constraint

package

v3.23.0 Latest Latest Go to latest Published: Jul 9, 2026 License: Apache-2.0 Imports: 49 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/open-policy-agent/gatekeeper

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
Variables
func GetDefaultGenerateVAP() bool
func GetDefaultGenerateVAPB() bool
func GetDefaultWaitForVAPBGeneration() int
func SetDefaultGenerateVAP(value bool)
func SetDefaultGenerateVAPB(value bool)
func SetDefaultWaitForVAPBGeneration(value int)
func ShouldGenerateVAP(ct *templates.ConstraintTemplate) (bool, error)
type Adder
type ConstraintsCache
- func NewConstraintsCache() *ConstraintsCache
type ReconcileConstraint
- func (r *ReconcileConstraint) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error)
type StatsReporter

Constants ¶

View Source

const (
	BlockVAPBGenerationUntilAnnotation = "gatekeeper.sh/block-vapb-generation-until"
	VAPBGenerationAnnotation           = "gatekeeper.sh/vapb-generation-state"
	ErrGenerateVAPBState               = "error"
	GeneratedVAPBState                 = "generated"
	WaitVAPBState                      = "waiting"
	VAPBGenerationBlocked              = "blocked"
	VAPBGenerationUnblocked            = "unblocked"
)

Variables ¶

View Source

var (
	DefaultGenerateVAPB          = flag.Bool("default-create-vap-binding-for-constraints", true, "(beta) Create VAPBinding resource for constraint of the template containing VAP-style CEL source. Allowed values are false: do not create Validating Admission Policy Binding, true: create Validating Admission Policy Binding.")
	DefaultGenerateVAP           = flag.Bool("default-create-vap-for-templates", true, "(beta) Create VAP resource for template containing VAP-style CEL source. Allowed values are false: do not create Validating Admission Policy unless generateVAP: true is set on constraint template explicitly, true: create Validating Admission Policy unless generateVAP: false is set on constraint template explicitly.")
	DefaultWaitForVAPBGeneration = flag.Int("default-wait-for-vapb-generation", 30, "(beta) Wait time in seconds before generating a ValidatingAdmissionPolicyBinding after a constraint CRD is created.")
)

View Source

var (
	ErrValidatingAdmissionPolicyAPIDisabled = errors.New("validatingAdmissionPolicy API is not enabled")
	ErrVAPConditionsNotSatisfied            = errors.New("conditions are not satisfied to generate ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding")
)

Functions ¶

func GetDefaultGenerateVAP ¶ added in v3.23.0

func GetDefaultGenerateVAP() bool

GetDefaultGenerateVAP returns the default VAP generation setting.

func GetDefaultGenerateVAPB ¶ added in v3.23.0

func GetDefaultGenerateVAPB() bool

GetDefaultGenerateVAPB returns the default VAPB generation setting.

func GetDefaultWaitForVAPBGeneration ¶ added in v3.23.0

func GetDefaultWaitForVAPBGeneration() int

GetDefaultWaitForVAPBGeneration returns the default VAPB generation wait time in seconds.

func SetDefaultGenerateVAP ¶ added in v3.23.0

func SetDefaultGenerateVAP(value bool)

SetDefaultGenerateVAP updates the default VAP generation setting.

func SetDefaultGenerateVAPB ¶ added in v3.23.0

func SetDefaultGenerateVAPB(value bool)

SetDefaultGenerateVAPB updates the default VAPB generation setting.

func SetDefaultWaitForVAPBGeneration ¶ added in v3.23.0

func SetDefaultWaitForVAPBGeneration(value int)

SetDefaultWaitForVAPBGeneration updates the default VAPB generation wait time in seconds.

func ShouldGenerateVAP ¶ added in v3.17.0

func ShouldGenerateVAP(ct *templates.ConstraintTemplate) (bool, error)

Types ¶

type Adder ¶

type Adder struct {
	CFClient         *constraintclient.Client
	ConstraintsCache *ConstraintsCache
	WatchManager     *watch.Manager
	Events           <-chan event.GenericEvent
	Tracker          *readiness.Tracker
	GetPod           func(context.Context) (*corev1.Pod, error)
	ProcessExcluder  *process.Excluder
	// IfWatching allows the reconciler to only execute functions if a constraint
	// template is currently being watched. It is designed to be atomic to avoid
	// race conditions between the constraint controller and the constraint template
	// controller
	IfWatching func(schema.GroupVersionKind, func() error) (bool, error)
}

func (*Adder) Add ¶

func (a *Adder) Add(mgr manager.Manager) error

Add creates a new Constraint Controller and adds it to the Manager. The Manager will set fields on the Controller and Start it when the Manager is Started.

func (*Adder) InjectCFClient ¶ added in v3.14.0

func (a *Adder) InjectCFClient(c *constraintclient.Client)

func (*Adder) InjectTracker ¶

func (a *Adder) InjectTracker(t *readiness.Tracker)

func (*Adder) InjectWatchManager ¶

func (a *Adder) InjectWatchManager(w *watch.Manager)

type ConstraintsCache ¶

type ConstraintsCache struct {
	// contains filtered or unexported fields
}

func NewConstraintsCache ¶

func NewConstraintsCache() *ConstraintsCache

type ReconcileConstraint ¶

type ReconcileConstraint struct {
	// contains filtered or unexported fields
}

ReconcileConstraint reconciles an arbitrary constraint object described by Kind.

func (*ReconcileConstraint) Reconcile ¶

func (r *ReconcileConstraint) Reconcile(ctx context.Context, request reconcile.Request) (reconcile.Result, error)

Reconcile reads that state of the cluster for a constraint object and makes changes based on the state read and what is in the constraint.Spec.

type StatsReporter ¶

type StatsReporter interface {
	ReportVAPBStatus(name types.NamespacedName, status metrics.VAPStatus)
	DeleteVAPBStatus(name types.NamespacedName)
	// contains filtered or unexported methods
}

StatsReporter reports audit metrics.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL