transform

package
v3.23.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 9, 2026 License: Apache-2.0 Imports: 33 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrBadEnforcementAction = errors.New("invalid enforcement action")
	ErrOperationMismatch    = errors.New("operations mismatch between webhook and constraint template")
	ErrOperationNoMatch     = errors.New("no matching operations between webhook and constraint template")
)
View Source 
var GroupVersion *schema.GroupVersion
View Source 
var SyncVAPScope = flag.Bool("sync-vap-enforcement-scope", true, "(beta) Synchronize ValidatingAdmissionPolicy enforcement scope with Gatekeeper's admission validation scope. When enabled, VAP resources inherit match criteria, conditions, and namespace exclusions from Gatekeeper's webhook configuration, Config resource and exempt namespace flags. This ensures consistent policy enforcement between Gatekeeper and VAP but triggers constraint template reconciliation on scope changes in Config resource or webhook configuration. This flag is deprecated and will be removed in Gatekeeper v3.24.")
View Source 
var VapAPIEnabled *bool

Functions

func AllMatchersV1Beta1 

func AllMatchersV1Beta1() []admissionregistrationv1beta1.MatchCondition

func AllVariablesCEL 

func AllVariablesCEL() []cel.NamedExpressionAccessor

func AllVariablesV1Beta1 

func AllVariablesV1Beta1() []admissionregistrationv1beta1.Variable

func BindObjectV1Beta1 

func BindObjectV1Beta1() admissionregistrationv1beta1.Variable

func BindParamsCEL 

func BindParamsCEL() cel.NamedExpressionAccessor

func BindParamsV1Beta1 

func BindParamsV1Beta1() admissionregistrationv1beta1.Variable

func ConstraintToBinding 

func ConstraintToBinding(constraint *unstructured.Unstructured, actions []string) (*admissionregistrationv1beta1.ValidatingAdmissionPolicyBinding, error)

ConstraintToBinding converts a Constraint to a ValidatingAdmissionPolicyBinding. Accepts a list of enforcement actions to apply to the binding. If the enforcement action is not recognized, returns an error.

func GetVAPBindingName added in v3.22.1 

func GetVAPBindingName(kind, constraintName string) string

func IsVapAPIEnabled 

func IsVapAPIEnabled(log *logr.Logger) (bool, *schema.GroupVersion)

func LegacyVAPBindingName added in v3.22.1 

func LegacyVAPBindingName(constraintName string) string

LegacyVAPBindingName returns the old-format VAPB name that did not include the constraint Kind. Used during migration to clean up old VAPBs.

TODO(v3.25.0): Remove this function once users have had two releases to upgrade (introduced in v3.23.0).

func MatchExcludedNamespacesGlobCEL 

func MatchExcludedNamespacesGlobCEL() []cel.ExpressionAccessor

func MatchExcludedNamespacesGlobV1Beta1 

func MatchExcludedNamespacesGlobV1Beta1() admissionregistrationv1beta1.MatchCondition

func MatchGlobalExcludedNamespacesGlobV1Beta1 added in v3.21.0 

func MatchGlobalExcludedNamespacesGlobV1Beta1(excludedNamespaces string) admissionregistrationv1beta1.MatchCondition

func MatchGlobalExemptedNamespacesGlobV1Beta1 added in v3.21.0 

func MatchGlobalExemptedNamespacesGlobV1Beta1(exemptedNamespaces string) admissionregistrationv1beta1.MatchCondition

func MatchKindsCEL 

func MatchKindsCEL() []cel.ExpressionAccessor

func MatchKindsV1Beta1 

func MatchKindsV1Beta1() admissionregistrationv1beta1.MatchCondition

func MatchNameGlobCEL 

func MatchNameGlobCEL() []cel.ExpressionAccessor

func MatchNameGlobV1Beta1 

func MatchNameGlobV1Beta1() admissionregistrationv1beta1.MatchCondition

func MatchNamespacesGlobCEL 

func MatchNamespacesGlobCEL() []cel.ExpressionAccessor

func MatchNamespacesGlobV1Beta1 

func MatchNamespacesGlobV1Beta1() admissionregistrationv1beta1.MatchCondition

func RequestToVersionedAttributes 

func RequestToVersionedAttributes(request *admissionv1.AdmissionRequest) (*admission.VersionedAttributes, error)

func SetGroupVersion added in v3.22.0 

func SetGroupVersion(gv *schema.GroupVersion)

SetGroupVersion sets the GroupVersion in a thread-safe manner. Use this instead of directly assigning transform.GroupVersion when the value may be read concurrently (e.g., by a running controller).

func SetVapAPIEnabled added in v3.22.0 

func SetVapAPIEnabled(enabled *bool)

SetVapAPIEnabled sets the VapAPIEnabled flag in a thread-safe manner. Use this instead of directly assigning transform.VapAPIEnabled when the value may be read concurrently (e.g., by a running controller).

func TemplateToPolicyDefinition 

func TemplateToPolicyDefinition(template *templates.ConstraintTemplate) (*admissionregistrationv1beta1.ValidatingAdmissionPolicy, error)

func TemplateToPolicyDefinitionWithWebhookConfig added in v3.21.0 

func TemplateToPolicyDefinitionWithWebhookConfig(template *templates.ConstraintTemplate, webhookConfig *webhookconfigcache.WebhookMatchingConfig, excludedNamespaces []string, exemptedNamespaces []string) (*admissionregistrationv1beta1.ValidatingAdmissionPolicy, error)

Types

type RequestWrapper 

type RequestWrapper struct {
	// contains filtered or unexported fields
}

FRICTION this wrapper class is excessive. Validator code should define an interface that only requires the methods it needs.

func NewWrapper 

func NewWrapper(req *admissionv1.AdmissionRequest) (*RequestWrapper, error)

func (*RequestWrapper) AddAnnotation 

func (w *RequestWrapper) AddAnnotation(_, _ string) error

func (*RequestWrapper) AddAnnotationWithLevel 

func (w *RequestWrapper) AddAnnotationWithLevel(_, _ string, _ auditinternal.Level) error

func (*RequestWrapper) GetKind 

func (w *RequestWrapper) GetKind() schema.GroupVersionKind

func (*RequestWrapper) GetName 

func (w *RequestWrapper) GetName() string

func (*RequestWrapper) GetNamespace 

func (w *RequestWrapper) GetNamespace() string

func (*RequestWrapper) GetObject 

func (w *RequestWrapper) GetObject() runtime.Object

func (*RequestWrapper) GetOldObject 

func (w *RequestWrapper) GetOldObject() runtime.Object

func (*RequestWrapper) GetOperation 

func (w *RequestWrapper) GetOperation() admission.Operation

func (*RequestWrapper) GetOperationOptions 

func (w *RequestWrapper) GetOperationOptions() runtime.Object

func (*RequestWrapper) GetReinvocationContext 

func (w *RequestWrapper) GetReinvocationContext() admission.ReinvocationContext

func (*RequestWrapper) GetResource 

func (w *RequestWrapper) GetResource() schema.GroupVersionResource

func (*RequestWrapper) GetSubresource 

func (w *RequestWrapper) GetSubresource() string

func (*RequestWrapper) GetUserInfo 

func (w *RequestWrapper) GetUserInfo() user.Info

func (*RequestWrapper) IsDryRun 

func (w *RequestWrapper) IsDryRun() bool

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.