Skip to content

Commit f5c5bff

Browse files
RottenRatRottenRat
committed
add feature flags
Signed-off-by: Sinelnikov Michail <mikhail.sinelnikov@flant.com>
1 parent d6dfd51 commit f5c5bff

File tree

4 files changed

+180
-32
lines changed

4 files changed

+180
-32
lines changed

‎internal/module/module.go‎

Lines changed: 79 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,85 @@ func mapRuleSettings(linterSettings *pkg.LintersSettings, configSettings *config
194194
// mapContainerRules configures Container linter rules
195195
func mapContainerRules(linterSettings *pkg.LintersSettings, configSettings *config.LintersSettings, globalConfig *global.Linters) {
196196
linterSettings.Container.Rules.RecommendedLabelsRule.SetLevel(
197-
globalConfig.Container.RecommendedLabelsRule.Impact,
197+
globalConfig.Container.Rules.RecommendedLabelsRule.Impact,
198+
configSettings.Container.Impact,
199+
)
200+
linterSettings.Container.Rules.NamespaceLabelsRule.SetLevel(
201+
globalConfig.Container.Rules.NamespaceLabelsRule.Impact,
202+
configSettings.Container.Impact,
203+
)
204+
linterSettings.Container.Rules.ApiVersionRule.SetLevel(
205+
globalConfig.Container.Rules.ApiVersionRule.Impact,
206+
configSettings.Container.Impact,
207+
)
208+
linterSettings.Container.Rules.PriorityClassRule.SetLevel(
209+
globalConfig.Container.Rules.PriorityClassRule.Impact,
210+
configSettings.Container.Impact,
211+
)
212+
linterSettings.Container.Rules.DNSPolicyRule.SetLevel(
213+
globalConfig.Container.Rules.DNSPolicyRule.Impact,
214+
configSettings.Container.Impact,
215+
)
216+
linterSettings.Container.Rules.ControllerSecurityContextRule.SetLevel(
217+
globalConfig.Container.Rules.ControllerSecurityContextRule.Impact,
218+
configSettings.Container.Impact,
219+
)
220+
linterSettings.Container.Rules.NewRevisionHistoryLimitRule.SetLevel(
221+
globalConfig.Container.Rules.NewRevisionHistoryLimitRule.Impact,
222+
configSettings.Container.Impact,
223+
)
224+
225+
// Container-specific rules
226+
linterSettings.Container.Rules.NameDuplicatesRule.SetLevel(
227+
globalConfig.Container.Rules.NameDuplicatesRule.Impact,
228+
configSettings.Container.Impact,
229+
)
230+
linterSettings.Container.Rules.ReadOnlyRootFilesystemRule.SetLevel(
231+
globalConfig.Container.Rules.ReadOnlyRootFilesystemRule.Impact,
232+
configSettings.Container.Impact,
233+
)
234+
linterSettings.Container.Rules.NoNewPrivilegesRule.SetLevel(
235+
globalConfig.Container.Rules.NoNewPrivilegesRule.Impact,
236+
configSettings.Container.Impact,
237+
)
238+
linterSettings.Container.Rules.SeccompProfileRule.SetLevel(
239+
globalConfig.Container.Rules.SeccompProfileRule.Impact,
240+
configSettings.Container.Impact,
241+
)
242+
linterSettings.Container.Rules.HostNetworkPortsRule.SetLevel(
243+
globalConfig.Container.Rules.HostNetworkPortsRule.Impact,
244+
configSettings.Container.Impact,
245+
)
246+
linterSettings.Container.Rules.EnvVariablesDuplicatesRule.SetLevel(
247+
globalConfig.Container.Rules.EnvVariablesDuplicatesRule.Impact,
248+
configSettings.Container.Impact,
249+
)
250+
linterSettings.Container.Rules.ImageDigestRule.SetLevel(
251+
globalConfig.Container.Rules.ImageDigestRule.Impact,
252+
configSettings.Container.Impact,
253+
)
254+
linterSettings.Container.Rules.ImagePullPolicyRule.SetLevel(
255+
globalConfig.Container.Rules.ImagePullPolicyRule.Impact,
256+
configSettings.Container.Impact,
257+
)
258+
linterSettings.Container.Rules.ResourcesRule.SetLevel(
259+
globalConfig.Container.Rules.ResourcesRule.Impact,
260+
configSettings.Container.Impact,
261+
)
262+
linterSettings.Container.Rules.ContainerSecurityContextRule.SetLevel(
263+
globalConfig.Container.Rules.ContainerSecurityContextRule.Impact,
264+
configSettings.Container.Impact,
265+
)
266+
linterSettings.Container.Rules.PortsRule.SetLevel(
267+
globalConfig.Container.Rules.PortsRule.Impact,
268+
configSettings.Container.Impact,
269+
)
270+
linterSettings.Container.Rules.LivenessRule.SetLevel(
271+
globalConfig.Container.Rules.LivenessRule.Impact,
272+
configSettings.Container.Impact,
273+
)
274+
linterSettings.Container.Rules.ReadinessRule.SetLevel(
275+
globalConfig.Container.Rules.ReadinessRule.Impact,
198276
configSettings.Container.Impact,
199277
)
200278
}

‎pkg/config.go‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -290,7 +290,28 @@ func (l PrefixRuleExcludeList) Get() []PrefixRuleExclude {
290290
}
291291

292292
type ContainerLinterRules struct {
293-
RecommendedLabelsRule RuleConfig
293+
RecommendedLabelsRule RuleConfig
294+
NamespaceLabelsRule RuleConfig
295+
ApiVersionRule RuleConfig
296+
PriorityClassRule RuleConfig
297+
DNSPolicyRule RuleConfig
298+
ControllerSecurityContextRule RuleConfig
299+
NewRevisionHistoryLimitRule RuleConfig
300+
301+
// Container-specific rules
302+
NameDuplicatesRule RuleConfig
303+
ReadOnlyRootFilesystemRule RuleConfig
304+
NoNewPrivilegesRule RuleConfig
305+
SeccompProfileRule RuleConfig
306+
HostNetworkPortsRule RuleConfig
307+
EnvVariablesDuplicatesRule RuleConfig
308+
ImageDigestRule RuleConfig
309+
ImagePullPolicyRule RuleConfig
310+
ResourcesRule RuleConfig
311+
ContainerSecurityContextRule RuleConfig
312+
PortsRule RuleConfig
313+
LivenessRule RuleConfig
314+
ReadinessRule RuleConfig
294315
}
295316

296317
type ContainerExcludeRules struct {

‎pkg/config/global/global.go‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,33 @@ type LinterConfig struct {
4040
}
4141

4242
type ContainerLinterConfig struct {
43-
LinterConfig `mapstructure:",squash"`
44-
RecommendedLabelsRule RuleConfig `mapstructure:"recommended-labels"`
43+
LinterConfig `mapstructure:",squash"`
44+
Rules ContainerRules `mapstructure:"rules"`
45+
}
46+
47+
type ContainerRules struct {
48+
RecommendedLabelsRule RuleConfig `mapstructure:"recommended-labels"`
49+
NamespaceLabelsRule RuleConfig `mapstructure:"namespace-labels"`
50+
ApiVersionRule RuleConfig `mapstructure:"api-version"`
51+
PriorityClassRule RuleConfig `mapstructure:"priority-class"`
52+
DNSPolicyRule RuleConfig `mapstructure:"dns-policy"`
53+
ControllerSecurityContextRule RuleConfig `mapstructure:"controller-security-context"`
54+
NewRevisionHistoryLimitRule RuleConfig `mapstructure:"revision-history-limit"`
55+
56+
// Container-specific rules
57+
NameDuplicatesRule RuleConfig `mapstructure:"name-duplicates"`
58+
ReadOnlyRootFilesystemRule RuleConfig `mapstructure:"read-only-root-filesystem"`
59+
NoNewPrivilegesRule RuleConfig `mapstructure:"no-new-privileges"`
60+
SeccompProfileRule RuleConfig `mapstructure:"seccomp-profile"`
61+
HostNetworkPortsRule RuleConfig `mapstructure:"host-network-ports"`
62+
EnvVariablesDuplicatesRule RuleConfig `mapstructure:"env-variables-duplicates"`
63+
ImageDigestRule RuleConfig `mapstructure:"image-digest"`
64+
ImagePullPolicyRule RuleConfig `mapstructure:"image-pull-policy"`
65+
ResourcesRule RuleConfig `mapstructure:"resources"`
66+
ContainerSecurityContextRule RuleConfig `mapstructure:"container-security-context"`
67+
PortsRule RuleConfig `mapstructure:"ports"`
68+
LivenessRule RuleConfig `mapstructure:"liveness-probe"`
69+
ReadinessRule RuleConfig `mapstructure:"readiness-probe"`
4570
}
4671

4772
type ImagesLinterConfig struct {

‎pkg/linters/container/rules.go‎

Lines changed: 52 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,14 @@ func (l *Container) applyContainerRules(object storage.StoreObject, errorList *e
2828
errorList = errorList.WithFilePath(object.GetPath())
2929

3030
rules.NewRecommendedLabelsRule().ObjectRecommendedLabels(object, errorList.WithRule("recommended-labels").WithMaxLevel(l.cfg.Rules.RecommendedLabelsRule.GetLevel()))
31-
rules.NewNamespaceLabelsRule().ObjectNamespaceLabels(object, errorList)
32-
rules.NewAPIVersionRule().ObjectAPIVersion(object, errorList)
33-
rules.NewPriorityClassRule().ObjectPriorityClass(object, errorList)
31+
rules.NewNamespaceLabelsRule().ObjectNamespaceLabels(object, errorList.WithRule("namespace-labels").WithMaxLevel(l.cfg.Rules.NamespaceLabelsRule.GetLevel()))
32+
rules.NewAPIVersionRule().ObjectAPIVersion(object, errorList.WithRule("api-version").WithMaxLevel(l.cfg.Rules.ApiVersionRule.GetLevel()))
33+
rules.NewPriorityClassRule().ObjectPriorityClass(object, errorList.WithRule("priority-class").WithMaxLevel(l.cfg.Rules.PriorityClassRule.GetLevel()))
3434
rules.NewDNSPolicyRule(l.cfg.ExcludeRules.DNSPolicy.Get()).
35-
ObjectDNSPolicy(object, errorList)
35+
ObjectDNSPolicy(object, errorList.WithRule("dns-policy").WithMaxLevel(l.cfg.Rules.DNSPolicyRule.GetLevel()))
3636
rules.NewControllerSecurityContextRule(l.cfg.ExcludeRules.ControllerSecurityContext.Get()).
37-
ControllerSecurityContext(object, errorList)
38-
rules.NewRevisionHistoryLimitRule().ObjectRevisionHistoryLimit(object, errorList)
37+
ControllerSecurityContext(object, errorList.WithRule("controller-security-context").WithMaxLevel(l.cfg.Rules.ControllerSecurityContextRule.GetLevel()))
38+
rules.NewRevisionHistoryLimitRule().ObjectRevisionHistoryLimit(object, errorList.WithRule("revision-history-limit").WithMaxLevel(l.cfg.Rules.NewRevisionHistoryLimitRule.GetLevel()))
3939

4040
allContainers, err := object.GetAllContainers()
4141
if err != nil {
@@ -50,24 +50,44 @@ func (l *Container) applyContainerRules(object storage.StoreObject, errorList *e
5050
}
5151

5252
containerRules := []func(storage.StoreObject, []corev1.Container, *errors.LintRuleErrorsList){
53-
rules.NewNameDuplicatesRule().ContainerNameDuplicates,
54-
rules.NewCheckReadOnlyRootFilesystemRule(l.cfg.ExcludeRules.ReadOnlyRootFilesystem.Get()).
55-
ObjectReadOnlyRootFilesystem,
56-
rules.NewNoNewPrivilegesRule(l.cfg.ExcludeRules.NoNewPrivileges.Get()).
57-
ContainerNoNewPrivileges,
58-
rules.NewSeccompProfileRule(l.cfg.ExcludeRules.SeccompProfile.Get()).
59-
ContainerSeccompProfile,
60-
rules.NewHostNetworkPortsRule(l.cfg.ExcludeRules.HostNetworkPorts.Get()).ObjectHostNetworkPorts,
61-
62-
// old with module names skipping
63-
rules.NewEnvVariablesDuplicatesRule().ContainerEnvVariablesDuplicates,
64-
rules.NewImageDigestRule(l.cfg.ExcludeRules.ImageDigest.Get()).ContainerImageDigestCheck,
65-
rules.NewImagePullPolicyRule().ContainersImagePullPolicy,
66-
rules.NewResourcesRule(l.cfg.ExcludeRules.Resources.Get()).
67-
ContainerStorageEphemeral,
68-
rules.NewContainerSecurityContextRule(l.cfg.ExcludeRules.SecurityContext.Get()).
69-
ContainerSecurityContext,
70-
rules.NewPortsRule(l.cfg.ExcludeRules.Ports.Get()).ContainerPorts,
53+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
54+
rules.NewNameDuplicatesRule().ContainerNameDuplicates(object, containers, errorList.WithRule("name-duplicates").WithMaxLevel(l.cfg.Rules.NameDuplicatesRule.GetLevel()))
55+
},
56+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
57+
rules.NewCheckReadOnlyRootFilesystemRule(l.cfg.ExcludeRules.ReadOnlyRootFilesystem.Get()).
58+
ObjectReadOnlyRootFilesystem(object, containers, errorList.WithRule("read-only-root-filesystem").WithMaxLevel(l.cfg.Rules.ReadOnlyRootFilesystemRule.GetLevel()))
59+
},
60+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
61+
rules.NewNoNewPrivilegesRule(l.cfg.ExcludeRules.NoNewPrivileges.Get()).
62+
ContainerNoNewPrivileges(object, containers, errorList.WithRule("no-new-privileges").WithMaxLevel(l.cfg.Rules.NoNewPrivilegesRule.GetLevel()))
63+
},
64+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
65+
rules.NewSeccompProfileRule(l.cfg.ExcludeRules.SeccompProfile.Get()).
66+
ContainerSeccompProfile(object, containers, errorList.WithRule("seccomp-profile").WithMaxLevel(l.cfg.Rules.SeccompProfileRule.GetLevel()))
67+
},
68+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
69+
rules.NewHostNetworkPortsRule(l.cfg.ExcludeRules.HostNetworkPorts.Get()).ObjectHostNetworkPorts(object, containers, errorList.WithRule("host-network-ports").WithMaxLevel(l.cfg.Rules.HostNetworkPortsRule.GetLevel()))
70+
},
71+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
72+
rules.NewEnvVariablesDuplicatesRule().ContainerEnvVariablesDuplicates(object, containers, errorList.WithRule("env-variables-duplicates").WithMaxLevel(l.cfg.Rules.EnvVariablesDuplicatesRule.GetLevel()))
73+
},
74+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
75+
rules.NewImageDigestRule(l.cfg.ExcludeRules.ImageDigest.Get()).ContainerImageDigestCheck(object, containers, errorList.WithRule("image-digest").WithMaxLevel(l.cfg.Rules.ImageDigestRule.GetLevel()))
76+
},
77+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
78+
rules.NewImagePullPolicyRule().ContainersImagePullPolicy(object, containers, errorList.WithRule("image-pull-policy").WithMaxLevel(l.cfg.Rules.ImagePullPolicyRule.GetLevel()))
79+
},
80+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
81+
rules.NewResourcesRule(l.cfg.ExcludeRules.Resources.Get()).
82+
ContainerStorageEphemeral(object, containers, errorList.WithRule("resources").WithMaxLevel(l.cfg.Rules.ResourcesRule.GetLevel()))
83+
},
84+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
85+
rules.NewContainerSecurityContextRule(l.cfg.ExcludeRules.SecurityContext.Get()).
86+
ContainerSecurityContext(object, containers, errorList.WithRule("container-security-context").WithMaxLevel(l.cfg.Rules.ContainerSecurityContextRule.GetLevel()))
87+
},
88+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
89+
rules.NewPortsRule(l.cfg.ExcludeRules.Ports.Get()).ContainerPorts(object, containers, errorList.WithRule("ports").WithMaxLevel(l.cfg.Rules.PortsRule.GetLevel()))
90+
},
7191
}
7292

7393
for _, rule := range containerRules {
@@ -87,10 +107,14 @@ func (l *Container) applyContainerRules(object storage.StoreObject, errorList *e
87107
}
88108

89109
notInitContainerRules := []func(storage.StoreObject, []corev1.Container, *errors.LintRuleErrorsList){
90-
rules.NewLivenessRule(l.cfg.ExcludeRules.Liveness.Get()).
91-
CheckProbe,
92-
rules.NewReadinessRule(l.cfg.ExcludeRules.Readiness.Get()).
93-
CheckProbe,
110+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
111+
rules.NewLivenessRule(l.cfg.ExcludeRules.Liveness.Get()).
112+
CheckProbe(object, containers, errorList.WithRule("liveness-probe").WithMaxLevel(l.cfg.Rules.LivenessRule.GetLevel()))
113+
},
114+
func(object storage.StoreObject, containers []corev1.Container, errorList *errors.LintRuleErrorsList) {
115+
rules.NewReadinessRule(l.cfg.ExcludeRules.Readiness.Get()).
116+
CheckProbe(object, containers, errorList.WithRule("readiness-probe").WithMaxLevel(l.cfg.Rules.ReadinessRule.GetLevel()))
117+
},
94118
}
95119

96120
for _, rule := range notInitContainerRules {

0 commit comments

Comments
 (0)