Add support for API groups with multiple slashes

Author: jpreese

examples/virtual-service-naming/constraint.yaml

@@ -0,0 +1,11 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: VirtualServiceNaming
+metadata:
+  name: virtualservicenaming
+spec:
+  match:
+    kinds:
+    - apiGroups:
+      - networking.istio.io/v1alpha3
+      kinds:
+      - VirtualService

examples/virtual-service-naming/src.rego

@@ -0,0 +1,16 @@
+package policy
+
+import data.lib.k8s
+
+# VirtualServices must not be named virtual-service
+# @Kinds networking.istio.io/v1alpha3/VirtualService
+violation[msg] {
+  not virtualservice_name_allowed
+
+  msg := k8s.format(sprintf("(%s) %s: VirtualServices must not be named virtual-service", [k8s.kind, k8s.name]))
+}
+
+virtualservice_name_allowed {
+  k8s.kind == "VirtualService"
+  not k8s.name == "virtual-service"
+}

examples/virtual-service-naming/src_test.rego

@@ -0,0 +1,23 @@
+package policy
+
+test_input_as_invalid_name {
+  input := {
+    "kind": "VirtualService",
+    "metadata": {
+      "name": "virtual-service"
+    }
+  }
+
+  not virtualservice_name_allowed with input as input
+}
+
+test_input_as_valid_name {
+  input := {
+    "kind": "VirtualService",
+    "metadata": {
+      "name": "valid-name"
+    }
+  }
+
+  virtualservice_name_allowed with input as input
+}

…s-emptydir-limits-required/template.yaml …les/virtual-service-naming/template.yamlexamples/volumes-emptydir-limits-required/template.yaml renamed to examples/virtual-service-naming/template.yaml examples/volumes-emptydir-limits-required/template.yaml renamed to examples/virtual-service-naming/template.yaml

@@ -2,12 +2,12 @@ apiVersion: templates.gatekeeper.sh/v1beta1
 kind: ConstraintTemplate
 metadata:
   creationTimestamp: null
-  name: volumesemptydirlimitsrequired
+  name: virtualservicenaming
 spec:
   crd:
     spec:
       names:
-        kind: VolumesEmptydirLimitsRequired
+        kind: VirtualServiceNaming
   targets:
   - libs:
     - |
@@ -297,16 +297,13 @@ spec:
 
       import data.lib.k8s
 
-      # EmptyDir volume mounts must specify a size limit.
-      # @Kinds apps/DaemonSet apps/Deployment apps/StatefulSet core/Pod
+      # VirtualServices must not be named virtual-service
+      # @Kinds networking.istio.io/v1alpha3/VirtualService
       violation[msg] {
-        volumes_emptydir_size_limit_required
+        k8s.kind == "VirtualService"
+        k8s.name == "virtual-service"
 
-        msg := k8s.format(sprintf("(%s) %s: Volume mounts of type emptyDir must set a size limit", [k8s.kind, k8s.name]))
-      }
-
-      volumes_emptydir_size_limit_required {
-        k8s.missing_field(k8s.volumes[_].emptyDir, "sizeLimit")
+        msg := k8s.format(sprintf("(%s) %s: VirtualServices must not be named virtual-service", [k8s.kind, k8s.name]))
       }
     target: admission.k8s.gatekeeper.sh
 status: {}

examples/volumes-emptydir-limits-required/constraint.yaml

@@ -116,12 +116,13 @@ func getPolicyCommentBlocks(policy []byte) ([]PolicyCommentBlock, error) {
 		var kinds []string
 		for _, kindGroup := range kindGroups {
 			kindTokens := strings.Split(kindGroup, "/")
+			apiGroup := strings.Join(kindTokens[:len(kindTokens)-1], "/")
 
-			if !contains(apiGroups, kindTokens[0]) {
-				apiGroups = append(apiGroups, kindTokens[0])
+			if !contains(apiGroups, apiGroup) {
+				apiGroups = append(apiGroups, apiGroup)
 			}
 
-			kinds = append(kinds, kindTokens[1])
+			kinds = append(kinds, kindTokens[len(kindTokens)-1])
 		}
 
 		policyCommentBlock := PolicyCommentBlock{

examples/volumes-emptydir-limits-required/src.rego

@@ -23,7 +23,7 @@ violation[msg] {
 func TestGetPolicyCommentBlocks(t *testing.T) {
 	policy := `
 # First description
-# @Kinds core/Pods apps/Deployments apps/DaemonSet
+# @Kinds core/Pods apps/Deployments apps/DaemonSet networking.istio.io/v1alpha3/VirtualService
 violation[msg] {
 	false
 }`
@@ -38,7 +38,7 @@ violation[msg] {
 		t.Errorf("expected policy block to exist, but one did not.")
 	}
 
-	expectedAPIGroupCount := 2
+	expectedAPIGroupCount := 3
 	if len(actual[0].APIGroups) != expectedAPIGroupCount {
 		t.Errorf("expected %v APIGroups to exists but %v were found", expectedAPIGroupCount, len(actual[0].APIGroups))
 	}
@@ -51,11 +51,19 @@ violation[msg] {
 		t.Errorf("expected policy block to contain 'apps' APIGroup, but was not found.")
 	}
 
+	if !contains(actual[0].APIGroups, "networking.istio.io/v1alpha3") {
+		t.Errorf("expected policy block to contain 'apps' APIGroup, but was not found.")
+	}
+
 	if !contains(actual[0].Kinds, "Pods") {
 		t.Errorf("expected policy block to contain 'Pods' Kind, but was not found.")
 	}
 
 	if !contains(actual[0].Kinds, "Deployments") {
 		t.Errorf("expected policy block to contain 'Deployments' Kind, but was not found.")
 	}
+
+	if !contains(actual[0].Kinds, "VirtualService") {
+		t.Errorf("expected policy block to contain 'VirtualService' Kind, but was not found.")
+	}
 }