Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Remove validation of constraint template rego #3262

Merged
merged 2 commits into from
Feb 14, 2024
Merged

fix: Remove validation of constraint template rego #3262

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
43f33c9
Remove validation of constraint template rego
mzkhan Feb 11, 2024
8e049c6
Run gofumpt and address comments
mzkhan Feb 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -405,12 +405,6 @@ func setupControllers(ctx context.Context, mgr ctrl.Manager, sw *watch.Controlle

cfArgs := []constraintclient.Opt{constraintclient.Targets(&target.K8sValidationTarget{})}

if *webhook.ValidateTemplateRego && *enableK8sCel {
err := fmt.Errorf("cannot validate template rego when K8s cel is enabled. Please disable K8s cel by setting --experimental-enable-k8s-native-validation=false or disable template rego validation by setting --validate-template-rego=false")
setupLog.Error(err, "unable to set up OPA and K8s native drivers")
return err
}

if *enableK8sCel {
// initialize K8sValidation
k8sDriver, err := k8scel.New()
Expand Down
21 changes: 1 addition & 20 deletions pkg/webhook/policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ import (
externaldataUnversioned "github.com/open-policy-agent/frameworks/constraint/pkg/apis/externaldata/unversioned"
constraintclient "github.com/open-policy-agent/frameworks/constraint/pkg/client"
"github.com/open-policy-agent/frameworks/constraint/pkg/client/drivers"
"github.com/open-policy-agent/frameworks/constraint/pkg/client/drivers/rego"
"github.com/open-policy-agent/frameworks/constraint/pkg/core/templates"
"github.com/open-policy-agent/frameworks/constraint/pkg/externaldata"
rtypes "github.com/open-policy-agent/frameworks/constraint/pkg/types"
Expand Down Expand Up @@ -69,10 +68,7 @@ import (
// https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#response
const httpStatusWarning = 299

var (
ValidateTemplateRego = flag.Bool("validate-template-rego", true, "validate Rego code for constraint templates. Defaults to true. This flag will be removed in Gatekeeper v3.16 and cannot be used if `experimental-enable-k8s-native-validation` flag is set. Use Gator to validate in shift left manner to avoid impact with this behavior change.). Use Gator to validate in shift left manner to avoid impact with this behavior change.")
maxServingThreads = flag.Int("max-serving-threads", -1, "cap the number of threads handling non-trivial requests, -1 caps the number of threads to GOMAXPROCS. Defaults to -1.")
)
var maxServingThreads = flag.Int("max-serving-threads", -1, "cap the number of threads handling non-trivial requests, -1 caps the number of threads to GOMAXPROCS. Defaults to -1.")

func init() {
AddToManagerFuncs = append(AddToManagerFuncs, AddPolicyWebhook)
Expand Down Expand Up @@ -398,21 +394,6 @@ func (h *validationHandler) validateTemplate(ctx context.Context, req *admission
return true, err
}

// TODO: This is a temporary check for rego to give enough time to users to migrate to gator for validation. To be removed before 3.16.
if *ValidateTemplateRego {
// Create a temporary Driver and attempt to add the Template to it. This
// ensures the Rego code both parses and compiles.
d, err := rego.New()
if err != nil {
return false, fmt.Errorf("unable to create Driver: %w", err)
}

err = d.AddTemplate(ctx, unversioned)
if err != nil {
return true, err
}
}

return false, nil
}

Expand Down
1 change: 0 additions & 1 deletion website/docs/constrainttemplates.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@ ConstraintTemplates define a way to validate some set of Kubernetes objects in G
1. [Rego](https://www.openpolicyagent.org/docs/latest/#rego) code that defines a policy violation
2. The schema of the accompanying `Constraint` object, which represents an instantiation of a `ConstraintTemplate`

> ❗ Validation of Rego for constraint templates is enabled by default. Set `validate-template-rego` flag to `false` to disable rego validation if you want to use `experimental-enable-k8s-native-validation` Kubernetes CEL based policies as well. This flag will be removed from Gatekeeper 3.16 and later, please make use of [Gator](https://open-policy-agent.github.io/gatekeeper/website/docs/gator) to validate constraint template in shift left manner to avoid any impact with this behavior change.

## `v1` Constraint Template

Expand Down
2 changes: 1 addition & 1 deletion website/docs/validating-admission-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ title: Integration with Kubernetes Validating Admission Policy
`Feature State`: Gatekeeper version v3.13+ (pre-alpha)

> ❗ This feature is pre-alpha, subject to change (feedback is welcome!). It is disabled by default. To enable the feature,
> set the `experimental-enable-k8s-native-validation` flag to true and use the [development build of Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/docs/install/#deploying-a-release-using-development-image). Do not use this feature with `validate-template-rego` flag enabled, as the policies with CEL would get rejected with Rego compilation error.
> set the `experimental-enable-k8s-native-validation` flag to true and use the [development build of Gatekeeper](https://open-policy-agent.github.io/gatekeeper/website/docs/install/#deploying-a-release-using-development-image).
## Description

Expand Down
Loading