36 lines
941 B
YAML
36 lines
941 B
YAML
apiVersion: templates.gatekeeper.sh/v1
|
|
kind: ConstraintTemplate
|
|
metadata:
|
|
name: k8sattestexternaldata
|
|
spec:
|
|
crd:
|
|
spec:
|
|
names:
|
|
kind: K8sAttestExternalData
|
|
targets:
|
|
- target: admission.k8s.gatekeeper.sh
|
|
rego: |
|
|
package k8sexternaldata
|
|
|
|
violation[{"msg": msg}] {
|
|
# build a list of keys containing images
|
|
images := [img | img = input.review.object.spec.containers[_].image]
|
|
|
|
# send external data request
|
|
response := external_data({"provider": "attest-provider", "keys": images})
|
|
|
|
response_with_error(response)
|
|
|
|
msg := sprintf("invalid response: %v", [response])
|
|
}
|
|
|
|
response_with_error(response) {
|
|
count(response.errors) > 0
|
|
errs := response.errors[_]
|
|
contains(errs[i], "admit: false")
|
|
}
|
|
|
|
response_with_error(response) {
|
|
count(response.system_error) > 0
|
|
}
|