Skip to content

Commit

Permalink
feat: Allow wildcard at start string and end together (open-policy-ag…
Browse files Browse the repository at this point in the history 
…ent#2130)

* Change all roles to support extra rules

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* add astrix on start and end

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* add check of wild card, for both prefix and suffix

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* remove rules from this pr

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* remove new line

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* lint files

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* add test, fix misspelling

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* add test for mutltiple hyphens

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* remove change deploy and charts

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* add 2 more tests

Signed-off-by: Erez Tamam <erezo9@gmail.com>

* change test name

Signed-off-by: Erez Tamam <erezo9@gmail.com>
Signed-off-by: Christoph Fraundorfer <christoph.fraundorfer@allianzdirect.de>
  • Loading branch information
@erezo9 @ChrisFraun
erezo9 authored and ChrisFraun committed Jul 6, 2022
1 parent 626fc2e commit 0fbecaa
Show file tree
Hide file tree
Showing 12 changed files with 91 additions and 59 deletions.
2 changes: 1 addition & 1 deletion config/crd/bases/config.gatekeeper.sh_configs.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ spec:
or end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
processes:
Expand Down
12 changes: 6 additions & 6 deletions config/crd/bases/mutations.gatekeeper.sh_assign.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -158,7 +158,7 @@ spec:
a prefix or suffix glob. For example, `name: pod-*` would match
both `pod-a` and `pod-b`, and `name: *-pod` would match both
`a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an
Expand Down Expand Up @@ -217,7 +217,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down Expand Up @@ -416,7 +416,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -495,7 +495,7 @@ spec:
a prefix or suffix glob. For example, `name: pod-*` would match
both `pod-a` and `pod-b`, and `name: *-pod` would match both
`a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an
Expand Down Expand Up @@ -554,7 +554,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down
12 changes: 6 additions & 6 deletions config/crd/bases/mutations.gatekeeper.sh_assignmetadata.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -131,7 +131,7 @@ spec:
a prefix or suffix glob. For example, `name: pod-*` would match
both `pod-a` and `pod-b`, and `name: *-pod` would match both
`a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an
Expand Down Expand Up @@ -190,7 +190,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down Expand Up @@ -341,7 +341,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -420,7 +420,7 @@ spec:
a prefix or suffix glob. For example, `name: pod-*` would match
both `pod-a` and `pod-b`, and `name: *-pod` would match both
`a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an
Expand Down Expand Up @@ -479,7 +479,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down
12 changes: 6 additions & 6 deletions config/crd/bases/mutations.gatekeeper.sh_modifyset.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -159,7 +159,7 @@ spec:
a prefix or suffix glob. For example, `name: pod-*` would match
both `pod-a` and `pod-b`, and `name: *-pod` would match both
`a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an
Expand Down Expand Up @@ -218,7 +218,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down Expand Up @@ -383,7 +383,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -462,7 +462,7 @@ spec:
a prefix or suffix glob. For example, `name: pod-*` would match
both `pod-a` and `pod-b`, and `name: *-pod` would match both
`a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an
Expand Down Expand Up @@ -521,7 +521,7 @@ spec:
end. Ex: "kube-*" will match "kube-system" or "kube-public",
"*-system" will match "kube-system" or "gatekeeper-system". The
asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down
12 changes: 6 additions & 6 deletions manifest_staging/charts/gatekeeper/crds/assign-customresourcedefinition.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ spec:
description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.'
items:
description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -115,7 +115,7 @@ spec:
type: object
name:
description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace.
Expand Down Expand Up @@ -151,7 +151,7 @@ spec:
description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.'
items:
description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down Expand Up @@ -303,7 +303,7 @@ spec:
description: 'ExcludedNamespaces is a list of namespace names. If defined, a constraint only applies to resources not in a listed namespace. ExcludedNamespaces also supports a prefix or suffix based glob. For example, `excludedNamespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.'
items:
description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
kinds:
Expand Down Expand Up @@ -353,7 +353,7 @@ spec:
type: object
name:
description: 'Name is the name of an object. If defined, it will match against objects with the specified name. Name also supports a prefix or suffix glob. For example, `name: pod-*` would match both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
namespaceSelector:
description: NamespaceSelector is a label selector against an object's containing namespace or the object itself, if the object is a namespace.
Expand Down Expand Up @@ -389,7 +389,7 @@ spec:
description: 'Namespaces is a list of namespace names. If defined, a constraint only applies to resources in a listed namespace. Namespaces also supports a prefix or suffix based glob. For example, `namespaces: [kube-*]` matches both `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both `kube-system` and `gatekeeper-system`.'
items:
description: 'A string that supports globbing at its front or end. Ex: "kube-*" will match "kube-system" or "kube-public", "*-system" will match "kube-system" or "gatekeeper-system". The asterisk is required for wildcard matching.'
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
pattern: ^(\*|\*-)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\*|-\*)?$
type: string
type: array
scope:
Expand Down
Loading

0 comments on commit 0fbecaa

Please sign in to comment.