kata-containers/regorus
1
0
Fork 0
mirror of https://github.com/microsoft/regorus.git synced 2026-08-05 02:16:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Early return for 'some in' statement (#427)

Browse Source 
* fix: use early exit in 'some in' statements

Update kata tests:
Since 'early return' now works with 'some in' statement, interpreter
does not do any evaluation after it found match for rule, therefore
we don't have other rule checks after interpreter found match
This commit is contained in:
Kirill Zabelin
2025-07-08 20:47:06 +02:00
committed by GitHub
parent 0a9864f3ec
commit a29bfeeb4f
13 changed files with 33 additions and 801 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/kata/data/pod-cm2/prints.json
+2 -64
View File
@@ -394,11 +394,7 @@
"tests/kata/data/pod-cm2/policy.rego:395: allow_readonly_paths 1: true",
"tests/kata/data/pod-cm2/policy.rego:398: allow_readonly_paths 2: start",
"tests/kata/data/pod-cm2/policy.rego:346: allow_linux: true",
"tests/kata/data/pod-cm2/policy.rego:85: CreateContainerRequest: true",
"tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
"tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = false",
"tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
"tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = false"
"tests/kata/data/pod-cm2/policy.rego:85: CreateContainerRequest: true"
],
[],
[],
@@ -1339,65 +1335,7 @@
"tests/kata/data/pod-cm2/policy.rego:395: allow_readonly_paths 1: true",
"tests/kata/data/pod-cm2/policy.rego:398: allow_readonly_paths 2: start",
"tests/kata/data/pod-cm2/policy.rego:346: allow_linux: true",
"tests/kata/data/pod-cm2/policy.rego:85: CreateContainerRequest: true",
"tests/kata/data/pod-cm2/policy.rego:63: ======== CreateContainerRequest: trying next policy container",
"tests/kata/data/pod-cm2/policy.rego:67: CreateContainerRequest: p_pidns = true i_pidns = true",
"tests/kata/data/pod-cm2/policy.rego:72: CreateContainerRequest: p Version = 1.1.0-rc.1 i Version = 1.1.0-rc.1",
"tests/kata/data/pod-cm2/policy.rego:75: CreateContainerRequest: p Readonly = false i Readonly = false",
"tests/kata/data/pod-cm2/policy.rego:90: allow_anno 1: start",
"tests/kata/data/pod-cm2/policy.rego:97: allow_anno 2: p Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/$(bundle-id)\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox2\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"^[a-z0-9]{64}$\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\"}",
"tests/kata/data/pod-cm2/policy.rego:98: allow_anno 2: i Annotations = {\"io.katacontainers.pkg.oci.bundle_path\": \"/run/containerd/io.containerd.runtime.v2.task/k8s.io/0730592335b050edf5109d389763447a6771aaced62161efe5ce466b278cab87\", \"io.katacontainers.pkg.oci.container_type\": \"pod_container\", \"io.kubernetes.cri.container-name\": \"busybox\", \"io.kubernetes.cri.container-type\": \"container\", \"io.kubernetes.cri.image-name\": \"mcr.microsoft.com/aks/e2e/library-busybox:master.220314.1-linux-amd64\", \"io.kubernetes.cri.sandbox-id\": \"faf19d7261fcfb7121018a2abd34cbb58a2037f029d61467d8f32a8279ead55f\", \"io.kubernetes.cri.sandbox-name\": \"cm2\", \"io.kubernetes.cri.sandbox-namespace\": \"default\", \"io.kubernetes.cri.sandbox-uid\": \"e171518a-2666-434f-86bb-1b067839f6e9\"}",
"tests/kata/data/pod-cm2/policy.rego:101: allow_anno 2: i keys = {\"io.katacontainers.pkg.oci.bundle_path\", \"io.katacontainers.pkg.oci.container_type\", \"io.kubernetes.cri.container-name\", \"io.kubernetes.cri.container-type\", \"io.kubernetes.cri.image-name\", \"io.kubernetes.cri.sandbox-id\", \"io.kubernetes.cri.sandbox-name\", \"io.kubernetes.cri.sandbox-namespace\", \"io.kubernetes.cri.sandbox-uid\"}",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.bundle_path",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.bundle_path",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.katacontainers.pkg.oci.container_type",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.katacontainers.pkg.oci.container_type",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-name",
"tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-name",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.container-type",
"tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.container-type",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.image-name",
"tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.image-name",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-id",
"tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-id",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-name",
"tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-name",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-namespace",
"tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-namespace",
"tests/kata/data/pod-cm2/policy.rego:123: allow_anno_key 2: true",
"tests/kata/data/pod-cm2/policy.rego:111: allow_anno_key 1: i key = io.kubernetes.cri.sandbox-uid",
"tests/kata/data/pod-cm2/policy.rego:115: allow_anno_key 1: true",
"tests/kata/data/pod-cm2/policy.rego:118: allow_anno_key 2: i key = io.kubernetes.cri.sandbox-uid",
"tests/kata/data/pod-cm2/policy.rego:107: allow_anno 2: true",
"tests/kata/data/pod-cm2/policy.rego:129: allow_by_anno 1: start",
"tests/kata/data/pod-cm2/policy.rego:143: allow_by_anno 2: start",
"tests/kata/data/pod-cm2/policy.rego:149: allow_by_anno 2: i_s_name = cm2 p_s_name = cm2",
"tests/kata/data/pod-cm2/policy.rego:175: allow_sandbox_name 1: start",
"tests/kata/data/pod-cm2/policy.rego:179: allow_sandbox_name 1: true",
"tests/kata/data/pod-cm2/policy.rego:182: allow_sandbox_name 2: start",
"tests/kata/data/pod-cm2/policy.rego:158: allow_by_sandbox_name: start",
"tests/kata/data/pod-cm2/policy.rego:164: allow_by_sandbox_name: p_namespace = default i_namespace = default",
"tests/kata/data/pod-cm2/policy.rego:196: allow_by_container_types: checking io.kubernetes.cri.container-type",
"tests/kata/data/pod-cm2/policy.rego:202: allow_by_container_types: p_cri_type = container i_cri_type = container",
"tests/kata/data/pod-cm2/policy.rego:211: allow_by_container_type 1: i_cri_type = container",
"tests/kata/data/pod-cm2/policy.rego:226: allow_by_container_type 2: i_cri_type = container",
"tests/kata/data/pod-cm2/policy.rego:230: allow_by_container_type 2: i_kata_type = pod_container",
"tests/kata/data/pod-cm2/policy.rego:250: allow_container_name: start",
"tests/kata/data/pod-cm2/policy.rego:267: allow_container_annotation: key = io.kubernetes.cri.container-name",
"tests/kata/data/pod-cm2/policy.rego:271: allow_container_annotation: p_value = busybox2 i_value = busybox"
"tests/kata/data/pod-cm2/policy.rego:85: CreateContainerRequest: true"
],
[],
[