Skip to content

Commit deddbdf

Browse files
PeefyPeefy
committed
feat: add more istio mutation and validation modules
Signed-off-by: peefy <[email protected]>
1 parent 53259f4 commit deddbdf

File tree

32 files changed

+166
-7
lines changed

32 files changed

+166
-7
lines changed

‎add-network-policy-dns/kcl.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "add-network-policy-dns"
33
edition = "*"
4-
version = "0.1.0"
4+
version = "0.1.1"
55
description = "`add-network-policy-dns` is a KCL mutation module"
66

‎add-network-policy-dns/main.k

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
ns_list = [item.metadata.name for item in option("items") or [] if item.kind == "Namespace"]
1+
ns_list: [str] = [item.metadata.name for item in option("items") or [] if item.kind == "Namespace"]
22
items = (option("items") or []) + [{
33
apiVersion: "networking.k8s.io/v1"
44
kind: "NetworkPolicy"
55
name: "allow-dns"
6-
namespace: "${ns.metadata.name}"
6+
namespace: ns
77
synchronize: False
88
data.spec: {
99
# select all pods in the namespace

‎add-network-policy/kcl.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "add-network-policy"
33
edition = "*"
4-
version = "0.1.0"
4+
version = "0.1.1"
55
description = "`add-network-policy` is a KCL mutation module"
66

‎add-network-policy/main.k

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ items = (option("items") or []) + [{
33
apiVersion: "networking.k8s.io/v1"
44
kind: "NetworkPolicy"
55
name: "default-deny"
6-
namespace: "${ns.metadata.name}"
6+
namespace: ns
77
synchronize: True
88
data.spec: {
99
# select all pods in the namespace

‎add-rolebinding/kcl.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[package]
22
name = "add-rolebinding"
3-
version = "0.1.0"
3+
version = "0.1.1"
44
description = "`add-rolebinding` is a KCL mutation module."
55

‎add-rolebinding/main.k

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ items = option("items") + [
77
apiVersion: "rbac.authorization.k8s.io/v1"
88
kind: "RoleBinding"
99
name: "${username}-admin-binding"
10-
namespace: ns.metadata.name
10+
namespace: ns
1111
data: {
1212
roleRef: {
1313
apiGroup: "rbac.authorization.k8s.io"

‎istio-add-sidecar-injection/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Introduction
2+
3+
`istio-add-sidecar-injection` is a KCL mutation module to add istio sidecar inject labels for `Namespace` resources.
4+
5+
## Resource
6+
7+
The Code sources and documents are [here](https://github.com/kcl-lang/modules/tree/main/istio-add-sidecar-injection)

‎istio-add-sidecar-injection/kcl.mod

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
[package]
2+
name = "istio-add-sidecar-injection"
3+
edition = "*"
4+
version = "0.1.0"
5+
description = "`istio-add-sidecar-injection` is a KCL mutation module"

‎istio-add-sidecar-injection/main.k

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
items = [item | {
2+
if item.kind == "Namespace":
3+
metadata.labels: {
4+
"istio-injection" = "enabled"
5+
}
6+
} for item in option("items") or []]

‎istio-check-mtls/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Introduction
2+
3+
`istio-check-mtls` is a KCL validation module.
4+
5+
## Resource
6+
7+
The Code sources and documents are [here](https://github.com/kcl-lang/modules/tree/main/istio-check-mtls)

‎istio-check-mtls/kcl.mod

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[package]
2+
name = "istio-check-mtls"
3+
edition = "*"
4+
version = "0.1.0"
5+
description = "`istio-check-mtls` is a KCL validation module"
6+

‎istio-check-mtls/kcl.mod.lock

Whitespace-only changes.

‎istio-check-mtls/main.k

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Define the validation function
2+
validate = lambda item {
3+
if item.kind == "PeerAuthentication":
4+
assert item?.spec?.mtls?.mode in ["UNSET", "STRICT"], "PeerAuthentication resources may only set UNSET or STRICT for the mode."
5+
item
6+
}
7+
# Validate All resource
8+
items = [validate(i) for i in option("items") or []]

‎istio-check-sidecar-injection-label/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Introduction
2+
3+
`istio-check-sidecar-injection-label` is a KCL validation module.
4+
5+
## Resource
6+
7+
The Code sources and documents are [here](https://github.com/kcl-lang/modules/tree/main/istio-check-sidecar-injection-label)

‎istio-check-sidecar-injection-label/kcl.mod

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[package]
2+
name = "istio-check-sidecar-injection-label"
3+
edition = "*"
4+
version = "0.1.0"
5+
description = "`istio-check-sidecar-injection-label` is a KCL validation module"
6+

‎istio-check-sidecar-injection-label/kcl.mod.lock

Whitespace-only changes.

‎istio-check-sidecar-injection-label/main.k

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import yaml
2+
3+
# Define the validation function
4+
validate = lambda item {
5+
if item.kind == "Namespace":
6+
assert item?.metadata?.labels?["istio-injection"] == "enabled", "All new Namespaces must have Istio sidecar injection enabled."
7+
item
8+
}
9+
# Validate All resource
10+
items = [validate(i) for i in option("items") or []]
11+
12+
if option("__test__"):
13+
validate(yaml.decode("""\
14+
apiVersion: v1
15+
kind: Namespace
16+
metadata:
17+
labels:
18+
istio-injection: enabled
19+
name: good-istio-suite
20+
"""))

‎istio-check-virtual-service-wildcard/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Introduction
2+
3+
`istio-check-virtual-service-wildcard` is a KCL validation module.
4+
5+
## Resource
6+
7+
The Code sources and documents are [here](https://github.com/kcl-lang/modules/tree/main/istio-check-virtual-service-wildcard)

‎istio-check-virtual-service-wildcard/kcl.mod

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[package]
2+
name = "istio-check-virtual-service-wildcard"
3+
edition = "*"
4+
version = "0.1.0"
5+
description = "`istio-check-virtual-service-wildcard` is a KCL validation module"
6+

‎istio-check-virtual-service-wildcard/kcl.mod.lock

Whitespace-only changes.

‎istio-check-virtual-service-wildcard/main.k

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Define the validation function
2+
validate = lambda item {
3+
if item.kind == "VirtualService":
4+
hosts: [str] = item?.spec?.hosts or []
5+
assert not any host in hosts {
6+
"*" not in host
7+
}, "Wildcards are not permitted as hosts ${hosts}."
8+
item
9+
}
10+
# Validate All resource
11+
items = [validate(i) for i in option("items") or []]

‎istio-create-authorization-policy/README.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Introduction
2+
3+
## Resource
4+
5+
Code source and document is [here](https://github.com/kcl-lang/modules/tree/main/istio-create-authorization-policy)

‎istio-create-authorization-policy/kcl.mod

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[package]
2+
name = "istio-create-authorization-policy"
3+
version = "0.1.0"
4+
description = "`istio-create-authorization-policy` is a kcl mutation package"

‎istio-create-authorization-policy/main.k

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
ns_list: [str] = [item.metadata.name for item in option("items") or [] if item.kind == "Namespace"]
2+
3+
items = (option("items") or []) + [
4+
{
5+
apiVersion: "security.istio.io/v1beta1"
6+
kind: "AuthorizationPolicy"
7+
name: "default-deny"
8+
namespace: ns
9+
synchronize: True
10+
data.spec: {}
11+
} for ns in ns_list
12+
]

‎istio-enforce-tls-hosts-host-subnets/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Introduction
2+
3+
`istio-enforce-tls-hosts-host-subnets` is a KCL validation module.
4+
5+
## Resource
6+
7+
The Code sources and documents are [here](https://github.com/kcl-lang/modules/tree/main/istio-enforce-tls-hosts-host-subnets)

‎istio-enforce-tls-hosts-host-subnets/kcl.mod

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[package]
2+
name = "istio-enforce-tls-hosts-host-subnets"
3+
edition = "*"
4+
version = "0.1.0"
5+
description = "`istio-enforce-tls-hosts-host-subnets` is a KCL validation module"
6+

‎istio-enforce-tls-hosts-host-subnets/kcl.mod.lock

Whitespace-only changes.

‎istio-enforce-tls-hosts-host-subnets/main.k

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Define the validation function
2+
validate = lambda item {
3+
if item.kind == "DestinationRule":
4+
assert item?.spec?.trafficPolicy?.tls?.mode not in ["DISABLE"], "TLS may not be disabled for the trafficPolicy in any host."
5+
item
6+
}
7+
# Validate All resource
8+
items = [validate(i) for i in option("items") or []]

‎istio-prevent-disabling-injection-pods/README.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
## Introduction
2+
3+
`istio-prevent-disabling-injection-pods` is a KCL validation module.
4+
5+
## Resource
6+
7+
The Code sources and documents are [here](https://github.com/kcl-lang/modules/tree/main/istio-prevent-disabling-injection-pods)

‎istio-prevent-disabling-injection-pods/kcl.mod

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
[package]
2+
name = "istio-prevent-disabling-injection-pods"
3+
edition = "*"
4+
version = "0.1.0"
5+
description = "`istio-prevent-disabling-injection-pods` is a KCL validation module"
6+

‎istio-prevent-disabling-injection-pods/kcl.mod.lock

Whitespace-only changes.

‎istio-prevent-disabling-injection-pods/main.k

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Define the validation function
2+
validate = lambda item {
3+
if item.kind == "Pod":
4+
assert item?.metadata?.annotations?["sidecar.istio.io/inject"] != "false", "Pods may not disable sidecar injection by setting the annotation sidecar.istio.io/inject to a value of false."
5+
item
6+
}
7+
# Validate All resource
8+
items = [validate(i) for i in option("items") or []]

0 commit comments

Comments
 (0)