Skip to content

Commit 0aa3989

Browse files
LorenzBischofLorenzBischof
committed
feat: add generic fields rule enforcement
1 parent f7c5523 commit 0aa3989

19 files changed

Lines changed: 2160 additions & 32 deletions

‎charts/capsule/crds/capsule.clastix.io_rulestatuses.yaml‎

Lines changed: 268 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,95 @@ spec:
6868
- deny
6969
- audit
7070
type: string
71+
fields:
72+
description: Enforcement for values at declared field paths
73+
on namespaced resources.
74+
items:
75+
description: |-
76+
FieldRule defines value constraints for a declared field path on
77+
namespaced resources.
78+
79+
Rules constrain values that exist: a path resolving to no value (or only
80+
empty values) is not evaluated, so field rules never make a field
81+
required. Note that server-side defaulting (DefaultStorageClass,
82+
LimitRanger, ...) runs before validating webhooks, so defaulted fields
83+
are already populated when rules are evaluated.
84+
properties:
85+
apiGroups:
86+
description: |-
87+
API groups or API group/version selectors of the referents.
88+
89+
Empty or omitted APIGroups means the core Kubernetes API version "v1".
90+
Use "*" to match all API groups and versions.
91+
92+
Examples:
93+
- [] or [""] means core "v1".
94+
- ["v1"] means core "v1".
95+
- ["apps"] means any version in the "apps" API group.
96+
- ["apps/v1"] means only "apps/v1".
97+
- ["apps", "batch/v1"] means any "apps" version and "batch/v1".
98+
- ["*"] means all API groups and versions.
99+
items:
100+
type: string
101+
type: array
102+
kinds:
103+
description: |-
104+
Kinds of the referents.
105+
106+
Use "*" to match all kinds.
107+
items:
108+
minLength: 1
109+
type: string
110+
minItems: 1
111+
type: array
112+
match:
113+
description: |-
114+
Match defines allowed, denied, or audited values for the field,
115+
depending on the enforcement action.
116+
items:
117+
description: |-
118+
At least one of Exact or Exp must be set.
119+
Both may be set together.
120+
properties:
121+
exact:
122+
description: Exact matches one of the provided values
123+
exactly.
124+
items:
125+
type: string
126+
minItems: 1
127+
type: array
128+
exp:
129+
description: Exp matches regular expression.
130+
minLength: 1
131+
type: string
132+
negate:
133+
default: false
134+
description: Negate regular Expression
135+
type: boolean
136+
type: object
137+
x-kubernetes-validations:
138+
- message: at least one of exact or exp must be set
139+
rule: has(self.exact) || has(self.exp)
140+
minItems: 1
141+
type: array
142+
path:
143+
description: |-
144+
Path is a JSONPath expression into the object, written in the bare
145+
form without surrounding curly braces or a leading dot, e.g.
146+
"spec.template.spec.containers[*].image", where "[*]" expands every
147+
element of an array field into one checked value.
148+
149+
Values resolved by the path must be scalars, and violations are
150+
reported against the configured path, not concrete array indexes.
151+
maxLength: 512
152+
minLength: 1
153+
type: string
154+
required:
155+
- kinds
156+
- match
157+
- path
158+
type: object
159+
type: array
71160
metadata:
72161
description: Enforcement for object metadata on namespaced resources.
73162
items:
@@ -472,6 +561,95 @@ spec:
472561
- deny
473562
- audit
474563
type: string
564+
fields:
565+
description: Enforcement for values at declared field paths
566+
on namespaced resources.
567+
items:
568+
description: |-
569+
FieldRule defines value constraints for a declared field path on
570+
namespaced resources.
571+
572+
Rules constrain values that exist: a path resolving to no value (or only
573+
empty values) is not evaluated, so field rules never make a field
574+
required. Note that server-side defaulting (DefaultStorageClass,
575+
LimitRanger, ...) runs before validating webhooks, so defaulted fields
576+
are already populated when rules are evaluated.
577+
properties:
578+
apiGroups:
579+
description: |-
580+
API groups or API group/version selectors of the referents.
581+
582+
Empty or omitted APIGroups means the core Kubernetes API version "v1".
583+
Use "*" to match all API groups and versions.
584+
585+
Examples:
586+
- [] or [""] means core "v1".
587+
- ["v1"] means core "v1".
588+
- ["apps"] means any version in the "apps" API group.
589+
- ["apps/v1"] means only "apps/v1".
590+
- ["apps", "batch/v1"] means any "apps" version and "batch/v1".
591+
- ["*"] means all API groups and versions.
592+
items:
593+
type: string
594+
type: array
595+
kinds:
596+
description: |-
597+
Kinds of the referents.
598+
599+
Use "*" to match all kinds.
600+
items:
601+
minLength: 1
602+
type: string
603+
minItems: 1
604+
type: array
605+
match:
606+
description: |-
607+
Match defines allowed, denied, or audited values for the field,
608+
depending on the enforcement action.
609+
items:
610+
description: |-
611+
At least one of Exact or Exp must be set.
612+
Both may be set together.
613+
properties:
614+
exact:
615+
description: Exact matches one of the provided
616+
values exactly.
617+
items:
618+
type: string
619+
minItems: 1
620+
type: array
621+
exp:
622+
description: Exp matches regular expression.
623+
minLength: 1
624+
type: string
625+
negate:
626+
default: false
627+
description: Negate regular Expression
628+
type: boolean
629+
type: object
630+
x-kubernetes-validations:
631+
- message: at least one of exact or exp must be set
632+
rule: has(self.exact) || has(self.exp)
633+
minItems: 1
634+
type: array
635+
path:
636+
description: |-
637+
Path is a JSONPath expression into the object, written in the bare
638+
form without surrounding curly braces or a leading dot, e.g.
639+
"spec.template.spec.containers[*].image", where "[*]" expands every
640+
element of an array field into one checked value.
641+
642+
Values resolved by the path must be scalars, and violations are
643+
reported against the configured path, not concrete array indexes.
644+
maxLength: 512
645+
minLength: 1
646+
type: string
647+
required:
648+
- kinds
649+
- match
650+
- path
651+
type: object
652+
type: array
475653
metadata:
476654
description: Enforcement for object metadata on namespaced
477655
resources.
@@ -815,6 +993,96 @@ spec:
815993
- deny
816994
- audit
817995
type: string
996+
fields:
997+
description: Enforcement for values at declared field paths
998+
on namespaced resources.
999+
items:
1000+
description: |-
1001+
FieldRule defines value constraints for a declared field path on
1002+
namespaced resources.
1003+
1004+
Rules constrain values that exist: a path resolving to no value (or only
1005+
empty values) is not evaluated, so field rules never make a field
1006+
required. Note that server-side defaulting (DefaultStorageClass,
1007+
LimitRanger, ...) runs before validating webhooks, so defaulted fields
1008+
are already populated when rules are evaluated.
1009+
properties:
1010+
apiGroups:
1011+
description: |-
1012+
API groups or API group/version selectors of the referents.
1013+
1014+
Empty or omitted APIGroups means the core Kubernetes API version "v1".
1015+
Use "*" to match all API groups and versions.
1016+
1017+
Examples:
1018+
- [] or [""] means core "v1".
1019+
- ["v1"] means core "v1".
1020+
- ["apps"] means any version in the "apps" API group.
1021+
- ["apps/v1"] means only "apps/v1".
1022+
- ["apps", "batch/v1"] means any "apps" version and "batch/v1".
1023+
- ["*"] means all API groups and versions.
1024+
items:
1025+
type: string
1026+
type: array
1027+
kinds:
1028+
description: |-
1029+
Kinds of the referents.
1030+
1031+
Use "*" to match all kinds.
1032+
items:
1033+
minLength: 1
1034+
type: string
1035+
minItems: 1
1036+
type: array
1037+
match:
1038+
description: |-
1039+
Match defines allowed, denied, or audited values for the field,
1040+
depending on the enforcement action.
1041+
items:
1042+
description: |-
1043+
At least one of Exact or Exp must be set.
1044+
Both may be set together.
1045+
properties:
1046+
exact:
1047+
description: Exact matches one of the provided
1048+
values exactly.
1049+
items:
1050+
type: string
1051+
minItems: 1
1052+
type: array
1053+
exp:
1054+
description: Exp matches regular expression.
1055+
minLength: 1
1056+
type: string
1057+
negate:
1058+
default: false
1059+
description: Negate regular Expression
1060+
type: boolean
1061+
type: object
1062+
x-kubernetes-validations:
1063+
- message: at least one of exact or exp must be
1064+
set
1065+
rule: has(self.exact) || has(self.exp)
1066+
minItems: 1
1067+
type: array
1068+
path:
1069+
description: |-
1070+
Path is a JSONPath expression into the object, written in the bare
1071+
form without surrounding curly braces or a leading dot, e.g.
1072+
"spec.template.spec.containers[*].image", where "[*]" expands every
1073+
element of an array field into one checked value.
1074+
1075+
Values resolved by the path must be scalars, and violations are
1076+
reported against the configured path, not concrete array indexes.
1077+
maxLength: 512
1078+
minLength: 1
1079+
type: string
1080+
required:
1081+
- kinds
1082+
- match
1083+
- path
1084+
type: object
1085+
type: array
8181086
metadata:
8191087
description: Enforcement for object metadata on namespaced
8201088
resources.

0 commit comments

Comments
 (0)