Skip to content

Commit a35a4e4

Browse files
darryk10Kaizhe
darryk10
authored and
Kaizhe
committed
introduced opa policy generation
1 parent c1c9273 commit a35a4e4

File tree

3 files changed

+22
-22
lines changed

3 files changed

+22
-22
lines changed

‎advisor/advisor.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func NewAdvisor(kubeconfig string) (*Advisor, error) {
4343
}, nil
4444
}
4545

46-
func (advisor *Advisor) Process(namespace string, excludeNamespaces []string, OPAformat bool, OPAdefaultRule bool) error {
46+
func (advisor *Advisor) Process(namespace string, excludeNamespaces []string, OPAformat string, OPAdefaultRule bool) error {
4747
advisor.processor.SetNamespace(namespace)
4848
advisor.processor.SetExcludeNamespaces(excludeNamespaces)
4949

@@ -53,9 +53,9 @@ func (advisor *Advisor) Process(namespace string, excludeNamespaces []string, OP
5353
return err
5454
}
5555

56-
if OPAformat {
56+
if OPAformat == "opa" {
5757
advisor.OPAModulePolicy = advisor.processor.GenerateOPA(cssList, pssList, OPAdefaultRule)
58-
} else {
58+
} else if OPAformat == "psp" {
5959
advisor.podSecurityPolicy = advisor.processor.GeneratePSP(cssList, pssList)
6060
}
6161

‎generator/generator.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -938,7 +938,7 @@ func addOPARule(nameRuleHead string, arg string) *ast.Rule {
938938
return &Rule
939939
}
940940

941-
func (pg *Generator) fromPodObj(metadata types.Metadata, spec corev1.PodSpec, OPAformat bool, OPAdefaultRule bool) (string, error) {
941+
func (pg *Generator) fromPodObj(metadata types.Metadata, spec corev1.PodSpec, OPAformat string, OPAdefaultRule bool) (string, error) {
942942

943943
cssList, pss := pg.GetSecuritySpecFromPodSpec(metadata, "default", spec, nil)
944944

@@ -951,7 +951,7 @@ func (pg *Generator) fromPodObj(metadata types.Metadata, spec corev1.PodSpec, OP
951951
var mod *ast.Module
952952
var out string
953953

954-
if !OPAformat {
954+
if OPAformat == "psp" {
955955
psp = pg.GeneratePSP(cssList, pssList, "default", types.Version1_11)
956956
pspJson, err := json.Marshal(psp)
957957
if err != nil {
@@ -962,71 +962,71 @@ func (pg *Generator) fromPodObj(metadata types.Metadata, spec corev1.PodSpec, OP
962962
return "", fmt.Errorf("Could not convert resulting PSP to Json: %v", err)
963963
}
964964
out = string(pspYaml)
965-
} else {
965+
} else if OPAformat == "opa" {
966966
mod = pg.GenerateOPAPod(cssList, pssList, "default", types.Version1_11, OPAdefaultRule)
967967
out = mod.String()
968968
}
969969

970970
return string(out), nil
971971
}
972972

973-
func (pg *Generator) fromDaemonSet(ds *appsv1.DaemonSet, OPAformat bool, OPAdefaultRule bool) (string, error) {
973+
func (pg *Generator) fromDaemonSet(ds *appsv1.DaemonSet, OPAformat string, OPAdefaultRule bool) (string, error) {
974974
return pg.fromPodObj(types.Metadata{
975975
Name: ds.Name,
976976
Kind: ds.Kind,
977977
}, ds.Spec.Template.Spec, OPAformat, OPAdefaultRule)
978978
}
979979

980-
func (pg *Generator) fromDeployment(dep *appsv1.Deployment, OPAformat bool, OPAdefaultRule bool) (string, error) {
980+
func (pg *Generator) fromDeployment(dep *appsv1.Deployment, OPAformat string, OPAdefaultRule bool) (string, error) {
981981
return pg.fromPodObj(types.Metadata{
982982
Name: dep.Name,
983983
Kind: dep.Kind,
984984
}, dep.Spec.Template.Spec, OPAformat, OPAdefaultRule)
985985
}
986986

987-
func (pg *Generator) fromReplicaSet(rs *appsv1.ReplicaSet, OPAformat bool, OPAdefaultRule bool) (string, error) {
987+
func (pg *Generator) fromReplicaSet(rs *appsv1.ReplicaSet, OPAformat string, OPAdefaultRule bool) (string, error) {
988988
return pg.fromPodObj(types.Metadata{
989989
Name: rs.Name,
990990
Kind: rs.Kind,
991991
}, rs.Spec.Template.Spec, OPAformat, OPAdefaultRule)
992992
}
993993

994-
func (pg *Generator) fromStatefulSet(ss *appsv1.StatefulSet, OPAformat bool, OPAdefaultRule bool) (string, error) {
994+
func (pg *Generator) fromStatefulSet(ss *appsv1.StatefulSet, OPAformat string, OPAdefaultRule bool) (string, error) {
995995
return pg.fromPodObj(types.Metadata{
996996
Name: ss.Name,
997997
Kind: ss.Kind,
998998
}, ss.Spec.Template.Spec, OPAformat, OPAdefaultRule)
999999
}
10001000

1001-
func (pg *Generator) fromReplicationController(rc *corev1.ReplicationController, OPAformat bool, OPAdefaultRule bool) (string, error) {
1001+
func (pg *Generator) fromReplicationController(rc *corev1.ReplicationController, OPAformat string, OPAdefaultRule bool) (string, error) {
10021002
return pg.fromPodObj(types.Metadata{
10031003
Name: rc.Name,
10041004
Kind: rc.Kind,
10051005
}, rc.Spec.Template.Spec, OPAformat, OPAdefaultRule)
10061006
}
10071007

1008-
func (pg *Generator) fromCronJob(cj *batchv1beta1.CronJob, OPAformat bool, OPAdefaultRule bool) (string, error) {
1008+
func (pg *Generator) fromCronJob(cj *batchv1beta1.CronJob, OPAformat string, OPAdefaultRule bool) (string, error) {
10091009
return pg.fromPodObj(types.Metadata{
10101010
Name: cj.Name,
10111011
Kind: cj.Kind,
10121012
}, cj.Spec.JobTemplate.Spec.Template.Spec, OPAformat, OPAdefaultRule)
10131013
}
10141014

1015-
func (pg *Generator) fromJob(job *batch.Job, OPAformat bool, OPAdefaultRule bool) (string, error) {
1015+
func (pg *Generator) fromJob(job *batch.Job, OPAformat string, OPAdefaultRule bool) (string, error) {
10161016
return pg.fromPodObj(types.Metadata{
10171017
Name: job.Name,
10181018
Kind: job.Kind,
10191019
}, job.Spec.Template.Spec, OPAformat, OPAdefaultRule)
10201020
}
10211021

1022-
func (pg *Generator) fromPod(pod *corev1.Pod, OPAformat bool, OPAdefaultRule bool) (string, error) {
1022+
func (pg *Generator) fromPod(pod *corev1.Pod, OPAformat string, OPAdefaultRule bool) (string, error) {
10231023
return pg.fromPodObj(types.Metadata{
10241024
Name: pod.Name,
10251025
Kind: pod.Kind,
10261026
}, pod.Spec, OPAformat, OPAdefaultRule)
10271027
}
10281028

1029-
func (pg *Generator) FromPodObjString(podObjString string, OPAformat bool, OPAdefaultRule bool) (string, error) {
1029+
func (pg *Generator) FromPodObjString(podObjString string, OPAformat string, OPAdefaultRule bool) (string, error) {
10301030

10311031
podObjJson, err := yaml.YAMLToJSON([]byte(podObjString))
10321032
if err != nil {

‎kube-psp-advisor.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
_ "k8s.io/client-go/plugin/pkg/client/auth"
2424
)
2525

26-
func inspect(kubeconfig string, namespace string, excludeNamespaces []string, withReport, withGrant bool, OPAformat bool, OPAdefaultRule bool) error {
26+
func inspect(kubeconfig string, namespace string, excludeNamespaces []string, withReport, withGrant bool, OPAformat string, OPAdefaultRule bool) error {
2727
advisor, err := advisor.NewAdvisor(kubeconfig)
2828

2929
if err != nil {
@@ -45,12 +45,12 @@ func inspect(kubeconfig string, namespace string, excludeNamespaces []string, wi
4545
return advisor.PrintPodSecurityPolicyWithGrants()
4646
}
4747

48-
if !OPAformat {
48+
if OPAformat == "psp" {
4949
err = advisor.PrintPodSecurityPolicy()
5050
if err != nil {
5151
return fmt.Errorf("Could not print PSP: %v", err)
5252
}
53-
} else {
53+
} else if OPAformat == "opa" {
5454
opaRuleOutput := advisor.PrintOPAPolicy()
5555
if opaRuleOutput == "" {
5656
return fmt.Errorf("Could not print OPA rule: %v", err)
@@ -59,7 +59,7 @@ func inspect(kubeconfig string, namespace string, excludeNamespaces []string, wi
5959
return nil
6060
}
6161

62-
func convert(podObjFilename string, pspFilename string, OPAformat bool, OPAdefaultRule bool) error {
62+
func convert(podObjFilename string, pspFilename string, OPAformat string, OPAdefaultRule bool) error {
6363
podObjFile, err := os.Open(podObjFilename)
6464
if err != nil {
6565
return fmt.Errorf("Could not open pod object file %s for reading: %v", podObjFilename, err)
@@ -140,7 +140,7 @@ func main() {
140140
var excludeNamespaces []string
141141
var podObjFilename string
142142
var pspFilename string
143-
var OPAformat bool
143+
var OPAformat string
144144
var OPAdefaultRule bool
145145
var logLevel string
146146
var srcYamlDir string
@@ -234,12 +234,12 @@ func main() {
234234
inspectCmd.Flags().BoolVarP(&withGrant, "grant", "g", false, "(optional) return with pod security policies, roles and rolebindings")
235235
inspectCmd.Flags().StringVarP(&namespace, "namespace", "n", "", "(optional) namespace")
236236
inspectCmd.Flags().StringSliceVarP(&excludeNamespaces, "exclude-namespaces", "e", []string{}, "(optional) comma separated list of namespaces to exclude")
237-
inspectCmd.Flags().BoolVarP(&OPAformat, "opa", "", false, "(optional) OPA option for output in OPA format")
237+
inspectCmd.Flags().StringVarP(&OPAformat, "policy", "p", "", "set policy type. Default psp")
238238
inspectCmd.Flags().BoolVarP(&OPAdefaultRule, "OPADefaultRule", "", false, "(optional) OPA Default Rule: use this option iF OPA Default Rule is Deny ALL")
239239

240240
convertCmd.Flags().StringVar(&podObjFilename, "podFile", "", "Path to a yaml file containing an object with a pod Spec")
241241
convertCmd.Flags().StringVar(&pspFilename, "pspFile", "", "Write the resulting output to this file")
242-
convertCmd.Flags().BoolVarP(&OPAformat, "opa", "", false, "(optional) OPA option for output in OPA format")
242+
convertCmd.Flags().StringVarP(&OPAformat, "policy", "p", "psp", "set policy type. Default psp")
243243
convertCmd.Flags().BoolVarP(&OPAdefaultRule, "deny-by-default", "", false, "(optional) OPA Default Rule: use this option if OPA Default Rule is Deny ALL")
244244

245245
compareCmd.Flags().StringVar(&srcYamlDir, "sourceDir", "", "Source YAML directory to load YAMLs")

0 commit comments

Comments
 (0)