Migrate policy-controller-validate to use kyaml

examples/validators/policy-controller-validate/invalid/.expected/config.yaml

@@ -0,0 +1,2 @@
+exitCode: 1
+runCount: 2

examples/validators/policy-controller-validate/invalid/.expected/results.yaml

@@ -0,0 +1,12 @@
+name: policy-controller-validate
+items:
+- message: |+
+    Found 1 violations:
+
+    [1] The following banned keys are being used in the config map: {"private_key"}
+
+    name: "super-secret"
+    path: resources.yaml
+    violatedConstraint: no-secrets-in-configmap
+
+  severity: error

examples/validators/policy-controller-validate/invalid/.krmignore

@@ -0,0 +1 @@
+.expected

examples/validators/policy-controller-validate/invalid/README.md

@@ -0,0 +1,3 @@
+# policy-controller-validate: invalid resources
+
+TODO

examples/validators/policy-controller-validate/invalid/fn-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: my-func-config
+  annotations:
+    config.k8s.io/function: |
+      container:
+        image: gcr.io/kpt-fn/policy-controller-validate:unstable
+    config.kubernetes.io/local-config: 'true'

examples/validators/policy-controller-validate/invalid/resources.yaml

@@ -0,0 +1,51 @@
+apiVersion: templates.gatekeeper.sh/v1beta1
+kind: ConstraintTemplate
+metadata:
+  name: k8sbannedconfigmapkeysv1
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sBannedConfigMapKeysV1
+        validation:
+          openAPIV3Schema:
+            properties:
+              keys:
+                type: array
+                items:
+                  type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |-
+        package ban_keys
+
+        violation[{"msg": sprintf("%v", [val])}] {
+          keys = {key | input.review.object.data[key]}
+          banned = {key | input.parameters.keys[_] = key}
+          overlap = keys & banned
+          count(overlap) > 0
+          val := sprintf("The following banned keys are being used in the config map: %v", [overlap])
+        }
+---
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sBannedConfigMapKeysV1
+metadata:
+  name: no-secrets-in-configmap
+spec:
+  match:
+    kinds:
+      - apiGroups:
+          - ''
+        kinds:
+          - ConfigMap
+  parameters:
+    keys:
+      - private_key
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: super-secret
+  namespace: default
+data:
+  private_key: sensitive data goes here

examples/validators/policy-controller-validate/valid/.expected/config.yaml

@@ -0,0 +1 @@
+runCount: 2

examples/validators/policy-controller-validate/valid/.krmignore

@@ -0,0 +1 @@
+.expected

examples/validators/policy-controller-validate/valid/README.md

@@ -0,0 +1,3 @@
+# policy-controller-validate: valid resources
+
+TODO

examples/validators/policy-controller-validate/valid/fn-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: my-func-config
+  annotations:
+    config.k8s.io/function: |
+      container:
+        image: gcr.io/kpt-fn/policy-controller-validate:unstable
+    config.kubernetes.io/local-config: 'true'

examples/validators/policy-controller-validate/valid/resources.yaml

@@ -0,0 +1,51 @@
+apiVersion: templates.gatekeeper.sh/v1beta1
+kind: ConstraintTemplate
+metadata:
+  name: k8sbannedconfigmapkeysv1
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sBannedConfigMapKeysV1
+        validation:
+          openAPIV3Schema:
+            properties:
+              keys:
+                type: array
+                items:
+                  type: string
+  targets:
+  - rego: |-
+      package ban_keys
+
+      violation[{"msg": sprintf("%v", [val])}] {
+        keys = {key | input.review.object.data[key]}
+        banned = {key | input.parameters.keys[_] = key}
+        overlap = keys & banned
+        count(overlap) > 0
+        val := sprintf("The following banned keys are being used in the config map: %v", [overlap])
+      }
+    target: admission.k8s.gatekeeper.sh
+---
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sBannedConfigMapKeysV1
+metadata:
+  name: no-secrets-in-configmap
+spec:
+  match:
+    kinds:
+    - apiGroups:
+      - ''
+      kinds:
+      - ConfigMap
+  parameters:
+    keys:
+    - private_key
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: super-secret
+  namespace: default
+data:
+  public_key: no secrets here

functions/go/Makefile

@@ -23,7 +23,8 @@ FUNCTIONS := \
 	set-namespace \
 	starlark \
 	apply-setters \
-	search-replace
+	search-replace \
+	policy-controller-validate
 
 # Targets for running all function tests
 FUNCTION_TESTS := $(patsubst %,%-TEST,$(FUNCTIONS))

functions/go/policy-controller-validate/Dockerfile

@@ -0,0 +1,15 @@
+FROM golang:1.15-alpine3.12
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN go build -o /usr/local/bin/validate ./
+
+#############################################
+
+FROM alpine:3.12
+COPY --from=0 /usr/local/bin/validate /usr/local/bin/validate
+ENTRYPOINT ["validate"]

functions/go/policy-controller-validate/go.mod

@@ -0,0 +1,11 @@
+module github.com/GoogleContainerTools/kpt-functions-catalog/functions/go/policy-controller-validate
+
+go 1.15
+
+require (
+	github.com/open-policy-agent/frameworks/constraint v0.0.0-20210317225149-4f80ac172ddf
+	github.com/open-policy-agent/gatekeeper v3.0.4-beta.2+incompatible
+	k8s.io/apimachinery v0.17.2
+	sigs.k8s.io/kustomize/kyaml v0.10.13
+	sigs.k8s.io/yaml v1.2.0
+)