Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[RuleSet] add support for annotations and labels #271

Merged

Conversation

fin09pcap
Copy link
Member

Adds support for generation of additional metadata when using the bundle as the source for a ruleSet.
When validating bundles, this update include all annotations and labels in the RuleSet.

# test.spec.yaml
# yaml-language-server: $schema=https://github.com/elastic/harp/blob/main/api/jsonschema/harp.bundle.v1/Template.json
apiVersion: harp.elastic.co/v1
kind: BundleTemplate

meta:
  name: "example"
  owner: [email protected]
  description: "exmaple bundle"

spec:
  selector:
    quality: "production"
    platform: "testPlatform"
    product: "testProduct"
    version: "v1.0.0"

  namespaces:
    platform:
      - region: "us-east-1"
        components:
        - name: "testComponent"
          secrets:
          - suffix: "testCredentials"
            description: "test credentials"
            labels:
                vendor: "true"
            annotations:
              infosec.elastic.co/rotationPeriod: "90d"
            template: |-
              {
                "foo": "{{ noSymbolPassword }}"
              }

The expected output should include all defined annotations and labels for the secret.

$ bin/harp-darwin-arm64 from bundle-template --in test.spec.yaml --out - \
| bin/harp-darwin-arm64 to ruleset --in -

apiVersion: harp.elastic.co/v1
kind: RuleSet
meta:
  description: Generated from bundle content
  name: cxDVHHkKEFbD8jjjMIVOQGP1pbbx8yo2hR_56i8WIo1jhpGDp_EYT42PGak9Q8PwNzt-huFL4ehsEgaXm7D7rg
spec:
  rules:
  - constraints:
    - p.match_label("vendor")
    - p.match_annotation("infosec.elastic.co/rotationPeriod")
    - p.has_secret("foo")
    name: LINT-cxDVHH-1
    path: platform/production/testPlatform/us-east-1/testComponent/testCredentials
$ bin/harp-darwin-arm64 from bundle-template --in test.spec.yaml --out - \
| bin/harp-darwin-arm64 to ruleset --in - --out ruleset.yaml

Validate against the generated bundle.

$ bin/harp-darwin-arm64 from bundle-template --in test.spec.yaml --out - \
| bin/harp-darwin-arm64 bundle lint --in - --spec ruleset.yaml

@fin09pcap fin09pcap self-assigned this May 28, 2023
Copy link
Member

@renanvice renanvice left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some changes to allow it to pass lint

pkg/bundle/ruleset/bundle.go Outdated Show resolved Hide resolved
pkg/bundle/ruleset/bundle.go Outdated Show resolved Hide resolved
@fin09pcap fin09pcap force-pushed the ruleset/add_support_for_annotations_and_labels branch from 8524d46 to 5f6d466 Compare June 27, 2023 23:21
@fin09pcap fin09pcap requested a review from renanvice June 27, 2023 23:24
Copy link
Member

@renanvice renanvice left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fin09pcap fin09pcap merged commit 186f399 into elastic:main Jun 27, 2023
10 of 12 checks passed
@fin09pcap fin09pcap deleted the ruleset/add_support_for_annotations_and_labels branch June 27, 2023 23:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants