Rewrite policy-controller-validate with kyaml

examples/validators/gatekeeper-validate/invalid-configmap/.expected/config.yaml

@@ -0,0 +1,2 @@
+exitCode: 1
+runCount: 2

examples/validators/gatekeeper-validate/invalid-configmap/.expected/results.yaml

@@ -0,0 +1,14 @@
+items:
+- message: |-
+    The following banned keys are being used in the config map: {"private_key"}
+    violatedConstraint: no-secrets-in-configmap
+  severity: error
+  resourceRef:
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: super-secret
+      namespace: default
+  file:
+    path: resources.yaml
+    index: 2

examples/validators/gatekeeper-validate/invalid-configmap/.krmignore

@@ -0,0 +1 @@
+.expected

examples/validators/gatekeeper-validate/invalid-configmap/README.md

@@ -0,0 +1,73 @@
+# gatekeeper-validate: invalid configmap
+
+## Overview
+
+This example demonstrates how to validate config maps using a constraint.
+
+There are 3 resources: a ConstraintTemplate, a K8sBannedConfigMapKeysV1 and a
+ConfigMap.
+The constraint disallows `private_key` to be used as a key in the config map.
+
+## Function invocation
+
+Get the package:
+
+```shell
+$ kpt pkg get https://github.com/GoogleContainerTools/kpt-functions-catalog.git/examples/validators/gatekeeper-validate/invalid-configmap .
+```
+
+Create a directory for storing the structured output.
+
+```shell
+$ cd invalid-configmap
+$ mkdir results
+```
+
+Run the function:
+
+```shell
+$ kpt fn run --results-dir=results .
+```
+
+## Expected result
+
+You should see the following output:
+
+```
+The following banned keys are being used in the config map: {"private_key"}
+violatedConstraint: no-secrets-in-configmaperror: exit status 1
+```
+
+Let's take a look at the structured output:
+
+```shell
+$ cat results/results-0.yaml 
+items:
+- message: |-
+    The following banned keys are being used in the config map: {"private_key"}
+    violatedConstraint: no-secrets-in-configmap
+  severity: error
+  resourceRef:
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: super-secret
+      namespace: default
+  file:
+    path: resources.yaml
+    index: 2
+```
+
+You can find:
+- a detailed error message
+- what resource violates the constraints
+- what constraint does it violate
+- where does the resource live and its index in the file
+
+To pass validation, let's replace the key `private_key` in the ConfigMap in
+`resources.yaml` with something else e.g. `public_key`.
+Rerun the command. It will succeed (no output).
+
+## Function Reference
+
+TODO: add the link

examples/validators/gatekeeper-validate/invalid-configmap/fn-config.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: my-func-config
+  annotations:
+    config.k8s.io/function: |
+      container:
+        image: gcr.io/kpt-fn/gatekeeper-validate:unstable
+    config.kubernetes.io/local-config: 'true'

examples/validators/gatekeeper-validate/invalid-configmap/resources.yaml

@@ -0,0 +1,51 @@
+apiVersion: templates.gatekeeper.sh/v1beta1
+kind: ConstraintTemplate
+metadata:
+  name: k8sbannedconfigmapkeysv1
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sBannedConfigMapKeysV1
+        validation:
+          openAPIV3Schema:
+            properties:
+              keys:
+                type: array
+                items:
+                  type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |-
+        package ban_keys
+
+        violation[{"msg": sprintf("%v", [val])}] {
+          keys = {key | input.review.object.data[key]}
+          banned = {key | input.parameters.keys[_] = key}
+          overlap = keys & banned
+          count(overlap) > 0
+          val := sprintf("The following banned keys are being used in the config map: %v", [overlap])
+        }
+---
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sBannedConfigMapKeysV1
+metadata:
+  name: no-secrets-in-configmap
+spec:
+  match:
+    kinds:
+      - apiGroups:
+          - ''
+        kinds:
+          - ConfigMap
+  parameters:
+    keys:
+      - private_key
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: super-secret
+  namespace: default
+data:
+  private_key: sensitive data goes here

functions/go/Makefile

@@ -23,7 +23,8 @@ FUNCTIONS := \
 	set-namespace \
 	starlark \
 	apply-setters \
-	search-replace
+	search-replace \
+	gatekeeper-validate
 
 # Targets for running all function tests
 FUNCTION_TESTS := $(patsubst %,%-TEST,$(FUNCTIONS))

functions/go/gatekeeper-validate/Dockerfile

@@ -0,0 +1,15 @@
+FROM golang:1.15-alpine3.12
+ENV CGO_ENABLED=0
+WORKDIR /go/src/
+
+COPY go.mod go.sum ./
+RUN go mod download
+
+COPY . .
+RUN go build -o /usr/local/bin/validate ./
+
+#############################################
+
+FROM alpine:3.12
+COPY --from=0 /usr/local/bin/validate /usr/local/bin/validate
+ENTRYPOINT ["validate"]

functions/go/gatekeeper-validate/README.md

@@ -0,0 +1,41 @@
+# gatekeeper-validate
+
+### Overview
+
+<!--mdtogo:Short-->
+
+Validate the KRM resources using the policy controller.
+
+<!--mdtogo-->
+
+### Synopsis
+
+<!--mdtogo:Long-->
+
+You can use the policy controller to validate KRM resources. To learn more about
+the policy controller, see: https://cloud.google.com/anthos-config-management/docs/concepts/policy-controller.
+
+The function ensures the constraint policies are enforced on KRM resources.
+The function takes 3 types of resources from the input resource list:
+
+- constraint templates
+- constraints
+- other KRM resources
+
+Every constraint should be backed by a constraint template that defines the
+schema and logic of the constraint.
+
+To learn more about how to write constraint templates and constraints, see:
+https://cloud.google.com/anthos-config-management/docs/how-to/write-a-constraint-template
+and
+https://cloud.google.com/anthos-config-management/docs/how-to/creating-constraints.
+
+<!--mdtogo-->
+
+### Examples
+
+<!--mdtogo:Examples-->
+
+TODO: link to the examples
+
+<!--mdtogo-->

functions/go/gatekeeper-validate/go.mod

@@ -0,0 +1,11 @@
+module github.com/GoogleContainerTools/kpt-functions-catalog/functions/go/gatekeeper-validate
+
+go 1.15
+
+require (
+	github.com/open-policy-agent/frameworks/constraint v0.0.0-20210317225149-4f80ac172ddf
+	github.com/open-policy-agent/gatekeeper v3.0.4-beta.2+incompatible
+	k8s.io/apimachinery v0.17.2
+	sigs.k8s.io/kustomize/kyaml v0.10.13
+	sigs.k8s.io/yaml v1.2.0
+)