Documentation
¶
Index ¶
- type CelRuleCreator
- func (c *CelRuleCreator) Accepts(kind string) bool
- func (c *CelRuleCreator) CreateAllRules() []rules.RuleEvaluator
- func (c *CelRuleCreator) CreateRuleByID(id string) rules.RuleEvaluator
- func (c *CelRuleCreator) CreateRuleByName(name string) rules.RuleEvaluator
- func (c *CelRuleCreator) CreateRulesByTags(tags []string) []rules.RuleEvaluator
- func (c *CelRuleCreator) KindFilter() *KindFilter
- func (c *CelRuleCreator) SyncRules(rules []armotypes.RuntimeRule)
- type CelRuleEvaluator
- func (e *CelRuleEvaluator) GetParameters() map[string]interface{}
- func (e *CelRuleEvaluator) ID() string
- func (e *CelRuleEvaluator) Name() string
- func (e *CelRuleEvaluator) ProcessEvent(attrs admission.Attributes, access objectcache.KubernetesCache) rules.RuleFailure
- func (e *CelRuleEvaluator) SetParameters(parameters map[string]interface{})
- type KindFilter
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type CelRuleCreator ¶
type CelRuleCreator struct {
// contains filtered or unexported fields
}
CelRuleCreator implements rules.RuleCreator backed by a []armotypes.RuntimeRule that can be replaced atomically via SyncRules.
func NewCelRuleCreator ¶
func NewCelRuleCreator(celEngine *admissioncel.AdmissionCEL) *CelRuleCreator
NewCelRuleCreator returns a new CelRuleCreator with no rules loaded yet.
func (*CelRuleCreator) Accepts ¶
func (c *CelRuleCreator) Accepts(kind string) bool
Accepts reports whether at least one currently-loaded rule could match an admission event of the given Kind. Always reads the latest filter snapshot, so it stays correct across SyncRules calls without callers having to refresh.
func (*CelRuleCreator) CreateAllRules ¶
func (c *CelRuleCreator) CreateAllRules() []rules.RuleEvaluator
CreateAllRules returns evaluators for every loaded rule.
func (*CelRuleCreator) CreateRuleByID ¶
func (c *CelRuleCreator) CreateRuleByID(id string) rules.RuleEvaluator
CreateRuleByID returns a RuleEvaluator for the rule with the given ID, or nil if no matching rule exists.
func (*CelRuleCreator) CreateRuleByName ¶
func (c *CelRuleCreator) CreateRuleByName(name string) rules.RuleEvaluator
CreateRuleByName returns a RuleEvaluator for the first rule whose Name matches, or nil if no matching rule exists.
func (*CelRuleCreator) CreateRulesByTags ¶
func (c *CelRuleCreator) CreateRulesByTags(tags []string) []rules.RuleEvaluator
CreateRulesByTags returns evaluators for all rules that have at least one tag in common with the requested tags set.
func (*CelRuleCreator) KindFilter ¶
func (c *CelRuleCreator) KindFilter() *KindFilter
KindFilter returns the current set of Kinds at least one loaded rule could match. Used by the validator to skip evaluation for unrelated admission events. The returned filter is a snapshot; callers must not mutate it.
func (*CelRuleCreator) SyncRules ¶
func (c *CelRuleCreator) SyncRules(rules []armotypes.RuntimeRule)
SyncRules replaces the internal rule set with a copy of the provided slice. It is safe to call concurrently. After the swap, the CEL engine's program cache is pruned to the expressions still referenced by the new rule set so memory does not grow monotonically as rules are added and removed.
type CelRuleEvaluator ¶
type CelRuleEvaluator struct {
// contains filtered or unexported fields
}
CelRuleEvaluator wraps a single armotypes.RuntimeRule and evaluates it against k8s admission events using the shared AdmissionCEL engine.
func (*CelRuleEvaluator) GetParameters ¶
func (e *CelRuleEvaluator) GetParameters() map[string]interface{}
GetParameters returns the per-binding parameter overrides.
func (*CelRuleEvaluator) ID ¶
func (e *CelRuleEvaluator) ID() string
ID returns the rule's unique identifier.
func (*CelRuleEvaluator) Name ¶
func (e *CelRuleEvaluator) Name() string
Name returns the rule's human-readable name.
func (*CelRuleEvaluator) ProcessEvent ¶
func (e *CelRuleEvaluator) ProcessEvent(attrs admission.Attributes, access objectcache.KubernetesCache) rules.RuleFailure
ProcessEvent evaluates the rule's CEL expressions against the admission event. Returns nil when the rule does not fire for this event. Returns a RuleFailure when the rule matches.
func (*CelRuleEvaluator) SetParameters ¶
func (e *CelRuleEvaluator) SetParameters(parameters map[string]interface{})
SetParameters stores per-binding parameter overrides.
type KindFilter ¶
type KindFilter struct {
// contains filtered or unexported fields
}
KindFilter is the set of admission Kinds that at least one currently-loaded rule could match. It is built from the loaded rule expressions at SyncRules time and used by the validator to skip CEL evaluation for events no rule targets.
The filter is *conservative*: if an expression cannot be statically resolved to a finite set of Kinds (e.g. it uses ||, has no event.Kind == constraint, or uses set membership / regex), the filter falls back to wildcard mode and accepts every Kind. Correctness is preserved at the cost of skipping the optimization.
func (*KindFilter) Accepts ¶
func (f *KindFilter) Accepts(kind string) bool
Accepts reports whether at least one loaded rule could match an admission event of the given Kind. Wildcard filters accept every Kind.
func (*KindFilter) IsWildcard ¶
func (f *KindFilter) IsWildcard() bool
IsWildcard reports whether the filter accepts every Kind.
func (*KindFilter) Kinds ¶
func (f *KindFilter) Kinds() []string
Kinds returns the set of admission Kinds this filter explicitly accepts. Returns nil for wildcard filters.
Source Files