Skip to content

Commit

Permalink
feat: add NamespacedPolicy CRD [multi-tenancy PR 7] (ratify-project#1402
Browse files Browse the repository at this point in the history
)
binbin-li authored Apr 26, 2024

Verified

This commit was signed with the committer’s verified signature.
ThijsBroersen Thijs Broersen
1 parent ea5604a commit 1f21940
Showing 41 changed files with 1,789 additions and 222 deletions.
2 changes: 1 addition & 1 deletion Makefile
Original file line number Diff line number Diff line change
@@ -135,7 +135,7 @@ delete-demo-constraints:

.PHONY: deploy-rego-policy
deploy-rego-policy:
kubectl apply -f ./config/samples/policy/config_v1beta1_policy_rego.yaml
kubectl apply -f ./config/samples/clustered/policy/config_v1beta1_policy_rego.yaml

.PHONY: deploy-gatekeeper
deploy-gatekeeper:
8 changes: 8 additions & 0 deletions PROJECT
Original file line number Diff line number Diff line change
@@ -80,4 +80,12 @@ resources:
kind: KeyManagementProvider
path: github.com/deislabs/ratify/api/v1beta1
version: v1beta1
- api:
crdVersion: v1
namespaced: true
domain: ratify.deislabs.io
group: config
kind: NamespacedPolicy
path: github.com/deislabs/ratify/api/v1beta1
version: v1beta1
version: "3"
63 changes: 63 additions & 0 deletions api/unversioned/namespacedpolicy_types.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
/*
Copyright The Ratify Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package unversioned

import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
runtime "k8s.io/apimachinery/pkg/runtime"
)

// NamespacedPolicySpec defines the desired state of Policy
type NamespacedPolicySpec struct {
// Important: Run "make" to regenerate code after modifying this file

// Type of the policy
Type string `json:"type,omitempty"`
// Parameters for this policy
Parameters runtime.RawExtension `json:"parameters,omitempty"`
}

// NamespacedPolicyStatus defines the observed state of Policy
type NamespacedPolicyStatus struct {
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
// Important: Run "make" to regenerate code after modifying this file

// Is successful while applying the policy.
IsSuccess bool `json:"issuccess"`
// Error message if NamespacedPolicy is not successfully applied.
// +optional
Error string `json:"error,omitempty"`
// Truncated error message if the message is too long
// +optional
BriefError string `json:"brieferror,omitempty"`
}

// NamespacedPolicy is the Schema for the policies API
type NamespacedPolicy struct {
metav1.TypeMeta `json:",inline"`
metav1.ObjectMeta `json:"metadata,omitempty"`

Spec NamespacedPolicySpec `json:"spec,omitempty"`
Status NamespacedPolicyStatus `json:"status,omitempty"`
}

// NamespacedPolicyList contains a list of Policy
type NamespacedPolicyList struct {
metav1.TypeMeta `json:",inline"`
metav1.ListMeta `json:"metadata,omitempty"`
Items []NamespacedPolicy `json:"items"`
}
74 changes: 74 additions & 0 deletions api/unversioned/zz_generated.deepcopy.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

80 changes: 80 additions & 0 deletions api/v1beta1/namespacedpolicy_types.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
/*
Copyright The Ratify Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package v1beta1

import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
runtime "k8s.io/apimachinery/pkg/runtime"
)

// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.

// NamespacedPolicySpec defines the desired state of NamespacedPolicy
type NamespacedPolicySpec struct {
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
// Important: Run "make" to regenerate code after modifying this file

// Type of the policy
Type string `json:"type,omitempty"`
// +kubebuilder:pruning:PreserveUnknownFields
// Parameters for this policy
Parameters runtime.RawExtension `json:"parameters,omitempty"`
}

// NamespacedPolicyStatus defines the observed state of NamespacedPolicy
type NamespacedPolicyStatus struct {
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
// Important: Run "make" to regenerate code after modifying this file

// Is successful while applying the policy.
IsSuccess bool `json:"issuccess"`
// Error message if policy is not successfully applied.
// +optional
Error string `json:"error,omitempty"`
// Truncated error message if the message is too long
// +optional
BriefError string `json:"brieferror,omitempty"`
}

// +kubebuilder:object:root=true
// +kubebuilder:resource:scope="Namespaced"
// +kubebuilder:subresource:status
// +kubebuilder:storageversion
// +kubebuilder:printcolumn:name="IsSuccess",type=boolean,JSONPath=`.status.issuccess`
// +kubebuilder:printcolumn:name="Error",type=string,JSONPath=`.status.brieferror`
// NamespacedPolicy is the Schema for the namespacedpolicies API
type NamespacedPolicy struct {
metav1.TypeMeta `json:",inline"`
metav1.ObjectMeta `json:"metadata,omitempty"`

Spec NamespacedPolicySpec `json:"spec,omitempty"`
Status NamespacedPolicyStatus `json:"status,omitempty"`
}

// +kubebuilder:object:root=true
// +kubebuilder:storageversion
// NamespacedPolicyList contains a list of NamespacedPolicy
type NamespacedPolicyList struct {
metav1.TypeMeta `json:",inline"`
metav1.ListMeta `json:"metadata,omitempty"`
Items []NamespacedPolicy `json:"items"`
}

func init() {
SchemeBuilder.Register(&NamespacedPolicy{}, &NamespacedPolicyList{})
}
Loading

0 comments on commit 1f21940

Please sign in to comment.