Skip to content

Commit 2e675d0

Browse files
tmuntanertmuntaner
committed
Set up policies
1 parent 9b76ed2 commit 2e675d0

File tree

21 files changed

+1455
-0
lines changed

21 files changed

+1455
-0
lines changed

‎.github/actions/get-policy-metadata/action.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: "Get policy information"
2+
branding:
3+
icon: "package"
4+
color: "blue"
5+
inputs:
6+
policy-working-dir:
7+
description: "Policy folder"
8+
required: true
9+
type: string
10+
outputs:
11+
policy-id:
12+
description: "Policy ID extract from the policy OCI URL"
13+
value: ${{ steps.policy-info.outputs.policy-id}}
14+
policy-rust-package:
15+
description: "Rust package name from Cargo.toml"
16+
value: ${{ steps.policy-info.outputs.policy-rust-package}}
17+
policy-language:
18+
description: "Policy programming language detected"
19+
value: ${{ steps.policy-info.outputs.policy-language}}
20+
policy-version:
21+
description: "Policy version from the metadata.yaml"
22+
value: ${{ steps.policy-info.outputs.policy-version}}
23+
policy-basename:
24+
description: "Policy directory basename"
25+
value: ${{ steps.policy-info.outputs.policy-basename}}
26+
runs:
27+
using: "composite"
28+
steps:
29+
- name: Get policy info
30+
shell: bash
31+
id: policy-info
32+
run: |
33+
if [ ! -d "${{ inputs.policy-working-dir }}" ]; then
34+
echo "$policy_working_dir does not exist, policy not found";
35+
exit 1;
36+
fi
37+
38+
policy_ociUrl=$(yq -r '.annotations."io.kubewarden.policy.ociUrl"' '${{ inputs.policy-working-dir}}/metadata.yml')
39+
policy_version=$(yq -r '.annotations."io.kubewarden.policy.version"' '${{ inputs.policy-working-dir}}/metadata.yml')
40+
policy_id=${policy_ociUrl##*/}
41+
policy_basename=$(basename ${{inputs.policy-working-dir}})
42+
policy_language=""
43+
policy_rust_package=""
44+
45+
if [ -f '${{ inputs.policy-working-dir}}/Cargo.toml' ]; then
46+
policy_language="rust"
47+
policy_rust_package=$(sed -n 's,^name = \"\(.*\)\",\1,p' "${{ inputs.policy-working-dir}}/Cargo.toml")
48+
if [ '$policy_rust_package' == "" ]; then
49+
echo 'cannot get rust policy ${{ inputs.policy-working-dir }} package name';
50+
exit 1;
51+
fi
52+
else
53+
# Currently this repository supports go and rust policies only
54+
policy_language="go"
55+
fi
56+
57+
echo "policy_language=$policy_language"
58+
echo "policy_rust_package=$policy_rust_package"
59+
echo "policy-id=$policy_id"
60+
echo "policy-version=$policy_version"
61+
echo "policy-basename=$policy_basename"
62+
63+
echo "policy-language=$policy_language" >> $GITHUB_OUTPUT
64+
echo "policy-rust-package=$policy_rust_package" >> $GITHUB_OUTPUT
65+
echo "policy-id=$policy_id" >> $GITHUB_OUTPUT
66+
echo "policy-version=$policy_version" >> $GITHUB_OUTPUT
67+
echo "policy-basename=$policy_basename" >> $GITHUB_OUTPUT

‎.github/actions/install-dependencies/action.yaml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
name: "kubewarden-policy-gh-action-dependencies"
2+
description: "Install all the binaries needed inside of GH action"
3+
branding:
4+
icon: "package"
5+
color: "blue"
6+
inputs:
7+
KWCTL_VERSION:
8+
description: "kwctl release to be installed"
9+
required: false
10+
default: v1.29.1
11+
SYFT_VERSION:
12+
description: "syft release to be installed"
13+
required: false
14+
default: "1.28.0"
15+
arch:
16+
description: "syft arch to be installed"
17+
required: false
18+
default: "linux_amd64" # windows_amd64, darwin_amd64
19+
BINARYEN_VERSION:
20+
description: "binaryen release to be installed"
21+
required: false
22+
default: "116"
23+
runs:
24+
using: "composite"
25+
steps:
26+
- name: Install cosign
27+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
28+
- name: Install kwctl
29+
shell: bash
30+
run: |
31+
#!/bin/bash
32+
set -e
33+
34+
# Build name of gihub release asset
35+
OS=$(echo "${{ runner.os }}" | tr '[:upper:]' '[:lower:]' | sed 's/macos/darwin/')
36+
ARCH=$(echo "${{ runner.arch }}" | sed -E 's/X64/x86_64/; s/ARM64/aarch64/')
37+
ASSET="kwctl-${OS}-${ARCH}"
38+
39+
INSTALL_DIR=$HOME/.kwctl
40+
RELEASE_URL="download/${{ inputs.KWCTL_VERSION }}"
41+
[ "${{ inputs.KWCTL_VERSION }}" == "latest" ] && RELEASE_URL="latest/download"
42+
43+
mkdir -p $INSTALL_DIR
44+
curl -sL https://github.com/kubewarden/kwctl/releases/$RELEASE_URL/$ASSET.zip -o $INSTALL_DIR/$ASSET.zip
45+
unzip -o $INSTALL_DIR/$ASSET.zip -d $INSTALL_DIR
46+
rm $INSTALL_DIR/$ASSET.zip
47+
48+
mv $INSTALL_DIR/$ASSET $INSTALL_DIR/kwctl
49+
chmod 755 $INSTALL_DIR/kwctl
50+
echo $INSTALL_DIR >> $GITHUB_PATH
51+
52+
$INSTALL_DIR/kwctl -V
53+
- name: Install bats
54+
shell: bash
55+
run: sudo apt install -y bats
56+
- name: Install SBOM generator tool
57+
shell: bash
58+
if: ${{ inputs.arch != 'windows_amd64' }}
59+
run: |
60+
#!/bin/bash
61+
set -e
62+
63+
INSTALL_DIR=$HOME/.syft
64+
65+
mkdir -p $INSTALL_DIR
66+
67+
curl -sL https://github.com/anchore/syft/releases/download/v${{ inputs.SYFT_VERSION }}/syft_${{ inputs.SYFT_VERSION }}_${{ inputs.arch }}.tar.gz -o $INSTALL_DIR/syft.tar.gz
68+
tar xvf $INSTALL_DIR/syft.tar.gz -C $INSTALL_DIR
69+
rm $INSTALL_DIR/syft.tar.gz
70+
71+
echo $INSTALL_DIR >> $GITHUB_PATH
72+
73+
- name: Install SBOM generator tool
74+
shell: bash
75+
if: ${{ inputs.arch == 'windows_amd64' }}
76+
run: |
77+
#!/bin/bash
78+
set -e
79+
80+
INSTALL_DIR=$HOME/.syft
81+
82+
mkdir -p $INSTALL_DIR
83+
84+
curl -sL https://github.com/anchore/syft/releases/download/v${{ inputs.SYFT_VERSION }}/syft_${{ inputs.SYFT_VERSION }}_windows_amd64.zip -o $INSTALL_DIR/syft.zip
85+
unzip -n $INSTALL_DIR/syft.zip -d $INSTALL_DIR
86+
rm $INSTALL_DIR/syft.zip
87+
88+
echo $INSTALL_DIR >> $GITHUB_PATH
89+
- name: Install binaryen tool
90+
shell: bash
91+
run: |
92+
#!/bin/bash
93+
set -e
94+
95+
INSTALL_DIR=$HOME/.binaryen
96+
97+
mkdir -p $INSTALL_DIR
98+
99+
curl -sL https://github.com/WebAssembly/binaryen/releases/download/version_${{ inputs.BINARYEN_VERSION }}/binaryen-version_${{ inputs.BINARYEN_VERSION }}-x86_64-linux.tar.gz -o $INSTALL_DIR/binaryen.tar.gz
100+
tar xvf $INSTALL_DIR/binaryen.tar.gz -C $INSTALL_DIR
101+
mv $INSTALL_DIR/binaryen-version_${{ inputs.BINARYEN_VERSION }}/bin/* $INSTALL_DIR
102+
rm $INSTALL_DIR/binaryen.tar.gz
103+
rm -rf $INSTALL_DIR/binaryen-version_${{ inputs.BINARYEN_VERSION }}
104+
105+
echo $INSTALL_DIR >> $GITHUB_PATH
106+
- name: Setup rust toolchain
107+
run: |
108+
rustup toolchain install stable --profile minimal --target wasm32-wasip1
109+
rustup override set stable
110+
shell: bash
111+
- name: Install tinygo
112+
shell: bash
113+
run: |
114+
wget https://github.com/tinygo-org/tinygo/releases/download/v0.39.0/tinygo_0.39.0_amd64.deb
115+
sudo dpkg -i tinygo_0.39.0_amd64.deb
116+
- name: Install semver tool
117+
shell: bash
118+
run: |
119+
INSTALL_DIR="$HOME"/.semver
120+
mkdir -p "$INSTALL_DIR"
121+
wget -O "$INSTALL_DIR"/semver https://github.com/fsaintjacques/semver-tool/raw/3.4.0/src/semver
122+
chmod +x "$INSTALL_DIR"/semver
123+
echo "$INSTALL_DIR" >> "$GITHUB_PATH"
124+
- name: Install updatecli
125+
uses: updatecli/updatecli-action@719e3592d124cbf826da704cbe557e1221dd4bba # v2.94.0

‎.github/workflows/ci.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Continuous integration
2+
on:
3+
workflow_dispatch:
4+
pull_request:
5+
schedule:
6+
- cron: "0 21 * * *"
7+
8+
defaults:
9+
run:
10+
shell: bash
11+
12+
jobs:
13+
calculate-policy-matrix:
14+
runs-on: ubuntu-latest
15+
outputs:
16+
policy_working_dirs: ${{ steps.calculate-policy-dirs.outputs.policy_working_dirs }}
17+
steps:
18+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
19+
with:
20+
fetch-depth: 0 # checkout all history to do git diff
21+
- name: calculate which policies need a CI job
22+
id: calculate-policy-dirs
23+
shell: bash
24+
run: |
25+
git remote -v
26+
27+
policies_working_dirs=($(find policies -maxdepth 2 -name Makefile -exec dirname '{}' \;))
28+
if [ "${{github.event_name}}" == "pull_request" ]; then
29+
# list only changes of files in `policies/`:
30+
git_files="$(git diff --no-color --find-renames --find-copies --name-only origin/${{ github.base_ref }} ${{ github.sha }} -- policies)"
31+
32+
# build policy_working_dirs:
33+
policies_working_dirs=($(echo "$git_files" | cut -d/ -f1,2 ))
34+
fi
35+
36+
declare -p policies_working_dirs # for debug
37+
policy_working_dirs=$(jq --compact-output --null-input '$ARGS.positional | map(select(. != "policies/Cargo.lock" and . != "policies/Cargo.toml" and . != "policies/go.mod" and . != "policies/go.sum")) | unique' --args -- "${policies_working_dirs[@]}")
38+
echo "policy_working_dirs=$policy_working_dirs"
39+
echo "policy_working_dirs=$policy_working_dirs" >> $GITHUB_OUTPUT
40+
41+
continuos-integration:
42+
uses: ./.github/workflows/reusable-ci.yaml
43+
needs: calculate-policy-matrix
44+
if: ${{ needs.calculate-policy-matrix.outputs.policy_working_dirs != '[]' }}
45+
strategy:
46+
matrix:
47+
policy-working-dir: ${{ fromJSON(needs.calculate-policy-matrix.outputs.policy_working_dirs) }}
48+
with:
49+
policy-working-dir: ${{ matrix.policy-working-dir }}

‎.github/workflows/reusable-ci.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
policy-working-dir:
5+
description: "Working directory of the policy. Useful for repos with policies in folders"
6+
required: false
7+
type: string
8+
default: "."
9+
10+
jobs:
11+
linter:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
15+
with:
16+
go-version: "1.25"
17+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
18+
with:
19+
version: "latest"
20+
install-only: true
21+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
22+
- name: Install dependencies
23+
uses: ./.github/actions/install-dependencies
24+
- name: Policy linter
25+
shell: bash
26+
run: |
27+
make -C ${{ inputs.policy-working-dir}} lint
28+
build:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
32+
with:
33+
go-version: "1.25"
34+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
35+
with:
36+
version: "latest"
37+
install-only: true
38+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
39+
- name: Install dependencies
40+
uses: ./.github/actions/install-dependencies
41+
- name: Build policy
42+
shell: bash
43+
run: |
44+
make -C ${{ inputs.policy-working-dir}} policy.wasm
45+
unit-test:
46+
runs-on: ubuntu-latest
47+
steps:
48+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
49+
with:
50+
go-version: "1.25"
51+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
52+
with:
53+
version: "latest"
54+
install-only: true
55+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
56+
- name: Install dependencies
57+
uses: ./.github/actions/install-dependencies
58+
- name: Policy unit tests
59+
shell: bash
60+
run: |
61+
make -C ${{ inputs.policy-working-dir}} test
62+
e2e-test:
63+
runs-on: ubuntu-latest
64+
steps:
65+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
66+
with:
67+
go-version: "1.25"
68+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
69+
with:
70+
version: "latest"
71+
install-only: true
72+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
73+
- name: Install dependencies
74+
uses: ./.github/actions/install-dependencies
75+
- name: Policy integration test
76+
shell: bash
77+
run: |
78+
make -C ${{ inputs.policy-working-dir}} e2e-tests

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
qodana.yaml
2+
.github/workflows/qodana_code_quality.yml
23

34
### VisualStudioCode template
45
.vscode/*

‎policies/istio-gateway/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
target
2+
*.wasm

‎policies/istio-gateway/Cargo.toml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
[package]
2+
name = "policy-istio-gateway"
3+
version = "0.1.0"
4+
edition = "2021"
5+
6+
[lib]
7+
crate-type = ["cdylib"]
8+
9+
[dependencies]
10+
k8s-openapi = { version = "0.26.0", default-features = false, features = [
11+
"v1_31",
12+
] }
13+
kcr_networking_istio_io = "2.20251019.30658"
14+
kubewarden-policy-sdk = "0.15"
15+
lazy_static = "1.5"
16+
serde = { version = "1.0", features = ["derive"] }
17+
serde_json = "1.0"
18+
slog = "2.7"
19+
thiserror = "2.0.17"

‎policies/istio-gateway/Makefile‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
SOURCE_FILES := $(shell test -e src/ && find src -type f)
2+
3+
policy.wasm: $(SOURCE_FILES) Cargo.*
4+
cargo build --target=wasm32-wasip1 --release
5+
cp target/wasm32-wasip1/release/*.wasm policy.wasm
6+
7+
annotated-policy.wasm: policy.wasm metadata.yml
8+
kwctl annotate -m metadata.yml -u README.md -o annotated-policy.wasm policy.wasm
9+
10+
.PHONY: fmt
11+
fmt:
12+
cargo fmt --all -- --check
13+
14+
.PHONY: lint
15+
lint:
16+
cargo clippy -- -D warnings
17+
18+
.PHONY: e2e-tests
19+
e2e-tests: annotated-policy.wasm
20+
bats e2e.bats
21+
22+
.PHONY: test
23+
test: fmt lint
24+
cargo test
25+
26+
.PHONY: clean
27+
clean:
28+
cargo clean
29+
rm -f policy.wasm annotated-policy.wasm
30+
31+
# .PHONY: push_gitlab
32+
# push_gitlab:
33+
# kwctl push --docker-config-json-path=`pwd` ./annotated-policy.wasm $(CI_REGISTRY)/itpe/core/open-platform/kubewarden-policies/policy-istio-gateway:$(VERSION)
34+
35+
.PHONY: push_harbor
36+
push_harbor:
37+
kwctl push --docker-config-json-path=`pwd` ./annotated-policy.wasm harbor.op-prg2-0-ingress.op.suse.org/policy-istio-gateway/policy-istio-gateway:$(VERSION)

0 commit comments

Comments
 (0)