Skip to content

Commit 27467af

Browse files
mruegmrueg
authored
feat: Remove support for legacy annotations (#555)
BREAKING CHANGE!!
1 parent 09083fe commit 27467af

File tree

11 files changed

+66
-1121
lines changed

11 files changed

+66
-1121
lines changed

‎docs/cli/konstraint.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ A tool to create and manage Gatekeeper CRDs from Rego
1414

1515
### SEE ALSO
1616

17-
* [konstraint convert](konstraint_convert.md) - Convert legacy annotations to OPA Metadata Annotations
1817
* [konstraint create](konstraint_create.md) - Create Gatekeeper constraints from Rego policies
1918
* [konstraint doc](konstraint_doc.md) - Generate documentation from Rego policies
2019

‎docs/cli/konstraint_create.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ Create constraints with the Gatekeeper enforcement action set to dryrun
2525
--constraint-custom-template-file string Path to a custom template file to generate constraints
2626
--constraint-template-custom-template-file string Path to a custom template file to generate constraint templates
2727
--constraint-template-version string Set the version of ConstraintTemplates (default "v1")
28-
-d, --dryrun Set the enforcement action of the constraints to dryrun, overriding the @enforcement tag
28+
-d, --dryrun Set the enforcement action of the constraints to dryrun, overriding the enforcement setting
2929
-h, --help help for create
3030
--log-level string Set a log level. Options: error, info, debug, trace (default "info")
3131
-o, --output string Specify an output directory for the Gatekeeper resources

‎docs/constraint_creation.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,7 @@ in the custom metadata section.
117117

118118
### Legacy annotations
119119

120-
Previously Konstraint had custom annotation format, such as `@title` or `@kinds`, which is a legacy format and will be removed in future releases.
121-
122-
To aid with transition to OPA Metadata format, a conversion tool is provided as `konstraint convert`
120+
Previously Konstraint had custom annotation format, such as `@title` or `@kinds`, which is a legacy format and were removed in release v0.42.0.
123121

124122
## Using Input Parameters
125123

‎internal/commands/convert.go

Lines changed: 0 additions & 123 deletions
This file was deleted.

‎internal/commands/create.go

Lines changed: 5 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package commands
22

33
import (
44
"bytes"
5-
"encoding/json"
65
"fmt"
76
"os"
87
"path/filepath"
@@ -23,10 +22,6 @@ import (
2322
"sigs.k8s.io/yaml"
2423
)
2524

26-
const (
27-
legacyMigrationMessage = " are set with legacy annotations, this functionality will be removed in a future release. Please migrate to OPA Metadata annotations. See konstraint convert."
28-
)
29-
3025
func newCreateCommand() *cobra.Command {
3126
cmd := cobra.Command{
3227
Use: "create <dir>",
@@ -88,7 +83,7 @@ Create constraints with the Gatekeeper enforcement action set to dryrun
8883
}
8984

9085
cmd.PersistentFlags().StringP("output", "o", "", "Specify an output directory for the Gatekeeper resources")
91-
cmd.PersistentFlags().BoolP("dryrun", "d", false, "Set the enforcement action of the constraints to dryrun, overriding the @enforcement tag")
86+
cmd.PersistentFlags().BoolP("dryrun", "d", false, "Set the enforcement action of the constraints to dryrun, overriding the enforcement setting")
9287
cmd.PersistentFlags().Bool("skip-constraints", false, "Skip generation of constraints")
9388
cmd.PersistentFlags().String("constraint-template-version", "v1", "Set the version of ConstraintTemplates")
9489
cmd.PersistentFlags().Bool("partial-constraints", false, "Generate partial Constraints for policies with parameters")
@@ -152,7 +147,7 @@ func runCreateCommand(path string) error {
152147
}
153148

154149
// Skip Constraint generation if there are parameters on the template.
155-
if !viper.GetBool("partial-constraints") && (len(violation.Parameters()) > 0 || len(violation.AnnotationParameters()) > 0) {
150+
if !viper.GetBool("partial-constraints") && len(violation.AnnotationParameters()) > 0 {
156151
logger.Warn("Skipping constraint generation due to use of parameters")
157152
continue
158153
}
@@ -247,7 +242,7 @@ func renderTemplate(violation rego.Rego, appliedTemplate []byte) ([]byte, error)
247242
return buf.Bytes(), nil
248243
}
249244

250-
func getConstraintTemplatev1(violation rego.Rego, logger *log.Entry) *v1.ConstraintTemplate {
245+
func getConstraintTemplatev1(violation rego.Rego, _ *log.Entry) *v1.ConstraintTemplate {
251246
constraintTemplate := v1.ConstraintTemplate{
252247
TypeMeta: metav1.TypeMeta{
253248
APIVersion: "templates.gatekeeper.sh/v1",
@@ -274,20 +269,7 @@ func getConstraintTemplatev1(violation rego.Rego, logger *log.Entry) *v1.Constra
274269
},
275270
}
276271

277-
if len(violation.Parameters()) > 0 {
278-
logger.Warn("Parameters" + legacyMigrationMessage)
279-
constraintTemplate.Spec.CRD.Spec.Validation = &v1.Validation{
280-
OpenAPIV3Schema: &apiextensionsv1.JSONSchemaProps{
281-
Properties: violation.GetOpenAPISchemaProperties(),
282-
Type: "object",
283-
},
284-
}
285-
}
286-
287272
if len(violation.AnnotationParameters()) > 0 {
288-
if constraintTemplate.Spec.CRD.Spec.Validation != nil {
289-
logger.Warn("Parameters already set with legacy annotations, overwriting the parameters using values from OPA Metadata")
290-
}
291273
constraintTemplate.Spec.CRD.Spec.Validation = &v1.Validation{
292274
OpenAPIV3Schema: &apiextensionsv1.JSONSchemaProps{
293275
Properties: violation.AnnotationParameters(),
@@ -299,7 +281,7 @@ func getConstraintTemplatev1(violation rego.Rego, logger *log.Entry) *v1.Constra
299281
return &constraintTemplate
300282
}
301283

302-
func getConstraintTemplatev1beta1(violation rego.Rego, logger *log.Entry) *v1beta1.ConstraintTemplate {
284+
func getConstraintTemplatev1beta1(violation rego.Rego, _ *log.Entry) *v1beta1.ConstraintTemplate {
303285
constraintTemplate := v1beta1.ConstraintTemplate{
304286
TypeMeta: metav1.TypeMeta{
305287
APIVersion: "templates.gatekeeper.sh/v1beta1",
@@ -326,19 +308,7 @@ func getConstraintTemplatev1beta1(violation rego.Rego, logger *log.Entry) *v1bet
326308
},
327309
}
328310

329-
if len(violation.Parameters()) > 0 {
330-
logger.Warn("Parameters" + legacyMigrationMessage)
331-
constraintTemplate.Spec.CRD.Spec.Validation = &v1beta1.Validation{
332-
OpenAPIV3Schema: &apiextensionsv1.JSONSchemaProps{
333-
Properties: violation.GetOpenAPISchemaProperties(),
334-
},
335-
}
336-
}
337-
338311
if len(violation.AnnotationParameters()) > 0 {
339-
if constraintTemplate.Spec.CRD.Spec.Validation != nil {
340-
logger.Warn("Parameters already set with legacy annotations, overwriting the parameters using values from OPA Metadata")
341-
}
342312
constraintTemplate.Spec.CRD.Spec.Validation = &v1beta1.Validation{
343313
OpenAPIV3Schema: &apiextensionsv1.JSONSchemaProps{
344314
Properties: violation.AnnotationParameters(),
@@ -349,7 +319,7 @@ func getConstraintTemplatev1beta1(violation rego.Rego, logger *log.Entry) *v1bet
349319
return &constraintTemplate
350320
}
351321

352-
func getConstraint(violation rego.Rego, logger *log.Entry) (*unstructured.Unstructured, error) {
322+
func getConstraint(violation rego.Rego, _ *log.Entry) (*unstructured.Unstructured, error) {
353323
gvk := schema.GroupVersionKind{
354324
Group: "constraints.gatekeeper.sh",
355325
Version: "v1beta1",
@@ -382,68 +352,14 @@ func getConstraint(violation rego.Rego, logger *log.Entry) (*unstructured.Unstru
382352
}
383353
}
384354

385-
matchers, err := violation.Matchers()
386-
if err != nil {
387-
return nil, fmt.Errorf("get matchers: %w", err)
388-
}
389-
390-
if len(matchers.KindMatchers) > 0 {
391-
logger.Warn("Kind Matchers" + legacyMigrationMessage)
392-
if err := setKindMatcher(&constraint, matchers.KindMatchers); err != nil {
393-
return nil, fmt.Errorf("set kind matcher: %w", err)
394-
}
395-
}
396-
397-
if len(matchers.MatchLabelsMatcher) > 0 {
398-
logger.Warn("Match Labels Matchers" + legacyMigrationMessage)
399-
if err := setMatchLabelsMatcher(&constraint, matchers.MatchLabelsMatcher); err != nil {
400-
return nil, fmt.Errorf("set match labels matcher: %w", err)
401-
}
402-
}
403-
404-
if len(matchers.MatchExpressionsMatcher) > 0 {
405-
logger.Warn("Match Expressions Matchers" + legacyMigrationMessage)
406-
if err := setMatchExpressionsMatcher(&constraint, matchers.MatchExpressionsMatcher); err != nil {
407-
return nil, fmt.Errorf("set match expressions matcher: %w", err)
408-
}
409-
}
410-
411-
if len(matchers.NamespaceMatcher) > 0 {
412-
logger.Warn("Namespace Matchers" + legacyMigrationMessage)
413-
if err := setNestedStringSlice(&constraint, matchers.NamespaceMatcher, "spec", "match", "namespaces"); err != nil {
414-
return nil, fmt.Errorf("set namespace matcher: %w", err)
415-
}
416-
}
417-
418-
if len(matchers.ExcludedNamespaceMatcher) > 0 {
419-
logger.Warn("Excluded Namespace Matchers" + legacyMigrationMessage)
420-
if err := setNestedStringSlice(&constraint, matchers.ExcludedNamespaceMatcher, "spec", "match", "excludedNamespaces"); err != nil {
421-
return nil, fmt.Errorf("set namespace matcher: %w", err)
422-
}
423-
}
424-
425355
metadataMatchers, err := violation.GetAnnotation("matchers")
426356
if err == nil {
427-
if len(matchers.KindMatchers) > 0 ||
428-
len(matchers.MatchLabelsMatcher) > 0 ||
429-
len(matchers.MatchExpressionsMatcher) > 0 ||
430-
len(matchers.NamespaceMatcher) > 0 ||
431-
len(matchers.ExcludedNamespaceMatcher) > 0 {
432-
logger.Warn("Overwriting matchers set with legacy annotations using matchers from OPA Metadata.")
433-
}
434-
435357
if err := unstructured.SetNestedField(constraint.Object, metadataMatchers, "spec", "match"); err != nil {
436358
return nil, fmt.Errorf("set matchers from metadata annotation: %w", err)
437359
}
438360
}
439361

440362
if viper.GetBool("partial-constraints") {
441-
if len(violation.Parameters()) > 0 {
442-
logger.Warn("Parameters" + legacyMigrationMessage)
443-
if err := addParametersToConstraintLegacy(&constraint, violation.Parameters()); err != nil {
444-
return nil, fmt.Errorf("add parameters %v to constraint: %w", violation.Parameters(), err)
445-
}
446-
}
447363
if len(violation.AnnotationParameters()) > 0 {
448364
if err := addParametersToConstraint(&constraint, violation.AnnotationParameters()); err != nil {
449365
return nil, fmt.Errorf("add parameters %v to constraint: %w", violation.AnnotationParameters(), err)
@@ -466,52 +382,6 @@ func addParametersToConstraint(constraint *unstructured.Unstructured, parameters
466382
return nil
467383
}
468384

469-
func addParametersToConstraintLegacy(constraint *unstructured.Unstructured, parameters []rego.Parameter) error {
470-
params := make(map[string]interface{}, len(parameters))
471-
for _, p := range parameters {
472-
params[p.Name] = nil
473-
}
474-
if err := unstructured.SetNestedField(constraint.Object, params, "spec", "parameters"); err != nil {
475-
return fmt.Errorf("set parameters map: %w", err)
476-
}
477-
478-
return nil
479-
}
480-
481-
func setKindMatcher(constraint *unstructured.Unstructured, kindMatchers rego.KindMatchers) error {
482-
if err := unstructured.SetNestedSlice(constraint.Object, kindMatchers.ToSpec(), "spec", "match", "kinds"); err != nil {
483-
return fmt.Errorf("set constraint kinds matchers: %w", err)
484-
}
485-
return nil
486-
}
487-
488-
func setMatchLabelsMatcher(constraint *unstructured.Unstructured, matcher rego.MatchLabelsMatcher) error {
489-
if err := unstructured.SetNestedStringMap(constraint.Object, matcher, "spec", "match", "labelSelector", "matchLabels"); err != nil {
490-
return fmt.Errorf("set constraint labelSelector.matchLabels matchers: %w", err)
491-
}
492-
return nil
493-
}
494-
495-
func setMatchExpressionsMatcher(constraint *unstructured.Unstructured, matcher []rego.MatchExpressionMatcher) error {
496-
marshaled, err := json.Marshal(matcher)
497-
if err != nil {
498-
return err
499-
}
500-
var unmarshaled []interface{}
501-
if err := json.Unmarshal(marshaled, &unmarshaled); err != nil {
502-
return err
503-
}
504-
return unstructured.SetNestedSlice(constraint.Object, unmarshaled, "spec", "match", "labelSelector", "matchExpressions")
505-
}
506-
507-
func setNestedStringSlice(constraint *unstructured.Unstructured, slice []string, path ...string) error {
508-
var values []interface{}
509-
for _, s := range slice {
510-
values = append(values, interface{}(s))
511-
}
512-
return unstructured.SetNestedSlice(constraint.Object, values, path...)
513-
}
514-
515385
func isValidEnforcementAction(action string) bool {
516386
for _, a := range []string{"deny", "dryrun", "warn"} {
517387
if a == action {

‎internal/commands/default.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ func NewDefaultCommand() *cobra.Command {
2424

2525
cmd.AddCommand(newCreateCommand())
2626
cmd.AddCommand(newDocCommand())
27-
cmd.AddCommand(newConvertCommand())
2827

2928
return &cmd
3029
}

0 commit comments

Comments
 (0)