generated from kubewarden/go-policy-template
-
Notifications
You must be signed in to change notification settings - Fork 2
/
validate.go
94 lines (77 loc) · 2.15 KB
/
validate.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
package main
import (
"fmt"
"strings"
mapset "github.com/deckarep/golang-set/v2"
"github.com/kubewarden/gjson"
kubewarden "github.com/kubewarden/policy-sdk-go"
)
func validate(payload []byte) ([]byte, error) {
if !gjson.ValidBytes(payload) {
return kubewarden.RejectRequest(
kubewarden.Message("Not a valid JSON document"),
kubewarden.Code(400))
}
settings, err := NewSettingsFromValidationReq(payload)
if err != nil {
return kubewarden.RejectRequest(
kubewarden.Message(err.Error()),
kubewarden.Code(400))
}
data := gjson.GetBytes(
payload,
"request.object.metadata.labels")
labels := mapset.NewThreadUnsafeSet[string]()
denied_labels_violations := []string{}
constrained_labels_violations := []string{}
data.ForEach(func(key, value gjson.Result) bool {
label := key.String()
labels.Add(label)
if settings.DeniedLabels.Contains(label) {
denied_labels_violations = append(denied_labels_violations, label)
return true
}
regExp, found := settings.ConstrainedLabels[label]
if found {
// This is a constrained label
if !regExp.Match([]byte(value.String())) {
constrained_labels_violations = append(constrained_labels_violations, label)
return true
}
}
return true
})
errorMsgs := []string{}
if len(denied_labels_violations) > 0 {
errorMsgs = append(
errorMsgs,
fmt.Sprintf(
"The following labels are denied: %s",
strings.Join(denied_labels_violations, ","),
))
}
if len(constrained_labels_violations) > 0 {
errorMsgs = append(
errorMsgs,
fmt.Sprintf(
"The following labels are violating user constraints: %s",
strings.Join(constrained_labels_violations, ","),
))
}
mandatoryLabelsViolations := settings.MandatoryLabels.Difference(labels)
if mandatoryLabelsViolations.Cardinality() > 0 {
violations := mandatoryLabelsViolations.ToSlice()
errorMsgs = append(
errorMsgs,
fmt.Sprintf(
"The following mandatory labels are missing: %s",
strings.Join(violations, ","),
))
}
if len(errorMsgs) > 0 {
return kubewarden.RejectRequest(
kubewarden.Message(strings.Join(errorMsgs, ". ")),
kubewarden.NoCode)
}
return kubewarden.AcceptRequest()
}