-
Notifications
You must be signed in to change notification settings - Fork 23
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(domains): file domain #688
Closed
Closed
Changes from all commits
Commits
Show all changes
9 commits
Select commit
Hold shift + click to select a range
0fcfdd0
feature: file domain
mildwonkey ec6d4c3
go fmt
mildwonkey 47fa213
adding remote file download and some okayish tests
mildwonkey dcdb639
PR feedback - replace go-getter with Fetch and extend FileInfo to inc…
mildwonkey c82e399
rough draft documentation
mildwonkey 9448d77
fix use of filepath.Name
mildwonkey 8234d77
embetter tests
mildwonkey e143c0d
comment cleanup
mildwonkey a86baf0
add opa example to docs - i don't like my phrasing here
mildwonkey File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| # File Domain | ||
| The File domain allows for validation of arbitrary file contents. The file domain can evaluate local files and network files. Files are copied to a temporary directory for evaluation and deleted afterwards. | ||
|
|
||
| ## Specification | ||
| The File domain specification accepts a descriptive name for the file as well as it's path. The names must be unique. | ||
|
|
||
| ```yaml | ||
| domain: | ||
| type: file | ||
| file-spec: | ||
| filepaths: | ||
| - name: config | ||
| path: grafana.ini | ||
| ``` | ||
|
|
||
| ## Supported File Types | ||
| The file domain use's OPA's [conftest](https://conftest.dev) to parse files into a json-compatible format for validations. ∑Both OPA and kyverno (using [kyverno-json](https://kyverno.github.io/kyverno-json/latest/)) can validate files parsed by the file domain. | ||
|
|
||
| The file domain supports the following file formats for validation: | ||
| * CUE | ||
| * CycloneDX | ||
| * Dockerfile | ||
| * EDN | ||
| * Environment files (.env) | ||
| * HCL and HCL2 | ||
| * HOCON | ||
| * Ignore files (.gitignore, .dockerignore) | ||
| * INI | ||
| * JSON | ||
| * Jsonnet | ||
| * Property files (.properties) | ||
| * SPDX | ||
| * TextProto (Protocol Buffers) | ||
| * TOML | ||
| * VCL | ||
| * XML | ||
| * YAML | ||
|
|
||
| ## Validations | ||
| When writing validations against files, the filepath Name must be included as | ||
| the top-level key in the validation. The placement varies between providers. | ||
|
|
||
| Given the following ini file: | ||
|
|
||
| ```grafana.ini | ||
| [server] | ||
| # Protocol (http, https, socket) | ||
| protocol = http | ||
| ``` | ||
|
|
||
| The below Kyverno policy validates the protocol is https by including Grafana as the top-level key under "check": | ||
|
|
||
| ```yaml | ||
| metadata: | ||
| name: check-grafana-protocol | ||
| uuid: ad38ef57-99f6-4ac6-862e-e0bc9f55eebe | ||
| domain: | ||
| type: file | ||
| file-spec: | ||
| filepaths: | ||
| - name: 'grafana' | ||
| path: 'custom.ini' | ||
| provider: | ||
| type: kyverno | ||
| kyverno-spec: | ||
| policy: | ||
| apiVersion: json.kyverno.io/v1alpha1 | ||
| kind: ValidatingPolicy | ||
| metadata: | ||
| name: grafana-config | ||
| spec: | ||
| rules: | ||
| - name: protocol-is-https | ||
| assert: | ||
| all: | ||
| - check: | ||
| grafana: | ||
| server: | ||
| protocol: https | ||
| ``` | ||
|
|
||
| While in an OPA policy, the filepath Name is the input key to access the config: | ||
|
|
||
| ```yaml | ||
| metadata: | ||
| name: validate-grafana-config | ||
| uuid: ad38ef57-99f6-4ac6-862e-e0bc9f55eebe | ||
| domain: | ||
| type: file | ||
| file-spec: | ||
| filepaths: | ||
| - name: 'grafana' | ||
| path: 'custom.ini' | ||
| provider: | ||
| type: opa | ||
| opa-spec: | ||
| rego: | | ||
| package validate | ||
| import rego.v1 | ||
|
|
||
| # Default values | ||
| default validate := false | ||
| default msg := "Not evaluated" | ||
|
|
||
| validate if { | ||
| check_grafana_config.result | ||
| } | ||
| msg = check_grafana_config.msg | ||
|
|
||
| config := input["grafana"] | ||
| protocol := config.server.protocol | ||
|
|
||
| check_grafana_config = {"result": true, "msg": msg} if { | ||
| protocol == "https" | ||
| msg := "Server protocol is set to https" | ||
| } else = {"result": false, "msg": msg} if { | ||
| protocol == "http" | ||
| msg := "Grafana protcol is insecure" | ||
| } | ||
|
|
||
| output: | ||
| validation: validate.validate | ||
| observations: | ||
| - validate.msg | ||
| ``` | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We don't yet have a good pattern for the mapping of domain -> provider.
That said - I do like the Kyverno example below. Could we add an OPA provider example as well?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think the writing is very good but I added an OPA example! please nitpick freely.