feat: adding scopedenforcementactions #403
Conversation
JaydipGabani
force-pushed
the
multi-ea
branch
2 times, most recently
from
0c29c4c
to
b09049c
Compare
JaydipGabani
force-pushed
the
multi-ea
branch
3 times, most recently
from
7bea138
to
8a991c7
Compare
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
| val = append(val, &types.Result{ | ||
| Msg: r.error.Error(), | ||
| Constraint: r.constraint, | ||
| EnforcementAction: action, |
There was a problem hiding this comment.
Should probably just update EnforcementAction to be an array, otherwise we use RAM storing duplicate messages.
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #403 +/- ##
==========================================
- Coverage 54.68% 53.93% -0.75%
==========================================
Files 71 104 +33
Lines 5241 6726 +1485
==========================================
+ Hits 2866 3628 +762
- Misses 2073 2729 +656
- Partials 302 369 +67
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
@maxsmythe Sorry for the delay. I have addressed all the comments and implemented the feedback. PTAL. |
Signed-off-by: Jaydipkumar Arvindbhai Gabani <gabanijaydip@gmail.com>
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if len(actionsForEP[apiconstraints.WebhookEnforcementPoint]) == 0 { |
There was a problem hiding this comment.
Should VAP be its own enforcement point?
There was a problem hiding this comment.
that makes sense and the actions will be mapped as: deny, warn, audit as part of the generated vap resource.
There was a problem hiding this comment.
does enforcementPoints validation.gatekeeper.sh -> gatekeeper webhook & admission.k8s.io -> VAP work?
There was a problem hiding this comment.
Maybe? Probably best to bikeshed on naming at the community meeting. Admission webhooks are their own concept in K8s, IIRC.
vap.k8s.io?
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>
This PR implements changes for multi ea/ep design
For gatekeeper changes and CI tests refer to PR gatekeeper/3321