Gatekeeper

assign.mutations.gatekeeper.sh
assignimage.mutations.gatekeeper.sh
assignmetadata.mutations.gatekeeper.sh
configs.config.gatekeeper.sh
constraintpodstatuses.status.gatekeeper.sh
constrainttemplatepodstatuses.status.gatekeeper.sh
constrainttemplates.templates.gatekeeper.sh
expansiontemplate.expansion.gatekeeper.sh
expansiontemplatepodstatuses.status.gatekeeper.sh
modifyset.mutations.gatekeeper.sh
mutatorpodstatuses.status.gatekeeper.sh
providers.externaldata.gatekeeper.sh

k8srequiredlabels.constraints.gatekeeper.sh

apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: foosystemrequiredlabels
spec:
  # 自动创建 foosystemrequiredlabels.constraints.gatekeeper.sh 类型
  crd:
    spec:
      names:
        kind: FooSystemRequiredLabels
      validation:
        # 这里的属性会添加到自动创建 crd 的 parameters 参数下
        openAPIV3Schema:
          type: object
          properties:
            labels:
              type: array
              items:
                type: string

  targets:
  - target: admission.k8s.gatekeeper.sh
    libs:
      - |
        package lib.helpers

        make_message(missing) = msg {
          msg := sprintf("you must provide labels: %v", [missing])
        }        

    rego: |
      package foosystemrequiredlabels

      import data.lib.helpers

      violation[{"msg": msg, "details": {"missing_labels": missing}}] {
        provided := {label | input.request.object.metadata.labels[label]}
        required := {label | label := input.parameters.labels[_]}
        missing := required - provided
        count(missing) > 0
        msg := helpers.make_message(missing)
      }      

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: ns-must-have-gk
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
  parameters:
    labels: ["gatekeeper"]
  enforcementAction: "deny"

input.review 

input.parameters

// ConstraintTemplate is the Schema for the constrainttemplates API
// +k8s:openapi-gen=true
// +k8s:conversion-gen-external-types=github.com/open-policy-agent/frameworks/constraint/pkg/apis/templates
type ConstraintTemplate struct {
    metav1.TypeMeta   `json:",inline"`
    metav1.ObjectMeta `json:"metadata,omitempty"`

    Spec   ConstraintTemplateSpec   `json:"spec,omitempty"`
    Status ConstraintTemplateStatus `json:"status,omitempty"`
}

// ConstraintTemplateSpec defines the desired state of ConstraintTemplate.
type ConstraintTemplateSpec struct {
    CRD     CRD      `json:"crd,omitempty"`
    Targets []Target `json:"targets,omitempty"`
}

type CRD struct {
    Spec CRDSpec `json:"spec,omitempty"`
}

type CRDSpec struct {
    Names Names `json:"names,omitempty"`
    // +kubebuilder:default={legacySchema: false}
    Validation *Validation `json:"validation,omitempty"`
}

type Names struct {
    Kind       string   `json:"kind,omitempty"`
    ShortNames []string `json:"shortNames,omitempty"`
}

type Validation struct {
    // +kubebuilder:validation:Schemaless
    // +kubebuilder:validation:Type=object
    // +kubebuilder:pruning:PreserveUnknownFields
    // +k8s:conversion-gen=false
    OpenAPIV3Schema *apiextensionsv1.JSONSchemaProps `json:"openAPIV3Schema,omitempty"`
    // +kubebuilder:default=false
    LegacySchema *bool `json:"legacySchema,omitempty"` // *bool allows for "unset" state which we need to apply appropriate defaults
}

type Target struct {
    Target string   `json:"target,omitempty"`
    Rego   string   `json:"rego,omitempty"`
    Libs   []string `json:"libs,omitempty"`
    // The source code options for the constraint template. "Rego" can only
    // be specified in one place (either here or in the "rego" field)
    // +listType=map
    // +listMapKey=engine
    // +kubebuilder:validation:Required
    Code []Code `json:"code,omitempty"`
}

type Code struct {
    // The engine used to evaluate the code. Example: "Rego". Required.
    // +kubebuilder:validation:Required
    Engine string `json:"engine"`

    // +kubebuilder:validation:Required
    // +kubebuilder:validation:Schemaless
    // +kubebuilder:pruning:PreserveUnknownFields
    // The source code for the template. Required.
    Source *templates.Anything `json:"source"`
}

kubectl get constraints

github.com/open-policy-agent/frameworks/constraint/pkg/client/crds/schema.go -> CreateSchema -> apiextensions.JSONSchemaProps
github.com/open-policy-agent/frameworks/constraint/pkg/client/crds/crds.go -> CreateCRD -> apiextensions.CustomResourceDefinition

apiextensions.JSONSchemaProps -> apiextensions.CustomResourceDefinition

// CreateSchema combines the schema of the match target and the ConstraintTemplate parameters
// to form the schema of the actual constraint resource.
func CreateSchema(templ *templates.ConstraintTemplate, target MatchSchemaProvider) *apiextensions.JSONSchemaProps {
    props := map[string]apiextensions.JSONSchemaProps{
        "match":             target.MatchSchema(),
        "enforcementAction": {Type: "string"},
    }

    if templ.Spec.CRD.Spec.Validation != nil && templ.Spec.CRD.Spec.Validation.OpenAPIV3Schema != nil {
        internalSchema := *templ.Spec.CRD.Spec.Validation.OpenAPIV3Schema.DeepCopy()
        props["parameters"] = internalSchema
    }

    schema := &apiextensions.JSONSchemaProps{
        Type: "object",
        Properties: map[string]apiextensions.JSONSchemaProps{
            "metadata": {
                Type: "object",
                Properties: map[string]apiextensions.JSONSchemaProps{
                    "name": {
                        Type:      "string",
                        MaxLength: pointer.Int64(63),
                    },
                },
            },
            "spec": {
                Type:       "object",
                Properties: props,
            },
            "status": {
                XPreserveUnknownFields: pointer.Bool(true),
            },
        },
    }

    return schema
}

// Match selects which objects are in scope.
// +kubebuilder:object:generate=true
type Match struct {
    // Source determines whether generated or original resources are matched.
    // Accepts `Generated`|`Original`|`All` (defaults to `All`). A value of
    // `Generated` will only match generated resources, while `Original` will only
    // match regular resources.
    // +kubebuilder:validation:Enum=All;Generated;Original
    Source string  `json:"source,omitempty"`
    Kinds  []Kinds `json:"kinds,omitempty"`
    // Scope determines if cluster-scoped and/or namespaced-scoped resources
    // are matched.  Accepts `*`, `Cluster`, or `Namespaced`. (defaults to `*`)
    Scope apiextensionsv1.ResourceScope `json:"scope,omitempty"`
    // Namespaces is a list of namespace names. If defined, a constraint only
    // applies to resources in a listed namespace.  Namespaces also supports a
    // prefix or suffix based glob.  For example, `namespaces: [kube-*]` matches both
    // `kube-system` and `kube-public`, and `namespaces: [*-system]` matches both
    // `kube-system` and `gatekeeper-system`.
    Namespaces []wildcard.Wildcard `json:"namespaces,omitempty"`
    // ExcludedNamespaces is a list of namespace names. If defined, a
    // constraint only applies to resources not in a listed namespace.
    // ExcludedNamespaces also supports a prefix or suffix based glob.  For example,
    // `excludedNamespaces: [kube-*]` matches both `kube-system` and
    // `kube-public`, and `excludedNamespaces: [*-system]` matches both `kube-system` and
    // `gatekeeper-system`.
    ExcludedNamespaces []wildcard.Wildcard `json:"excludedNamespaces,omitempty"`
    // LabelSelector is the combination of two optional fields: `matchLabels`
    // and `matchExpressions`.  These two fields provide different methods of
    // selecting or excluding k8s objects based on the label keys and values
    // included in object metadata.  All selection expressions from both
    // sections are ANDed to determine if an object meets the cumulative
    // requirements of the selector.
    LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
    // NamespaceSelector is a label selector against an object's containing
    // namespace or the object itself, if the object is a namespace.
    NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
    // Name is the name of an object.  If defined, it will match against objects with the specified
    // name.  Name also supports a prefix or suffix glob.  For example, `name: pod-*` would match
    // both `pod-a` and `pod-b`, and `name: *-pod` would match both `a-pod` and `b-pod`.
    Name wildcard.Wildcard `json:"name,omitempty"`
}

// Kinds accepts a list of objects with apiGroups and kinds fields
// that list the groups/kinds of objects to which the mutation will apply.
// If multiple groups/kinds objects are specified,
// only one match is needed for the resource to be in scope.
// +kubebuilder:object:generate=true
type Kinds struct {
    // APIGroups is the API groups the resources belong to. '*' is all groups.
    // If '*' is present, the length of the slice must be one.
    // Required.
    APIGroups []string `json:"apiGroups,omitempty" protobuf:"bytes,1,rep,name=apiGroups"`
    Kinds     []string `json:"kinds,omitempty"`
}