Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: scaffold KW policy from Kubernetes ValidatingAdmissionPolicy #834

Merged
merged 1 commit into from
Jun 19, 2024
Merged

feat: scaffold KW policy from Kubernetes ValidatingAdmissionPolicy #834

merged 1 commit into from
Jun 19, 2024

Conversation

flavio
Copy link
Member

@flavio flavio commented Jun 19, 2024

Add the new scaffold vap subcommand. This allows to create a Kubewarden ClusterAdmissionPolicy starting from a Kubernetes ValidatingAdmissionPolicy.

@flavio flavio requested a review from a team as a code owner June 19, 2024 11:22
@flavio
Copy link
Member Author

flavio commented Jun 19, 2024

Depends on kubewarden/policy-evaluator#525

@flavio flavio self-assigned this Jun 19, 2024
@codecov Codecov
Copy link

codecov bot commented Jun 19, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 30.86420% with 56 lines in your changes missing coverage. Please review.

Project coverage is 10.35%. Comparing base (c21efb6) to head (d123b55).
Report is 4 commits behind head on main.

❗ Current head d123b55 differs from pull request most recent head 27e80c2

Please upload reports for the commit 27e80c2 to get more accurate results.

Files Patch % Lines
src/scaffold.rs 50.00% 25 Missing ⚠️
src/cli.rs 0.00% 22 Missing ⚠️
src/main.rs 0.00% 9 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff            @@
##            main     #834      +/-   ##
=========================================
+ Coverage   9.49%   10.35%   +0.85%     
=========================================
  Files         20       20              
  Lines       1727     1806      +79     
=========================================
+ Hits         164      187      +23     
- Misses      1563     1619      +56
Flag Coverage Δ
unit-tests 10.35% <30.86%> (+0.85%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

fabriziosestito
fabriziosestito requested changes Jun 19, 2024
View reviewed changes
Copy link
Contributor

@fabriziosestito fabriziosestito left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall LGTM, a few nitpicks here and there.
However, we need to add a warning when no version is set, informing the user that we are defaulting to the latest tag.

src/scaffold.rs Outdated Show resolved Hide resolved
src/scaffold.rs Outdated Show resolved Hide resolved
src/scaffold.rs Outdated Show resolved Hide resolved
@flavio
Copy link
Member Author

flavio commented Jun 19, 2024

I've done all the changes requested, except printing the warning message when the latest CEL policy is being used. I'm going to handle that right now. In the meantime you can take a look at the changes I pushed inside of the latest commit

fabriziosestito
fabriziosestito approved these changes Jun 19, 2024
View reviewed changes
Copy link
Contributor

@fabriziosestito fabriziosestito left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@flavio approved modulo the warning message

viccuad
viccuad reviewed Jun 19, 2024
View reviewed changes
src/cli.rs
Arg::new("cel-policy")
.long("cel-policy")
.value_name("URI")
.default_value("ghcr.io/kubewarden/policies/cel-policy:latest")
Copy link
Member

@viccuad viccuad Jun 19, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would be ok with "ghcr.io/kubewarden/policies/cel-policy:<version>" so by default the user is forced to edit and doesn't instantiate a possible broken policy.

viccuad
viccuad approved these changes Jun 19, 2024
View reviewed changes
Copy link
Member

@viccuad viccuad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@flavio
Copy link
Member Author

flavio commented Jun 19, 2024

I've just pushed a commit that introduces the check about latest image being used.

When the policy being referenced is <anything>:latest or <anything> (no tag -> latest), the tool will print a warning. The warning goes to the STDERR, which means the stdout containing the YAML file is not disrupted

@flavio
Copy link
Member Author

flavio commented Jun 19, 2024

BTW, I'll squash the commits together once you're done with the review

@flavio
Copy link
Member Author

flavio commented Jun 19, 2024

I've bumped policy-evaluator to the tag I just created. My fork is no longer involved

@fabriziosestito
Copy link
Contributor

:shipit:

@flavio
feat: scaffold KW policy from Kubernetes ValidatingAdmissionPolicy
27e80c2 
Add the new `scaffold vap` subcommand. This allows to create a
Kubewarden ClusterAdmissionPolicy starting from a Kubernetes
ValidatingAdmissionPolicy.

Signed-off-by: Flavio Castelli <fcastelli@suse.com>
@flavio flavio merged commit 57d6217 into kubewarden:main Jun 19, 2024
2 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fabriziosestito fabriziosestito fabriziosestito approved these changes

@jvanz jvanz jvanz approved these changes

@viccuad viccuad viccuad approved these changes

Assignees

@flavio flavio

Labels
kind/feature
Projects
Kubewarden
Archived in project
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@flavio @fabriziosestito @jvanz @viccuad