mirror of
https://github.com/FairwindsOps/polaris.git
synced 2026-05-11 19:57:01 +00:00
69 lines
2.4 KiB
Go
69 lines
2.4 KiB
Go
// Copyright 2019 FairwindsOps Inc
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package validator
|
|
|
|
import (
|
|
"github.com/fairwindsops/polaris/pkg/config"
|
|
corev1 "k8s.io/api/core/v1"
|
|
)
|
|
|
|
// ContainerValidation tracks validation failures associated with a Container.
|
|
type ContainerValidation struct {
|
|
*ResourceValidation
|
|
Container *corev1.Container
|
|
IsInitContainer bool
|
|
parentPodSpec corev1.PodSpec
|
|
}
|
|
|
|
// ValidateContainer validates that each pod conforms to the Polaris config, returns a ResourceResult.
|
|
// FIXME When validating a container, there are some things in a container spec
|
|
// that can be affected by the podSpec. This means we need a copy of the
|
|
// relevant podSpec in order to check certain aspects of a containerSpec.
|
|
// Perhaps there is a more ideal solution instead of attaching a parent
|
|
// podSpec to every container Validation struct...
|
|
func ValidateContainer(container *corev1.Container, parentPodResult *PodResult, conf *config.Configuration, controllerName string, controllerType config.SupportedController, isInit bool) ContainerResult {
|
|
cv := ContainerValidation{
|
|
Container: container,
|
|
ResourceValidation: &ResourceValidation{},
|
|
IsInitContainer: isInit,
|
|
}
|
|
|
|
// Support initializing
|
|
// FIXME This is a product of pulling in the podSpec, ideally we'd never
|
|
// expect this be nil but our tests have conditions in which the
|
|
// parent podResult isn't initialized in this ContainerValidation
|
|
// struct.
|
|
if parentPodResult == nil {
|
|
// initialize a blank pod spec
|
|
cv.parentPodSpec = corev1.PodSpec{}
|
|
} else {
|
|
cv.parentPodSpec = parentPodResult.podSpec
|
|
}
|
|
|
|
err := applyContainerSchemaChecks(conf, controllerName, controllerType, &cv)
|
|
// FIXME: don't panic
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
cRes := ContainerResult{
|
|
Name: container.Name,
|
|
Messages: cv.messages(),
|
|
Summary: cv.summary(),
|
|
}
|
|
|
|
return cRes
|
|
}
|