feat: add type to policy CRD

api/unversioned/policy_types.go

@@ -25,6 +25,9 @@ import (
 type PolicySpec struct {
 	// Important: Run "make" to regenerate code after modifying this file
 
+	// Type of the polocy
+	Type string `json:"type,omitempty"`
+
 	// Parameters for this policy
 	Parameters runtime.RawExtension `json:"parameters,omitempty"`
 }

api/v1alpha1/policy_types.go

@@ -28,6 +28,9 @@ import (
 type PolicySpec struct {
 	// Important: Run "make" to regenerate code after modifying this file
 
+	// Type of the polocy
+	Type string `json:"type,omitempty"`
+
 	// +kubebuilder:pruning:PreserveUnknownFields
 	// Parameters for this policy
 	Parameters runtime.RawExtension `json:"parameters,omitempty"`

charts/ratify/crds/policy-customresourcedefinition.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -40,6 +41,9 @@ spec:
                   description: Parameters for this policy
                   type: object
                   x-kubernetes-preserve-unknown-fields: true
+                type:
+                  description: Type of the polocy
+                  type: string
               type: object
             status:
               description: PolicyStatus defines the observed state of Policy

config/crd/bases/config.ratify.deislabs.io_policies.yaml

@@ -39,6 +39,9 @@ spec:
                 description: Parameters for this policy
                 type: object
                 x-kubernetes-preserve-unknown-fields: true
+              type:
+                description: Type of the polocy
+                type: string
             type: object
           status:
             description: PolicyStatus defines the observed state of Policy

config/samples/policy/config_v1alpha1_policy_json.yaml

@@ -1,8 +1,9 @@
 apiVersion: config.ratify.deislabs.io/v1alpha1
 kind: Policy
 metadata:
-  name: "configpolicy"
+  name: "ratify-policy"
 spec:
+  type: "configpolicy"
   parameters:
     artifactVerificationPolicies:
       default: "all"

config/samples/policy/config_v1alpha1_policy_rego.yaml

@@ -1,8 +1,9 @@
 apiVersion: config.ratify.deislabs.io/v1alpha1
 kind: Policy
 metadata:
-  name: "regopolicy"
+  name: "ratify-policy"
 spec:
+  type: "regopolicy"
   parameters:
     passthroughEnabled: false
     policy: |

docs/reference/crds/policies.md

@@ -5,22 +5,24 @@ View more CRD samples [here](../../../config/samples/policy). The `metadata.name
 apiVersion: config.ratify.deislabs.io/v1alpha1
 kind: Policy
 metadata:
-  name: "configpolicy"
+  name: "ratify-policy"
 spec:
+  type: required. Type of the policy.
   parameters: required. Parameters specific to this policy
 ```
-There would be exactly one CR existing in the cluster. That means if users apply a new CR, the old one would be replaced.
+Ratify would only accept a policy setting `metadata.name` as `ratify-policy` since there is at most one active policy for Ratify to use. That means if users apply a new CR with different `metadata.name`, Ratify will not update the existing policy.
 
-Note: `metadata.name` MUST be `configpolicy` or `regopolicy` per the usage.
+Note: `spec.name` MUST be `configpolicy` or `regopolicy` per the usage.
 
 ## configpolicy
 Sample spec:
 ```yml
 apiVersion: config.ratify.deislabs.io/v1alpha1
 kind: Policy
 metadata:
-  name: "configpolicy"
+  name: "ratify-policy"
 spec:
+  type: "configpolicy"
   parameters:
     artifactVerificationPolicies:
       "application/vnd.cncf.notary.signature": "any"
@@ -38,8 +40,9 @@ Sample spec:
 apiVersion: config.ratify.deislabs.io/v1alpha1
 kind: Policy
 metadata:
-  name: "regopolicy"
+  name: "ratify-policy"
 spec:
+  type: "regopolicy"
   parameters:
     passthroughEnabled: false
     policy: |

pkg/controllers/policy_controller.go

@@ -31,6 +31,8 @@
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
+const ratifyPolicy = "ratify-policy"
+
 // PolicyReconciler reconciles a Policy object
 type PolicyReconciler struct {
 	client.Client
@@ -74,33 +76,15 @@
 		return ctrl.Result{}, client.IgnoreNotFound(err)
 	}
 
-	if err := policyAddOrReplace(policy.Spec, resource); err != nil {
-		policyLogger.Error("unable to create policy from policy crd: ", err)
-		return ctrl.Result{}, err
+	if resource != ratifyPolicy {
+		return ctrl.Result{}, nil
 	}
 
-	// List all policies in the same namespace.
-	policyList := &configv1alpha1.PolicyList{}
-	if err := r.List(ctx, policyList, client.InNamespace(req.Namespace)); err != nil {
-		policyLogger.Error("failed to list Policies: ", err)
+	if err := policyAddOrReplace(policy.Spec); err != nil {
+		policyLogger.Error("unable to create policy from policy crd: ", err)
 		return ctrl.Result{}, err
 	}
 
-	// Delete all policies except the current one.
-	for _, item := range policyList.Items {
-		item := item
-		if item.Name != resource {
-			policyLogger.Infof("Deleting policy %s", item.Name)
-			err := r.Delete(ctx, &item)
-			if err != nil {
-				policyLogger.Error("failed to delete Policy: ", err)
-				return ctrl.Result{}, err
-			}
-			policyLogger.Info("Deleted policy", "name", item.Name)
-		}
-	}
-
-	// returning empty result and no error to indicate we’ve successfully reconciled this object
 	return ctrl.Result{}, nil
 }
 
@@ -111,19 +95,19 @@
 		Complete(r)
 }
 
-func policyAddOrReplace(spec configv1alpha1.PolicySpec, policyName string) error {
-	policyEnforcer, err := specToPolicyEnforcer(spec, policyName)
+func policyAddOrReplace(spec configv1alpha1.PolicySpec) error {
+	policyEnforcer, err := specToPolicyEnforcer(spec)
 	if err != nil {
 		return fmt.Errorf("failed to create policy enforcer: %w", err)
 	}
 
-	ActivePolicy.Name = policyName
+	ActivePolicy.Name = spec.Type
 	ActivePolicy.Enforcer = policyEnforcer
 	return nil
 }
 
-func specToPolicyEnforcer(spec configv1alpha1.PolicySpec, policyName string) (policyprovider.PolicyProvider, error) {
-	policyConfig, err := rawToPolicyConfig(spec.Parameters.Raw, policyName)
+func specToPolicyEnforcer(spec configv1alpha1.PolicySpec) (policyprovider.PolicyProvider, error) {
+	policyConfig, err := rawToPolicyConfig(spec.Parameters.Raw, spec.Type)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse policy config: %w", err)
 	}

pkg/controllers/policy_controller_test.go

@@ -145,30 +145,32 @@ func TestSpecToPolicyEnforcer(t *testing.T) {
 		expectProvider bool
 	}{
 		{
-			name:           "invalid spec",
-			policyName:     policyName1,
-			spec:           configv1alpha1.PolicySpec{},
+			name:       "invalid spec",
+			policyName: policyName1,
+			spec: configv1alpha1.PolicySpec{
+				Type: policyName1,
+			},
 			expectErr:      true,
 			expectProvider: false,
 		},
 		{
-			name:       "non-supported policy",
-			policyName: policyName1,
+			name: "non-supported policy",
 			spec: configv1alpha1.PolicySpec{
 				Parameters: runtime.RawExtension{
 					Raw: []byte("{\"name\": \"policy1\"}"),
 				},
+				Type: policyName1,
 			},
 			expectErr:      true,
 			expectProvider: false,
 		},
 		{
-			name:       "valid spec",
-			policyName: "configpolicy",
+			name: "valid spec",
 			spec: configv1alpha1.PolicySpec{
 				Parameters: runtime.RawExtension{
 					Raw: []byte("{\"name\": \"configpolicy\"}"),
 				},
+				Type: "configpolicy",
 			},
 			expectErr:      false,
 			expectProvider: true,
@@ -177,7 +179,7 @@ func TestSpecToPolicyEnforcer(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			provider, err := specToPolicyEnforcer(tc.spec, tc.policyName)
+			provider, err := specToPolicyEnforcer(tc.spec)
 
 			if tc.expectErr != (err != nil) {
 				t.Fatalf("Expected error to be %t, got %t", tc.expectErr, err != nil)
@@ -197,26 +199,27 @@ func TestPolicyAddOrReplace(t *testing.T) {
 		expectErr  bool
 	}{
 		{
-			name:       "invalid spec",
-			spec:       configv1alpha1.PolicySpec{},
-			policyName: policyName1,
-			expectErr:  true,
+			name: "invalid spec",
+			spec: configv1alpha1.PolicySpec{
+				Type: policyName1,
+			},
+			expectErr: true,
 		},
 		{
 			name: "valid spec",
 			spec: configv1alpha1.PolicySpec{
 				Parameters: runtime.RawExtension{
 					Raw: []byte("{\"name\": \"configpolicy\"}"),
 				},
+				Type: "configpolicy",
 			},
-			policyName: "configpolicy",
-			expectErr:  false,
+			expectErr: false,
 		},
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			err := policyAddOrReplace(tc.spec, tc.policyName)
+			err := policyAddOrReplace(tc.spec)
 
 			if tc.expectErr != (err != nil) {
 				t.Fatalf("Expected error to be %t, got %t", tc.expectErr, err != nil)