Skip to content

Commit 4f88e8e

Browse files
JaydipGabaniJaydipGabani
authored
docs: adding opa v1 docs and tests (#3908)
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
1 parent 05a900e commit 4f88e8e

File tree

7 files changed

+286
-1
lines changed

7 files changed

+286
-1
lines changed

‎test/bats/test.bats

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@ teardown_file() {
7070
else
7171
wait_for_process ${WAIT_TIME} ${SLEEP_TIME} "kubectl apply -f ${BATS_TESTS_DIR}/templates/k8srequiredlabels_template_vap.yaml"
7272

73-
# check status resource on expansion template
7473
wait_for_process ${WAIT_TIME} ${SLEEP_TIME} "kubectl get constrainttemplates.templates.gatekeeper.sh k8srequiredlabelsvap -ojson | jq -r -e '.status.byPod[0]'"
7574

7675
kubectl get constrainttemplates.templates.gatekeeper.sh k8srequiredlabelsvap -oyaml
@@ -681,3 +680,16 @@ __expansion_audit_test() {
681680
run kubectl delete -f test/export/nginx_deployment.yaml --ignore-not-found
682681
run kubectl delete ns nginx --ignore-not-found
683682
}
683+
684+
@test "rego v1 tests" {
685+
wait_for_process ${WAIT_TIME} ${SLEEP_TIME} "kubectl apply -f ${BATS_TESTS_DIR}/templates/k8srequiredlabels_template_regov1.yaml"
686+
wait_for_process ${WAIT_TIME} ${SLEEP_TIME} "kubectl get constrainttemplates.templates.gatekeeper.sh k8srequiredlabels -ojson | jq -r -e '.status.byPod[0]'"
687+
688+
kubectl get constrainttemplates.templates.gatekeeper.sh k8srequiredlabelsv1 -oyaml
689+
wait_for_process ${WAIT_TIME} ${SLEEP_TIME} "kubectl apply -f ${BATS_TESTS_DIR}/constraints/all_ns_must_have_label_provided.yaml"
690+
691+
run kubectl apply -f ${BATS_TESTS_DIR}/bad/bad_ns.yaml
692+
assert_match 'denied' "${output}"
693+
assert_failure
694+
wait_for_process ${WAIT_TIME} ${SLEEP_TIME} "kubectl delete --ignore-not-found -f ${BATS_TESTS_DIR}/templates/k8srequiredlabels_template_regov1.yaml"
695+
}

‎test/bats/tests/constraints/all_ns_must_have_label_provided.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: constraints.gatekeeper.sh/v1beta1
2+
kind: K8sRequiredLabelsV1
3+
metadata:
4+
name: all-must-have-label
5+
spec:
6+
match:
7+
kinds:
8+
- apiGroups: [""]
9+
kinds: ["Namespace"]
10+
parameters:
11+
message: "All namespaces must have an `owner` label that points to your company username"
12+
labels:
13+
- key: owner
14+
allowedRegex: "^[a-zA-Z]+.agilebank.demo$"

‎test/bats/tests/templates/k8srequiredlabels_template_regov1.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
apiVersion: templates.gatekeeper.sh/v1
2+
kind: ConstraintTemplate
3+
metadata:
4+
name: k8srequiredlabelsv1
5+
spec:
6+
crd:
7+
spec:
8+
names:
9+
kind: K8sRequiredLabelsV1
10+
validation:
11+
# Schema for the `parameters` field
12+
openAPIV3Schema:
13+
type: object
14+
properties:
15+
message:
16+
type: string
17+
labels:
18+
type: array
19+
items:
20+
type: object
21+
properties:
22+
key:
23+
type: string
24+
allowedRegex:
25+
type: string
26+
targets:
27+
- target: admission.k8s.gatekeeper.sh
28+
code:
29+
- engine: Rego
30+
source:
31+
version: "v1"
32+
rego: |
33+
package k8srequiredlabelsv1
34+
35+
violation contains
36+
{"msg": msg, "details": {"missing_labels": missing}}
37+
if {
38+
provided := {label | input.review.object.metadata.labels[label]}
39+
required := {label | label := input.parameters.labels[_]}
40+
missing := required - provided
41+
count(missing) > 0
42+
msg := sprintf("you must provide labels: %v", [missing])
43+
}

‎test/gator/test/fixtures/manifests/with-policies/with-violations-rego-v1.yaml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: allowed-namespace
5+
---
6+
apiVersion: constraints.gatekeeper.sh/v1beta1
7+
kind: K8sRequiredLabels
8+
metadata:
9+
name: all-must-have-owner
10+
spec:
11+
match:
12+
kinds:
13+
- apiGroups: [""]
14+
kinds: ["Namespace"]
15+
parameters:
16+
message: "All namespaces must have an `owner` label that points to your company username"
17+
labels:
18+
- key: owner
19+
allowedRegex: "^[a-zA-Z]+.agilebank.demo$"
20+
---
21+
apiVersion: templates.gatekeeper.sh/v1
22+
kind: ConstraintTemplate
23+
metadata:
24+
name: k8srequiredlabels
25+
annotations:
26+
description: >-
27+
Requires resources to contain specified labels, with values matching
28+
provided regular expressions.
29+
spec:
30+
crd:
31+
spec:
32+
names:
33+
kind: K8sRequiredLabels
34+
validation:
35+
openAPIV3Schema:
36+
type: object
37+
properties:
38+
message:
39+
type: string
40+
labels:
41+
type: array
42+
description: >-
43+
A list of labels and values the object must specify.
44+
items:
45+
type: object
46+
properties:
47+
key:
48+
type: string
49+
description: >-
50+
The required label.
51+
allowedRegex:
52+
type: string
53+
description: >-
54+
If specified, a regular expression the annotation's value
55+
must match. The value must contain at least one match for
56+
the regular expression.
57+
targets:
58+
- target: admission.k8s.gatekeeper.sh
59+
code:
60+
- engine: Rego
61+
source:
62+
version: "v1"
63+
rego: |
64+
package k8srequiredlabels
65+
66+
violation contains
67+
{"msg": msg, "details": {"missing_labels": missing}}
68+
if {
69+
provided := {label | input.review.object.metadata.labels[label]}
70+
required := {label | label := input.parameters.labels[_]}
71+
missing := required - provided
72+
count(missing) > 0
73+
msg := sprintf("you must provide labels: %v", [missing])
74+
}

‎test/gator/test/test.bats

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,10 @@ match_yaml_msg () {
8585
! bin/gator test --filename="$BATS_TEST_DIRNAME/fixtures/manifests/with-policies/with-violations.yaml"
8686
}
8787

88+
@test "manifest with rego v1 template and violations included as flag returns 1 exit status" {
89+
! bin/gator test --filename="$BATS_TEST_DIRNAME/fixtures/manifests/with-policies/with-violations-rego-v1.yaml"
90+
}
91+
8892
@test "multiple files passed in flags is supported" {
8993
run bin/gator test --filename="$BATS_TEST_DIRNAME/fixtures/manifests/no-policies/with-violations.yaml" --filename="$BATS_TEST_DIRNAME/fixtures/policies/default" -oyaml
9094
[ "$status" -eq 1 ]

‎website/docs/constrainttemplates.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,3 +158,72 @@ k8srequiredlabels.constraints.gatekeeper.sh/ns-must-have-gk created
158158
$ kubectl create ns foobar
159159
Error from server ([ns-must-have-gk] you must provide labels: {"gatekeeper"}): admission webhook "validation.gatekeeper.sh" denied the request: [ns-must-have-gk] you must provide labels: {"gatekeeper"}
160160
```
161+
162+
## Enable OPA Rego v1 syntax in ConstraintTemplates
163+
164+
Gatekeeper 3.19 ships with ability to use OPA Rego v1 as policy language in ConstraintTemplates. Using Rego v1 syntax is opt-in, by default only Rego v0 is allowed. You can use below spec to enable Rego v1 syntax:
165+
166+
```yaml
167+
...
168+
targets:
169+
- target: admission.k8s.gatekeeper.sh
170+
code:
171+
- engine: Rego
172+
source:
173+
version: "v1"
174+
rego: |
175+
<v1-rego-code>
176+
...
177+
```
178+
179+
:::note
180+
Rego v1 syntax can only be used under `targets[_].code[_].[engine: Rego].source` with `version: "v1"`. No need to add `import rego.v1` to use rego v1 syntax.
181+
:::
182+
183+
Here is a sample ConstraintTemplate using Rego v1 syntax:
184+
185+
```yaml
186+
apiVersion: templates.gatekeeper.sh/v1
187+
kind: ConstraintTemplate
188+
metadata:
189+
name: k8srequiredlabels
190+
spec:
191+
crd:
192+
spec:
193+
names:
194+
kind: K8sRequiredLabels
195+
validation:
196+
# Schema for the `parameters` field
197+
openAPIV3Schema:
198+
type: object
199+
properties:
200+
message:
201+
type: string
202+
labels:
203+
type: array
204+
items:
205+
type: object
206+
properties:
207+
key:
208+
type: string
209+
allowedRegex:
210+
type: string
211+
targets:
212+
- target: admission.k8s.gatekeeper.sh
213+
code:
214+
- engine: Rego
215+
source:
216+
version: "v1"
217+
rego: |
218+
package k8srequiredlabels
219+
220+
violation contains
221+
{"msg": msg, "details": {"missing_labels": missing}}
222+
if {
223+
provided := {label | input.review.object.metadata.labels[label]}
224+
required := {label | label := input.parameters.labels[_]}
225+
missing := required - provided
226+
count(missing) > 0
227+
msg := sprintf("you must provide labels: %v", [missing])
228+
}
229+
```

‎website/versioned_docs/version-v3.19.x/constrainttemplates.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,3 +158,72 @@ k8srequiredlabels.constraints.gatekeeper.sh/ns-must-have-gk created
158158
$ kubectl create ns foobar
159159
Error from server ([ns-must-have-gk] you must provide labels: {"gatekeeper"}): admission webhook "validation.gatekeeper.sh" denied the request: [ns-must-have-gk] you must provide labels: {"gatekeeper"}
160160
```
161+
162+
## Enable OPA Rego v1 syntax in ConstraintTemplates
163+
164+
Gatekeeper 3.19 ships with ability to use OPA Rego v1 as policy language in ConstraintTemplates. Using Rego v1 syntax is opt-in, by default only Rego v0 is allowed. You can use below spec to enable Rego v1 syntax:
165+
166+
```yaml
167+
...
168+
targets:
169+
- target: admission.k8s.gatekeeper.sh
170+
code:
171+
- engine: Rego
172+
source:
173+
version: "v1"
174+
rego: |
175+
<v1-rego-code>
176+
...
177+
```
178+
179+
:::note
180+
Rego v1 syntax can only be used under `targets[_].code[_].[engine: Rego].source` with `version: "v1"`. No need to add `import rego.v1` to use rego v1 syntax.
181+
:::
182+
183+
Here is a sample ConstraintTemplate using Rego v1 syntax:
184+
185+
```yaml
186+
apiVersion: templates.gatekeeper.sh/v1
187+
kind: ConstraintTemplate
188+
metadata:
189+
name: k8srequiredlabels
190+
spec:
191+
crd:
192+
spec:
193+
names:
194+
kind: K8sRequiredLabels
195+
validation:
196+
# Schema for the `parameters` field
197+
openAPIV3Schema:
198+
type: object
199+
properties:
200+
message:
201+
type: string
202+
labels:
203+
type: array
204+
items:
205+
type: object
206+
properties:
207+
key:
208+
type: string
209+
allowedRegex:
210+
type: string
211+
targets:
212+
- target: admission.k8s.gatekeeper.sh
213+
code:
214+
- engine: Rego
215+
source:
216+
version: "v1"
217+
rego: |
218+
package k8srequiredlabels
219+
220+
violation contains
221+
{"msg": msg, "details": {"missing_labels": missing}}
222+
if {
223+
provided := {label | input.review.object.metadata.labels[label]}
224+
required := {label | label := input.parameters.labels[_]}
225+
missing := required - provided
226+
count(missing) > 0
227+
msg := sprintf("you must provide labels: %v", [missing])
228+
}
229+
```

0 commit comments

Comments
 (0)