Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: send matched bypass permissions criteria with evaluation results #422

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

feat: send matched bypass permissions criteria with evaluation results #422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3199789
feat: send matched bypass permissions criteria with evaluation results
Jul 16, 2023
6581fbd
fix: fix rebase conflict mistakes
Jul 16, 2023
d4fd88b
fix: ensure bypass permissions type matches cli-service type
Jul 16, 2023
8b08903
fix: json tag bypass properties
Jul 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module github.com/datreeio/admission-webhook-datree
go 1.19

require (
github.com/datreeio/datree v1.8.42
github.com/datreeio/datree v1.9.10
github.com/ghodss/yaml v1.0.0
github.com/google/go-cmp v0.5.9
github.com/lithammer/shortuuid v3.0.0+incompatible
Expand Down
2 changes: 2 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWH
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/datreeio/datree v1.8.42 h1:nR2HnqdZFzY8bD78eN8yYLMfaRxmOPYs3MonnOVoYbU=
github.com/datreeio/datree v1.8.42/go.mod h1:H9iOfrpbK6pLk+5q9e97uUf+hfyFezhnE7pp/ZE0rHA=
github.com/datreeio/datree v1.9.10 h1:bmyzB49+IPz0t5AMRnufTlS/UeebP9NzpNTWBi3p5cI=
github.com/datreeio/datree v1.9.10/go.mod h1:RWd7yt4qEFfz2wxaAeJF3oqrJf68ktY6OOuX4c7+l7A=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
Expand Down
59 changes: 44 additions & 15 deletions pkg/clients/cliServiceClient.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,21 +161,44 @@ type WebhookEvaluationRequestData struct {
MetadataName string
}

type BypassCriteriaType int

const (
ServiceAccount BypassCriteriaType = iota
UserAccount
Group
)

func (s BypassCriteriaType) String() string {
switch s {
case ServiceAccount:
return "serviceAccounts"
case UserAccount:
return "userAccounts"
case Group:
return "groups"
default:
return "unknown"
}
}

type EvaluationResultRequest struct {
ClientId string `json:"clientId"`
Token string `json:"token"`
Metadata *Metadata `json:"metadata"`
K8sVersion string `json:"k8sVersion"`
PolicyName string `json:"policyName"`
FailedYamlFiles []string `json:"failedYamlFiles"`
FailedK8sFiles []string `json:"failedK8sFiles"`
AllExecutedRules []cliClient.RuleData `json:"allExecutedRules"`
AllEvaluatedFiles []cliClient.FileData `json:"allEvaluatedFiles"`
PolicyCheckResults map[string]map[string]*cliClient.FailedRule `json:"policyCheckResults"`
ClusterUuid k8sTypes.UID `json:"clusterUuid,omitempty"`
Namespace string `json:"namespace,omitempty"`
Kind string `json:"kind"`
MetadataName string `json:"metadataName"`
ClientId string `json:"clientId"`
Token string `json:"token"`
Metadata *Metadata `json:"metadata"`
K8sVersion string `json:"k8sVersion"`
PolicyName string `json:"policyName"`
FailedYamlFiles []string `json:"failedYamlFiles"`
FailedK8sFiles []string `json:"failedK8sFiles"`
AllExecutedRules []cliClient.RuleData `json:"allExecutedRules"`
AllEvaluatedFiles []cliClient.FileData `json:"allEvaluatedFiles"`
PolicyCheckResults map[string]map[string]*cliClient.FailedRule `json:"policyCheckResults"`
ClusterUuid k8sTypes.UID `json:"clusterUuid,omitempty"`
Namespace string `json:"namespace,omitempty"`
Kind string `json:"kind"`
MetadataName string `json:"metadataName"`
MatchedBypassCriteria *BypassCriteria `json:"matchedBypassCriteria,omitempty"`
IsBypassedByPermissions bool `json:"isBypassedByPermissions"`
}

type Metadata struct {
Expand All @@ -187,16 +210,22 @@ type Metadata struct {
EvaluationDurationSeconds float64 `json:"evaluationDurationSeconds"`
}

type BypassCriteria struct {
Type BypassCriteriaType `json:"type"`
Value string `json:"value"`
}

type ClusterContext struct {
WebhookVersion string `json:"webhookVersion"`
IsInCluster bool `json:"isInCluster"`
IsEnforceMode bool `json:"isEnforceMode"`
}

func (c *CliClient) SendWebhookEvaluationResult(request *EvaluationResultRequest) (*cliClient.SendEvaluationResultsResponse, error) {
func (c *CliClient) SaveWebhookEvaluationResults(request *EvaluationResultRequest) (*cliClient.SendEvaluationResultsResponse, error) {
if c.networkValidator.IsLocalMode() {
return &cliClient.SendEvaluationResultsResponse{}, nil
}

httpRes, err := c.httpClient.Request(http.MethodPost, "/cli/evaluation/policyCheck/result", request, c.flagsHeaders)
if err != nil {
networkErr := c.networkValidator.IdentifyNetworkError(err)
Expand Down
Loading