Spike: investigate implementing parameter resources

[fabriziosestito]

We need to investigate implementing parameter resources.
Kubewarden has no equivalent to ValidatingAdmissionPolicyBinding, but we could define both paramKind and paramRef in the settings and use context-aware calls to retrieve the resource.

[floriankoch]

is there another way to get parameters into the policy?

[floriankoch]

@fabriziosestito any idea how to get parameters into the policy?

[fabriziosestito]

@floriankoch kubewarden doesn't have the concept of bindings so we need to figure out a way to implement the parameters feature inside the cel policy. We are working to support host capabilities inside CEL policies. Could you please elaborate a bit more on what you are trying to achieve so we can understand if it this could fit your use-case?

[floriankoch]

@fabriziosestito sure

i have this expression, and i want the array of prefixes to be dynamic, it depends on cluster and environment
and i don't want to define n policies

validations:
    - expression: "(['bar-','foo-'].exists(prefix,object.metadata.name.startsWith(prefix)))"
      message: "Namespaces must start with an allowed prefix 'foo-, bar-'"

I have another usecase where i have a allowlist for ingress domains, but the domains are different on each stage

I can deploy a configmap with the settings, bit how can i read them from the expression
i tested, bit it does not worked

(kw.k8s.getResource(GetResourceRequest{Kind: 'ConfigMap', Namespace: 'kubewarden', Name: 'param'}).data.prefixes)

Error: [clusterwide-validate-namespace-prefix-policy] settings are not valid: Some("The settings are invalid: 1 error occurred:\n\t* validations[0].expression: Invalid value: \"((kw.k8s.getResource(GetResourceRequest{Kind: 'ConfigMap', Namespace: 'kubewarden', Name: 'param'}).data.prefixes).exists(prefix,object.metadata.name.startsWith(prefix)))\": compilation failed: ERROR: <input>:1:40: undeclared reference to 'GetResourceRequest' (in container 'net')\n | ((kw.k8s.getResource(GetResourceRequest{Kind: 'ConfigMap', Namespace: 'kubewarden', Name: 'param'}).data.prefixes).exists(prefix,object.metadata.name.startsWith(prefix)))\n | .......................................^:\n\n")

[floriankoch]

@fabriziosestito anything new here?

[viccuad]

@floriankoch please stay tuned, we are looking forward to tackling this, but it will not go into the Kubewarden 1.14 milestone for now.