11package commands
22
33import (
4+ "bytes"
45 "encoding/json"
56 "fmt"
67 "os"
78 "path/filepath"
9+ "text/template"
810
911 "github.com/plexsystems/konstraint/internal/rego"
1012
13+ "github.com/Masterminds/sprig/v3"
1114 v1 "github.com/open-policy-agent/frameworks/constraint/pkg/apis/templates/v1"
1215 "github.com/open-policy-agent/frameworks/constraint/pkg/apis/templates/v1beta1"
1316 log "github.com/sirupsen/logrus"
@@ -50,10 +53,21 @@ Create constraints with the Gatekeeper enforcement action set to dryrun
5053 if err := viper .BindPFlag ("constraint-template-version" , cmd .PersistentFlags ().Lookup ("constraint-template-version" )); err != nil {
5154 return fmt .Errorf ("bind constraint-template-version flag: %w" , err )
5255 }
56+ if err := viper .BindPFlag ("constraint-template-custom-template-file" , cmd .PersistentFlags ().Lookup ("constraint-template-custom-template-file" )); err != nil {
57+ return fmt .Errorf ("bind constraint-template-custom-template-file flag: %w" , err )
58+ }
59+ if err := viper .BindPFlag ("constraint-custom-template-file" , cmd .PersistentFlags ().Lookup ("constraint-custom-template-file" )); err != nil {
60+ return fmt .Errorf ("bind constraint-custom-template-file flag: %w" , err )
61+ }
62+
5363 if err := viper .BindPFlag ("partial-constraints" , cmd .PersistentFlags ().Lookup ("partial-constraints" )); err != nil {
5464 return fmt .Errorf ("bind partial-constraints flag: %w" , err )
5565 }
5666
67+ if cmd .PersistentFlags ().Lookup ("constraint-template-custom-template-file" ).Changed && cmd .PersistentFlags ().Lookup ("constraint-template-version" ).Changed {
68+ return fmt .Errorf ("need to set either constraint-template-custom-template-file or constraint-template-version" )
69+ }
70+
5771 path := "."
5872 if len (args ) > 0 {
5973 path = args [0 ]
@@ -68,6 +82,8 @@ Create constraints with the Gatekeeper enforcement action set to dryrun
6882 cmd .PersistentFlags ().Bool ("skip-constraints" , false , "Skip generation of constraints" )
6983 cmd .PersistentFlags ().String ("constraint-template-version" , "v1beta1" , "Set the version of ConstraintTemplates" )
7084 cmd .PersistentFlags ().Bool ("partial-constraints" , false , "Generate partial Constraints for policies with parameters" )
85+ cmd .PersistentFlags ().String ("constraint-template-custom-template-file" , "" , "Path to a custom template file to generate constraint templates" )
86+ cmd .PersistentFlags ().String ("constraint-custom-template-file" , "" , "Path to a custom template file to generate constraints" )
7187
7288 return & cmd
7389}
@@ -107,21 +123,36 @@ func runCreateCommand(path string) error {
107123 }
108124
109125 constraintTemplateVersion := viper .GetString ("constraint-template-version" )
126+ constraintTemplateCustomTemplateFile := viper .GetString ("constraint-template-custom-template-file" )
127+
110128 var constraintTemplate any
111- switch constraintTemplateVersion {
112- case "v1" :
113- constraintTemplate = getConstraintTemplatev1 (violation , logger )
114- case "v1beta1" :
115- constraintTemplate = getConstraintTemplatev1beta1 (violation , logger )
116- default :
117- return fmt .Errorf ("unsupported API version for constrainttemplate: %s" , constraintTemplateVersion )
118- }
129+ var constraintTemplateBytes []byte
119130
120- constraintTemplateBytes , err := yaml .Marshal (constraintTemplate )
121- if err != nil {
122- return fmt .Errorf ("marshal constrainttemplate: %w" , err )
123- }
131+ if constraintTemplateCustomTemplateFile != "" {
132+ customTemplate , err := os .ReadFile (constraintTemplateCustomTemplateFile )
133+ if err != nil {
134+ return fmt .Errorf ("unable to open/read template file: %w" , err )
135+ }
136+ constraintTemplateBytes , err = renderTemplate (violation , customTemplate , logger )
137+ if err != nil {
138+ return fmt .Errorf ("unable to render custom template: %w" , err )
139+ }
140+ } else {
141+ switch constraintTemplateVersion {
142+ case "v1" :
143+ constraintTemplate = getConstraintTemplatev1 (violation , logger )
144+ case "v1beta1" :
145+ constraintTemplate = getConstraintTemplatev1beta1 (violation , logger )
146+ default :
147+ return fmt .Errorf ("unsupported API version for constrainttemplate: %s" , constraintTemplateVersion )
148+ }
149+ constraintTemplateBytes , err = yaml .Marshal (constraintTemplate )
124150
151+ if err != nil {
152+ return fmt .Errorf ("marshal constrainttemplate: %w" , err )
153+ }
154+
155+ }
125156 if err := os .WriteFile (filepath .Join (outputDir , templateFileName ), constraintTemplateBytes , 0644 ); err != nil {
126157 return fmt .Errorf ("writing template: %w" , err )
127158 }
@@ -137,16 +168,28 @@ func runCreateCommand(path string) error {
137168 continue
138169 }
139170
140- constraint , err := getConstraint (violation , logger )
141- if err != nil {
142- return fmt .Errorf ("get constraint: %w" , err )
143- }
171+ constraintCustomTemplateFile := viper .GetString ("constraint-custom-template-file" )
172+ var constraintBytes []byte
173+ if constraintCustomTemplateFile != "" {
174+ customTemplate , err := os .ReadFile (constraintCustomTemplateFile )
175+ if err != nil {
176+ return fmt .Errorf ("unable to open/read template file: %w" , err )
177+ }
178+ constraintBytes , err = renderTemplate (violation , customTemplate , logger )
179+ if err != nil {
180+ return fmt .Errorf ("unable to render custom constraint: %w" , err )
181+ }
182+ } else {
183+ constraint , err := getConstraint (violation , logger )
184+ if err != nil {
185+ return fmt .Errorf ("get constraint: %w" , err )
186+ }
144187
145- constraintBytes , err := yaml .Marshal (constraint )
146- if err != nil {
147- return fmt .Errorf ("marshal constraint: %w" , err )
188+ constraintBytes , err = yaml .Marshal (constraint )
189+ if err != nil {
190+ return fmt .Errorf ("marshal constraint: %w" , err )
191+ }
148192 }
149-
150193 if err := os .WriteFile (filepath .Join (outputDir , constraintFileName ), constraintBytes , 0644 ); err != nil {
151194 return fmt .Errorf ("writing constraint: %w" , err )
152195 }
@@ -157,6 +200,20 @@ func runCreateCommand(path string) error {
157200 return nil
158201}
159202
203+ func renderTemplate (violation rego.Rego , appliedTemplate []byte , _ * log.Entry ) ([]byte , error ) {
204+ t , err := template .New ("template" ).Funcs (sprig .FuncMap ()).Parse (string (appliedTemplate ))
205+ if err != nil {
206+ return nil , fmt .Errorf ("parsing template: %w" , err )
207+ }
208+ buf := new (bytes.Buffer )
209+
210+ if err := t .Execute (buf , violation ); err != nil {
211+ return nil , fmt .Errorf ("executing template: %w" , err )
212+ }
213+
214+ return buf .Bytes (), nil
215+ }
216+
160217func getConstraintTemplatev1 (violation rego.Rego , logger * log.Entry ) * v1.ConstraintTemplate {
161218 constraintTemplate := v1.ConstraintTemplate {
162219 TypeMeta : metav1.TypeMeta {
0 commit comments