Skip to content

Commit

Permalink
Format function-export-blueprint
Browse files Browse the repository at this point in the history
  • Loading branch information
ZhuGongpu committed Jul 30, 2020
1 parent 68b08b6 commit 6bcd831
Show file tree
Hide file tree
Showing 3 changed files with 41 additions and 40 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,11 @@ metadata:
spec:
match:
kinds:
- apiGroups: ["apps"]
kinds: ["Deployment"]
- apiGroups: ["apps"]
kinds: ["Deployment"]
parameters:
labels:
- key: "owner"
message: "Deployment objects should have an 'owner' label indicating who created them."
- key: "owner"
message: "Deployment objects should have an 'owner' label indicating who created
them."
# [END constraint]
Original file line number Diff line number Diff line change
Expand Up @@ -24,43 +24,43 @@ spec:
# Schema for the `parameters` field
openAPIV3Schema:
properties:
message:
type: string
labels:
type: array
items:
type: object
properties:
key:
type: string
allowedRegex:
type: string
key:
type: string
message:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package k8srequiredlabels
get_message(parameters, _default) = msg {
not parameters.message
msg := _default
}
get_message(parameters, _default) = msg {
msg := parameters.message
}
violation[{"msg": msg, "details": {"missing_labels": missing}}] {
provided := {label | input.review.object.metadata.labels[label]}
required := {label | label := input.parameters.labels[_].key}
missing := required - provided
count(missing) > 0
def_msg := sprintf("you must provide labels: %v", [missing])
msg := get_message(input.parameters, def_msg)
}
violation[{"msg": msg}] {
value := input.review.object.metadata.labels[key]
expected := input.parameters.labels[_]
expected.key == key
# do not match if allowedRegex is not defined, or is an empty string
expected.allowedRegex != ""
not re_match(expected.allowedRegex, value)
def_msg := sprintf("Label <%v: %v> does not satisfy allowed regex: %v", [key, value, expected.allowedRegex])
msg := get_message(input.parameters, def_msg)
}
- rego: |
package k8srequiredlabels
get_message(parameters, _default) = msg {
not parameters.message
msg := _default
}
get_message(parameters, _default) = msg {
msg := parameters.message
}
violation[{"msg": msg, "details": {"missing_labels": missing}}] {
provided := {label | input.review.object.metadata.labels[label]}
required := {label | label := input.parameters.labels[_].key}
missing := required - provided
count(missing) > 0
def_msg := sprintf("you must provide labels: %v", [missing])
msg := get_message(input.parameters, def_msg)
}
violation[{"msg": msg}] {
value := input.review.object.metadata.labels[key]
expected := input.parameters.labels[_]
expected.key == key
# do not match if allowedRegex is not defined, or is an empty string
expected.allowedRegex != ""
not re_match(expected.allowedRegex, value)
def_msg := sprintf("Label <%v: %v> does not satisfy allowed regex: %v", [key, value, expected.allowedRegex])
msg := get_message(input.parameters, def_msg)
}
target: admission.k8s.gatekeeper.sh
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ spec:
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.14.2
ports:
- containerPort: 80
- name: nginx
image: nginx:1.14.2
ports:
- containerPort: 80

0 comments on commit 6bcd831

Please sign in to comment.