brennen
/
blubber
1
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
120 Commits
2 Branches
713 KiB
Branch: master
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'master'
${ noResults }
blubber/policy.example.yaml

9 lines
404 B
Raw Permalink Normal View History

Allow for configuration policies Summary: Implements a rough interface for validating configuration against arbitrary policy rules. Policies are provided as YAML and passed via the command line as file paths or remote URIs. The format of policies is: enforcements: - path: <path> rule: <rule> Where `<path>` is a YAML-ish path to a config field and `<rule>` is any expression our config validator understands (expressions built in by the validator library and custom tags defined in `config.validation.go`). Example policy: enforcements: - path: variants.production.base rule: oneof=debian:jessie debian:stretch - path: variants.production.runs.as rule: ne=foo - path: variants.production.node.dependencies rule: isfalse Command flag parsing was implemented in `main.go` to support the new `--policy=uri` flag and improve existing handling of `--version` and the usage statement. Test Plan: Run `go test ./...`. Reviewers: thcipriani, demon, hashar, mmodell, #release-engineering-team Reviewed By: thcipriani, #release-engineering-team Tags: #release-engineering-team Differential Revision: https://phabricator.wikimedia.org/D999
6 years ago
Update go-playground validator Update the go-playground validator to support "startswith" and "endswith" validators to be used to validate images used for production. See the example in policy.example.yaml for how this would be used. Bug: T215319 Change-Id: Ie4362184bdb19399c667b4180b4bef32c2198063
4 years ago
​
Policy example should work on blubber.example.yaml Test Plan: Run: blubber -p policy.example.yaml blubber.example.yaml production Be happy it works. Reviewers: dduvall, #release-engineering-team Reviewed By: dduvall, #release-engineering-team Tags: #release-engineering-team Differential Revision: https://phabricator.wikimedia.org/D1013
6 years ago
​
Update go-playground validator Update the go-playground validator to support "startswith" and "endswith" validators to be used to validate images used for production. See the example in policy.example.yaml for how this would be used. Bug: T215319 Change-Id: Ie4362184bdb19399c667b4180b4bef32c2198063
4 years ago
​
​
​
 
  1. enforcements:

  2.   - path: base

  3.     rule: oneof=docker-registry.wikimedia.org/wikimedia-stretch:latest docker-registry.wikimedia.org/wikimedia-jessie:latest

  4.   - path: variants.production.runs.insecurely

  5.     rule: isfalse

  6.   - path: variants.test.base

  7.     rule: omitempty,startswith=docker-registry.wikimedia.org

  8.   - path: variants.production.base

  9.     rule: omitempty,startswith=docker-registry.wikimedia.org