Skip to content

Commit d325550

Browse files
GilTeraSkyshobha2626
GilTeraSky
authored and
shobha2626
committed
Added custom policy template resource
Signed-off-by: GilTS <gil@terasky.com>
1 parent 8c08715 commit d325550

File tree

23 files changed

+1333
-32
lines changed

23 files changed

+1333
-32
lines changed

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- 'v*'
77

88
env:
9-
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner'
9+
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner custompolicytemplate'
1010

1111
jobs:
1212
goreleaser:

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Test and coverage
33
on: [pull_request, push]
44

55
env:
6-
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner'
6+
BUILD_TAGS: 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner custompolicytemplate'
77
jobs:
88
build:
99
name: Test and coverage

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,11 @@ ifeq ($(TEST_FLAGS),)
2222
endif
2323

2424
ifeq ($(BUILD_TAGS),)
25+
<<<<<<< HEAD
2526
BUILD_TAGS := 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy helmfeature helmrelease backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster provisioner'
27+
=======
28+
BUILD_TAGS := 'akscluster cluster clustergroup credential ekscluster gitrepository iampolicy kustomization namespace custompolicy imagepolicy networkpolicy quotapolicy securitypolicy sourcesecret workspace tanzupackage tanzupackages packagerepository packageinstall clustersecret integration mutationpolicy helmfeature helmrelease backupschedule targetlocation dataprotection tanzukubernetescluster clusterclass managementcluster custompolicytemplate'
29+
>>>>>>> 46f9c4b (Added custom policy template resource)
2630
endif
2731

2832
.PHONY: build clean-up test gofmt vet lint acc-test website-lint website-lint-fix

‎docs/resources/custom_policy_template.md‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
Title: "Custom Policy Template Resource"
3+
Description: |-
4+
Creating a custom policy template.
5+
---
6+
7+
# Custom Policy Template Resource
8+
9+
This resource enables users to create custom policy template in TMC.
10+
11+
For more information regarding custom policy template, see [Custom Policy Template][custom-policy-template].
12+
13+
[custom-policy-template]: https://docs.vmware.com/en/VMware-Tanzu-Mission-Control/services/tanzumc-using/GUID-F147492B-04FD-4CFD-8D1F-66E36D40D49C.html
14+
15+
## Example Usage
16+
17+
```terraform
18+
resource "tanzu-mission-control_custom_policy_template" "sample" {
19+
name = "tf-custom-template-test"
20+
21+
spec {
22+
object_type = "ConstraintTemplate"
23+
template_type = "OPAGatekeeper"
24+
25+
data_inventory {
26+
kind = "ConfigMap"
27+
group = "admissionregistration.k8s.io"
28+
version = "v1"
29+
}
30+
31+
data_inventory {
32+
kind = "Deployment"
33+
group = "extensions"
34+
version = "v1"
35+
}
36+
37+
template_manifest = <<YAML
38+
apiVersion: templates.gatekeeper.sh/v1beta1
39+
kind: ConstraintTemplate
40+
metadata:
41+
name: tf-custom-template-test
42+
annotations:
43+
description: Requires Pods to have readiness and/or liveness probes.
44+
spec:
45+
crd:
46+
spec:
47+
names:
48+
kind: tf-custom-template-test
49+
validation:
50+
openAPIV3Schema:
51+
properties:
52+
probes:
53+
type: array
54+
items:
55+
type: string
56+
probeTypes:
57+
type: array
58+
items:
59+
type: string
60+
targets:
61+
- target: admission.k8s.gatekeeper.sh
62+
rego: |
63+
package k8srequiredprobes
64+
probe_type_set = probe_types {
65+
probe_types := {type | type := input.parameters.probeTypes[_]}
66+
}
67+
violation[{"msg": msg}] {
68+
container := input.review.object.spec.containers[_]
69+
probe := input.parameters.probes[_]
70+
probe_is_missing(container, probe)
71+
msg := get_violation_message(container, input.review, probe)
72+
}
73+
probe_is_missing(ctr, probe) = true {
74+
not ctr[probe]
75+
}
76+
probe_is_missing(ctr, probe) = true {
77+
probe_field_empty(ctr, probe)
78+
}
79+
probe_field_empty(ctr, probe) = true {
80+
probe_fields := {field | ctr[probe][field]}
81+
diff_fields := probe_type_set - probe_fields
82+
count(diff_fields) == count(probe_type_set)
83+
}
84+
get_violation_message(container, review, probe) = msg {
85+
msg := sprintf("Container <%v> in your <%v> <%v> has no <%v>", [container.name, review.kind.kind, review.object.metadata.name, probe])
86+
}
87+
YAML
88+
}
89+
}
90+
```
91+
92+
<!-- schema generated by tfplugindocs -->
93+
## Schema
94+
95+
### Required
96+
97+
- `name` (String) The name of the custom policy template
98+
- `spec` (Block List, Min: 1, Max: 1) Spec block of the custom policy template (see [below for nested schema](#nestedblock--spec))
99+
100+
### Optional
101+
102+
- `meta` (Block List, Max: 1) Metadata for the resource (see [below for nested schema](#nestedblock--meta))
103+
104+
### Read-Only
105+
106+
- `id` (String) The ID of this resource.
107+
108+
<a id="nestedblock--spec"></a>
109+
### Nested Schema for `spec`
110+
111+
Required:
112+
113+
- `template_manifest` (String) YAML formatted Kubernetes resource.
114+
The Kubernetes object has to be of the type defined in ObjectType ('ConstraintTemplate').
115+
The object name must match the name of the wrapping policy template.
116+
This will be applied on the cluster after a policy is created using this version of the template.
117+
This contains the latest version of the object. For previous versions, check Versions API.
118+
119+
Optional:
120+
121+
- `data_inventory` (Block List) List of Kubernetes api-resource kinds that need to be synced/replicated in Gatekeeper in order to enforce policy rules on those resources.
122+
Note: This is used for OPAGatekeeper based templates, and should be used if the policy enforcement logic in Rego code uses cached data using "data.inventory" fields. (see [below for nested schema](#nestedblock--spec--data_inventory))
123+
- `is_deprecated` (Boolean) Flag representing whether the custom policy template is deprecated.
124+
- `object_type` (String) The type of Kubernetes resource encoded in Object.
125+
Currently, we only support OPAGatekeeper based 'ConstraintTemplate' object.
126+
- `template_type` (String) The type of policy template.
127+
Currently, we only support 'OPAGatekeeper' based policy templates.
128+
129+
<a id="nestedblock--spec--data_inventory"></a>
130+
### Nested Schema for `spec.data_inventory`
131+
132+
Required:
133+
134+
- `group` (String) API resource group
135+
- `kind` (String) API resource kind
136+
- `version` (String) API resource version
137+
138+
139+
140+
<a id="nestedblock--meta"></a>
141+
### Nested Schema for `meta`
142+
143+
Optional:
144+
145+
- `annotations` (Map of String) Annotations for the resource
146+
- `description` (String) Description of the resource
147+
- `labels` (Map of String) Labels for the resource
148+
149+
Read-Only:
150+
151+
- `resource_version` (String) Resource version of the resource
152+
- `uid` (String) UID of the resource

‎examples/resources/custom_policy_template/provider.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
terraform {
2+
required_providers {
3+
tanzu-mission-control = {
4+
source = "vmware/dev/tanzu-mission-control"
5+
}
6+
}
7+
}
8+
9+
terraform {
10+
backend "local" {
11+
path = "./terraform.tfstate"
12+
}
13+
}
14+
15+
provider "tanzu-mission-control" {
16+
}

‎examples/resources/custom_policy_template/resource_custom_policy_template.tf‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
resource "tanzu-mission-control_custom_policy_template" "sample" {
2+
name = "tf-custom-template-test"
3+
4+
spec {
5+
object_type = "ConstraintTemplate"
6+
template_type = "OPAGatekeeper"
7+
8+
data_inventory {
9+
kind = "ConfigMap"
10+
group = "admissionregistration.k8s.io"
11+
version = "v1"
12+
}
13+
14+
data_inventory {
15+
kind = "Deployment"
16+
group = "extensions"
17+
version = "v1"
18+
}
19+
20+
template_manifest = <<YAML
21+
apiVersion: templates.gatekeeper.sh/v1beta1
22+
kind: ConstraintTemplate
23+
metadata:
24+
name: tf-custom-template-test
25+
annotations:
26+
description: Requires Pods to have readiness and/or liveness probes.
27+
spec:
28+
crd:
29+
spec:
30+
names:
31+
kind: tf-custom-template-test
32+
validation:
33+
openAPIV3Schema:
34+
properties:
35+
probes:
36+
type: array
37+
items:
38+
type: string
39+
probeTypes:
40+
type: array
41+
items:
42+
type: string
43+
targets:
44+
- target: admission.k8s.gatekeeper.sh
45+
rego: |
46+
package k8srequiredprobes
47+
probe_type_set = probe_types {
48+
probe_types := {type | type := input.parameters.probeTypes[_]}
49+
}
50+
violation[{"msg": msg}] {
51+
container := input.review.object.spec.containers[_]
52+
probe := input.parameters.probes[_]
53+
probe_is_missing(container, probe)
54+
msg := get_violation_message(container, input.review, probe)
55+
}
56+
probe_is_missing(ctr, probe) = true {
57+
not ctr[probe]
58+
}
59+
probe_is_missing(ctr, probe) = true {
60+
probe_field_empty(ctr, probe)
61+
}
62+
probe_field_empty(ctr, probe) = true {
63+
probe_fields := {field | ctr[probe][field]}
64+
diff_fields := probe_type_set - probe_fields
65+
count(diff_fields) == count(probe_type_set)
66+
}
67+
get_violation_message(container, review, probe) = msg {
68+
msg := sprintf("Container <%v> in your <%v> <%v> has no <%v>", [container.name, review.kind.kind, review.object.metadata.name, probe])
69+
}
70+
YAML
71+
}
72+
}

‎internal/client/custompolicytemplate/custompolicytemplate_resource.go‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
/*
2+
Copyright © 2023 VMware, Inc. All Rights Reserved.
3+
SPDX-License-Identifier: MPL-2.0
4+
*/
5+
6+
package custompolicytemplateclient
7+
8+
import (
9+
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/transport"
10+
"github.com/vmware/terraform-provider-tanzu-mission-control/internal/helper"
11+
custompolicytemplatemodels "github.com/vmware/terraform-provider-tanzu-mission-control/internal/models/custompolicytemplate"
12+
)
13+
14+
const (
15+
customPolicyTemplateAPIVersionAndGroup = "v1alpha1/policy/templates"
16+
)
17+
18+
// New creates a new custom policy template resource service API client.
19+
func New(transport *transport.Client) ClientService {
20+
return &Client{Client: transport}
21+
}
22+
23+
/*
24+
Client for custom policy template resource service API.
25+
*/
26+
type Client struct {
27+
*transport.Client
28+
}
29+
30+
// ClientService is the interface for Client methods.
31+
type ClientService interface {
32+
CustomPolicyTemplateResourceServiceCreate(request *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData) (*custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData, error)
33+
34+
CustomPolicyTemplateResourceServiceUpdate(request *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData) (*custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData, error)
35+
36+
CustomPolicyTemplateResourceServiceDelete(fn *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateFullName) error
37+
38+
CustomPolicyTemplateResourceServiceGet(fn *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateFullName) (*custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData, error)
39+
}
40+
41+
/*
42+
CustomPolicyTemplateResourceServiceGet gets an custom policy template.
43+
*/
44+
func (c *Client) CustomPolicyTemplateResourceServiceGet(fullName *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateFullName) (*custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData, error) {
45+
requestURL := helper.ConstructRequestURL(customPolicyTemplateAPIVersionAndGroup, fullName.Name).String()
46+
resp := &custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData{}
47+
err := c.Get(requestURL, resp)
48+
49+
return resp, err
50+
}
51+
52+
/*
53+
CustomPolicyTemplateResourceServiceCreate creates an custom policy template.
54+
*/
55+
func (c *Client) CustomPolicyTemplateResourceServiceCreate(request *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData) (*custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData, error) {
56+
response := &custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData{}
57+
requestURL := helper.ConstructRequestURL(customPolicyTemplateAPIVersionAndGroup).String()
58+
err := c.Create(requestURL, request, response)
59+
60+
return response, err
61+
}
62+
63+
/*
64+
CustomPolicyTemplateResourceServiceUpdate updates an custom policy template.
65+
*/
66+
func (c *Client) CustomPolicyTemplateResourceServiceUpdate(request *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData) (*custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData, error) {
67+
response := &custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateData{}
68+
requestURL := helper.ConstructRequestURL(customPolicyTemplateAPIVersionAndGroup, request.Template.FullName.Name).String()
69+
err := c.Update(requestURL, request, response)
70+
71+
return response, err
72+
}
73+
74+
/*
75+
CustomPolicyTemplateResourceServiceDelete deletes an custom policy template.
76+
*/
77+
func (c *Client) CustomPolicyTemplateResourceServiceDelete(fullName *custompolicytemplatemodels.VmwareTanzuManageV1alpha1PolicyTemplateFullName) error {
78+
requestURL := helper.ConstructRequestURL(customPolicyTemplateAPIVersionAndGroup, fullName.Name).String()
79+
80+
return c.Delete(requestURL)
81+
}

‎internal/client/http_client.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ import (
3838
policyclustergroupclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/clustergroup/policy"
3939
sourcesecretclustergroupclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/clustergroup/sourcesecret"
4040
credentialclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/credential"
41+
custompolicytemplateclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/custompolicytemplate"
4142
eksclusterclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/ekscluster"
4243
eksnodepoolclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/ekscluster/nodepool"
4344
integrationclient "github.com/vmware/terraform-provider-tanzu-mission-control/internal/client/integration"
@@ -144,6 +145,7 @@ func newHTTPClient(httpClient *transport.Client) *TanzuMissionControl {
144145
ClusterClassResourceService: clusterclassclient.New(httpClient),
145146
TanzuKubernetesClusterResourceService: tanzukubernetesclusterclient.New(httpClient),
146147
ProvisionerResourceService: provisionerclient.New(httpClient),
148+
CustomPolicyTemplateResourceService: custompolicytemplateclient.New(httpClient),
147149
}
148150
}
149151

@@ -202,4 +204,5 @@ type TanzuMissionControl struct {
202204
ClusterClassResourceService clusterclassclient.ClientService
203205
TanzuKubernetesClusterResourceService tanzukubernetesclusterclient.ClientService
204206
ProvisionerResourceService provisionerclient.ClientService
207+
CustomPolicyTemplateResourceService custompolicytemplateclient.ClientService
205208
}

0 commit comments

Comments
 (0)