New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Gator sync test support #3098
base: master
Are you sure you want to change the base?
Conversation
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3098 +/- ##
==========================================
- Coverage 54.49% 46.43% -8.06%
==========================================
Files 134 225 +91
Lines 12329 15112 +2783
==========================================
+ Hits 6719 7018 +299
- Misses 5116 7283 +2167
- Partials 494 811 +317
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Signed-off-by: Anlan Du <[email protected]>
…eeper into gator-sync-support
Signed-off-by: Anlan Du <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks really good 💯 !! Thanks for working on it.
A few questions and suggestions.
Signed-off-by: Anlan Du <[email protected]>
…eeper into gator-sync-support
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
…eeper into gator-sync-support
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
163381b
to
1431bb9
Compare
@ritazh Definitely! I'll finish up these last comments next week. |
Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
49f4234
to
7825b31
Compare
Signed-off-by: Anlan Du <[email protected]>
7825b31
to
0fe90b9
Compare
func isTemplate(u *unstructured.Unstructured) bool { | ||
gvk := u.GroupVersionKind() | ||
return gvk.Group == templatesv1.SchemeGroupVersion.Group && gvk.Kind == "ConstraintTemplate" | ||
} | ||
|
||
func isConstraint(u *unstructured.Unstructured) bool { | ||
gvk := u.GroupVersionKind() | ||
return gvk.Group == "constraints.gatekeeper.sh" | ||
} | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we not have helper methods like these in the code somewhere already? Perhaps not but they seem to straightforward and helpful i'd be surprised.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's a great question lol, do you remember seeing anything back when these were written in the gator test PR
Co-authored-by: alex <[email protected]> Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
…thands Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM modulo small nit around testing
Co-authored-by: alex <[email protected]> Signed-off-by: Anlan Du <[email protected]>
Signed-off-by: Anlan Du <[email protected]>
Thanks for all the comments so far, let me know if you have any thoughts @ritazh @sozercan @maxsmythe! |
This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions. |
What this PR does / why we need it:
Certain templates require replicating into OPA to enable correct evaluation. These templates can use the annotation
metadata.gatekeeper.sh/requires-sync-data
to indicate which resources need to be synced. This template annotation is descriptive, not prescriptive. The prescription of which resources to sync is done inSyncSet
resources and/or the GatekeeperConfig
resource. The management of these various requirements can get challenging as the number of templates requiring replicated data increases.gator sync test
aims to mitigate this challenge by enabling the user to verify their sync configuration is correct. The user passes in any number of Constraint Templates, SyncSets, and a Gatekeeper Config object, along with a GVK manifest listing the GVKs supported by the cluster under test, and the command will determine which requirements enumerated by the Constraint Templates are unfulfilled by the given SyncSet(s), Config, and/or manifest.PRD
Which issue(s) this PR fixes (optional, using
fixes #<issue number>(, fixes #<issue_number>, ...)
format, will close the issue(s) when the PR gets merged):xref #2393
Special notes for your reviewer: