-
Notifications
You must be signed in to change notification settings - Fork 51
Open
Description
Hello,
As of GateKeeper v3.19.0, Gatekeeper now offers v1 syntax support. It looks like right now that feature is enable via opt-in in your constraint template. Does Konstraint have any means to generate Constraint Templates in the v1 format that GateKeeper expects?
More info here: https://open-policy-agent.github.io/gatekeeper/website/docs/constrainttemplates/#enable-opa-rego-v1-syntax-in-constrainttemplates
targets:
- target: admission.k8s.gatekeeper.sh
code:
- engine: Rego
source:
version: "v1"
rego: |
<v1-rego-code>apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: k8srequiredlabels
spec:
crd:
spec:
names:
kind: K8sRequiredLabels
validation:
# Schema for the `parameters` field
openAPIV3Schema:
type: object
properties:
message:
type: string
labels:
type: array
items:
type: object
properties:
key:
type: string
allowedRegex:
type: string
targets:
- target: admission.k8s.gatekeeper.sh
code:
- engine: Rego
source:
version: "v1"
rego: |
package k8srequiredlabels
violation contains
{"msg": msg, "details": {"missing_labels": missing}}
if {
provided := {label | input.review.object.metadata.labels[label]}
required := {label | label := input.parameters.labels[_]}
missing := required - provided
count(missing) > 0
msg := sprintf("you must provide labels: %v", [missing])
}Nicholas95, mrueg, LorenzBischof and robertcoltheart
Metadata
Metadata
Assignees
Labels
No labels