feat: raw policy validation #357
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fabriziosestito
added
kind/enhancement
fabriziosestito
force-pushed
the
feat/raw-validations
branch
from
2bc2c9f to
08d112a
Compare
viccuad
approved these changes
Oct 23, 2023
fabriziosestito
force-pushed
the
feat/raw-validations
branch
from
55586f8 to
a5c7cc5
Compare
flavio
requested changes
Oct 24, 2023
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
fabriziosestito
force-pushed
the
feat/raw-validations
branch
from
a5c7cc5 to
4850533
Compare
flavio
approved these changes
Oct 24, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Change the policy evaluator and the existing runtimes to support "raw" policy requests.
Raw requests are generic requests that are not in the form of Kubernetes AdmissionRequests.
The AdmissionRequest type has been moved from the policy-server to this repo, which already contains the AdmissionResponse type.
The ValidatieRequest type has been refactored into an Enum type to support the new variant and runtimes have been changed accordingly.
The only exception is the Gatekeeper execution mode, being Gatekeeper k8s only by nature.
Note that we are still using the AdmissionResponse type as the return type of an evaluation since it is generic enough. The only difference is that we will not wrap it inside an AdmissionReview in the policy server if the user has requested a raw policy validation.
Related to: kubewarden/kubewarden-controller#527
Test
Since the current testing is structured this way, most of the tests are done in the policy-server e2e tests.
We could improve this by adding runtime-related integration tests inside this crate.
See: #358
Additional Information
Tradeoff