Test resourcelocker replacement

Author: bastjan

class/defaults.yml

@@ -1,5 +1,10 @@
 parameters:
   kyverno:
+    _metadata:
+      replaces: resource-locker
+      library_aliases:
+        resource-locker.libjsonnet: kyverno-resource-locker-migrate.libsonnet
+
     namespace: syn-kyverno
     images:
       kyverno:

lib/kyverno-resource-locker-migrate.libsonnet

@@ -0,0 +1,6 @@
+std.trace(
+  'importing resource-locker.libjsonnet is deprecated, ' +
+  "please switch to `import 'patch-operator.libsonnet'`. " +
+  'See https://hub.syn.tools/patch-operator/how-tos/migrating-from-resource-locker.html for more details.',
+  import 'kyverno.libsonnet'
+)

lib/kyverno-resource-locker.libsonnet

@@ -0,0 +1,98 @@
+/**
+ * \file Library with public methods provided by component patch-operator.
+ */
+
+local kap = import 'lib/kapitan.libjsonnet';
+local kube = import 'lib/kube.libjsonnet';
+local kyverno = import 'lib/kyverno.libsonnet';
+
+local inv = kap.inventory();
+local kyverno_params = inv.parameters.kyverno;
+local namespace = kyverno_params.namespace;
+local instance = inv.parameters._instance;
+
+local apiVersion = 'redhatcop.redhat.io/v1alpha1';
+
+local render_patch(patch, _, patch_id='patch1') =
+  { [patch_id]: patch };
+
+
+local targetData(obj) =
+  local apigrp = std.split(obj.apiVersion, '/')[0];
+  {
+    apiVersion: obj.apiVersion,
+    apigroup:: if apigrp == 'v1' then '' else apigrp,
+    kind: obj.kind,
+    name: obj.metadata.name,
+    namespace: if std.objectHas(obj.metadata, 'namespace') then obj.metadata.namespace,
+  };
+
+local patchName(targetObj) =
+  local target = targetData(targetObj);
+
+  // Some objects like ClusterRoleBinding can contain colons.
+  local name = std.strReplace(target.name, ':', '-');
+  local unhashed = '%s-%s-%s-%s-%s' % [ instance, target.kind, target.apigroup, target.namespace, name ];
+  // Take 15 characters of the md5 hash, to leave room for a human-readable
+  // prefix.
+  local hashed = std.substr(std.md5(unhashed), 0, 15);
+
+  local prefix =
+    local p =
+      if target.namespace != null then
+        // for namespaced objects, use `<ns>-<name>` as the prefix
+        '%s-%s' % [ std.asciiLower(target.namespace), name ]
+      else
+        // for cluster-scoped objects, use `<kind>-<name>` as the prefix
+        // We could also add `<apigroup>` in the prefix, but we don't
+        // need to do this, since the apigroup is part of the hashed string.
+        '%s-%s' % [ std.asciiLower(target.kind), name ];
+    // Trim the prefix if it's too long, make sure the kind/namespace part of
+    // the prefix remains.
+    if std.length(p) > 31 then
+      std.substr(p, 0, 31)
+    else
+      p;
+
+  local n = '%s-%s' % [ prefix, hashed ];
+
+  // We generate names with a max length of 47, so there's a few characters
+  // left for adding `manager` in `clusterRoleName()` and `saname`.
+  assert
+    std.length(n) <= 47 :
+    "name generated by rl_obj_name() is longer than 47 characters, this shouldn't happen";
+  n;
+
+local Patch(targetobj, patchTemplate, patchStrategy='application/strategic-merge-patch+json') =
+  local name = patchName(targetobj);
+  [
+    kyverno.ClusterPolicy(name) {
+      spec: {
+        rules: [ {
+          name: name,
+          match: {
+            all: [ {
+              resources: {
+                kinds: [ '%s/%s' % [ targetobj.apiVersion, targetobj.kind ] ],
+                [if std.objectHas(targetobj.metadata, 'namespace') && targetobj.metadata.namespace != null then 'namespaces']: [ targetobj.metadata.namespace ],
+                names: [ targetobj.metadata.name ],
+              },
+            } ],
+          },
+          mutate: {
+            patchStrategicMerge: patchTemplate,
+          },
+        } ],
+      },
+    },
+  ];
+
+local Resource(obj) =
+  error "kyverno doesn't support kind `Resource`, please manage full resources directly in your component";
+
+{
+  apiVersion: apiVersion,
+  Resource: Resource,
+  Patch: Patch,
+  renderPatch: render_patch,
+}

lib/kyverno.libsonnet

@@ -58,3 +58,5 @@ local GenerateRequest(name) = kube._Object('kyverno.io/v1alpha1', 'GenerateReque
   ClusterReportChangeRequest: ClusterReportChangeRequest,
   GenerateRequest: GenerateRequest,
 }
++
+import 'kyverno-resource-locker.libsonnet'

tests/golden/lib/kyverno/apps/kyverno.yaml

@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations: {}
+  labels:
+    name: foo-test-5f124f8af545124
+  name: foo-test-5f124f8af545124
+spec:
+  rules:
+    - match:
+        all:
+          - resources:
+              kinds:
+                - rbac.authorization.k8s.io/v1/ClusterRoleBinding
+              names:
+                - test
+              namespaces:
+                - foo
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              patched: ''
+      name: foo-test-5f124f8af545124

tests/golden/lib/kyverno/tests/clusterrolebindingpatch.yaml

@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations: {}
+  labels:
+    name: foo-test-2647e277de7e28f
+  name: foo-test-2647e277de7e28f
+spec:
+  rules:
+    - match:
+        all:
+          - resources:
+              kinds:
+                - rbac.authorization.k8s.io/v1/ClusterRole
+              names:
+                - test
+              namespaces:
+                - foo
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              patched: ''
+      name: foo-test-2647e277de7e28f

tests/golden/lib/kyverno/tests/clusterrolepatch.yaml

@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations: {}
+  labels:
+    name: foo-test-748008595ba4d68
+  name: foo-test-748008595ba4d68
+spec:
+  rules:
+    - match:
+        all:
+          - resources:
+              kinds:
+                - rbac.authorization.k8s.io/v1/RoleBinding
+              names:
+                - test
+              namespaces:
+                - foo
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              patched: ''
+      name: foo-test-748008595ba4d68

tests/golden/lib/kyverno/tests/rolebindingpatch.yaml

@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations: {}
+  labels:
+    name: foo-test-124e2e3e489a95e
+  name: foo-test-124e2e3e489a95e
+spec:
+  rules:
+    - match:
+        all:
+          - resources:
+              kinds:
+                - rbac.authorization.k8s.io/v1/Role
+              names:
+                - test
+              namespaces:
+                - foo
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              patched: ''
+      name: foo-test-124e2e3e489a95e

tests/golden/lib/kyverno/tests/rolepatch.yaml

@@ -0,0 +1,21 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations: {}
+  labels:
+    name: clusterrolebinding-system-build-7d296671e024f88
+  name: clusterrolebinding-system-build-7d296671e024f88
+spec:
+  rules:
+    - match:
+        all:
+          - resources:
+              kinds:
+                - rbac.authorization.k8s.io/v1/ClusterRoleBinding
+              names:
+                - system:build-strategy-docker-binding
+      mutate:
+        patchStrategicMerge:
+          annotations:
+            rbac.authorization.kubernetes.io/autoupdate: 'false'
+      name: clusterrolebinding-system-build-7d296671e024f88