volume-secret-ref.yaml

apiVersion: kubevious.io/v1alpha1
kind: ClusterRule
metadata:
  name: pod-spec-volume-secret-ref
spec:
  summary: |
    Validate PodSpec volume mount Secret reference.
  categories:
    - k8s
    - pod-spec
    - secret
    - volume
    - reference 
  target: |
    Shortcut("PodSpec")
  rule: |
    for(const volume of config.spec?.volumes ?? [])
    {
      if (volume.secret)
      {
        checkSecretRef(volume.name, volume.secret.secretName, volume.secret);
      }
      else if (volume.projected)
      {
        for(const source of volume.projected.sources)
        {
          if (source.secret)
          {
            checkSecretRef(volume.name, source.secret.name, source.secret);
          }
        }
      }
    }

    function checkSecretRef(volumeName, secretName, secretRef)
    {
      const secretItem = Shortcut("Secret", secretName)
                      .single();
      if (!secretItem)
      {
        if (!secretRef.optional)
        {
          error(`Could not find Secret ${secretName} referenced in volume ${volumeName}.`);
        }
      }
      else
      {
        if (secretRef.items)
        {
          const dataObj = secretItem.config.data ?? {};
          for(const item of secretRef.items)
          {
            if (!dataObj[item.key])
            {
              if (!secretRef.optional)
              {
                error(`Could not find data key ${item.key} in Secret ${secretName} referenced in volume ${volumeName}.`);
              }
            }
          }
        }
      }
    }