feat: Add ValidatingAdmissionPolicy generation function #376

maxsmythe · 2023-11-14T06:05:56Z

Adds the ability to generate a VAP policy definition from a constraint template using the K8sNative engine.

This is an incremental step towards implementing the Gatekeeper-to-VAP User Flow

Signed-off-by: Max Smythe <smythe@google.com>

codecov-commenter · 2023-11-14T06:15:55Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (af4fcdb) 54.06% compared to head (b8a5935) 54.38%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #376      +/-   ##
==========================================
+ Coverage   54.06%   54.38%   +0.31%     
==========================================
  Files          67       71       +4     
  Lines        4796     5176     +380     
==========================================
+ Hits         2593     2815     +222     
- Misses       1923     2064     +141     
- Partials      280      297      +17

Flag	Coverage Δ
unittests	`54.38% <ø> (+0.31%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: Max Smythe <smythe@google.com>

acpana

excited to see this happening 🎉

left some minor, non blocking comments

constraint/pkg/client/drivers/k8scel/transform/cel_snippets.go

constraint/pkg/client/drivers/k8scel/schema/schema.go

constraint/pkg/client/drivers/k8scel/transform/cel_snippets_test.go

ritazh · 2023-12-14T00:33:59Z

constraint/pkg/client/drivers/k8scel/transform/request.go

+
+func NewWrapper(req *admissionv1.AdmissionRequest) (*RequestWrapper, error) {
+	var object runtime.Object
+	if len(req.Object.Raw) != 0 {


should we return error early for all the len == 0 cases?

len == 0 is acceptable in some cases (e.g. object on delete, oldObject on create)

(in these cases, expected value is nil)

constraint/pkg/client/drivers/k8scel/schema/schema.go

ritazh · 2023-12-14T01:28:14Z

constraint/pkg/client/drivers/k8scel/schema/schema.go

-	Expression        string
-	Message           string
-	MessageExpression string
+	// A CEL expression. Maps to ValidationAdmissionPolicy's spec.validations


I think this comment is meant for the Validation type so might be good to move it before the type definition.

Putting the comment here is what would generate the docstring for Open API schema.

For example, this field:

https://github.com/open-policy-agent/gatekeeper/blob/650397965cfd9dcfe3d2bd3456a13c04e8fc8338/apis/mutations/v1/externaldata_types.go#L13-L16

Turns into this schema:

https://github.com/open-policy-agent/gatekeeper/blob/650397965cfd9dcfe3d2bd3456a13c04e8fc8338/config/crd/bases/mutations.gatekeeper.sh_assign.yaml#L251-L253

I was aiming for consistency, but happy to move things if you like. LMK what you prefer.

ritazh · 2023-12-14T01:28:33Z

constraint/pkg/client/drivers/k8scel/schema/schema.go

 	Expression string `json:"expression"`
 }

+type Variable struct {
+	// A CEL variable definition. Maps to ValidationAdmissionPolicy's spec.variables


same, move comment before the type

Signed-off-by: Max Smythe <smythe@google.com>

sozercan · 2023-12-18T18:18:17Z

constraint/pkg/client/drivers/k8scel/schema/schema.go

+	Name = "K8sNativeValidation"
+	// ReservedPrefix signifies a prefix that no user-defined value (variable, matcher, etc.) is allowed to have.
+	// This gives us the ability to add new variables in the future without worrying about breaking pre-existing templates.
+	ReservedPrefix = "g8r_internal_"


nit: Should we rename this to gatekeeper_...? Users/contributors might not know what g8r means. That made me think maybe we should rename "K8s" to "Kubernetes" too?

TBH, I'm mostly concerned about brevity/uniqueness. Since this is more about reserving a namespace for us, ideally users never collide with the naming and therefore never need to know the details.

I'm okay with either, but would rather not rename things more than one more time in this PR.

@ritazh preferred name?

I'm ok with either as well. +1 on "gatekeeper_" since g8r is less well known.

ritazh · 2023-12-19T00:53:58Z

constraint/pkg/client/drivers/k8scel/transform/make_vap_objects.go

+		return nil, err
+	}
+
+	matchConditions, err := source.GetV1Alpha1MatchConditions()


why do we only convert to the alpha one? backward compat? when should we consider beta and v1?

I'd say we'd switch once its possible to generate v1beta1 (or greater) VAP resources.

If we wanted to avoid future breaking changes, I could rename this to TemplateToV1Alpha1PolicyDefinition() if you prefer?

I'm ok keeping it as is.

constraint/pkg/client/drivers/k8scel/schema/schema.go

ritazh · 2023-12-19T01:27:42Z

constraint/pkg/client/drivers/k8scel/transform/cel_snippets_test.go

+			name:        "Simple match",
+			matcher:     nsMatcher{"somename"},
+			namespace:   ptr.To[string]("somename"),
+			shouldMatch: false,


why is shouldMatch false for this case?

b/c its testing excluded namespaces

maxsmythe

Sorry, for some reason my comments were listed as "pending review", so some of these are older responses (but probably still relevant)

maxsmythe · 2023-12-15T00:29:26Z

constraint/pkg/client/drivers/k8scel/schema/schema.go

-	Expression        string
-	Message           string
-	MessageExpression string
+	// A CEL expression. Maps to ValidationAdmissionPolicy's spec.validations


Putting the comment here is what would generate the docstring for Open API schema.

For example, this field:

https://github.com/open-policy-agent/gatekeeper/blob/650397965cfd9dcfe3d2bd3456a13c04e8fc8338/apis/mutations/v1/externaldata_types.go#L13-L16

Turns into this schema:

https://github.com/open-policy-agent/gatekeeper/blob/650397965cfd9dcfe3d2bd3456a13c04e8fc8338/config/crd/bases/mutations.gatekeeper.sh_assign.yaml#L251-L253

I was aiming for consistency, but happy to move things if you like. LMK what you prefer.

maxsmythe · 2023-12-15T07:32:15Z

constraint/pkg/client/drivers/k8scel/transform/request.go

+
+func NewWrapper(req *admissionv1.AdmissionRequest) (*RequestWrapper, error) {
+	var object runtime.Object
+	if len(req.Object.Raw) != 0 {


len == 0 is acceptable in some cases (e.g. object on delete, oldObject on create)

maxsmythe · 2023-12-15T07:32:53Z

constraint/pkg/client/drivers/k8scel/transform/request.go

+
+func NewWrapper(req *admissionv1.AdmissionRequest) (*RequestWrapper, error) {
+	var object runtime.Object
+	if len(req.Object.Raw) != 0 {


(in these cases, expected value is nil)

constraint/pkg/client/drivers/k8scel/schema/schema.go

maxsmythe · 2023-12-21T23:44:43Z

constraint/pkg/client/drivers/k8scel/schema/schema.go

+	Name = "K8sNativeValidation"
+	// ReservedPrefix signifies a prefix that no user-defined value (variable, matcher, etc.) is allowed to have.
+	// This gives us the ability to add new variables in the future without worrying about breaking pre-existing templates.
+	ReservedPrefix = "g8r_internal_"


TBH, I'm mostly concerned about brevity/uniqueness. Since this is more about reserving a namespace for us, ideally users never collide with the naming and therefore never need to know the details.

I'm okay with either, but would rather not rename things more than one more time in this PR.

@ritazh preferred name?

maxsmythe · 2023-12-21T23:47:44Z

constraint/pkg/client/drivers/k8scel/transform/make_vap_objects.go

+		return nil, err
+	}
+
+	matchConditions, err := source.GetV1Alpha1MatchConditions()


I'd say we'd switch once its possible to generate v1beta1 (or greater) VAP resources.

If we wanted to avoid future breaking changes, I could rename this to TemplateToV1Alpha1PolicyDefinition() if you prefer?

maxsmythe · 2023-12-21T23:52:48Z

constraint/pkg/client/drivers/k8scel/transform/cel_snippets_test.go

+			name:        "Simple match",
+			matcher:     nsMatcher{"somename"},
+			namespace:   ptr.To[string]("somename"),
+			shouldMatch: false,


b/c its testing excluded namespaces

Signed-off-by: Max Smythe <smythe@google.com>

ritazh

LGTM

Excited to integrate this!

maxsmythe requested review from sozercan and ritazh November 14, 2023 06:06

maxsmythe changed the title ~~Add ValidatingAdmissionPolicy generation function~~ feat: Add ValidatingAdmissionPolicy generation function Nov 14, 2023

Add ValidatingAdmissionPolicy generation function

5e8e843

Signed-off-by: Max Smythe <smythe@google.com>

maxsmythe force-pushed the generate-vap-objects branch from b410a0f to 5e8e843 Compare November 14, 2023 06:14

Remove use of uitl/pointer

d673b4a

Signed-off-by: Max Smythe <smythe@google.com>

acpana approved these changes Nov 16, 2023

View reviewed changes

ritazh mentioned this pull request Dec 13, 2023

Integration with k8s Validating Admission Policy for admission open-policy-agent/gatekeeper#2874

Closed

ritazh reviewed Dec 14, 2023

View reviewed changes

constraint/pkg/client/drivers/k8scel/schema/schema.go Outdated Show resolved Hide resolved

ritazh reviewed Dec 14, 2023

View reviewed changes

Rename reserved prefix, document global constants

c171f27

Signed-off-by: Max Smythe <smythe@google.com>

maxsmythe force-pushed the generate-vap-objects branch from fa9c08d to c171f27 Compare December 15, 2023 08:14

sozercan reviewed Dec 18, 2023

View reviewed changes

ritazh reviewed Dec 19, 2023

View reviewed changes

constraint/pkg/client/drivers/k8scel/schema/schema.go Show resolved Hide resolved

ritazh reviewed Dec 19, 2023

View reviewed changes

constraint/pkg/client/drivers/k8scel/schema/schema.go Show resolved Hide resolved

ritazh reviewed Dec 19, 2023

View reviewed changes

maxsmythe commented Dec 21, 2023

View reviewed changes

maxsmythe added 2 commits December 21, 2023 23:58

More validation of source fields

70504d1

Signed-off-by: Max Smythe <smythe@google.com>

Rename reserved namespace to gatekeeper_internal_

b8a5935

Signed-off-by: Max Smythe <smythe@google.com>

ritazh approved these changes Jan 5, 2024

View reviewed changes

maxsmythe merged commit 6adc486 into open-policy-agent:master Jan 5, 2024
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Add ValidatingAdmissionPolicy generation function #376

feat: Add ValidatingAdmissionPolicy generation function #376

maxsmythe commented Nov 14, 2023

codecov-commenter commented Nov 14, 2023 •

edited

Loading

acpana left a comment

ritazh Dec 14, 2023

maxsmythe Dec 15, 2023

maxsmythe Dec 15, 2023

ritazh Dec 14, 2023

maxsmythe Dec 15, 2023

ritazh Dec 14, 2023

sozercan Dec 18, 2023 •

edited

Loading

maxsmythe Dec 21, 2023

ritazh Jan 1, 2024

ritazh Dec 19, 2023

maxsmythe Dec 21, 2023

ritazh Jan 1, 2024

ritazh Dec 19, 2023

maxsmythe Dec 21, 2023

maxsmythe left a comment

maxsmythe Dec 15, 2023

maxsmythe Dec 15, 2023

maxsmythe Dec 15, 2023

maxsmythe Dec 21, 2023

maxsmythe Dec 21, 2023

maxsmythe Dec 21, 2023

ritazh left a comment

feat: Add ValidatingAdmissionPolicy generation function #376

feat: Add ValidatingAdmissionPolicy generation function #376

Conversation

maxsmythe commented Nov 14, 2023

codecov-commenter commented Nov 14, 2023 • edited Loading

Codecov Report

acpana left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sozercan Dec 18, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxsmythe left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ritazh left a comment

Choose a reason for hiding this comment

codecov-commenter commented Nov 14, 2023 •

edited

Loading

sozercan Dec 18, 2023 •

edited

Loading