policy

package
v0.8.5 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: Apache-2.0 Imports: 3 Imported by: 0

Documentation

Overview

Package policy evaluates deploy guardrail rules against what an app is about to run. It is pure: callers resolve the layers and the subject.

Index

Constants

View Source 
const (
	ScopeOrg         = "org"
	ScopeProject     = "project"
	ScopeEnvironment = "environment"
	// OrgScopeID is the single organization-wide scope id.
	OrgScopeID = "org"
)

Scopes a rule set can be attached to, least to most specific.

View Source 
const (
	RuleAllowedRegistries = "allowed_registries"
	RuleRequireReadiness  = "require_readiness_probe"
	RuleMaxMemoryMB       = "max_memory_mb"
	RuleMaxCPU            = "max_cpu"
	RuleForbidPrivileged  = "forbid_privileged"
	RuleForbidHostMounts  = "forbid_host_mounts"
	RuleRequiredLabels    = "required_labels"
	RuleMaxReplicas       = "max_replicas"
)

Rule ids, the keys of a Set.

View Source 
const (
	CodeRegistryNotAllowed  = "policy_registry_not_allowed"
	CodeReadinessRequired   = "policy_readiness_probe_required"
	CodeMemoryCeiling       = "policy_memory_ceiling_exceeded"
	CodeCPUCeiling          = "policy_cpu_ceiling_exceeded"
	CodePrivilegedForbidden = "policy_privileged_forbidden"
	CodeHostMountForbidden  = "policy_host_mount_forbidden"
	CodeLabelRequired       = "policy_label_required"
	CodeReplicasExceeded    = "policy_replicas_exceeded"
	// CodeViolation is the response code of a blocked deploy.
	CodeViolation = "policy_violation"
)

Stable machine readable violation codes.

Variables

This section is empty.

Functions

func RegistryOf 

func RegistryOf(image string) string

RegistryOf returns the registry host an image reference pulls from.

func RuleIDs 

func RuleIDs() []string

RuleIDs lists every known rule in display order.

func Validate 

func Validate(s Set) error

Validate rejects unknown rules, modes, and rules missing what they need.

Types

type Mode 

type Mode string

Mode is how a rule reacts: off ignores it, warn reports it, enforce blocks. 

const (
	ModeOff     Mode = "off"
	ModeWarn    Mode = "warn"
	ModeEnforce Mode = "enforce"
)

Rule modes.

type Rule 

type Rule struct {
	Mode   Mode     `json:"mode"`
	Values []string `json:"values,omitempty"`
	Limit  float64  `json:"limit,omitempty"`
}

Rule is one guardrail. Values carries list rules (registries, labels, allowed host path prefixes); Limit carries numeric ceilings.

type Set 

type Set map[string]Rule

Set maps a rule id to its rule.

func Merge 

func Merge(layers ...Set) Set

Merge layers rule sets from least to most specific; a later layer's rule replaces an earlier one with the same id, so an environment can relax or tighten what the organization set.

type Subject 

type Subject struct {
	Image        string
	MemoryBytes  int64
	NanoCPUs     int64
	HasReadiness bool
	Privileged   bool
	HostMounts   []string
	Labels       map[string]string
	Replicas     int
}

Subject is the deploy being judged. Zero MemoryBytes or NanoCPUs mean no limit is set, which a ceiling treats as exceeding it.

type Violation 

type Violation struct {
	Rule       string `json:"rule"`
	Code       string `json:"code"`
	Mode       Mode   `json:"mode"`
	Message    string `json:"message"`
	NextAction string `json:"next_action"`
}

Violation is one rule a subject breaks, with a stable code and the next action for a human.

func Blocking 

func Blocking(vs []Violation) []Violation

Blocking returns the violations that stop a deploy.

func Evaluate 

func Evaluate(s Set, subj Subject) []Violation

Evaluate returns every violation of s by subj, in rule display order.

func (Violation) Blocks 

func (v Violation) Blocks() bool

Blocks reports whether this violation stops a deploy.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.