-
Notifications
You must be signed in to change notification settings - Fork 783
/
forceMutate.go
112 lines (97 loc) · 3.5 KB
/
forceMutate.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
package engine
import (
"fmt"
"github.com/go-logr/logr"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/engine/context"
"github.com/kyverno/kyverno/pkg/engine/internal"
"github.com/kyverno/kyverno/pkg/engine/mutate"
"github.com/kyverno/kyverno/pkg/engine/variables"
"github.com/kyverno/kyverno/pkg/utils/api"
"k8s.io/apiextensions-apiserver/pkg/apis/apiextensions"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)
// ForceMutate does not check any conditions, it simply mutates the given resource
// It is used to validate mutation logic, and for tests.
func ForceMutate(
ctx context.Interface,
logger logr.Logger,
policy kyvernov1.PolicyInterface,
resource unstructured.Unstructured,
) (unstructured.Unstructured, error) {
logger = internal.LoggerWithPolicy(logger, policy)
logger = internal.LoggerWithResource(logger, "resource", resource)
// logger := logging.WithName("EngineForceMutate").WithValues("policy", policy.GetName(), "kind", resource.GetKind(),
// "namespace", resource.GetNamespace(), "name", resource.GetName())
patchedResource := resource
// TODO: if we apply autogen, tests will fail
spec := policy.GetSpec()
for _, rule := range spec.Rules {
if !rule.HasMutate() {
continue
}
logger := internal.LoggerWithRule(logger, rule)
ruleCopy := rule.DeepCopy()
removeConditions(ruleCopy)
r, err := variables.SubstituteAllForceMutate(logger, ctx, *ruleCopy)
if err != nil {
return resource, err
}
if r.Mutation.ForEachMutation != nil {
patchedResource, err = applyForEachMutate(r.Name, r.Mutation.ForEachMutation, patchedResource, logger)
if err != nil {
return patchedResource, err
}
} else {
m := r.Mutation
patchedResource, err = applyPatches(r.Name, m.GetPatchStrategicMerge(), m.PatchesJSON6902, patchedResource, logger)
if err != nil {
return patchedResource, err
}
}
}
return patchedResource, nil
}
func applyForEachMutate(name string, foreach []kyvernov1.ForEachMutation, resource unstructured.Unstructured, logger logr.Logger) (patchedResource unstructured.Unstructured, err error) {
patchedResource = resource
for _, fe := range foreach {
if fe.ForEachMutation != nil {
nestedForEach, err := api.DeserializeJSONArray[kyvernov1.ForEachMutation](fe.ForEachMutation)
if err != nil {
return patchedResource, fmt.Errorf("failed to deserialize foreach: %w", err)
}
return applyForEachMutate(name, nestedForEach, patchedResource, logger)
}
patchedResource, err = applyPatches(name, fe.GetPatchStrategicMerge(), fe.PatchesJSON6902, patchedResource, logger)
if err != nil {
return resource, err
}
}
return patchedResource, nil
}
func applyPatches(name string, mergePatch apiextensions.JSON, jsonPatch string, resource unstructured.Unstructured, logger logr.Logger) (unstructured.Unstructured, error) {
patcher := mutate.NewPatcher(mergePatch, jsonPatch)
resourceBytes, err := resource.MarshalJSON()
if err != nil {
return resource, err
}
resourceBytes, err = patcher.Patch(logger, resourceBytes)
if err != nil {
return resource, err
}
if err := resource.UnmarshalJSON(resourceBytes); err != nil {
return resource, err
}
return resource, err
}
// removeConditions mutates the rule to remove AnyAllConditions
func removeConditions(rule *kyvernov1.Rule) {
if rule.GetAnyAllConditions() != nil {
rule.SetAnyAllConditions(nil)
}
for i, fem := range rule.Mutation.ForEachMutation {
if fem.AnyAllConditions != nil {
rule.Mutation.ForEachMutation[i].AnyAllConditions = nil
}
}
}