Creating a new validation policy
This tutorial covers creating a policy that validates the labels of Pod objects.
The policy is to reject all Pods that use one or more labels on the deny-list. The policy also validates certain labels using a regular expression provided by the user.
To summarize, the policy settings should look like this:
# List of labels that cannot be used
denied_labels:
- foo
- bar
# Labels that are validated with user-defined regular expressions
constrained_labels:
priority: "[123]"
cost-center: "^cc-\d+"
The policy rejects the creation of this Pod:
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
foo: hello world
spec:
containers:
- name: nginx
image: nginx:latest
It also rejects the creation of this Pod:
apiVersion: v1
kind: Pod
metadata:
name: nginx
labels:
cost-center: cc-marketing
spec:
containers:
- name: nginx
image: nginx:latest
You can use the policy's settings to force using a label specification, regardless of content:
constrained_labels:
mandatory-label: ".*" # <- this label must be present, we don't care about its value
Scaffolding new policy project​
You can create a new policy project using the template repository. Select the "Use this template" green button near the top of the page and follow GitHub's wizard.
Clone the repository locally and set the module directive in the go.mod file to look like:
module <path to your repository>
A real policy would use a repository path, like github.com/kubewarden/go-policy-template.
Testing​
Provided the necessary tools are in place a make test command uses Docker to pull a TinyGo compiler image using it to build and test the policy template.
The default make command builds the policy.wasm target. Then make test runs the defined Go tests.
The command make e2e-tests runs tests using bats within a Kubewarden cluster.
After cloning the go-policy-template, running these commands checks you have the tools in place for the tutorial.