-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #398 from flavio/refactor
refactor: change signature of `PolicyEvaluator.validate`
- Loading branch information
Showing
5 changed files
with
142 additions
and
129 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| use anyhow::{anyhow, Result}; | ||
| use kubewarden_policy_sdk::metadata::ProtocolVersion; | ||
| use kubewarden_policy_sdk::settings::SettingsValidationResponse; | ||
| use std::fmt; | ||
|
|
||
| use crate::admission_response::AdmissionResponse; | ||
| use crate::evaluation_context::EvaluationContext; | ||
| use crate::policy_evaluator::{PolicySettings, ValidateRequest}; | ||
| use crate::runtimes::rego::Runtime as BurregoRuntime; | ||
| use crate::runtimes::wapc::Runtime as WapcRuntime; | ||
| use crate::runtimes::wasi_cli::Runtime as WasiRuntime; | ||
| use crate::runtimes::Runtime; | ||
|
|
||
| pub struct PolicyEvaluator { | ||
| runtime: Runtime, | ||
| eval_ctx: EvaluationContext, | ||
| } | ||
|
|
||
| impl PolicyEvaluator { | ||
| pub(crate) fn new(runtime: Runtime, eval_ctx: &EvaluationContext) -> Self { | ||
| Self { | ||
| runtime, | ||
| eval_ctx: eval_ctx.to_owned(), | ||
| } | ||
| } | ||
|
|
||
| #[tracing::instrument(skip(request))] | ||
| pub fn validate( | ||
| &mut self, | ||
| request: ValidateRequest, | ||
| settings: &PolicySettings, | ||
| ) -> AdmissionResponse { | ||
| match self.runtime { | ||
| Runtime::Wapc(ref mut wapc_stack) => { | ||
| WapcRuntime(wapc_stack).validate(settings, &request) | ||
| } | ||
| Runtime::Rego(ref mut burrego_evaluator) => { | ||
| let kube_ctx = burrego_evaluator.build_kubernetes_context( | ||
| self.eval_ctx.callback_channel.as_ref(), | ||
| &self.eval_ctx.ctx_aware_resources_allow_list, | ||
| ); | ||
| match kube_ctx { | ||
| Ok(ctx) => BurregoRuntime(burrego_evaluator).validate(settings, &request, &ctx), | ||
| Err(e) => { | ||
| AdmissionResponse::reject(request.uid().to_string(), e.to_string(), 500) | ||
| } | ||
| } | ||
| } | ||
| Runtime::Cli(ref mut cli_stack) => WasiRuntime(cli_stack).validate(settings, &request), | ||
| } | ||
| } | ||
|
|
||
| #[tracing::instrument] | ||
| pub fn validate_settings(&mut self, settings: &PolicySettings) -> SettingsValidationResponse { | ||
| let settings_str = match serde_json::to_string(settings) { | ||
| Ok(settings) => settings, | ||
| Err(err) => { | ||
| return SettingsValidationResponse { | ||
| valid: false, | ||
| message: Some(format!("could not marshal settings: {err}")), | ||
| } | ||
| } | ||
| }; | ||
|
|
||
| match self.runtime { | ||
| Runtime::Wapc(ref mut wapc_stack) => { | ||
| WapcRuntime(wapc_stack).validate_settings(settings_str) | ||
| } | ||
| Runtime::Rego(ref mut burrego_evaluator) => { | ||
| BurregoRuntime(burrego_evaluator).validate_settings(settings_str) | ||
| } | ||
| Runtime::Cli(ref mut cli_stack) => { | ||
| WasiRuntime(cli_stack).validate_settings(settings_str) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| pub fn protocol_version(&mut self) -> Result<ProtocolVersion> { | ||
| match &mut self.runtime { | ||
| Runtime::Wapc(ref mut wapc_stack) => WapcRuntime(wapc_stack).protocol_version(), | ||
| _ => Err(anyhow!( | ||
| "protocol_version is only applicable to a Kubewarden policy" | ||
| )), | ||
| } | ||
| } | ||
| } | ||
|
|
||
| impl fmt::Debug for PolicyEvaluator { | ||
| fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { | ||
| let runtime = self.runtime.to_string(); | ||
|
|
||
| f.debug_struct("PolicyEvaluator") | ||
| .field("runtime", &runtime) | ||
| .finish() | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| use crate::runtimes::{rego, wapc, wasi_cli}; | ||
|
|
||
| /// Holds pre-initialized stacks for all the types of policies we run | ||
| /// | ||
| /// Pre-initialized instances are key to reduce the evaluation time when | ||
| /// using on-demand PolicyEvaluator instances; where on-demand means that | ||
| /// each validation request has a brand new PolicyEvaluator that is discarded | ||
| /// once the evaluation is done. | ||
| pub(crate) enum StackPre { | ||
| Wapc(crate::runtimes::wapc::StackPre), | ||
| Wasi(crate::runtimes::wasi_cli::StackPre), | ||
| Rego(crate::runtimes::rego::StackPre), | ||
| } | ||
|
|
||
| impl From<wapc::StackPre> for StackPre { | ||
| fn from(wapc_stack_pre: wapc::StackPre) -> Self { | ||
| StackPre::Wapc(wapc_stack_pre) | ||
| } | ||
| } | ||
|
|
||
| impl From<wasi_cli::StackPre> for StackPre { | ||
| fn from(wasi_stack_pre: wasi_cli::StackPre) -> Self { | ||
| StackPre::Wasi(wasi_stack_pre) | ||
| } | ||
| } | ||
|
|
||
| impl From<rego::StackPre> for StackPre { | ||
| fn from(rego_stack_pre: rego::StackPre) -> Self { | ||
| StackPre::Rego(rego_stack_pre) | ||
| } | ||
| } |