Documentation
¶
Index ¶
- func MockUserInfo(username string, groups []string) user.Info
- func NewAuthorizerValue(auth authorizer.Authorizer, userInfo user.Info) ref.Val
- type AuthorizationMockConfig
- type EvaluationResult
- type Evaluator
- func (e *Evaluator) EvaluateMutating(policy *admissionregv1.MutatingAdmissionPolicy, ...) (*EvaluationResult, error)
- func (e *Evaluator) EvaluateTest(mutatingPolicy *admissionregv1.MutatingAdmissionPolicy, ...) *TestResult
- func (e *Evaluator) EvaluateValidating(policy *admissionregv1.ValidatingAdmissionPolicy, ...) (*EvaluationResult, error)
- type MockAuthorizer
- func (m *MockAuthorizer) Add(c AuthorizationMockConfig)
- func (m *MockAuthorizer) Allow(group, resource, subresource, namespace, verb string)
- func (m *MockAuthorizer) Authorize(_ context.Context, attrs authorizer.Attributes) (authorizer.Decision, string, error)
- func (m *MockAuthorizer) Deny(group, resource, subresource, namespace, verb string)
- type TestCase
- type TestExpectation
- type TestOutcome
- type TestResult
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MockUserInfo ¶
MockUserInfo creates a simple user.Info for testing.
func NewAuthorizerValue ¶
func NewAuthorizerValue(auth authorizer.Authorizer, userInfo user.Info) ref.Val
NewAuthorizerValue creates a CEL authorizer value using Kubernetes' library function. This wraps a Kubernetes authorizer for use in CEL expressions.
Types ¶
type AuthorizationMockConfig ¶ added in v0.1.1
type AuthorizationMockConfig struct {
Group string `json:"group,omitempty"`
Resource string `json:"resource"`
Subresource string `json:"subresource,omitempty"`
Namespace string `json:"namespace,omitempty"`
Verb string `json:"verb"`
Decision string `json:"decision"` // "allow" or "deny"
}
AuthorizationMockConfig represents a mocked authorization decision configuration.
type EvaluationResult ¶
type EvaluationResult struct {
Allowed bool
Message string
Warnings []string
PatchType *admissionv1.PatchType
PatchedObject *unstructured.Unstructured // The object after applying mutations
AuditAnnotations map[string]string
}
EvaluationResult contains the result of evaluating a policy.
type Evaluator ¶
type Evaluator struct {
// contains filtered or unexported fields
}
Evaluator evaluates admission policies using CEL expressions.
func New ¶
New creates a new Evaluator with a CEL environment configured for Kubernetes admission policies.
func (*Evaluator) EvaluateMutating ¶
func (e *Evaluator) EvaluateMutating( policy *admissionregv1.MutatingAdmissionPolicy, binding *admissionregv1.MutatingAdmissionPolicyBinding, request *admissionv1.AdmissionRequest, object *unstructured.Unstructured, oldObject *unstructured.Unstructured, params *unstructured.Unstructured, namespaceObj *unstructured.Unstructured, authorizer authorizer.Authorizer, userInfo user.Info, ) (*EvaluationResult, error)
EvaluateMutating evaluates a MutatingAdmissionPolicy against an admission request.
func (*Evaluator) EvaluateTest ¶
func (e *Evaluator) EvaluateTest( mutatingPolicy *admissionregv1.MutatingAdmissionPolicy, mutatingBinding *admissionregv1.MutatingAdmissionPolicyBinding, validatingPolicy *admissionregv1.ValidatingAdmissionPolicy, validatingBinding *admissionregv1.ValidatingAdmissionPolicyBinding, testCase TestCase, ) *TestResult
EvaluateTest evaluates a policy against a test case and returns whether it passed.
func (*Evaluator) EvaluateValidating ¶
func (e *Evaluator) EvaluateValidating( policy *admissionregv1.ValidatingAdmissionPolicy, binding *admissionregv1.ValidatingAdmissionPolicyBinding, request *admissionv1.AdmissionRequest, object *unstructured.Unstructured, oldObject *unstructured.Unstructured, params *unstructured.Unstructured, namespaceObj *unstructured.Unstructured, authorizer authorizer.Authorizer, userInfo user.Info, ) (*EvaluationResult, error)
EvaluateValidating evaluates a ValidatingAdmissionPolicy against an admission request.
type MockAuthorizer ¶
type MockAuthorizer struct {
// contains filtered or unexported fields
}
MockAuthorizer is a simple mock authorizer for testing.
func NewMockAuthorizer ¶
func NewMockAuthorizer() *MockAuthorizer
NewMockAuthorizer creates a new mock authorizer.
func NewMockAuthorizerFromConfig ¶ added in v0.1.1
func NewMockAuthorizerFromConfig(configs []AuthorizationMockConfig) *MockAuthorizer
NewMockAuthorizerFromConfig creates a mock authorizer from a list of configs.
func (*MockAuthorizer) Add ¶ added in v0.1.1
func (m *MockAuthorizer) Add(c AuthorizationMockConfig)
Add adds a decision to the mock authorizer.
func (*MockAuthorizer) Allow ¶
func (m *MockAuthorizer) Allow(group, resource, subresource, namespace, verb string)
Allow configures the mock to allow a specific request.
func (*MockAuthorizer) Authorize ¶
func (m *MockAuthorizer) Authorize(_ context.Context, attrs authorizer.Attributes) (authorizer.Decision, string, error)
Authorize implements the authorizer.Authorizer interface.
func (*MockAuthorizer) Deny ¶
func (m *MockAuthorizer) Deny(group, resource, subresource, namespace, verb string)
Deny configures the mock to deny a specific request.
type TestCase ¶
type TestCase interface {
GetRequest() *admissionv1.AdmissionRequest
GetObject() *unstructured.Unstructured
GetOldObject() *unstructured.Unstructured
GetParams() *unstructured.Unstructured
GetNamespaceObj() *unstructured.Unstructured
GetUserInfo() user.Info
GetExpectAllowed() bool
GetExpectMessage() string
GetExpectWarnings() []string
GetExpectAuditAnnotations() map[string]string
GetExpectedObject() *unstructured.Unstructured
GetError() error
GetAuthorizer() []AuthorizationMockConfig
}
TestCase represents a test case with inputs and expected outcomes. This is a subset of the loader.TestCase interface that evaluator needs.
type TestExpectation ¶
type TestExpectation struct {
Allowed bool
Message string
Object *unstructured.Unstructured
Warnings []string
AuditAnnotations map[string]string
}
TestExpectation contains what the test expects to happen.
type TestOutcome ¶
type TestOutcome struct {
Allowed bool
Message string
Object *unstructured.Unstructured
Warnings []string
AuditAnnotations map[string]string
EvaluationErr error
}
TestOutcome contains what actually happened during evaluation.
type TestResult ¶
type TestResult struct {
Passed bool
Expected TestExpectation
Actual TestOutcome
Message string // Failure explanation or diff
PatchedObject *unstructured.Unstructured
}
TestResult contains the result of evaluating a test case.
Source Files