Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
Convert to using OPA Constraint Framework #80
This implements the ConstraintTemplate/Constraint functionality for Gatekeeper.
There is a lot more to do including:
Signed-off-by: Max Smythe firstname.lastname@example.org
tsandall left a comment
@maxsmythe this looks like a great start. I reviewed the watch manager implementation and nothing jumped out at me immediately. One thing I was unsure about was why the manager polls every 5 seconds (as opposed to being signaled asynchronously when there's an update to process.) It would be good to include a comment in the manager code explaining the design.
A few other notes:
I've also reviewed the target Rego and noticed one small issue in the kind selector.
Thanks for the review!
I added a comment to the watch manager, but the gist is that changes to the underlying CRD resource version will break the watch, so it's a good idea to make sure the roster stays up-to-date independent of actions from a controller.
Re: other comments:
Also, signal boost that I copied your modified kind selector Rego code into the target. LMK if this is not okay to do.
No, it was just the initialization you described. It just took me a while to find my way around the code because of the indirection but I think once you spend some time with it, it's not so bad.
The rest of the changes look good to me. Feel free to merge whenever you want.