policy

Documentation

Index

• func ContainsVariablesOtherThanObject(policy kyverno.ClusterPolicy) error
• func ConvertPolicyToClusterPolicy(nsPolicies *kyverno.Policy) *kyverno.ClusterPolicy
• func ExcludePod(resourceMap map[string]unstructured.Unstructured, log logr.Logger) map[string]unstructured.Unstructured
• func ExcludeResources(included map[string]unstructured.Unstructured, ...)
• func GetAllNamespaces(nslister listerv1.NamespaceLister, log logr.Logger) []string
• func GetMatchingNamespaces(wildcards []string, nslister listerv1.NamespaceLister, log logr.Logger) []string
• func GetNamespacesForRule(rule *kyverno.Rule, nslister listerv1.NamespaceLister, log logr.Logger) []string
• func GetResourcesPerNamespace(kind string, client *client.Client, namespace string, rule kyverno.Rule, ...) map[string]unstructured.Unstructured
• func HasWildcard(s string) bool
• func MergeResources(a, b map[string]unstructured.Unstructured)
• func Validate(policyRaw []byte, client *dclient.Client, mock bool, ...) error
• type Condition
• type PolicyController
  • func NewPolicyController(kyvernoClient *kyvernoclient.Clientset, client *client.Client, ...) (*PolicyController, error)
  • func (pc *PolicyController) Run(workers int, stopCh <-chan struct{})
• type ResourceManager
  • func NewResourceManager(rebuildTime int64) *ResourceManager
  • func (rm *ResourceManager) Drop()
  • func (rm *ResourceManager) ProcessResource(policy, pv, kind, ns, name, rv string) bool
  • func (rm *ResourceManager) RegisterResource(policy, pv, kind, ns, name, rv string)
• type Validation

Functions

func ContainsVariablesOtherThanObject

func ContainsVariablesOtherThanObject(policy kyverno.ClusterPolicy) error

ContainsVariablesOtherThanObject returns error if variable that does not start from request.object

func ConvertPolicyToClusterPolicy

func ConvertPolicyToClusterPolicy(nsPolicies *kyverno.Policy) *kyverno.ClusterPolicy

ConvertPolicyToClusterPolicy - convert Policy to ClusterPolicy

func ExcludePod

func ExcludePod(resourceMap map[string]unstructured.Unstructured, log logr.Logger) map[string]unstructured.Unstructured

ExcludePod filters out the pods with ownerReference

func ExcludeResources

func ExcludeResources(included map[string]unstructured.Unstructured, exclude kyverno.ResourceDescription, configHandler config.Interface, log logr.Logger)

ExcludeResources ...

func GetAllNamespaces

func GetAllNamespaces(nslister listerv1.NamespaceLister, log logr.Logger) []string

GetAllNamespaces gets all namespaces in the cluster

func GetMatchingNamespaces

func GetMatchingNamespaces(wildcards []string, nslister listerv1.NamespaceLister, log logr.Logger) []string

GetMatchingNamespaces ...

func GetNamespacesForRule

func GetNamespacesForRule(rule *kyverno.Rule, nslister listerv1.NamespaceLister, log logr.Logger) []string

GetNamespacesForRule gets the matched namespacse list for the given rule

func GetResourcesPerNamespace

func GetResourcesPerNamespace(kind string, client *client.Client, namespace string, rule kyverno.Rule, configHandler config.Interface, log logr.Logger) map[string]unstructured.Unstructured

GetResourcesPerNamespace ...

func HasWildcard

func HasWildcard(s string) bool

HasWildcard ...

func MergeResources

func MergeResources(a, b map[string]unstructured.Unstructured)

MergeResources merges b into a map

func Validate

func Validate(policyRaw []byte, client *dclient.Client, mock bool, openAPIController *openapi.Controller) error

Validate does some initial check to verify some conditions - One operation per rule - ResourceDescription mandatory checks

Types

type Condition

type Condition int

Condition defines condition type

const (
	//NotEvaluate to not evaluate condition
	NotEvaluate Condition = 0
	// Process to evaluate condition
	Process Condition = 1
	// Skip to ignore/skip the condition
	Skip Condition = 2
)

type PolicyController

type PolicyController struct {
	// contains filtered or unexported fields
}

PolicyController is responsible for synchronizing Policy objects stored in the system with the corresponding policy violations

func NewPolicyController

func NewPolicyController(kyvernoClient *kyvernoclient.Clientset,
	client *client.Client,
	pInformer kyvernoinformer.ClusterPolicyInformer,
	npInformer kyvernoinformer.PolicyInformer,
	grInformer kyvernoinformer.GenerateRequestInformer,
	configHandler config.Interface,
	eventGen event.Interface,
	prGenerator policyreport.GeneratorInterface,
	namespaces informers.NamespaceInformer,
	log logr.Logger,
	resCache resourcecache.ResourceCacheIface) (*PolicyController, error)

NewPolicyController create a new PolicyController

func (*PolicyController) Run

func (pc *PolicyController) Run(workers int, stopCh <-chan struct{})

Run begins watching and syncing.

type ResourceManager

type ResourceManager struct {
	// contains filtered or unexported fields
}

ResourceManager stores the details on already processed resources for caching

func NewResourceManager

func NewResourceManager(rebuildTime int64) *ResourceManager

NewResourceManager returns a new ResourceManager

func (*ResourceManager) Drop

func (rm *ResourceManager) Drop()

Drop drop the cache after every rebuild interval mins TODO: or drop based on the size

func (*ResourceManager) ProcessResource

func (rm *ResourceManager) ProcessResource(policy, pv, kind, ns, name, rv string) bool

ProcessResource returns true if the policy was not applied on the resource

func (*ResourceManager) RegisterResource

func (rm *ResourceManager) RegisterResource(policy, pv, kind, ns, name, rv string)

RegisterResource stores if the policy is processed on this resource version

type Validation

type Validation interface {
	Validate() (string, error)
}

Validation provides methods to validate a rule