Skip to content

Commit 571422f

Browse files
mruegmrueg
authored
Use if keyword to satisfy linter requirements (#564)
1 parent fdfe524 commit 571422f

File tree

30 files changed

+453
-319
lines changed

30 files changed

+453
-319
lines changed

‎examples/container-deny-added-caps/template.yaml

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,20 @@ spec:
1313
- |-
1414
package lib.core
1515
16+
import future.keywords.if
17+
1618
default is_gatekeeper := false
1719
18-
is_gatekeeper {
20+
is_gatekeeper if {
1921
has_field(input, "review")
2022
has_field(input.review, "object")
2123
}
2224
23-
resource := input.review.object {
25+
resource := input.review.object if {
2426
is_gatekeeper
2527
}
2628
27-
resource := input {
29+
resource := input if {
2830
not is_gatekeeper
2931
}
3032
@@ -47,74 +49,79 @@ spec:
4749
4850
gv := split(apiVersion, "/")
4951
50-
group := gv[0] {
52+
group := gv[0] if {
5153
contains(apiVersion, "/")
5254
}
5355
54-
group := "core" {
56+
group := "core" if {
5557
not contains(apiVersion, "/")
5658
}
5759
5860
version := gv[count(gv) - 1]
5961
60-
has_field(obj, field) {
62+
has_field(obj, field) if {
6163
not object.get(obj, field, "N_DEFINED") == "N_DEFINED"
6264
}
6365
64-
missing_field(obj, field) {
66+
missing_field(obj, field) if {
6567
obj[field] == ""
6668
}
6769
68-
missing_field(obj, field) {
70+
missing_field(obj, field) if {
6971
not has_field(obj, field)
7072
}
7173
- |-
7274
package lib.pods
7375
76+
import future.keywords.contains
77+
import future.keywords.if
78+
7479
import data.lib.core
7580
7681
default pod := false
7782
78-
pod := core.resource.spec.template {
83+
pod := core.resource.spec.template if {
7984
pod_templates := ["daemonset", "deployment", "job", "replicaset", "replicationcontroller", "statefulset"]
8085
lower(core.kind) == pod_templates[_]
8186
}
8287
83-
pod := core.resource {
88+
pod := core.resource if {
8489
lower(core.kind) == "pod"
8590
}
8691
87-
pod := core.resource.spec.jobTemplate.spec.template {
92+
pod := core.resource.spec.jobTemplate.spec.template if {
8893
lower(core.kind) == "cronjob"
8994
}
9095
91-
containers[container] {
96+
containers contains container if {
9297
keys := {"containers", "initContainers"}
9398
all_containers := [c | some k; keys[k]; c = pod.spec[k][_]]
9499
container := all_containers[_]
95100
}
96101
97-
volumes[pod.spec.volumes[_]]
102+
volumes contains pod.spec.volumes[_]
98103
- |-
99104
package lib.security
100105
101-
dropped_capability(container, cap) {
106+
import future.keywords.if
107+
108+
dropped_capability(container, cap) if {
102109
lower(container.securityContext.capabilities.drop[_]) == lower(cap)
103110
}
104111
105-
dropped_capability(psp, cap) {
112+
dropped_capability(psp, cap) if {
106113
lower(psp.spec.requiredDropCapabilities[_]) == lower(cap)
107114
}
108115
109-
added_capability(container, cap) {
116+
added_capability(container, cap) if {
110117
lower(container.securityContext.capabilities.add[_]) == lower(cap)
111118
}
112119
113-
added_capability(psp, cap) {
120+
added_capability(psp, cap) if {
114121
lower(psp.spec.allowedCapabilities[_]) == lower(cap)
115122
}
116123
117-
added_capability(psp, cap) {
124+
added_capability(psp, cap) if {
118125
lower(psp.spec.defaultAddCapabilities[_]) == lower(cap)
119126
}
120127
rego: |-

‎examples/container-deny-escalation/template.yaml

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,20 @@ spec:
1313
- |-
1414
package lib.core
1515
16+
import future.keywords.if
17+
1618
default is_gatekeeper := false
1719
18-
is_gatekeeper {
20+
is_gatekeeper if {
1921
has_field(input, "review")
2022
has_field(input.review, "object")
2123
}
2224
23-
resource := input.review.object {
25+
resource := input.review.object if {
2426
is_gatekeeper
2527
}
2628
27-
resource := input {
29+
resource := input if {
2830
not is_gatekeeper
2931
}
3032
@@ -47,54 +49,57 @@ spec:
4749
4850
gv := split(apiVersion, "/")
4951
50-
group := gv[0] {
52+
group := gv[0] if {
5153
contains(apiVersion, "/")
5254
}
5355
54-
group := "core" {
56+
group := "core" if {
5557
not contains(apiVersion, "/")
5658
}
5759
5860
version := gv[count(gv) - 1]
5961
60-
has_field(obj, field) {
62+
has_field(obj, field) if {
6163
not object.get(obj, field, "N_DEFINED") == "N_DEFINED"
6264
}
6365
64-
missing_field(obj, field) {
66+
missing_field(obj, field) if {
6567
obj[field] == ""
6668
}
6769
68-
missing_field(obj, field) {
70+
missing_field(obj, field) if {
6971
not has_field(obj, field)
7072
}
7173
- |-
7274
package lib.pods
7375
76+
import future.keywords.contains
77+
import future.keywords.if
78+
7479
import data.lib.core
7580
7681
default pod := false
7782
78-
pod := core.resource.spec.template {
83+
pod := core.resource.spec.template if {
7984
pod_templates := ["daemonset", "deployment", "job", "replicaset", "replicationcontroller", "statefulset"]
8085
lower(core.kind) == pod_templates[_]
8186
}
8287
83-
pod := core.resource {
88+
pod := core.resource if {
8489
lower(core.kind) == "pod"
8590
}
8691
87-
pod := core.resource.spec.jobTemplate.spec.template {
92+
pod := core.resource.spec.jobTemplate.spec.template if {
8893
lower(core.kind) == "cronjob"
8994
}
9095
91-
containers[container] {
96+
containers contains container if {
9297
keys := {"containers", "initContainers"}
9398
all_containers := [c | some k; keys[k]; c = pod.spec[k][_]]
9499
container := all_containers[_]
95100
}
96101
97-
volumes[pod.spec.volumes[_]]
102+
volumes contains pod.spec.volumes[_]
98103
rego: |-
99104
package container_deny_escalation
100105

‎examples/container-deny-latest-tag/template.yaml

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,20 @@ spec:
1313
- |-
1414
package lib.core
1515
16+
import future.keywords.if
17+
1618
default is_gatekeeper := false
1719
18-
is_gatekeeper {
20+
is_gatekeeper if {
1921
has_field(input, "review")
2022
has_field(input.review, "object")
2123
}
2224
23-
resource := input.review.object {
25+
resource := input.review.object if {
2426
is_gatekeeper
2527
}
2628
27-
resource := input {
29+
resource := input if {
2830
not is_gatekeeper
2931
}
3032
@@ -47,54 +49,57 @@ spec:
4749
4850
gv := split(apiVersion, "/")
4951
50-
group := gv[0] {
52+
group := gv[0] if {
5153
contains(apiVersion, "/")
5254
}
5355
54-
group := "core" {
56+
group := "core" if {
5557
not contains(apiVersion, "/")
5658
}
5759
5860
version := gv[count(gv) - 1]
5961
60-
has_field(obj, field) {
62+
has_field(obj, field) if {
6163
not object.get(obj, field, "N_DEFINED") == "N_DEFINED"
6264
}
6365
64-
missing_field(obj, field) {
66+
missing_field(obj, field) if {
6567
obj[field] == ""
6668
}
6769
68-
missing_field(obj, field) {
70+
missing_field(obj, field) if {
6971
not has_field(obj, field)
7072
}
7173
- |-
7274
package lib.pods
7375
76+
import future.keywords.contains
77+
import future.keywords.if
78+
7479
import data.lib.core
7580
7681
default pod := false
7782
78-
pod := core.resource.spec.template {
83+
pod := core.resource.spec.template if {
7984
pod_templates := ["daemonset", "deployment", "job", "replicaset", "replicationcontroller", "statefulset"]
8085
lower(core.kind) == pod_templates[_]
8186
}
8287
83-
pod := core.resource {
88+
pod := core.resource if {
8489
lower(core.kind) == "pod"
8590
}
8691
87-
pod := core.resource.spec.jobTemplate.spec.template {
92+
pod := core.resource.spec.jobTemplate.spec.template if {
8893
lower(core.kind) == "cronjob"
8994
}
9095
91-
containers[container] {
96+
containers contains container if {
9297
keys := {"containers", "initContainers"}
9398
all_containers := [c | some k; keys[k]; c = pod.spec[k][_]]
9499
container := all_containers[_]
95100
}
96101
97-
volumes[pod.spec.volumes[_]]
102+
volumes contains pod.spec.volumes[_]
98103
rego: |-
99104
package container_deny_latest_tag
100105

0 commit comments

Comments
 (0)