Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: validate PolicyGroup expressions #870

Merged
merged 6 commits into from
Sep 10, 2024
Merged

feat: validate PolicyGroup expressions #870

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
8341ec8
refactor: cleanup policy validation
fabriziosestito Sep 9, 2024
5f4bc1b
test: cleanup policy validation tests
fabriziosestito Sep 9, 2024
7bee897
feat: add PolicyGroup expression validator; add validatePolicyGroupCr…
fabriziosestito Sep 9, 2024
66f6dc0
feat: update PolicyGroup webhooks
fabriziosestito Sep 9, 2024
2820d52
test: fix policy group factory
fabriziosestito Sep 9, 2024
8895033
fix: policy mode validation
fabriziosestito Sep 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions api/policies/v1/admissionpolicy_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@

apierrors "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/validation/field"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
logf "sigs.k8s.io/controller-runtime/pkg/log"
Expand Down Expand Up @@ -51,6 +50,7 @@
// Default implements webhook.Defaulter so a webhook will be registered for the type.
func (r *AdmissionPolicy) Default() {
admissionpolicylog.Info("default", "name", r.Name)

if r.Spec.PolicyServer == "" {
r.Spec.PolicyServer = constants.DefaultPolicyServer
}
Expand All @@ -66,17 +66,12 @@
// ValidateCreate implements webhook.Validator so a webhook will be registered for the type.
func (r *AdmissionPolicy) ValidateCreate() (admission.Warnings, error) {
admissionpolicylog.Info("validate create", "name", r.Name)
errList := field.ErrorList{}

if errs := validateRulesField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if errs := validateMatchConditionsField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if len(errList) != 0 {
return nil, prepareInvalidAPIError(r, errList)
allErrors := validatePolicyCreate(r)
if len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)

Check warning on line 72 in api/policies/v1/admissionpolicy_webhook.go

View check run for this annotation

Codecov / codecov/patch

api/policies/v1/admissionpolicy_webhook.go#L72 

Added line #L72 was not covered by tests
}

return nil, nil
}

Expand All @@ -89,11 +84,18 @@
return admission.Warnings{}, apierrors.NewInternalError(
fmt.Errorf("object is not of type AdmissionPolicy: %#v", old))
}
return nil, validatePolicyUpdate(oldPolicy, r)

allErrors := validatePolicyUpdate(oldPolicy, r)
if len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)

Check warning on line 90 in api/policies/v1/admissionpolicy_webhook.go

View check run for this annotation

Codecov / codecov/patch

api/policies/v1/admissionpolicy_webhook.go#L90 

Added line #L90 was not covered by tests
}

return nil, nil
}

// ValidateDelete implements webhook.Validator so a webhook will be registered for the type.
func (r *AdmissionPolicy) ValidateDelete() (admission.Warnings, error) {
admissionpolicylog.Info("validate delete", "name", r.Name)

return nil, nil
}
26 changes: 12 additions & 14 deletions api/policies/v1/admissionpolicygroup_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@

apierrors "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/validation/field"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
logf "sigs.k8s.io/controller-runtime/pkg/log"
Expand Down Expand Up @@ -51,6 +50,7 @@
// Default implements webhook.Defaulter so a webhook will be registered for the type.
func (r *AdmissionPolicyGroup) Default() {
admissionpolicygrouplog.Info("default", "name", r.Name)

if r.Spec.PolicyServer == "" {
r.Spec.PolicyServer = constants.DefaultPolicyServer
}
Expand All @@ -66,20 +66,13 @@
// ValidateCreate implements webhook.Validator so a webhook will be registered for the type.
func (r *AdmissionPolicyGroup) ValidateCreate() (admission.Warnings, error) {
admissionpolicygrouplog.Info("validate create", "name", r.Name)
errList := field.ErrorList{}

if errs := validateRulesField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if errs := validateMatchConditionsField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if err := validatePolicyGroupMembers(r); err != nil {
errList = append(errList, err)
}
if len(errList) != 0 {
return nil, prepareInvalidAPIError(r, errList)
allErrors := validatePolicyGroupCreate(r)

if len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)
}

return nil, nil
}

Expand All @@ -92,7 +85,12 @@
return admission.Warnings{}, apierrors.NewInternalError(
fmt.Errorf("object is not of type AdmissionPolicyGroup: %#v", old))
}
return nil, validatePolicyUpdate(oldPolicy, r)

if allErrors := validatePolicyGroupUpdate(oldPolicy, r); len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)

Check warning on line 90 in api/policies/v1/admissionpolicygroup_webhook.go

View check run for this annotation

Codecov / codecov/patch

api/policies/v1/admissionpolicygroup_webhook.go#L90 

Added line #L90 was not covered by tests
}

return nil, nil
}

// ValidateDelete implements webhook.Validator so a webhook will be registered for the type.
Expand Down
24 changes: 13 additions & 11 deletions api/policies/v1/clusteradmissionpolicy_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@
"fmt"

"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/validation/field"

"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
"sigs.k8s.io/controller-runtime/pkg/webhook"
Expand All @@ -43,6 +42,7 @@
if err != nil {
return fmt.Errorf("failed enrolling webhook with manager: %w", err)
}

return nil
}

Expand All @@ -53,6 +53,7 @@
// Default implements webhook.Defaulter so a webhook will be registered for the type.
func (r *ClusterAdmissionPolicy) Default() {
clusteradmissionpolicylog.Info("default", "name", r.Name)

if r.Spec.PolicyServer == "" {
r.Spec.PolicyServer = constants.DefaultPolicyServer
}
Expand All @@ -68,17 +69,12 @@
// ValidateCreate implements webhook.Validator so a webhook will be registered for the type.
func (r *ClusterAdmissionPolicy) ValidateCreate() (admission.Warnings, error) {
clusteradmissionpolicylog.Info("validate create", "name", r.Name)
errList := field.ErrorList{}

if errs := validateRulesField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if errs := validateMatchConditionsField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if len(errList) != 0 {
return nil, prepareInvalidAPIError(r, errList)
allErrors := validatePolicyCreate(r)
if len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)

Check warning on line 75 in api/policies/v1/clusteradmissionpolicy_webhook.go

View check run for this annotation

Codecov / codecov/patch

api/policies/v1/clusteradmissionpolicy_webhook.go#L75 

Added line #L75 was not covered by tests
}

return nil, nil
}

Expand All @@ -92,11 +88,17 @@
fmt.Errorf("object is not of type ClusterAdmissionPolicy: %#v", old))
}

return nil, validatePolicyUpdate(oldPolicy, r)
allErrors := validatePolicyUpdate(oldPolicy, r)
if len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)

Check warning on line 93 in api/policies/v1/clusteradmissionpolicy_webhook.go

View check run for this annotation

Codecov / codecov/patch

api/policies/v1/clusteradmissionpolicy_webhook.go#L93 

Added line #L93 was not covered by tests
}

return nil, nil
}

// ValidateDelete implements webhook.Validator so a webhook will be registered for the type.
func (r *ClusterAdmissionPolicy) ValidateDelete() (admission.Warnings, error) {
clusteradmissionpolicylog.Info("validate delete", "name", r.Name)

return nil, nil
}
22 changes: 8 additions & 14 deletions api/policies/v1/clusteradmissionpolicygroup_webhook.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@
"fmt"

"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/util/validation/field"

"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
"sigs.k8s.io/controller-runtime/pkg/webhook"
Expand Down Expand Up @@ -68,21 +67,12 @@
// ValidateCreate implements webhook.Validator so a webhook will be registered for the type.
func (r *ClusterAdmissionPolicyGroup) ValidateCreate() (admission.Warnings, error) {
clusteradmissionpolicygrouplog.Info("validate create", "name", r.Name)
errList := field.ErrorList{}

if errs := validateRulesField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if errs := validateMatchConditionsField(r); len(errs) != 0 {
errList = append(errList, errs...)
}
if err := validatePolicyGroupMembers(r); err != nil {
errList = append(errList, err)
allErrors := validatePolicyGroupCreate(r)
if len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)
}

if len(errList) != 0 {
return nil, prepareInvalidAPIError(r, errList)
}
return nil, nil
}

Expand All @@ -96,7 +86,11 @@
fmt.Errorf("object is not of type ClusterAdmissionPolicyGroup: %#v", old))
}

return nil, validatePolicyUpdate(oldPolicy, r)
if allErrors := validatePolicyGroupUpdate(oldPolicy, r); len(allErrors) != 0 {
return nil, prepareInvalidAPIError(r, allErrors)

Check warning on line 90 in api/policies/v1/clusteradmissionpolicygroup_webhook.go

View check run for this annotation

Codecov / codecov/patch

api/policies/v1/clusteradmissionpolicygroup_webhook.go#L90 

Added line #L90 was not covered by tests
}

return nil, nil
}

// ValidateDelete implements webhook.Validator so a webhook will be registered for the type.
Expand Down
4 changes: 2 additions & 2 deletions api/policies/v1/policy_utils_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ func admissionPolicyGroupFactory() *AdmissionPolicyGroup {
Message: "This is a test policy",
Policies: []PolicyGroupMember{
{
Name: "testing-policy",
Name: "mypolicy",
Module: "ghcr.io/kubewarden/tests/user-group-psp:v0.4.9",
Settings: runtime.RawExtension{},
ContextAwareResources: []ContextAwareResource{},
Expand Down Expand Up @@ -101,7 +101,7 @@ func clusterAdmissionPolicyGroupFactory() *ClusterAdmissionPolicyGroup {
Message: "This is a test policy",
Policies: []PolicyGroupMember{
{
Name: "testing-policy",
Name: "mypolicy",
Module: "ghcr.io/kubewarden/tests/user-group-psp:v0.4.9",
Settings: runtime.RawExtension{},
ContextAwareResources: []ContextAwareResource{},
Expand Down
Loading
Loading