-
Notifications
You must be signed in to change notification settings - Fork 234
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactor parameters to support arbitrary types (#10)
Instead of a map[string]string, support (almost) arbitrary parameters via a map[string]interface{}.
Use k8s-style methodology to describe the objects: ie, describe them as Go structs, embedding metadata in comments, and parse out the properties from that using the same library k8s uses, and then use code generation for the validation etc.
Also add a new check template (and built-in check) for forbidden API object versions.- Loading branch information
1 parent
1b13a45
commit 5e2425e
Showing
44 changed files
with
1,300 additions
and
115 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,156 @@ | ||
| The following table enumerates supported check templates: | ||
|
|
||
| | Name | Description | Supported Objects | Parameters | | ||
| | ---- | ----------- | ----------------- | ---------- | | ||
| | env-var | Flag environment variables that match the provided patterns | DeploymentLike |- `name` (required): A regex for the env var name <br />- `value`: A regex for the env var value <br />| | ||
| | privileged | Flag privileged containers | DeploymentLike | none | | ||
| | read-only-root-fs | Flag containers without read-only root file systems | DeploymentLike | none | | ||
| | required-label | Flag objects not carrying at least one label matching the provided patterns | Any |- `key` (required): A regex for the key of the required label <br />- `value`: A regex for the value of the required label <br />| | ||
| | run-as-non-root | Flag containers set to run as a root user | DeploymentLike | none | | ||
| This page lists supported check templates. | ||
|
|
||
| ## Disallowed API Objects | ||
|
|
||
| **Key**: `disallowed-api-obj` | ||
|
|
||
| **Description**: Flag disallowed API object kinds | ||
|
|
||
| **Supported Objects**: Any | ||
|
|
||
| **Parameters**: | ||
| ``` | ||
| [ | ||
| { | ||
| "name": "group", | ||
| "type": "string", | ||
| "description": "The disallowed object group.", | ||
| "required": false, | ||
| "examples": [ | ||
| "apps" | ||
| ], | ||
| "regexAllowed": true, | ||
| "negationAllowed": true | ||
| }, | ||
| { | ||
| "name": "version", | ||
| "type": "string", | ||
| "description": "The disallowed object API version.", | ||
| "required": false, | ||
| "examples": [ | ||
| "v1", | ||
| "v1beta1" | ||
| ], | ||
| "regexAllowed": true, | ||
| "negationAllowed": true | ||
| }, | ||
| { | ||
| "name": "kind", | ||
| "type": "string", | ||
| "description": "The disallowed kind.", | ||
| "required": false, | ||
| "examples": [ | ||
| "Deployment", | ||
| "DaemonSet" | ||
| ], | ||
| "regexAllowed": true, | ||
| "negationAllowed": true | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| ## Environment Variables | ||
|
|
||
| **Key**: `env-var` | ||
|
|
||
| **Description**: Flag environment variables that match the provided patterns | ||
|
|
||
| **Supported Objects**: DeploymentLike | ||
|
|
||
| **Parameters**: | ||
| ``` | ||
| [ | ||
| { | ||
| "name": "name", | ||
| "type": "string", | ||
| "description": "The name of the environment variable.", | ||
| "required": true, | ||
| "regexAllowed": true, | ||
| "negationAllowed": true | ||
| }, | ||
| { | ||
| "name": "value", | ||
| "type": "string", | ||
| "description": "The value of the environment variable.", | ||
| "required": false, | ||
| "regexAllowed": true, | ||
| "negationAllowed": true | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| ## Privileged Containers | ||
|
|
||
| **Key**: `privileged` | ||
|
|
||
| **Description**: Flag privileged containers | ||
|
|
||
| **Supported Objects**: DeploymentLike | ||
|
|
||
| **Parameters**: | ||
| ``` | ||
| [] | ||
| ``` | ||
|
|
||
| ## Read-only Root Filesystems | ||
|
|
||
| **Key**: `read-only-root-fs` | ||
|
|
||
| **Description**: Flag containers without read-only root file systems | ||
|
|
||
| **Supported Objects**: DeploymentLike | ||
|
|
||
| **Parameters**: | ||
| ``` | ||
| [] | ||
| ``` | ||
|
|
||
| ## Required Label | ||
|
|
||
| **Key**: `required-label` | ||
|
|
||
| **Description**: Flag objects not carrying at least one label matching the provided patterns | ||
|
|
||
| **Supported Objects**: Any | ||
|
|
||
| **Parameters**: | ||
| ``` | ||
| [ | ||
| { | ||
| "name": "key", | ||
| "type": "string", | ||
| "description": "Key of the required label.", | ||
| "required": true, | ||
| "regexAllowed": true, | ||
| "negationAllowed": true | ||
| }, | ||
| { | ||
| "name": "value", | ||
| "type": "string", | ||
| "description": "Value of the required label.", | ||
| "required": false, | ||
| "regexAllowed": true, | ||
| "negationAllowed": true | ||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| ## Run as non-root user | ||
|
|
||
| **Key**: `run-as-non-root` | ||
|
|
||
| **Description**: Flag containers set to run as a root user | ||
|
|
||
| **Supported Objects**: DeploymentLike | ||
|
|
||
| **Parameters**: | ||
| ``` | ||
| [] | ||
| ``` | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| name: "no-extensions-v1beta" | ||
| description: "Alert on objects using deprecated API versions under extensions v1beta" | ||
| scope: | ||
| objectKinds: | ||
| - Any | ||
| template: "disallowed-api-obj" | ||
| params: | ||
| group: "extensions" | ||
| version: "v1beta.+" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| package check | ||
|
|
||
| import ( | ||
| "golang.stackrox.io/kube-linter/internal/pointers" | ||
| ) | ||
|
|
||
| // ParameterType represents the expected type of a particular parameter. | ||
| type ParameterType string | ||
|
|
||
| // This block enumerates all known type names. | ||
| // These type names are chosen to be aligned with OpenAPI/JSON schema. | ||
| const ( | ||
| StringType ParameterType = "string" | ||
| IntegerType ParameterType = "integer" | ||
| BooleanType ParameterType = "boolean" | ||
| NumberType ParameterType = "number" | ||
| ObjectType ParameterType = "object" | ||
| ) | ||
|
|
||
| // ParameterDesc describes a parameter. | ||
| type ParameterDesc struct { | ||
| Name string | ||
| Type ParameterType | ||
| Description string | ||
|
|
||
| Examples []string | ||
|
|
||
| // SubParameters are the child parameters of the given parameter. | ||
| // Only relevant if Type is "object". | ||
| SubParameters []ParameterDesc | ||
|
|
||
| // Required denotes whether the parameter is required. | ||
| Required bool | ||
|
|
||
| // NoRegex is set if the parameter does not support regexes. | ||
| // Only relevant if Type is "string". | ||
| NoRegex bool | ||
|
|
||
| // NotNegatable is set if the parameter does not support negation via a leading !. | ||
| // OnlyRelevant if Type is "string". | ||
| NotNegatable bool | ||
|
|
||
| // Fields below are for internal use only. | ||
|
|
||
| XXXStructFieldName string | ||
| } | ||
|
|
||
| // HumanReadableParamDesc is a human-friendly representation of a ParameterDesc. | ||
| // It is intended only for API documentation/JSON marshaling, and must NOT be used for | ||
| // any business logic. | ||
| type HumanReadableParamDesc struct { | ||
| Name string `json:"name"` | ||
| Type ParameterType `json:"type"` | ||
| Description string `json:"description"` | ||
| Required bool `json:"required"` | ||
| Examples []string `json:"examples,omitempty"` | ||
| RegexAllowed *bool `json:"regexAllowed,omitempty"` | ||
| NegationAllowed *bool `json:"negationAllowed,omitempty"` | ||
| SubParameters []HumanReadableParamDesc `json:"subParameters,omitempty"` | ||
| } | ||
|
|
||
| // HumanReadableFields returns a human-friendly representation of this ParameterDesc. | ||
| func (p *ParameterDesc) HumanReadableFields() HumanReadableParamDesc { | ||
| out := HumanReadableParamDesc{ | ||
| Name: p.Name, | ||
| Type: p.Type, | ||
| Description: p.Description, | ||
| Required: p.Required, | ||
| Examples: p.Examples, | ||
| } | ||
|
|
||
| if p.Type == StringType { | ||
| out.RegexAllowed = pointers.Bool(!p.NoRegex) | ||
| out.NegationAllowed = pointers.Bool(!p.NotNegatable) | ||
| } | ||
|
|
||
| if len(p.SubParameters) > 0 { | ||
| subParamFields := make([]HumanReadableParamDesc, 0, len(p.SubParameters)) | ||
| for _, subParam := range p.SubParameters { | ||
| subParamFields = append(subParamFields, subParam.HumanReadableFields()) | ||
| } | ||
| out.SubParameters = subParamFields | ||
| } | ||
| return out | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.