forked from kyverno/kyverno
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
NDEV-19320 : fix misleading annotations
Signed-off-by: Anushka Mittal <[email protected]>
- Loading branch information
1 parent
d866807
commit 25b86fc
Showing
4 changed files
with
1 addition
and
314 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,144 +1,6 @@ | ||
| package utils | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "strings" | ||
|
|
||
| "github.com/go-logr/logr" | ||
| engineapi "github.com/kyverno/kyverno/pkg/engine/api" | ||
| jsonutils "github.com/kyverno/kyverno/pkg/utils/json" | ||
| yamlv2 "gopkg.in/yaml.v2" | ||
| ) | ||
|
|
||
| const ( | ||
| PolicyAnnotation = "policies.kyverno.io/last-applied-patches" | ||
| policyAnnotation = "policies.kyverno.io~1last-applied-patches" | ||
| oldAnnotation = "policies.kyverno.io~1patches" | ||
| ManagedByLabel = "webhook.kyverno.io/managed-by" | ||
| KyvernoComponentLabel = "app.kubernetes.io/component" | ||
| ) | ||
|
|
||
| type RulePatch struct { | ||
| RuleName string `json:"rulename"` | ||
| Op string `json:"op"` | ||
| Path string `json:"path"` | ||
| } | ||
|
|
||
| var OperationToPastTense = map[string]string{ | ||
| "add": "added", | ||
| "remove": "removed", | ||
| "replace": "replaced", | ||
| "move": "moved", | ||
| "copy": "copied", | ||
| "test": "tested", | ||
| } | ||
|
|
||
| func GenerateAnnotationPatches(engineResponses []engineapi.EngineResponse, log logr.Logger) [][]byte { | ||
| var annotations map[string]string | ||
| var patchBytes [][]byte | ||
| for _, er := range engineResponses { | ||
| if ann := er.PatchedResource.GetAnnotations(); ann != nil { | ||
| annotations = ann | ||
| break | ||
| } | ||
| } | ||
| if annotations == nil { | ||
| annotations = make(map[string]string) | ||
| } | ||
| var patchResponse jsonutils.PatchOperation | ||
| value := annotationFromEngineResponses(engineResponses, log) | ||
| if value == nil { | ||
| // no patches or error while processing patches | ||
| return nil | ||
| } | ||
| if _, ok := annotations[strings.ReplaceAll(policyAnnotation, "~1", "/")]; ok { | ||
| // create update patch string | ||
| if _, ok := annotations["policies.kyverno.io/patches"]; ok { | ||
| patchResponse = jsonutils.NewPatchOperation("/metadata/annotations/"+oldAnnotation, "remove", nil) | ||
| delete(annotations, "policies.kyverno.io/patches") | ||
| patchByte, _ := json.Marshal(patchResponse) | ||
| patchBytes = append(patchBytes, patchByte) | ||
| } | ||
| patchResponse = jsonutils.NewPatchOperation("/metadata/annotations/"+policyAnnotation, "replace", string(value)) | ||
| patchByte, _ := json.Marshal(patchResponse) | ||
| patchBytes = append(patchBytes, patchByte) | ||
| } else { | ||
| // mutate rule has annotation patches | ||
| if len(annotations) > 0 { | ||
| if _, ok := annotations["policies.kyverno.io/patches"]; ok { | ||
| patchResponse = jsonutils.NewPatchOperation("/metadata/annotations/"+oldAnnotation, "remove", nil) | ||
| delete(annotations, "policies.kyverno.io/patches") | ||
| patchByte, _ := json.Marshal(patchResponse) | ||
| patchBytes = append(patchBytes, patchByte) | ||
| } | ||
| patchResponse = jsonutils.NewPatchOperation("/metadata/annotations/"+policyAnnotation, "add", string(value)) | ||
| patchByte, _ := json.Marshal(patchResponse) | ||
| patchBytes = append(patchBytes, patchByte) | ||
| } else { | ||
| // insert 'policies.kyverno.patches' entry in annotation map | ||
| annotations[strings.ReplaceAll(policyAnnotation, "~1", "/")] = string(value) | ||
| patchResponse = jsonutils.NewPatchOperation("/metadata/annotations", "add", annotations) | ||
| patchByte, _ := json.Marshal(patchResponse) | ||
| patchBytes = append(patchBytes, patchByte) | ||
| } | ||
| } | ||
| for _, patchByte := range patchBytes { | ||
| err := jsonutils.CheckPatch(patchByte) | ||
| if err != nil { | ||
| log.Error(err, "failed to build JSON patch for annotation", "patch", string(patchByte)) | ||
| } | ||
| } | ||
| return patchBytes | ||
| } | ||
|
|
||
| func annotationFromEngineResponses(engineResponses []engineapi.EngineResponse, log logr.Logger) []byte { | ||
| annotationContent := make(map[string]string) | ||
| for _, engineResponse := range engineResponses { | ||
| if !engineResponse.IsSuccessful() { | ||
| log.V(3).Info("skip building annotation; policy failed to apply", "policy", engineResponse.Policy().GetName()) | ||
| continue | ||
| } | ||
| rulePatches := annotationFromPolicyResponse(engineResponse.PolicyResponse, log) | ||
| if rulePatches == nil { | ||
| continue | ||
| } | ||
| policyName := engineResponse.Policy().GetName() | ||
| for _, rulePatch := range rulePatches { | ||
| annotationContent[rulePatch.RuleName+"."+policyName+".kyverno.io"] = OperationToPastTense[rulePatch.Op] + " " + rulePatch.Path | ||
| } | ||
| } | ||
|
|
||
| // return nil if there's no patches | ||
| // otherwise result = null, len(result) = 4 | ||
| if len(annotationContent) == 0 { | ||
| return nil | ||
| } | ||
|
|
||
| result, _ := yamlv2.Marshal(annotationContent) | ||
|
|
||
| return result | ||
| } | ||
|
|
||
| func annotationFromPolicyResponse(policyResponse engineapi.PolicyResponse, log logr.Logger) []RulePatch { | ||
| var RulePatches []RulePatch | ||
| for _, ruleInfo := range policyResponse.Rules { | ||
| for _, patch := range ruleInfo.Patches() { | ||
| var patchmap map[string]interface{} | ||
| if err := json.Unmarshal(patch, &patchmap); err != nil { | ||
| log.Error(err, "Failed to parse JSON patch bytes") | ||
| continue | ||
| } | ||
| rp := RulePatch{ | ||
| RuleName: ruleInfo.Name(), | ||
| Op: patchmap["op"].(string), | ||
| Path: patchmap["path"].(string), | ||
| } | ||
| RulePatches = append(RulePatches, rp) | ||
| log.V(4).Info("annotation value prepared", "patches", RulePatches) | ||
| } | ||
| } | ||
| if len(RulePatches) == 0 { | ||
| return nil | ||
| } | ||
| return RulePatches | ||
| } |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters