feat: add policy feedback support

Signed-off-by: Charles-Edouard Brétéché <[email protected]>
kyverno · Jun 10, 2024 · d3d2ddb · d3d2ddb
1 parent 69a4a1f
commit d3d2ddb
Show file tree

Hide file tree

Showing 13 changed files with 193 additions and 6 deletions.
diff --git a/.crds/json.kyverno.io_validatingpolicies.yaml b/.crds/json.kyverno.io_validatingpolicies.yaml
@@ -122,6 +122,23 @@ spec:
                             x-kubernetes-preserve-unknown-fields: true
                           type: array
                       type: object
+                    feedback:
+                      description: Feedback declares rule feedback entries.
+                      items:
+                        description: Feedback contains a feedback entry.
+                        properties:
+                          name:
+                            description: Name is the feedback entry name.
+                            type: string
+                          value:
+                            description: Value is the feedback entry value (a JMESPath
+                              expression).
+                            type: string
+                        required:
+                        - name
+                        - value
+                        type: object
+                      type: array
                     identifier:
                       description: Identifier declares a JMESPath expression to extract
                         a name from the payload.

diff --git a/.schemas/json/_definitions.json b/.schemas/json/_definitions.json
@@ -16592,6 +16592,28 @@
                       }
                     }
                   },
+                  "feedback": {
+                    "description": "Feedback declares rule feedback entries.",
+                    "type": "array",
+                    "items": {
+                      "description": "Feedback contains a feedback entry.",
+                      "type": "object",
+                      "required": [
+                        "name",
+                        "value"
+                      ],
+                      "properties": {
+                        "name": {
+                          "description": "Name is the feedback entry name.",
+                          "type": "string"
+                        },
+                        "value": {
+                          "description": "Value is the feedback entry value (a JMESPath expression).",
+                          "type": "string"
+                        }
+                      }
+                    }
+                  },
                   "identifier": {
                     "description": "Identifier declares a JMESPath expression to extract a name from the payload.",
                     "type": "string"

diff --git a/.schemas/json/validatingpolicy-json-v1alpha1.json b/.schemas/json/validatingpolicy-json-v1alpha1.json
@@ -417,6 +417,34 @@
                   }
                 }
               },
+              "feedback": {
+                "description": "Feedback declares rule feedback entries.",
+                "type": [
+                  "array",
+                  "null"
+                ],
+                "items": {
+                  "description": "Feedback contains a feedback entry.",
+                  "type": [
+                    "object",
+                    "null"
+                  ],
+                  "required": [
+                    "name",
+                    "value"
+                  ],
+                  "properties": {
+                    "name": {
+                      "description": "Name is the feedback entry name.",
+                      "type": "string"
+                    },
+                    "value": {
+                      "description": "Value is the feedback entry value (a JMESPath expression).",
+                      "type": "string"
+                    }
+                  }
+                }
+              },
               "identifier": {
                 "description": "Identifier declares a JMESPath expression to extract a name from the payload.",
                 "type": [

diff --git a/.schemas/json/validatingpolicylist-json-v1alpha1.json b/.schemas/json/validatingpolicylist-json-v1alpha1.json
@@ -440,6 +440,34 @@
                         }
                       }
                     },
+                    "feedback": {
+                      "description": "Feedback declares rule feedback entries.",
+                      "type": [
+                        "array",
+                        "null"
+                      ],
+                      "items": {
+                        "description": "Feedback contains a feedback entry.",
+                        "type": [
+                          "object",
+                          "null"
+                        ],
+                        "required": [
+                          "name",
+                          "value"
+                        ],
+                        "properties": {
+                          "name": {
+                            "description": "Name is the feedback entry name.",
+                            "type": "string"
+                          },
+                          "value": {
+                            "description": "Value is the feedback entry value (a JMESPath expression).",
+                            "type": "string"
+                          }
+                        }
+                      }
+                    },
                     "identifier": {
                       "description": "Identifier declares a JMESPath expression to extract a name from the payload.",
                       "type": [

diff --git a/.schemas/openapi/v2/schema.json b/.schemas/openapi/v2/schema.json
diff --git a/.schemas/openapi/v3/apis/json.kyverno.io/v1alpha1.json b/.schemas/openapi/v3/apis/json.kyverno.io/v1alpha1.json
diff --git a/Makefile b/Makefile
@@ -239,9 +239,9 @@ codegen-docs: codegen-api-docs codegen-cli-docs codegen-jp-docs codegen-catalog
 .PHONY: codegen-mkdocs
 codegen-mkdocs: codegen-docs ## Generate mkdocs website
 	@echo Generate mkdocs website... >&2
-	@$(PIP) install mkdocs
-	@$(PIP) install --upgrade pip
-	@$(PIP) install -U mkdocs-material mkdocs-redirects mkdocs-minify-plugin mkdocs-include-markdown-plugin lunr mkdocs-rss-plugin mike
+	@PIP_BREAK_SYSTEM_PACKAGES=1 $(PIP) install mkdocs
+	@PIP_BREAK_SYSTEM_PACKAGES=1 $(PIP) install --upgrade pip
+	@PIP_BREAK_SYSTEM_PACKAGES=1 $(PIP) install -U mkdocs-material mkdocs-redirects mkdocs-minify-plugin mkdocs-include-markdown-plugin lunr mkdocs-rss-plugin mike
 	@mkdocs build -f ./website/mkdocs.yaml
 
 .PHONY: codegen-schemas-openapi
@@ -261,7 +261,8 @@ codegen-schemas-openapi: $(KIND) $(HELM) ## Generate openapi schemas (v2 and v3)
 
 .PHONY: codegen-schemas-json
 codegen-schemas-json: codegen-schemas-openapi ## Generate json schemas
-	@$(PIP) install openapi2jsonschema --no-build-isolation
+	@PIP_BREAK_SYSTEM_PACKAGES=1 $(PIP) install -U pip setuptools 
+	@PIP_BREAK_SYSTEM_PACKAGES=1 $(PIP) install openapi2jsonschema --no-build-isolation
 	@rm -rf ./.schemas/json
 	@openapi2jsonschema ./.schemas/openapi/v2/schema.json --kubernetes --stand-alone --expanded -o ./.schemas/json
 

diff --git a/pkg/apis/policy/v1alpha1/feedback.go b/pkg/apis/policy/v1alpha1/feedback.go
@@ -0,0 +1,10 @@
+package v1alpha1
+
+// Feedback contains a feedback entry.
+type Feedback struct {
+	// Name is the feedback entry name.
+	Name string `json:"name"`
+
+	// Value is the feedback entry value (a JMESPath expression).
+	Value string `json:"value"`
+}
diff --git a/pkg/apis/policy/v1alpha1/validating_rule.go b/pkg/apis/policy/v1alpha1/validating_rule.go
@@ -22,6 +22,10 @@ type ValidatingRule struct {
 	// +optional
 	Identifier string `json:"identifier,omitempty"`
 
+	// Feedback declares rule feedback entries.
+	// +optional
+	Feedback []Feedback `json:"feedback,omitempty"`
+
 	// Assert is used to validate matching resources.
 	Assert *Assert `json:"assert"`
 }
diff --git a/pkg/apis/policy/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/policy/v1alpha1/zz_generated.deepcopy.go
diff --git a/pkg/data/crds/json.kyverno.io_validatingpolicies.yaml b/pkg/data/crds/json.kyverno.io_validatingpolicies.yaml
@@ -122,6 +122,23 @@ spec:
                             x-kubernetes-preserve-unknown-fields: true
                           type: array
                       type: object
+                    feedback:
+                      description: Feedback declares rule feedback entries.
+                      items:
+                        description: Feedback contains a feedback entry.
+                        properties:
+                          name:
+                            description: Name is the feedback entry name.
+                            type: string
+                          value:
+                            description: Value is the feedback entry value (a JMESPath
+                              expression).
+                            type: string
+                        required:
+                        - name
+                        - value
+                        type: object
+                      type: array
                     identifier:
                       description: Identifier declares a JMESPath expression to extract
                         a name from the payload.

diff --git a/pkg/json-engine/engine.go b/pkg/json-engine/engine.go
@@ -34,10 +34,16 @@ type RuleResponse struct {
 	Rule       v1alpha1.ValidatingRule
 	Timestamp  time.Time
 	Identifier string
+	Feedback   map[string]Feedback
 	Error      error
 	Violations matching.Results
 }
 
+type Feedback struct {
+	Error error
+	Value any
+}
+
 // PolicyResult specifies state of a policy result
 type PolicyResult string
 
@@ -103,19 +109,37 @@ func New() engine.Engine[Request, Response] {
 					return nil
 				}
 			}
+			var feedback map[string]Feedback
+			for _, f := range r.rule.Feedback {
+				result, err := template.Execute(context.Background(), f.Value, r.resource, bindings)
+				if feedback == nil {
+					feedback = map[string]Feedback{}
+				}
+				if err != nil {
+					feedback[f.Name] = Feedback{
+						Error: err,
+					}
+				} else {
+					feedback[f.Name] = Feedback{
+						Value: result,
+					}
+				}
+			}
 			violations, err := matching.MatchAssert(ctx, nil, r.rule.Assert, r.resource, bindings)
 			if err != nil {
 				return []RuleResponse{{
 					Rule:       r.rule,
 					Timestamp:  time.Now(),
 					Identifier: identifier,
+					Feedback:   feedback,
 					Error:      err,
 				}}
 			}
 			return []RuleResponse{{
 				Rule:       r.rule,
 				Timestamp:  time.Now(),
 				Identifier: identifier,
+				Feedback:   feedback,
 				Violations: violations,
 			}}
 		})

diff --git a/website/docs/apis/kyverno-json.v1alpha1.md b/website/docs/apis/kyverno-json.v1alpha1.md
@@ -98,6 +98,20 @@ auto_generated: true
 | `name` | `string` | :white_check_mark: |  | <p>Name is the entry name.</p> |
 | `variable` | [`Any`](#json-kyverno-io-v1alpha1-Any) |  |  | <p>Variable defines an arbitrary variable.</p> |
 
+## `Feedback`     {#json-kyverno-io-v1alpha1-Feedback}
+
+**Appears in:**
+
+- [ValidatingRule](#json-kyverno-io-v1alpha1-ValidatingRule)
+
+<p>Feedback contains a feedback entry.</p>
+
+
+| Field | Type | Required | Inline | Description |
+|---|---|---|---|---|
+| `name` | `string` | :white_check_mark: |  | <p>Name is the feedback entry name.</p> |
+| `value` | `string` | :white_check_mark: |  | <p>Value is the feedback entry value (a JMESPath expression).</p> |
+
 ## `Match`     {#json-kyverno-io-v1alpha1-Match}
 
 **Appears in:**
@@ -141,6 +155,7 @@ auto_generated: true
 | `match` | [`Match`](#json-kyverno-io-v1alpha1-Match) |  |  | <p>Match defines when this policy rule should be applied.</p> |
 | `exclude` | [`Match`](#json-kyverno-io-v1alpha1-Match) |  |  | <p>Exclude defines when this policy rule should not be applied.</p> |
 | `identifier` | `string` |  |  | <p>Identifier declares a JMESPath expression to extract a name from the payload.</p> |
+| `feedback` | [`[]Feedback`](#json-kyverno-io-v1alpha1-Feedback) |  |  | <p>Feedback declares rule feedback entries.</p> |
 | `assert` | [`Assert`](#json-kyverno-io-v1alpha1-Assert) | :white_check_mark: |  | <p>Assert is used to validate matching resources.</p> |