feat: add metadata enforcement (#1990)

* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: add metadata enforcement Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: add metadata enforcement Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: add resourcepoolclaim validation Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: add resourcepoolclaim validation Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: add resourcepoolclaim validation Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: add resourcepoolclaim validation Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-08-19 04:26:45 +00:00 · 2026-07-02 13:42:08 +02:00
parent 6fbd472f27
commit 77d1810bb9
89 changed files with 12731 additions and 556 deletions
@@ -3,16 +3,23 @@
 package ruleengine

 import (
+	"errors"
 	"fmt"
 	"net"
 	"regexp"
 	"strings"

-	"github.com/projectcapsule/capsule/pkg/api"
+	k8smeta "k8s.io/apimachinery/pkg/api/meta"
+	k8svalidation "k8s.io/apimachinery/pkg/util/validation"
+
 	"github.com/projectcapsule/capsule/pkg/api/rules"
+	"github.com/projectcapsule/capsule/pkg/api/runtime"
 )

-func ValidateRuleStatusBody(bodies []*rules.NamespaceRuleBodyNamespace) error {
+func ValidateRuleStatusBody(
+	mapper k8smeta.RESTMapper,
+	bodies []*rules.NamespaceRuleBodyNamespace,
+) error {
 	for i, rule := range bodies {
 		if rule == nil || rule.Enforce == nil {
 			continue
@@ -25,6 +32,10 @@ func ValidateRuleStatusBody(bodies []*rules.NamespaceRuleBodyNamespace) error {
 		if err := validateServiceRules(i, rule.Enforce.Services); err != nil {
 			return err
 		}
+
+		if err := validateMetadataRules(i, rule.Enforce.Metadata, mapper); err != nil {
+			return err
+		}
 	}

 	return nil
@@ -112,7 +123,76 @@ func validateServiceRules(
 	return nil
 }

-func validateExpressionMatch(match api.ExpressionMatch, fieldPath string) error {
+func validateMetadataRules(
+	ruleIndex int,
+	metadata []rules.MetadataRule,
+	mapper k8smeta.RESTMapper,
+) error {
+	for j, rule := range metadata {
+		fieldPath := fmt.Sprintf("rules[%d].enforce.metadata[%d]", ruleIndex, j)
+
+		if err := validateMetadataTargets(fieldPath, rule, mapper); err != nil {
+			return err
+		}
+
+		for key, policy := range rule.Labels {
+			if err := validateMetadataKey(key); err != nil {
+				return fmt.Errorf(
+					"%s.labels[%q] is invalid: %w",
+					fieldPath,
+					key,
+					err,
+				)
+			}
+
+			for k, matcher := range policy.Values {
+				if err := validateExpressionMatch(
+					matcher,
+					fmt.Sprintf("%s.labels[%q].values[%d]", fieldPath, key, k),
+				); err != nil {
+					return err
+				}
+			}
+		}
+
+		for key, policy := range rule.Annotations {
+			if err := validateMetadataKey(key); err != nil {
+				return fmt.Errorf(
+					"%s.annotations[%q] is invalid: %w",
+					fieldPath,
+					key,
+					err,
+				)
+			}
+
+			for k, matcher := range policy.Values {
+				if err := validateExpressionMatch(
+					matcher,
+					fmt.Sprintf("%s.annotations[%q].values[%d]", fieldPath, key, k),
+				); err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func validateMetadataKey(key string) error {
+	key = strings.TrimSpace(key)
+	if key == "" {
+		return errors.New("key is empty")
+	}
+
+	if errs := k8svalidation.IsQualifiedName(key); len(errs) > 0 {
+		return errors.New(strings.Join(errs, ", "))
+	}
+
+	return nil
+}
+
+func validateExpressionMatch(match runtime.ExpressionMatch, fieldPath string) error {
 	if err := validateExpression(match.Expression, fieldPath+".exp"); err != nil {
 		return err
 	}
@@ -181,3 +261,30 @@ func validateNodePortRange(portRange rules.ServiceNodePortRange) error {

 	return nil
 }
+
+func validateMetadataTargets(
+	fieldPath string,
+	rule rules.MetadataRule,
+	mapper k8smeta.RESTMapper,
+) error {
+	if len(rule.Kinds) == 0 {
+		return fmt.Errorf("%s.kinds is invalid: at least one kind must be configured", fieldPath)
+	}
+
+	for i, kind := range rule.Kinds {
+		kind = strings.TrimSpace(kind)
+		if kind == "" {
+			return fmt.Errorf("%s.kinds[%d] is invalid: kind is empty", fieldPath, i)
+		}
+	}
+
+	if mapper == nil {
+		return nil
+	}
+
+	if err := rule.ValidateKnownKinds(mapper, fieldPath); err != nil {
+		return err
+	}
+
+	return nil
+}