22
33
44class KubeDownscalerJobsPolicy (NamespacedAPIObject ):
5-
65 """Support the Kyverno Admission Controller Custom CRDs (https://kyverno.io/docs/introduction/#quick-start)."""
76
87 version = "kyverno.io/v1"
@@ -19,29 +18,21 @@ def create_job_policy(namespace):
1918 "namespace" : namespace ,
2019 "labels" : {
2120 "origin" : "kube-downscaler" ,
22- "kube-downscaler/policy-type" : "without-matching-labels"
21+ "kube-downscaler/policy-type" : "without-matching-labels" ,
2322 },
2423 "annotations" : {
2524 "policies.kyverno.io/title" : "Kube Downscaler Jobs Policy" ,
2625 "policies.kyverno.io/severity" : "medium" ,
2726 "policies.kyverno.io/subject" : "Job" ,
28- "policies.kyverno.io/description" : "Job creation is not allowed in this namespace during a kube-downscaler downtime period."
29- }
27+ "policies.kyverno.io/description" : "Job creation is not allowed in this namespace during a kube-downscaler downtime period." ,
28+ },
3029 },
3130 "spec" : {
3231 "validationFailureAction" : "Enforce" ,
3332 "rules" : [
3433 {
3534 "name" : "kube-downscaler-jobs-policy" ,
36- "match" : {
37- "any" : [
38- {
39- "resources" : {
40- "kinds" : ["Job" ]
41- }
42- }
43- ]
44- },
35+ "match" : {"any" : [{"resources" : {"kinds" : ["Job" ]}}]},
4536 "validate" : {
4637 "message" : "Job creation is not allowed in this namespace during a kube-downscaler downtime period." ,
4738 "deny" : {
@@ -50,25 +41,25 @@ def create_job_policy(namespace):
5041 {
5142 "key" : "{{ request.object.metadata.ownerReferences || 'null'}}" ,
5243 "operator" : "Equals" ,
53- "value" : "null"
44+ "value" : "null" ,
5445 },
5546 {
5647 "key" : "{{request.object.metadata.annotations.\" downscaler/exclude\" || ''}}" ,
5748 "operator" : "NotEquals" ,
58- "value" : "true"
49+ "value" : "true" ,
5950 },
6051 {
6152 "key" : "{{ time_after('{{ time_now() }}','{{ request.object.metadata.annotations.\" downscaler/exclude-until\" || '1970-01-01T00:00:00Z' }}') }}" ,
6253 "operator" : "Equals" ,
63- "value" : True
64- }
54+ "value" : True ,
55+ },
6556 ]
6657 }
67- }
68- }
58+ },
59+ },
6960 }
70- ]
71- }
61+ ],
62+ },
7263 }
7364
7465 return obj
@@ -83,35 +74,27 @@ def create_job_policy_with_matching_labels(namespace, matching_labels):
8374 "namespace" : namespace ,
8475 "labels" : {
8576 "origin" : "kube-downscaler" ,
86- "kube-downscaler/policy-type" : "with-matching-labels"
77+ "kube-downscaler/policy-type" : "with-matching-labels" ,
8778 },
8879 "annotations" : {
8980 "policies.kyverno.io/description" : "Job creation is not allowed in this namespace during a kube-downscaler downtime period." ,
9081 "policies.kyverno.io/severity" : "medium" ,
9182 "policies.kyverno.io/subject" : "Job" ,
92- "policies.kyverno.io/title" : "Kube Downscaler Jobs Policy"
93- }
83+ "policies.kyverno.io/title" : "Kube Downscaler Jobs Policy" ,
84+ },
9485 },
9586 "spec" : {
9687 "validationFailureAction" : "Enforce" ,
9788 "rules" : [
9889 {
99- "match" : {
100- "any" : [
101- {
102- "resources" : {
103- "kinds" : ["Job" ]
104- }
105- }
106- ]
107- },
90+ "match" : {"any" : [{"resources" : {"kinds" : ["Job" ]}}]},
10891 "name" : "kube-downscaler-jobs-policy" ,
10992 "preconditions" : {
11093 "all" : [
11194 {
11295 "key" : "{{ request.object.metadata.labels || 'NoLabel'}}" ,
11396 "operator" : "NotEquals" ,
114- "value" : "NoLabel"
97+ "value" : "NoLabel" ,
11598 }
11699 ]
117100 },
@@ -120,8 +103,8 @@ def create_job_policy_with_matching_labels(namespace, matching_labels):
120103 "name" : "labels" ,
121104 "variable" : {
122105 "jmesPath" : "items(request.object.metadata.labels, 'key', 'value')" ,
123- "default" : []
124- }
106+ "default" : [],
107+ },
125108 }
126109 ],
127110 "validate" : {
@@ -135,56 +118,63 @@ def create_job_policy_with_matching_labels(namespace, matching_labels):
135118 {
136119 "key" : "{{ request.object.metadata.ownerReferences || 'null'}}" ,
137120 "operator" : "Equals" ,
138- "value" : "null"
121+ "value" : "null" ,
139122 },
140123 {
141124 "key" : "{{request.object.metadata.annotations.\" downscaler/exclude\" || ''}}" ,
142125 "operator" : "NotEquals" ,
143- "value" : "true"
126+ "value" : "true" ,
144127 },
145128 {
146129 "key" : "{{ time_after('{{ time_now() }}','{{ request.object.metadata.annotations.\" downscaler/exclude-until\" || '1970-01-01T00:00:00Z' }}') }}" ,
147130 "operator" : "Equals" ,
148- "value" : True
149- }
131+ "value" : True ,
132+ },
150133 ]
151134 }
152- }
135+ },
153136 }
154- ]
155- }
137+ ],
138+ },
156139 }
157- ]
158- }
140+ ],
141+ },
159142 }
160143
161144 for pattern in matching_labels :
162145 matching_labels_condition = {
163- "key" : "{{ regex_match('" + pattern .pattern + "', '{{element.key}}={{element.value}}') }}" ,
146+ "key" : "{{ regex_match('"
147+ + pattern .pattern
148+ + "', '{{element.key}}={{element.value}}') }}" ,
164149 "operator" : "Equals" ,
165- "value" : True
150+ "value" : True ,
166151 }
167- obj ["spec" ]["rules" ][0 ]["validate" ]["foreach" ][0 ]["deny" ]["conditions" ]["all" ].append (
168- matching_labels_condition )
152+ obj ["spec" ]["rules" ][0 ]["validate" ]["foreach" ][0 ]["deny" ]["conditions" ][
153+ "all"
154+ ].append (matching_labels_condition )
169155
170156 return obj
171157
172158 @staticmethod
173159 def append_excluded_jobs_condition (obj , excluded_jobs , has_matching_labels_arg ):
174-
175160 excluded_jobs_regex = f"^({ '|' .join (excluded_jobs )} )$"
176161
177162 excluded_jobs_condition = {
178- "key" : "{{ regex_match('" + excluded_jobs_regex + "', '{{request.object.metadata.name}}') }}" ,
163+ "key" : "{{ regex_match('"
164+ + excluded_jobs_regex
165+ + "', '{{request.object.metadata.name}}') }}" ,
179166 "operator" : "NotEquals" ,
180- "value" : True
167+ "value" : True ,
181168 }
182169
183170 if has_matching_labels_arg :
184- obj ["spec" ]["rules" ][0 ]["validate" ]["foreach" ][0 ]["deny" ]["conditions" ]["all" ].append (
185- excluded_jobs_condition )
171+ obj ["spec" ]["rules" ][0 ]["validate" ]["foreach" ][0 ]["deny" ]["conditions" ][
172+ "all"
173+ ].append (excluded_jobs_condition )
186174 else :
187- obj ["spec" ]["rules" ][0 ]["validate" ]["deny" ]["conditions" ]["all" ].append (excluded_jobs_condition )
175+ obj ["spec" ]["rules" ][0 ]["validate" ]["deny" ]["conditions" ]["all" ].append (
176+ excluded_jobs_condition
177+ )
188178
189179 return obj
190180
0 commit comments