Skip to content

Commit bee475a

Browse files
mruegmrueg
committed
Update rego
1 parent 1089f32 commit bee475a

File tree

95 files changed

+442
-339
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

95 files changed

+442
-339
lines changed

‎examples/.regal/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ rules:
55
idiomatic:
66
no-defined-entrypoint:
77
level: ignore
8+
directory-package-mismatch:
9+
level: ignore
810
imports:
911
prefer-package-imports:
1012
level: ignore
@@ -17,6 +19,8 @@ rules:
1719
level: ignore
1820
prefer-snake-case:
1921
level: ignore
22+
rule-name-repeats-package:
23+
level: ignore
2024
testing:
2125
test-outside-test-package:
2226
level: ignore

examples/any-warn-deprecated-api-versions/src.rego renamed to examples/any_warn_deprecated_api_versions/src.rego

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,14 @@
1515
package any_warn_deprecated_api_versions
1616

1717
import data.lib.core
18+
import rego.v1
1819

1920
policyID := "P0001"
2021

21-
warn[msg] {
22-
resources := ["DaemonSet", "Deployment"]
22+
warn contains msg if {
2323
core.apiVersion == "extensions/v1beta1"
24-
core.kind == resources[_]
24+
resources := ["DaemonSet", "Deployment"]
25+
core.kind in resources
2526

2627
msg := core.format_with_id(
2728
sprintf("API extensions/v1beta1 for %s has been deprecated, use apps/v1 instead.", [core.kind]),

examples/any-warn-deprecated-api-versions/src_test.rego renamed to examples/any_warn_deprecated_api_versions/src_test.rego

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package any_warn_deprecated_api_versions
22

3-
test_matching {
3+
import rego.v1
4+
5+
test_matching if {
46
warns := warn with input as {
57
"kind": "Deployment",
68
"metadata": {"name": "test"},
@@ -9,7 +11,7 @@ test_matching {
911
count(warns) == 1
1012
}
1113

12-
test_different_kind {
14+
test_different_kind if {
1315
warns := warn with input as {
1416
"kind": "test",
1517
"metadata": {"name": "test"},
@@ -18,7 +20,7 @@ test_different_kind {
1820
count(warns) == 0
1921
}
2022

21-
test_different_apiversion {
23+
test_different_apiversion if {
2224
warns := warn with input as {
2325
"kind": "Deployment",
2426
"metadata": {"name": "test"},

examples/container-deny-added-caps/constraint.yaml renamed to examples/container_deny_added_caps/constraint.yaml

File renamed without changes.

examples/container-deny-added-caps/src.rego renamed to examples/container_deny_added_caps/src.rego

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,15 @@
2121
# - StatefulSet
2222
package container_deny_added_caps
2323

24+
25+
import rego.v1
2426
import data.lib.core
2527
import data.lib.pods
2628
import data.lib.security
2729

2830
policyID := "P1001"
2931

30-
violation[msg] {
32+
violation contains msg if {
3133
some container
3234
pods.containers[container]
3335
not container_dropped_all_capabilities(container)
@@ -38,6 +40,6 @@ violation[msg] {
3840
)
3941
}
4042

41-
container_dropped_all_capabilities(container) {
43+
container_dropped_all_capabilities(container) if {
4244
security.dropped_capability(container, "all")
4345
}

examples/container-deny-added-caps/src_test.rego renamed to examples/container_deny_added_caps/src_test.rego

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
package container_deny_added_caps
22

3-
test_dropped_all {
3+
import rego.v1
4+
5+
test_dropped_all if {
46
container_dropped_all_capabilities({"securityContext": {"capabilities": {"drop": ["all"]}}})
57
}
68

7-
test_dropped_none {
9+
test_dropped_none if {
810
not container_dropped_all_capabilities({"securityContext": {"capabilities": {"drop": ["none"]}}})
911
}

examples/container-deny-added-caps/template.yaml renamed to examples/container_deny_added_caps/template.yaml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -127,13 +127,15 @@ spec:
127127
rego: |-
128128
package container_deny_added_caps
129129
130+
131+
import rego.v1
130132
import data.lib.core
131133
import data.lib.pods
132134
import data.lib.security
133135
134136
policyID := "P1001"
135137
136-
violation[msg] {
138+
violation contains msg if {
137139
some container
138140
pods.containers[container]
139141
not container_dropped_all_capabilities(container)
@@ -144,7 +146,7 @@ spec:
144146
)
145147
}
146148
147-
container_dropped_all_capabilities(container) {
149+
container_dropped_all_capabilities(container) if {
148150
security.dropped_capability(container, "all")
149151
}
150152
target: admission.k8s.gatekeeper.sh

examples/container-deny-escalation/constraint.yaml renamed to examples/container_deny_escalation/constraint.yaml

File renamed without changes.

examples/container-deny-escalation/src.rego renamed to examples/container_deny_escalation/src.rego

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,25 +20,26 @@ package container_deny_escalation
2020

2121
import data.lib.core
2222
import data.lib.pods
23+
import rego.v1
2324

2425
policyID := "P1002"
2526

26-
violation[msg] {
27+
violation contains msg if {
2728
some container
2829
pods.containers[container]
2930
container_allows_escalation(container)
3031

3132
msg := core.format_with_id(sprintf("%s/%s: Allows privilege escalation", [core.kind, core.name]), policyID)
3233
}
3334

34-
container_allows_escalation(c) {
35+
container_allows_escalation(c) if {
3536
c.securityContext.allowPrivilegeEscalation == true
3637
}
3738

38-
container_allows_escalation(c) {
39+
container_allows_escalation(c) if {
3940
core.missing_field(c, "securityContext")
4041
}
4142

42-
container_allows_escalation(c) {
43+
container_allows_escalation(c) if {
4344
core.missing_field(c.securityContext, "allowPrivilegeEscalation")
4445
}

examples/container-deny-escalation/src_test.rego renamed to examples/container_deny_escalation/src_test.rego

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
package container_deny_escalation
22

3-
test_allowescalation_false {
3+
import rego.v1
4+
5+
test_allowescalation_false if {
46
not container_allows_escalation({"securityContext": {"allowPrivilegeEscalation": false}})
57
}
68

7-
test_allowescalation_true {
9+
test_allowescalation_true if {
810
container_allows_escalation({"securityContext": {"allowPrivilegeEscalation": true}})
911
}

0 commit comments

Comments
 (0)