Files
kubevela/pkg/cue/process/handle.go
Brian Kane 38dea0b56c feat: application-scoped policies (#7067)
Introduces application-scoped policies and global auto-applied policies
for KubeVela.

Key changes:
- PolicyDefinition gains `scope`, `global`, and `priority` fields
- Global policies (global=true, scope=Application) are auto-applied to
  every Application in their namespace (and vela-system globals apply
  cluster-wide) without being listed in spec.policies
- PolicyScopeIndex: in-memory singleton index of PolicyDefinition
  metadata, bootstrapped at startup and kept live via watch events.
  Follows KubeVela's 2-step lookup (local namespace → vela-system)
- ApplicationPolicyCache: per-app cache of rendered policy results,
  invalidated by spec hash, revision hash, or TTL; cleared on deletion
- Policy rendering pipeline extended to inject global policies before
  user-specified ones, respecting priority ordering
- Appfile.Context carries context.Context from controller into rendering
- Feature gates: EnableApplicationScopedPolicies and EnableGlobalPolicies
  (both Alpha, default false); admission webhook warns when a
  PolicyDefinition targets a disabled gate

Signed-off-by: Brian Kane <briankane1@gmail.com>
2026-03-19 07:58:15 -07:00

127 lines
3.8 KiB
Go

/*
Copyright 2021 The KubeVela Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package process
import (
"context"
"strconv"
"strings"
"github.com/kubevela/workflow/pkg/cue/process"
"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
"github.com/oam-dev/kubevela/apis/types"
"github.com/oam-dev/kubevela/pkg/oam"
"github.com/oam-dev/kubevela/pkg/oam/util"
)
// ContextData is the core data of process context
type ContextData struct {
Namespace string
Cluster string
AppName string
CompName string
StepName string
CompRevision string
AppRevisionName string
WorkflowName string
PublishVersion string
ReplicaKey string
Ctx context.Context
BaseHooks []process.BaseHook
AuxiliaryHooks []process.AuxiliaryHook
Components []common.ApplicationComponent
AppLabels map[string]string
AppAnnotations map[string]string
ClusterVersion types.ClusterVersion
Output interface{}
}
// policyAdditionalContextKey is the shared Go context key for policy output.ctx data
const policyAdditionalContextKey = oam.PolicyAdditionalContextKey
// NewContext creates a new process context
func NewContext(data ContextData) process.Context {
// Extract policy additionalContextif it exists
// This allows Application-scoped policies to inject data into component/trait rendering
var customData map[string]interface{}
if data.Ctx != nil {
if val := data.Ctx.Value(policyAdditionalContextKey); val != nil {
if contextMap, ok := val.(map[string]interface{}); ok {
// Wrap additionalContext under "custom" key so it's accessible as context.custom
customData = map[string]interface{}{
"custom": contextMap,
}
}
}
}
ctx := process.NewContext(process.ContextData{
Namespace: data.Namespace,
Name: data.CompName,
StepName: data.StepName,
WorkflowName: data.WorkflowName,
PublishVersion: data.PublishVersion,
Ctx: data.Ctx,
BaseHooks: data.BaseHooks,
AuxiliaryHooks: data.AuxiliaryHooks,
CustomData: customData,
})
ctx.PushData(ContextAppName, data.AppName)
ctx.PushData(ContextAppRevision, data.AppRevisionName)
ctx.PushData(ContextCompRevisionName, data.CompRevision)
ctx.PushData(ContextComponents, data.Components)
appLabels := data.AppLabels
if appLabels == nil {
appLabels = map[string]string{}
}
appAnnotations := data.AppAnnotations
if appAnnotations == nil {
appAnnotations = map[string]string{}
}
ctx.PushData(ContextAppLabels, appLabels)
ctx.PushData(ContextAppAnnotations, appAnnotations)
ctx.PushData(ContextReplicaKey, data.ReplicaKey)
revNum, _ := util.ExtractRevisionNum(data.AppRevisionName, "-")
ctx.PushData(ContextAppRevisionNum, revNum)
ctx.PushData(ContextCluster, data.Cluster)
ctx.PushData(ContextClusterVersion, parseClusterVersion(data.ClusterVersion))
if data.Output != nil {
ctx.PushData(OutputFieldName, data.Output)
}
return ctx
}
func parseClusterVersion(cv types.ClusterVersion) map[string]interface{} {
// no minor found, use control plane cluster version instead.
if cv.Minor == "" {
cv = types.ControlPlaneClusterVersion
}
minorS := strings.TrimSpace(cv.Minor)
minorS = strings.TrimRight(minorS, ".+-/?!")
minor, _ := strconv.ParseInt(minorS, 10, 64)
return map[string]interface{}{
"major": cv.Major,
"gitVersion": cv.GitVersion,
"platform": cv.Platform,
"minor": minor,
}
}