Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce Exclusions on PolicyCRD instead of rego #217

Merged
merged 2 commits into from
Dec 21, 2023

Conversation

waleedhammam
Copy link
Contributor

Closes #211

What changed?

  • Introduce exclude field on the policy CRD to have one or more of [namespaces, resources, labels]
  • Update the policies in the Repo

Why was this change made?

We have exclusions embedded in the policies Rego Code. While it works, it has its drawbacks with not being discovered, and interferring with policy parameters. So we want to make it more prominent.

How was this change implemented?

  • Introducing the new exclusions field
  • Check the entities against the policy exclude them to avoid validating this entity if it's excluded

How did you validate the change?

  • Unit Test
  • Manual Test

Release notes

Documentation Changes

@waleedhammam waleedhammam added the enhancement New feature or request label Dec 18, 2023
@waleedhammam waleedhammam marked this pull request as ready for review December 18, 2023 19:52
@codecov-commenter
Copy link

Codecov Report

Attention: 2 lines in your changes are missing coverage. Please review.

Comparison is base (1c286d2) 78.35% compared to head (b030625) 78.70%.

Files Patch % Lines
pkg/policy-core/validation/common.go 93.93% 1 Missing and 1 partial ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@            Coverage Diff             @@
##              dev     #217      +/-   ##
==========================================
+ Coverage   78.35%   78.70%   +0.35%     
==========================================
  Files          20       20              
  Lines        1289     1329      +40     
==========================================
+ Hits         1010     1046      +36     
- Misses        212      216       +4     
  Partials       67       67              
Flag Coverage Δ
unit 78.70% <95.00%> (+0.35%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Member

@Samra10 Samra10 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM just minor changes for a simpler code block.

Tested & working as expected. ✅
I like the new flag. now it's easier to apply the exclusion and a simpler policy code. 👌

pkg/policy-core/validation/common.go Outdated Show resolved Hide resolved
pkg/policy-core/validation/common.go Outdated Show resolved Hide resolved
policies/ControllerContainerBlockSysctls.yaml Show resolved Hide resolved
@waleedhammam waleedhammam requested a review from Samra10 December 20, 2023 18:41
@waleedhammam waleedhammam merged commit a51ffe4 into dev Dec 21, 2023
4 checks passed
@waleedhammam waleedhammam deleted the 211-policy-exclusions branch December 21, 2023 10:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Story] Introduce Exclusions on PolicyCRD
3 participants