatus checks if rule status is in a given list
|
|
func (r RuleResponse) HasStatus(status ...RuleStatus) bool {
|
|
for _, s := range status {
|
|
if r.Status == s {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// String implements Stringer interface
|
|
func (r RuleResponse) String() string {
|
|
return fmt.Sprintf("rule %s (%s): %v", r.Name, r.Type, r.Message)
|
|
}
|