Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add enforcementAction to status #180

Merged
merged 2 commits into from Jul 11, 2019

Conversation

Projects
None yet
3 participants
@ritazh
Copy link
Contributor

commented Jul 10, 2019

Signed-off-by: Rita Zhang rita.z.zhang@gmail.com

@timothyhinrichs @maxsmythe
Per our discussion for the Dry Run design proposal, this PR updates the status field of Constraint object to include the enforcementAction the violation resulted from.

Example of a Constraint's status field as a result of this PR:

status:
  auditTimestamp: "2019-07-10T06:06:29Z"
  byPod:
  - enforced: true
    id: gatekeeper-controller-manager-0
  violations:
  - enforcementAction: deny
    kind: Pod
    message: 'you must provide labels: {"gatekeeper"}'
    name: nginx-4rfps
    namespace: test
  - enforcementAction: deny
    kind: Pod
    message: 'you must provide labels: {"gatekeeper"}'
    name: nginx-xrxjk
    namespace: test

Once we have implemented the dry run feature, it could be something like:
Constraint for prod

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: K8sRequiredLabels
metadata:
  name: pod-must-have-gk-prod
spec:
  enforcementAction: dryrun
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "production"
  parameters:
    labels: ["gatekeeper"]
status:
  auditTimestamp: "2019-07-10T06:06:29Z"
  byPod:
  - enforced: true
    id: gatekeeper-controller-manager-0
  violations:
  - enforcementAction: dryrun
    kind: Pod
    message: 'you must provide labels: {"gatekeeper"}'
    name: nginx-xrxjk
    namespace: production

Constraint for dev

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: K8sRequiredLabels
metadata:
  name: pod-must-have-gk-dev
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "dev"
  parameters:
    labels: ["gatekeeper"]
status:
  auditTimestamp: "2019-07-10T06:06:29Z"
  byPod:
  - enforced: true
    id: gatekeeper-controller-manager-0
  violations:
  - enforcementAction: deny
    kind: Pod
    message: 'you must provide labels: {"gatekeeper"}'
    name: nginx-xrxjk
    namespace: dev
Add violationByAction to status
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

@ritazh ritazh requested review from maxsmythe and timothyhinrichs Jul 10, 2019

@maxsmythe
Copy link
Contributor

left a comment

LGTM after nits

Show resolved Hide resolved pkg/audit/manager.go Outdated
Show resolved Hide resolved pkg/audit/manager.go Outdated
@timothyhinrichs

This comment has been minimized.

Copy link
Member

commented Jul 10, 2019

LGTM.

'violations' instead of 'violationsByAction' (like we agreed to the other day) makes sense to me given that the value is an array of objects. It's clean that the enforcementaction is just another field.

Revert to violations
Signed-off-by: Rita Zhang <rita.z.zhang@gmail.com>

@ritazh ritazh changed the title Add violationByAction to status Add enforcementAction to status Jul 11, 2019

@maxsmythe
Copy link
Contributor

left a comment

LGTM

@ritazh ritazh merged commit a4473f9 into open-policy-agent:master Jul 11, 2019

3 checks passed

DCO DCO
Details
cla/linuxfoundation ritazh authorized
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.