genpolicy: add state to policy #10431
Conversation
katacontainersbot
added
the
size/huge
|
@Redent0r, please, rebase this PR atop of the current main. I've done a reasonable amount of changes in the workflows in order to get measured rootfs working, and that will requires PRs to be rebased, sorry. |
Redent0r
force-pushed
the
saulparedes/add-policy-state
branch
2 times, most recently
from
4ec207d to
fa4e605
Compare
Redent0r
force-pushed
the
saulparedes/add-policy-state
branch
3 times, most recently
from
31f99cd to
51e2678
Compare
|
@Redent0r, I've approved and re-triggered the failing CI (which is NOT related to the changes you're proposing). |
|
Since we can now use the state to model more complex request chains, can we add some unit tests so that the expected requests are allowed (technically already covered by the e2e tests) and no other requests on a certain state are allowed (not yet covered by e2e tests as far as I understand). |
Redent0r
force-pushed
the
saulparedes/add-policy-state
branch
from
51e2678 to
56020fc
Compare
Thanks! Created #10529 to tackle on a separate PR |
Use regorous engine's add_data method to add state to the policy. This data can later be accessed inside rego context through the data namespace. Support state modifications (json-patches) that may be returned as a result from policy evaluation. Also initialize a policy engine data slice "pstate" dedicated for storing state. Fixes kata-containers#10087 Signed-off-by: Saul Paredes <[email protected]>
Make sure all container sandbox names match the sandbox name of the first container. Signed-off-by: Saul Paredes <[email protected]>
Redent0r
force-pushed
the
saulparedes/add-policy-state
branch
from
56020fc to
c207312
Compare
katacontainersbot
added
size/large
7 participants
Fixes #10087
This PR adds the ability for the policy to save and load data to a state kept in the regorus engine, and also validates one field (sandbox name) to show capabilities.