Skip to content

Commit c648449

Browse files
mruegmrueg
authored
Fix constraint template when the matchers key is not present (#591)
* Add more acceptance tests * Fix constraint template * Fix tests
1 parent 2b6879d commit c648449

23 files changed

+246
-107
lines changed

‎.github/workflows/cron_e2e.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ jobs:
6565
run: |
6666
chmod +x ./konstraint
6767
./konstraint create -o e2e-resources examples
68-
./konstraint create -o e2e-resources test
6968
7069
- name: create kind cluster
7170
run: kind create cluster

‎.github/workflows/pull_request.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,6 @@ jobs:
196196
run: |
197197
chmod +x ./konstraint
198198
./konstraint create -o e2e-resources examples
199-
./konstraint create -o e2e-resources test
200199
201200
- name: create kind cluster
202201
run: kind create cluster

‎acceptance.bats

+4-4
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,13 @@
1919
}
2020

2121
@test "[CREATE] Creating constraints using --output matches expected output" {
22-
run ./build/konstraint create test --output test
22+
run ./build/konstraint create test/policies --output test/output/standard
2323
[ "$status" -eq 0 ]
24-
git diff --quiet -- test/
24+
git diff --quiet -- test/output/standard
2525
}
2626

2727
@test "[CREATE] Creating constraints using --constraint-custom-template-file, --constraint-template-custom-template-file and --output matches expected output" {
28-
run ./build/konstraint create test --constraint-custom-template-file internal/commands/constraint_template.tpl --constraint-template-custom-template-file internal/commands/constrainttemplate_template.tpl --partial-constraints --output test/custom
28+
run ./build/konstraint create test/policies --constraint-custom-template-file internal/commands/constraint_template.tpl --constraint-template-custom-template-file internal/commands/constrainttemplate_template.tpl --partial-constraints --output test/output/custom
2929
[ "$status" -eq 0 ]
30-
git diff --quiet -- test/custom
30+
git diff --quiet -- test/output/custom
3131
}

‎internal/commands/constraint_template.tpl

+14-5
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,21 @@ metadata:
1010
{{- end }}
1111
name: {{ .Name }}
1212
spec:
13-
{{- if .Matchers }}
14-
match: {{- .GetAnnotation "matchers" | toIndentYAML 2 | nindent 4 }}
15-
{{- end }}
1613
{{- if ne .Enforcement "deny" }}
1714
enforcementAction: {{ .Enforcement }}
1815
{{- end -}}
19-
{{- if .AnnotationParameters }}
20-
parameters: {{- .AnnotationParameters | toIndentYAML 2 | nindent 4 }}
16+
{{- if or .AnnotationKindMatchers .AnnotationNamespaceMatchers .AnnotationExcludedNamespaceMatchers .AnnotationLabelSelectorMatcher }}
17+
match:
18+
{{- if .AnnotationExcludedNamespaceMatchers }}
19+
excludedNamespaces: {{- .AnnotationExcludedNamespaceMatchers | toIndentYAML 2 | nindent 6 }}
20+
{{- end }}
21+
{{- if .AnnotationKindMatchers }}
22+
kinds: {{- .AnnotationKindMatchers | toJSON | fromJSON | toIndentYAML 2 | nindent 6 }}
23+
{{- end }}
24+
{{- if .AnnotationLabelSelectorMatcher }}
25+
labelSelector: {{- .AnnotationLabelSelectorMatcher | toJSON | fromJSON | toIndentYAML 2 | nindent 6 }}
26+
{{- end }}
27+
{{- if .AnnotationNamespaceMatchers }}
28+
namespaces: {{- .AnnotationNamespaceMatchers | toIndentYAML 2 | nindent 6 }}
29+
{{- end }}
2130
{{- end }}

‎internal/commands/create_test.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ func TestRenderConstraint(t *testing.T) {
1919
t.Errorf("Error getting violations: %v", err)
2020
}
2121

22-
expected, err := os.ReadFile("../../test/constraint_Test.yaml")
22+
expected, err := os.ReadFile("../../test/output/standard/constraint_FullMetadata.yaml")
2323
if err != nil {
2424
t.Errorf("Error reading expected file: %v", err)
2525
}
@@ -48,7 +48,7 @@ func TestRenderConstraintWithCustomTemplate(t *testing.T) {
4848
t.Errorf("Error getting violations: %v", err)
4949
}
5050

51-
expected, err := os.ReadFile("../../test/custom/constraint_Test.yaml")
51+
expected, err := os.ReadFile("../../test/output/custom/constraint_FullMetadata.yaml")
5252
if err != nil {
5353
t.Errorf("Error reading expected file: %v", err)
5454
}
@@ -77,7 +77,7 @@ func TestRenderConstraintTemplate(t *testing.T) {
7777
t.Errorf("Error getting violations: %v", err)
7878
}
7979

80-
expected, err := os.ReadFile("../../test/template_Test.yaml")
80+
expected, err := os.ReadFile("../../test/output/standard/template_FullMetadata.yaml")
8181
if err != nil {
8282
t.Errorf("Error reading expected file: %v", err)
8383
}
@@ -106,7 +106,7 @@ func TestRenderConstraintTemplateWithCustomTemplate(t *testing.T) {
106106
t.Errorf("Error getting violations: %v", err)
107107
}
108108

109-
expected, err := os.ReadFile("../../test/custom/template_Test.yaml")
109+
expected, err := os.ReadFile("../../test/output/custom/template_FullMetadata.yaml")
110110
if err != nil {
111111
t.Errorf("Error reading expected file: %v", err)
112112
}
@@ -129,7 +129,7 @@ func TestRenderConstraintTemplateWithCustomTemplate(t *testing.T) {
129129
}
130130

131131
func GetViolations() ([]rego.Rego, error) {
132-
violations, err := rego.GetViolations("../../test")
132+
violations, err := rego.GetViolations("../../test/policies/")
133133
if err != nil {
134134
return nil, err
135135
}

‎test/custom/constraint_Test.yaml

-82
This file was deleted.

‎test/output/custom/constraint_FullMetadata.yaml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# This is a custom template for constraints
2+
apiVersion: constraints.gatekeeper.sh/v1beta1
3+
kind: FullMetadata
4+
metadata:
5+
name: fullmetadata
6+
spec:
7+
match:
8+
excludedNamespaces:
9+
- kube-system
10+
- gatekeeper-system
11+
kinds:
12+
- apiGroups:
13+
- ""
14+
kinds:
15+
- Pod
16+
- apiGroups:
17+
- apps
18+
kinds:
19+
- DaemonSet
20+
- Deployment
21+
- StatefulSet
22+
labelSelector:
23+
matchExpressions:
24+
- key: foo
25+
operator: In
26+
values:
27+
- bar
28+
- baz
29+
- key: doggos
30+
operator: Exists
31+
namespaces:
32+
- dev
33+
- stage
34+
- prod

‎test/output/custom/constraint_NoMetadata.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# This is a custom template for constraints
2+
apiVersion: constraints.gatekeeper.sh/v1beta1
3+
kind: NoMetadata
4+
metadata:
5+
name: nometadata
6+
spec:

‎test/output/custom/constraint_PartialMetadata.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# This is a custom template for constraints
2+
apiVersion: constraints.gatekeeper.sh/v1beta1
3+
kind: PartialMetadata
4+
metadata:
5+
name: partialmetadata
6+
spec:
7+
match:
8+
namespaces:
9+
- dev
10+
- stage
11+
- prod

‎test/custom/template_Test.yaml ‎test/output/custom/template_FullMetadata.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
apiVersion: templates.gatekeeper.sh/v1
33
kind: ConstraintTemplate
44
metadata:
5-
name: test
5+
name: fullmetadata
66
spec:
77
crd:
88
spec:
99
names:
10-
kind: Test
10+
kind: FullMetadata
1111
validation:
1212
openAPIV3Schema:
1313
properties:
@@ -25,7 +25,7 @@ spec:
2525
- |-
2626
package lib.libraryB
2727
rego: |-
28-
package test
28+
package test_fullmetadata
2929
3030
import future.keywords.if
3131
import data.lib.libraryA

‎test/output/custom/template_NoMetadata.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# This is a custom template for a constraint template
2+
apiVersion: templates.gatekeeper.sh/v1
3+
kind: ConstraintTemplate
4+
metadata:
5+
name: nometadata
6+
spec:
7+
crd:
8+
spec:
9+
names:
10+
kind: NoMetadata
11+
targets:
12+
- libs:
13+
- |-
14+
package lib.libraryA
15+
16+
import data.lib.libraryB
17+
- |-
18+
package lib.libraryB
19+
rego: |-
20+
package test_nometadata
21+
22+
import future.keywords.if
23+
import data.lib.libraryA
24+
25+
policyID := "P123456"
26+
27+
violation if {
28+
true # some comment
29+
}
30+
target: admission.k8s.gatekeeper.sh

‎test/output/custom/template_PartialMetadata.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# This is a custom template for a constraint template
2+
apiVersion: templates.gatekeeper.sh/v1
3+
kind: ConstraintTemplate
4+
metadata:
5+
name: partialmetadata
6+
spec:
7+
crd:
8+
spec:
9+
names:
10+
kind: PartialMetadata
11+
targets:
12+
- libs:
13+
- |-
14+
package lib.libraryA
15+
16+
import data.lib.libraryB
17+
- |-
18+
package lib.libraryB
19+
rego: |-
20+
package test_partialmetadata
21+
22+
import future.keywords.if
23+
import data.lib.libraryA
24+
25+
policyID := "P123456"
26+
27+
violation if {
28+
true # some comment
29+
}
30+
target: admission.k8s.gatekeeper.sh

‎test/constraint_Test.yaml ‎test/output/standard/constraint_FullMetadata.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: constraints.gatekeeper.sh/v1beta1
2-
kind: Test
2+
kind: FullMetadata
33
metadata:
4-
name: test
4+
name: fullmetadata
55
spec:
66
match:
77
excludedNamespaces:

‎test/output/standard/constraint_NoMetadata.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: constraints.gatekeeper.sh/v1beta1
2+
kind: NoMetadata
3+
metadata:
4+
name: nometadata

‎test/output/standard/constraint_PartialMetadata.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: constraints.gatekeeper.sh/v1beta1
2+
kind: PartialMetadata
3+
metadata:
4+
name: partialmetadata
5+
spec:
6+
match:
7+
namespaces:
8+
- dev
9+
- stage
10+
- prod

‎test/template_Test.yaml ‎test/output/standard/template_FullMetadata.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@ apiVersion: templates.gatekeeper.sh/v1
22
kind: ConstraintTemplate
33
metadata:
44
creationTimestamp: null
5-
name: test
5+
name: fullmetadata
66
spec:
77
crd:
88
spec:
99
names:
10-
kind: Test
10+
kind: FullMetadata
1111
validation:
1212
openAPIV3Schema:
1313
properties:
@@ -25,7 +25,7 @@ spec:
2525
import data.lib.libraryB
2626
- package lib.libraryB
2727
rego: |-
28-
package test
28+
package test_fullmetadata
2929
3030
import future.keywords.if
3131
import data.lib.libraryA

0 commit comments

Comments
 (0)