Git Product home page Git Product logo

Comments (6)

JimBugwadia avatar JimBugwadia commented on August 14, 2024 1

Hi @lavishpal - lets keep this as tracking issue, as there are many policies to update.

Can you select one of the sub-tasks instead?

#1090
#1091
#1092
#1093
#1094
#1095
#1096
#1097
#1098
#1099
#1100

from policies.

Chandan-DK avatar Chandan-DK commented on August 14, 2024

cc @JimBugwadia @MariamFahmy98

from policies.

JimBugwadia avatar JimBugwadia commented on August 14, 2024

So, using these techniques we can simply a policy like this:

https://kyverno.io/policies/pod-security-cel/restricted/require-run-as-nonroot/require-run-as-nonroot/

      validate:
        cel:
          expressions:
            - expression: >-
                (
                    (
                      has(object.spec.securityContext) &&
                      has(object.spec.securityContext.runAsNonRoot) &&
                      object.spec.securityContext.runAsNonRoot == true
                    ) && (
                      (
                          object.spec.containers +
                          (has(object.spec.initContainers) ? object.spec.initContainers : []) +
                          (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : [])
                      ).all(container,
                          !has(container.securityContext) ||
                          !has(container.securityContext.runAsNonRoot) ||
                          container.securityContext.runAsNonRoot == true)
                    )
                ) || (
                    (
                        object.spec.containers +
                        (has(object.spec.initContainers) ? object.spec.initContainers : []) +
                        (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : [])
                    ).all(container,
                        has(container.securityContext) &&
                        has(container.securityContext.runAsNonRoot) &&
                        container.securityContext.runAsNonRoot == true)
                )

to:

      validate:
        cel:
          variables:
          - name: ctnrs
            expression: >-
              object.spec.containers +
              (has(object.spec.initContainers) ? object.spec.initContainers : []) +
              (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : [])
          expressions:
            - expression: >-
                (object.spec.?securityContext.?runAsNonRoot.orValue(false) == true
                  && variables.ctnrs.all(c, c.?securityContext.?runAsNonRoot.orValue(true) == true))
                  || variables.ctnrs.all(c, c.?securityContext.?runAsNonRoot.orValue(false) == true)

from policies.

Chandan-DK avatar Chandan-DK commented on August 14, 2024

Here are some more examples of simplifying CEL expressions in policies using optionals:

Example 1

has(object.metadata.annotations) && 'pod.kubernetes.io/lifetime' in object.metadata.annotations

Can be written as

object.metadata.?annotations[?'pod.kubernetes.io/lifetime'].orValue(false)

Playground

Example 2

(object.spec.containers + (has(object.spec.initContainers) ? object.spec.initContainers : []) + (has(object.spec.ephemeralContainers) ? object.spec.ephemeralContainers : []))

Can be written as:

object.spec.containers + object.spec.?initContainers.orValue([]) + object.spec.?ephemeralContainers.orValue([])

Playground

Example 3

has(object.spec.template.metadata) && has(object.spec.template.metadata.labels) && 'foo' in object.spec.template.metadata.labels

Can be written as:

object.spec.template.?metadata.?labels.?foo.hasValue()

Playground

Example 4

has(object.metadata.labels) && 'corp.org/version' in object.metadata.labels && object.metadata.labels['corp.org/version'].matches('^v[0-9].[0-9].[0-9]$')

Can be written as:

object.metadata.?labels[?'corp.org/version'].orValue('default').matches('^v[0-9].[0-9].[0-9]$')

Playground

Example 5

!has(object.spec.volumes) || object.spec.volumes.all(volume, !has(volume.secret))

Can be written as:

object.spec.?volumes.orValue([]).all(volume, !has(volume.secret))

Playground

from policies.

lavishpal avatar lavishpal commented on August 14, 2024

Hi @JimBugwadia , Could you assign this issue to me, it will be helpful if you provide guidance on how to get started?

from policies.

lavishpal avatar lavishpal commented on August 14, 2024

@Chandan-DK , @JimBugwadia Can I raise the pr for all .

from policies.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.