Documentation
¶
Overview ¶
Package policy compiles immutable selectors and templates shared by reconciliation and admission.
Index ¶
- Constants
- func Context(target map[string]any, captured map[string]any, w schedule.Window, ...) map[string]any
- func Parse(text string) (*template.Template, error)
- func ProtectedNamespace(namespace, controllerNamespace string) bool
- func Render(t *template.Template, data map[string]any, limit int) (string, error)
- type CandidateSet
- type Compiled
- type Message
- type Store
- type Target
Constants ¶
const (
ConditionBudget int64 = 100000
)
ConditionBudget bounds all evaluations in one admission request. Denials and warnings use separate budgets so a broken warning cannot exhaust denial work.
const ExecutionExtra = "addons.projectcapsule.dev/execution"
Variables ¶
This section is empty.
Functions ¶
func ProtectedNamespace ¶
ProtectedNamespace keeps the controller and Kubernetes recovery paths outside maintenance selection. Match the exclusions in both installation manifests.
Types ¶
type CandidateSet ¶
type CandidateSet struct {
// contains filtered or unexported fields
}
CandidateSet merges immutable exact and pattern indexes without allocating a result per request. Only pattern policies need checking beyond the exact GVR.
func (CandidateSet) Empty ¶
func (c CandidateSet) Empty() bool
type Compiled ¶
type Compiled struct {
Source *api.ChangeWindow
Engine *schedule.Engine
Namespaces []labels.Selector
Targets map[string]Target
Rules, Warnings []Message
}
func Compile ¶
func Compile(obj *api.ChangeWindow, mapper meta.RESTMapper) (*Compiled, error)
type Message ¶
type Message struct {
Name string
Match api.RequestMatch
When string
Within time.Duration
Template *template.Template
NeedsTarget bool
// contains filtered or unexported fields
}
func (Message) HasConditions ¶
func (Message) MatchConditions ¶
func (m Message) MatchConditions(ctx context.Context, variables map[string]any, budget *int64) (bool, error)
MatchConditions follows AND semantics, including false taking precedence over an ordinary evaluation error. Request-budget exhaustion and cancellation abort evaluation.
func (Message) MatchesAudience ¶
func (m Message) MatchesAudience(user authenticationv1.UserInfo) bool
type Store ¶
type Store struct {
Mapper meta.RESTMapper
// contains filtered or unexported fields
}
Store publishes immutable compiled policies indexed by the parent GVR. Status updates do not recompile. Deletion retires all references; no request snapshots or authorization decisions are cached here.
func NewStore ¶
func NewStore(mapper meta.RESTMapper) *Store
func (*Store) Candidates ¶
func (s *Store) Candidates(gvr schema.GroupVersionResource) (CandidateSet, error)
Candidates returns a read-only snapshot; published slices are never modified.
type Target ¶
type Target struct {
Namespaced bool
Spec api.Target
Selector labels.Selector
Resource schema.GroupVersionResource
Pattern *capsuleruntime.VersionKind
}
func (Target) MatchesAPI ¶
func (t Target) MatchesAPI(gvr schema.GroupVersionResource) bool
MatchesAPI filters before resolving a subresource's parent kind or namespace.
func (Target) MatchesKind ¶
func (t Target) MatchesKind(gvr schema.GroupVersionResource, kind string) bool
Source Files