fix: add matchConstraints to vap

Signed-off-by: Rita Zhang <[email protected]>
open-policy-agent · Jan 13, 2024 · bc5000d · bc5000d
1 parent 8fb8e5a
commit bc5000d
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 1 deletion.
diff --git a/constraint/pkg/client/drivers/k8scel/transform/make_vap_objects.go b/constraint/pkg/client/drivers/k8scel/transform/make_vap_objects.go
@@ -52,7 +52,16 @@ func TemplateToPolicyDefinition(template *templates.ConstraintTemplate) (*admiss
 				APIVersion: fmt.Sprintf("%s/%s", apiconstraints.Group, templatesv1beta1.SchemeGroupVersion.Version),
 				Kind:       template.Spec.CRD.Spec.Names.Kind,
 			},
-			MatchConstraints: nil, // We cannot support match constraints since `resource` is not available shift-left
+			MatchConstraints: &admissionregistrationv1alpha1.MatchResources{
+				ResourceRules: []admissionregistrationv1alpha1.NamedRuleWithOperations{
+					{
+						RuleWithOperations: admissionregistrationv1alpha1.RuleWithOperations{
+							Operations: []admissionregistrationv1alpha1.OperationType{admissionregistrationv1alpha1.OperationAll},
+							Rule:       admissionregistrationv1alpha1.Rule{APIGroups: []string{"*"}, APIVersions: []string{"*"}, Resources: []string{"*"}},
+						},
+					},
+				},
+			},
 			MatchConditions:  matchConditions,
 			Validations:      validations,
 			FailurePolicy:    failurePolicy,

diff --git a/constraint/pkg/client/drivers/k8scel/transform/make_vap_objects_test.go b/constraint/pkg/client/drivers/k8scel/transform/make_vap_objects_test.go
@@ -60,6 +60,16 @@ func TestTemplateToPolicyDefinition(t *testing.T) {
 						APIVersion: "constraints.gatekeeper.sh/v1beta1",
 						Kind:       "SomePolicy",
 					},
+					MatchConstraints: &admissionregistrationv1alpha1.MatchResources{
+						ResourceRules: []admissionregistrationv1alpha1.NamedRuleWithOperations{
+							{
+								RuleWithOperations: admissionregistrationv1alpha1.RuleWithOperations{
+									Operations: []admissionregistrationv1alpha1.OperationType{admissionregistrationv1alpha1.OperationAll},
+									Rule:       admissionregistrationv1alpha1.Rule{APIGroups: []string{"*"}, APIVersions: []string{"*"}, Resources: []string{"*"}},
+								},
+							},
+						},
+					},
 					MatchConditions: []admissionregistrationv1alpha1.MatchCondition{
 						{
 							Name:       "must_match_something",