Skip to content

Commit 877a742

Browse files
guicassolatoguicassolato
authored
Disallow empty AuthPolicies (#1034)
Signed-off-by: Guilherme Cassolato <[email protected]>
1 parent f58cb54 commit 877a742

File tree

6 files changed

+201
-13
lines changed

6 files changed

+201
-13
lines changed

‎api/v1/authpolicy_types.go

+3
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,9 @@ func (p *AuthPolicy) Kind() string {
292292
// +kubebuilder:validation:XValidation:rule="!(has(self.defaults) && (has(self.patterns) || has(self.when) || has(self.rules)))",message="Implicit and explicit defaults are mutually exclusive"
293293
// +kubebuilder:validation:XValidation:rule="!(has(self.overrides) && (has(self.patterns) || has(self.when) || has(self.rules)))",message="Implicit defaults and explicit overrides are mutually exclusive"
294294
// +kubebuilder:validation:XValidation:rule="!(has(self.overrides) && has(self.defaults))",message="Explicit overrides and explicit defaults are mutually exclusive"
295+
// +kubebuilder:validation:XValidation:rule="!(has(self.overrides) || has(self.defaults)) ? has(self.rules) && ((has(self.rules.authentication) && size(self.rules.authentication) > 0) || (has(self.rules.metadata) && size(self.rules.metadata) > 0) || (has(self.rules.authorization) && size(self.rules.authorization) > 0) || (has(self.rules.response) && (has(self.rules.response.unauthenticated) || has(self.rules.response.unauthorized) || (has(self.rules.response.success) && (size(self.rules.response.success.headers) > 0 || size(self.rules.response.success.filters) > 0)))) || (has(self.rules.callbacks) && size(self.rules.callbacks) > 0)) : true",message="At least one spec.rules must be defined"
296+
// +kubebuilder:validation:XValidation:rule="has(self.defaults) ? has(self.defaults.rules) && ((has(self.defaults.rules.authentication) && size(self.defaults.rules.authentication) > 0) || (has(self.defaults.rules.metadata) && size(self.defaults.rules.metadata) > 0) || (has(self.defaults.rules.authorization) && size(self.defaults.rules.authorization) > 0) || (has(self.defaults.rules.response) && (has(self.defaults.rules.response.unauthenticated) || has(self.defaults.rules.response.unauthorized) || (has(self.defaults.rules.response.success) && (size(self.defaults.rules.response.success.headers) > 0 || size(self.defaults.rules.response.success.filters) > 0)))) || (has(self.defaults.rules.callbacks) && size(self.defaults.rules.callbacks) > 0)) : true",message="At least one spec.defaults.rules must be defined"
297+
// +kubebuilder:validation:XValidation:rule="has(self.overrides) ? has(self.overrides.rules) && ((has(self.overrides.rules.authentication) && size(self.overrides.rules.authentication) > 0) || (has(self.overrides.rules.metadata) && size(self.overrides.rules.metadata) > 0) || (has(self.overrides.rules.authorization) && size(self.overrides.rules.authorization) > 0) || (has(self.overrides.rules.response) && (has(self.overrides.rules.response.unauthenticated) || has(self.overrides.rules.response.unauthorized) || (has(self.overrides.rules.response.success) && (size(self.overrides.rules.response.success.headers) > 0 || size(self.overrides.rules.response.success.filters) > 0)))) || (has(self.overrides.rules.callbacks) && size(self.overrides.rules.callbacks) > 0)) : true",message="At least one spec.overrides.rules must be defined"
295298
type AuthPolicySpec struct {
296299
// Reference to the object to which this policy applies.
297300
// +kubebuilder:validation:XValidation:rule="self.group == 'gateway.networking.k8s.io'",message="Invalid targetRef.group. The only supported value is 'gateway.networking.k8s.io'"

‎bundle/manifests/kuadrant-operator.clusterserviceversion.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ metadata:
109109
capabilities: Basic Install
110110
categories: Integration & Delivery
111111
containerImage: quay.io/kuadrant/kuadrant-operator:latest
112-
createdAt: "2024-11-25T09:30:08Z"
112+
createdAt: "2024-11-26T15:09:44Z"
113113
description: A Kubernetes Operator to manage the lifecycle of the Kuadrant system
114114
operators.operatorframework.io/builder: operator-sdk-v1.32.0
115115
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3

‎bundle/manifests/kuadrant.io_authpolicies.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -6888,6 +6888,36 @@ spec:
68886888
|| has(self.rules)))'
68896889
- message: Explicit overrides and explicit defaults are mutually exclusive
68906890
rule: '!(has(self.overrides) && has(self.defaults))'
6891+
- message: At least one spec.rules must be defined
6892+
rule: '!(has(self.overrides) || has(self.defaults)) ? has(self.rules)
6893+
&& ((has(self.rules.authentication) && size(self.rules.authentication)
6894+
> 0) || (has(self.rules.metadata) && size(self.rules.metadata) > 0)
6895+
|| (has(self.rules.authorization) && size(self.rules.authorization)
6896+
> 0) || (has(self.rules.response) && (has(self.rules.response.unauthenticated)
6897+
|| has(self.rules.response.unauthorized) || (has(self.rules.response.success)
6898+
&& (size(self.rules.response.success.headers) > 0 || size(self.rules.response.success.filters)
6899+
> 0)))) || (has(self.rules.callbacks) && size(self.rules.callbacks)
6900+
> 0)) : true'
6901+
- message: At least one spec.defaults.rules must be defined
6902+
rule: 'has(self.defaults) ? has(self.defaults.rules) && ((has(self.defaults.rules.authentication)
6903+
&& size(self.defaults.rules.authentication) > 0) || (has(self.defaults.rules.metadata)
6904+
&& size(self.defaults.rules.metadata) > 0) || (has(self.defaults.rules.authorization)
6905+
&& size(self.defaults.rules.authorization) > 0) || (has(self.defaults.rules.response)
6906+
&& (has(self.defaults.rules.response.unauthenticated) || has(self.defaults.rules.response.unauthorized)
6907+
|| (has(self.defaults.rules.response.success) && (size(self.defaults.rules.response.success.headers)
6908+
> 0 || size(self.defaults.rules.response.success.filters) > 0))))
6909+
|| (has(self.defaults.rules.callbacks) && size(self.defaults.rules.callbacks)
6910+
> 0)) : true'
6911+
- message: At least one spec.overrides.rules must be defined
6912+
rule: 'has(self.overrides) ? has(self.overrides.rules) && ((has(self.overrides.rules.authentication)
6913+
&& size(self.overrides.rules.authentication) > 0) || (has(self.overrides.rules.metadata)
6914+
&& size(self.overrides.rules.metadata) > 0) || (has(self.overrides.rules.authorization)
6915+
&& size(self.overrides.rules.authorization) > 0) || (has(self.overrides.rules.response)
6916+
&& (has(self.overrides.rules.response.unauthenticated) || has(self.overrides.rules.response.unauthorized)
6917+
|| (has(self.overrides.rules.response.success) && (size(self.overrides.rules.response.success.headers)
6918+
> 0 || size(self.overrides.rules.response.success.filters) > 0))))
6919+
|| (has(self.overrides.rules.callbacks) && size(self.overrides.rules.callbacks)
6920+
> 0)) : true'
68916921
status:
68926922
properties:
68936923
conditions:

‎charts/kuadrant-operator/templates/manifests.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -6888,6 +6888,36 @@ spec:
68886888
|| has(self.rules)))'
68896889
- message: Explicit overrides and explicit defaults are mutually exclusive
68906890
rule: '!(has(self.overrides) && has(self.defaults))'
6891+
- message: At least one spec.rules must be defined
6892+
rule: '!(has(self.overrides) || has(self.defaults)) ? has(self.rules)
6893+
&& ((has(self.rules.authentication) && size(self.rules.authentication)
6894+
> 0) || (has(self.rules.metadata) && size(self.rules.metadata) > 0)
6895+
|| (has(self.rules.authorization) && size(self.rules.authorization)
6896+
> 0) || (has(self.rules.response) && (has(self.rules.response.unauthenticated)
6897+
|| has(self.rules.response.unauthorized) || (has(self.rules.response.success)
6898+
&& (size(self.rules.response.success.headers) > 0 || size(self.rules.response.success.filters)
6899+
> 0)))) || (has(self.rules.callbacks) && size(self.rules.callbacks)
6900+
> 0)) : true'
6901+
- message: At least one spec.defaults.rules must be defined
6902+
rule: 'has(self.defaults) ? has(self.defaults.rules) && ((has(self.defaults.rules.authentication)
6903+
&& size(self.defaults.rules.authentication) > 0) || (has(self.defaults.rules.metadata)
6904+
&& size(self.defaults.rules.metadata) > 0) || (has(self.defaults.rules.authorization)
6905+
&& size(self.defaults.rules.authorization) > 0) || (has(self.defaults.rules.response)
6906+
&& (has(self.defaults.rules.response.unauthenticated) || has(self.defaults.rules.response.unauthorized)
6907+
|| (has(self.defaults.rules.response.success) && (size(self.defaults.rules.response.success.headers)
6908+
> 0 || size(self.defaults.rules.response.success.filters) > 0))))
6909+
|| (has(self.defaults.rules.callbacks) && size(self.defaults.rules.callbacks)
6910+
> 0)) : true'
6911+
- message: At least one spec.overrides.rules must be defined
6912+
rule: 'has(self.overrides) ? has(self.overrides.rules) && ((has(self.overrides.rules.authentication)
6913+
&& size(self.overrides.rules.authentication) > 0) || (has(self.overrides.rules.metadata)
6914+
&& size(self.overrides.rules.metadata) > 0) || (has(self.overrides.rules.authorization)
6915+
&& size(self.overrides.rules.authorization) > 0) || (has(self.overrides.rules.response)
6916+
&& (has(self.overrides.rules.response.unauthenticated) || has(self.overrides.rules.response.unauthorized)
6917+
|| (has(self.overrides.rules.response.success) && (size(self.overrides.rules.response.success.headers)
6918+
> 0 || size(self.overrides.rules.response.success.filters) > 0))))
6919+
|| (has(self.overrides.rules.callbacks) && size(self.overrides.rules.callbacks)
6920+
> 0)) : true'
68916921
status:
68926922
properties:
68936923
conditions:

‎config/crd/bases/kuadrant.io_authpolicies.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -6887,6 +6887,36 @@ spec:
68876887
|| has(self.rules)))'
68886888
- message: Explicit overrides and explicit defaults are mutually exclusive
68896889
rule: '!(has(self.overrides) && has(self.defaults))'
6890+
- message: At least one spec.rules must be defined
6891+
rule: '!(has(self.overrides) || has(self.defaults)) ? has(self.rules)
6892+
&& ((has(self.rules.authentication) && size(self.rules.authentication)
6893+
> 0) || (has(self.rules.metadata) && size(self.rules.metadata) > 0)
6894+
|| (has(self.rules.authorization) && size(self.rules.authorization)
6895+
> 0) || (has(self.rules.response) && (has(self.rules.response.unauthenticated)
6896+
|| has(self.rules.response.unauthorized) || (has(self.rules.response.success)
6897+
&& (size(self.rules.response.success.headers) > 0 || size(self.rules.response.success.filters)
6898+
> 0)))) || (has(self.rules.callbacks) && size(self.rules.callbacks)
6899+
> 0)) : true'
6900+
- message: At least one spec.defaults.rules must be defined
6901+
rule: 'has(self.defaults) ? has(self.defaults.rules) && ((has(self.defaults.rules.authentication)
6902+
&& size(self.defaults.rules.authentication) > 0) || (has(self.defaults.rules.metadata)
6903+
&& size(self.defaults.rules.metadata) > 0) || (has(self.defaults.rules.authorization)
6904+
&& size(self.defaults.rules.authorization) > 0) || (has(self.defaults.rules.response)
6905+
&& (has(self.defaults.rules.response.unauthenticated) || has(self.defaults.rules.response.unauthorized)
6906+
|| (has(self.defaults.rules.response.success) && (size(self.defaults.rules.response.success.headers)
6907+
> 0 || size(self.defaults.rules.response.success.filters) > 0))))
6908+
|| (has(self.defaults.rules.callbacks) && size(self.defaults.rules.callbacks)
6909+
> 0)) : true'
6910+
- message: At least one spec.overrides.rules must be defined
6911+
rule: 'has(self.overrides) ? has(self.overrides.rules) && ((has(self.overrides.rules.authentication)
6912+
&& size(self.overrides.rules.authentication) > 0) || (has(self.overrides.rules.metadata)
6913+
&& size(self.overrides.rules.metadata) > 0) || (has(self.overrides.rules.authorization)
6914+
&& size(self.overrides.rules.authorization) > 0) || (has(self.overrides.rules.response)
6915+
&& (has(self.overrides.rules.response.unauthenticated) || has(self.overrides.rules.response.unauthorized)
6916+
|| (has(self.overrides.rules.response.success) && (size(self.overrides.rules.response.success.headers)
6917+
> 0 || size(self.overrides.rules.response.success.filters) > 0))))
6918+
|| (has(self.overrides.rules.callbacks) && size(self.overrides.rules.callbacks)
6919+
> 0)) : true'
68906920
status:
68916921
properties:
68926922
conditions:

0 commit comments

Comments
 (0)