Skip to content

Commit c648449

Browse files
mruegmrueg
authored
Fix constraint template when the matchers key is not present (#591)
* Add more acceptance tests * Fix constraint template * Fix tests
1 parent 2b6879d commit c648449

23 files changed

+246
-107
lines changed

‎.github/workflows/cron_e2e.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ jobs:
6565
run: |
6666
chmod +x ./konstraint
6767
./konstraint create -o e2e-resources examples
68-
./konstraint create -o e2e-resources test
6968
7069
- name: create kind cluster
7170
run: kind create cluster

‎.github/workflows/pull_request.yaml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,6 @@ jobs:
196196
run: |
197197
chmod +x ./konstraint
198198
./konstraint create -o e2e-resources examples
199-
./konstraint create -o e2e-resources test
200199
201200
- name: create kind cluster
202201
run: kind create cluster

‎acceptance.bats

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,13 @@
1919
}
2020

2121
@test "[CREATE] Creating constraints using --output matches expected output" {
22-
run ./build/konstraint create test --output test
22+
run ./build/konstraint create test/policies --output test/output/standard
2323
[ "$status" -eq 0 ]
24-
git diff --quiet -- test/
24+
git diff --quiet -- test/output/standard
2525
}
2626

2727
@test "[CREATE] Creating constraints using --constraint-custom-template-file, --constraint-template-custom-template-file and --output matches expected output" {
28-
run ./build/konstraint create test --constraint-custom-template-file internal/commands/constraint_template.tpl --constraint-template-custom-template-file internal/commands/constrainttemplate_template.tpl --partial-constraints --output test/custom
28+
run ./build/konstraint create test/policies --constraint-custom-template-file internal/commands/constraint_template.tpl --constraint-template-custom-template-file internal/commands/constrainttemplate_template.tpl --partial-constraints --output test/output/custom
2929
[ "$status" -eq 0 ]
30-
git diff --quiet -- test/custom
30+
git diff --quiet -- test/output/custom
3131
}

‎internal/commands/constraint_template.tpl

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,21 @@ metadata:
1010
{{- end }}
1111
name: {{ .Name }}
1212
spec:
13-
{{- if .Matchers }}
14-
match: {{- .GetAnnotation "matchers" | toIndentYAML 2 | nindent 4 }}
15-
{{- end }}
1613
{{- if ne .Enforcement "deny" }}
1714
enforcementAction: {{ .Enforcement }}
1815
{{- end -}}
19-
{{- if .AnnotationParameters }}
20-
parameters: {{- .AnnotationParameters | toIndentYAML 2 | nindent 4 }}
16+
{{- if or .AnnotationKindMatchers .AnnotationNamespaceMatchers .AnnotationExcludedNamespaceMatchers .AnnotationLabelSelectorMatcher }}
17+
match:
18+
{{- if .AnnotationExcludedNamespaceMatchers }}
19+
excludedNamespaces: {{- .AnnotationExcludedNamespaceMatchers | toIndentYAML 2 | nindent 6 }}
20+
{{- end }}
21+
{{- if .AnnotationKindMatchers }}
22+
kinds: {{- .AnnotationKindMatchers | toJSON | fromJSON | toIndentYAML 2 | nindent 6 }}
23+
{{- end }}
24+
{{- if .AnnotationLabelSelectorMatcher }}
25+
labelSelector: {{- .AnnotationLabelSelectorMatcher | toJSON | fromJSON | toIndentYAML 2 | nindent 6 }}
26+
{{- end }}
27+
{{- if .AnnotationNamespaceMatchers }}
28+
namespaces: {{- .AnnotationNamespaceMatchers | toIndentYAML 2 | nindent 6 }}
29+
{{- end }}
2130
{{- end }}

‎internal/commands/create_test.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ func TestRenderConstraint(t *testing.T) {
1919
t.Errorf("Error getting violations: %v", err)
2020
}
2121

22-
expected, err := os.ReadFile("../../test/constraint_Test.yaml")
22+
expected, err := os.ReadFile("../../test/output/standard/constraint_FullMetadata.yaml")
2323
if err != nil {
2424
t.Errorf("Error reading expected file: %v", err)
2525
}
@@ -48,7 +48,7 @@ func TestRenderConstraintWithCustomTemplate(t *testing.T) {
4848
t.Errorf("Error getting violations: %v", err)
4949
}
5050

51-
expected, err := os.ReadFile("../../test/custom/constraint_Test.yaml")
51+
expected, err := os.ReadFile("../../test/output/custom/constraint_FullMetadata.yaml")
5252
if err != nil {
5353
t.Errorf("Error reading expected file: %v", err)
5454
}
@@ -77,7 +77,7 @@ func TestRenderConstraintTemplate(t *testing.T) {
7777
t.Errorf("Error getting violations: %v", err)
7878
}
7979

80-
expected, err := os.ReadFile("../../test/template_Test.yaml")
80+
expected, err := os.ReadFile("../../test/output/standard/template_FullMetadata.yaml")
8181
if err != nil {
8282
t.Errorf("Error reading expected file: %v", err)
8383
}
@@ -106,7 +106,7 @@ func TestRenderConstraintTemplateWithCustomTemplate(t *testing.T) {
106106
t.Errorf("Error getting violations: %v", err)
107107
}
108108

109-
expected, err := os.ReadFile("../../test/custom/template_Test.yaml")
109+
expected, err := os.ReadFile("../../test/output/custom/template_FullMetadata.yaml")
110110
if err != nil {
111111
t.Errorf("Error reading expected file: %v", err)
112112
}
@@ -129,7 +129,7 @@ func TestRenderConstraintTemplateWithCustomTemplate(t *testing.T) {
129129
}
130130

131131
func GetViolations() ([]rego.Rego, error) {
132-
violations, err := rego.GetViolations("../../test")
132+
violations, err := rego.GetViolations("../../test/policies/")
133133
if err != nil {
134134
return nil, err
135135
}

‎test/custom/constraint_Test.yaml

Lines changed: 0 additions & 82 deletions
This file was deleted.

‎test/output/custom/constraint_FullMetadata.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# This is a custom template for constraints
2+
apiVersion: constraints.gatekeeper.sh/v1beta1
3+
kind: FullMetadata
4+
metadata:
5+
name: fullmetadata
6+
spec:
7+
match:
8+
excludedNamespaces:
9+
- kube-system
10+
- gatekeeper-system
11+
kinds:
12+
- apiGroups:
13+
- ""
14+
kinds:
15+
- Pod
16+
- apiGroups:
17+
- apps
18+
kinds:
19+
- DaemonSet
20+
- Deployment
21+
- StatefulSet
22+
labelSelector:
23+
matchExpressions:
24+
- key: foo
25+
operator: In
26+
values:
27+
- bar
28+
- baz
29+
- key: doggos
30+
operator: Exists
31+
namespaces:
32+
- dev
33+
- stage
34+
- prod

‎test/output/custom/constraint_NoMetadata.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# This is a custom template for constraints
2+
apiVersion: constraints.gatekeeper.sh/v1beta1
3+
kind: NoMetadata
4+
metadata:
5+
name: nometadata
6+
spec:

‎test/output/custom/constraint_PartialMetadata.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# This is a custom template for constraints
2+
apiVersion: constraints.gatekeeper.sh/v1beta1
3+
kind: PartialMetadata
4+
metadata:
5+
name: partialmetadata
6+
spec:
7+
match:
8+
namespaces:
9+
- dev
10+
- stage
11+
- prod

‎test/custom/template_Test.yaml renamed to ‎test/output/custom/template_FullMetadata.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
apiVersion: templates.gatekeeper.sh/v1
33
kind: ConstraintTemplate
44
metadata:
5-
name: test
5+
name: fullmetadata
66
spec:
77
crd:
88
spec:
99
names:
10-
kind: Test
10+
kind: FullMetadata
1111
validation:
1212
openAPIV3Schema:
1313
properties:
@@ -25,7 +25,7 @@ spec:
2525
- |-
2626
package lib.libraryB
2727
rego: |-
28-
package test
28+
package test_fullmetadata
2929
3030
import future.keywords.if
3131
import data.lib.libraryA

0 commit comments

Comments
 (0)