Setting the file. One moment.
Sanitize Readiness Input · Azure Kubernetes Automatic Readiness · microsoft/azure-skills · Skills Docs
Back to the top of the page scripts/ sanitize-readiness-input.jq
JQ · 305 lines · 8 KB
18
.
19 end
20 );
21
22 def metadata_projection:
23 {
24 name: .name,
25 namespace: .namespace,
26 restrictedLabelKeys: (
27 (.labels // {})
28 | keys
29 | map(select(startswith("kubernetes.azure.com/")))
30 ),
31 legacyAppArmorProfiles: [
32 (.annotations // {})
33 | to_entries[]
34 | select(
35 .key
36 | startswith(
37 "container.apparmor.security.beta.kubernetes.io/"
38 )
39 )
40 | {
41 container: (
42 .key
43 | ltrimstr(
44 "container.apparmor.security.beta.kubernetes.io/"
45 )
46 ),
47 valid: (
48 .value == null
49 or .value == "runtime/default"
50 or (if (.value | type) == "string"
51 then (.value | startswith("localhost/"))
52 else false
53 end)
54 )
55 }
56 ]
57 }
58 | compact;
59
60 def security_context_projection:
61 {
62 privileged: .privileged,
63 allowPrivilegeEscalation: .allowPrivilegeEscalation,
64 runAsNonRoot: .runAsNonRoot,
65 runAsUser: .runAsUser,
66 procMount: .procMount,
67 capabilities: {
68 add: (.capabilities.add // []),
69 drop: (.capabilities.drop // [])
70 },
71 seccompProfile: {type: .seccompProfile.type},
72 appArmorProfile: {type: .appArmorProfile.type},
73 seLinuxOptions: {
74 type: .seLinuxOptions.type,
75 userConfigured: (.seLinuxOptions.user != null and .seLinuxOptions.user != ""),
76 roleConfigured: (.seLinuxOptions.role != null and .seLinuxOptions.role != "")
77 },
78 windowsOptions: {
79 hostProcess: .windowsOptions.hostProcess,
80 runsAsContainerAdministrator:
81 (.windowsOptions.runAsUserName == "ContainerAdministrator")
82 },
83 sysctls: [(.sysctls // [])[] | {name: .name}]
84 }
85 | compact;
86
87 def container_projection:
88 (.image // "") as $image
89 | ($image | test("@sha256:[0-9A-Fa-f]{64}$")) as $uses_digest
90 | ($image | split("@")[0] | split("/") | last) as $name_and_tag
91 | ($name_and_tag | test(":[^:]+$")) as $has_tag
92 | ($name_and_tag | endswith(":latest")) as $uses_latest_tag
93 |
94 {
95 name: .name,
96 imagePolicy: {
97 usesLatestTag: (
98 ($uses_digest | not)
99 and (($has_tag | not) or $uses_latest_tag)
100 ),
101 pinned: (
102 $uses_digest
103 or ($has_tag and ($uses_latest_tag | not))
104 )
105 },
106 resources: .resources,
107 readinessProbeConfigured: has("readinessProbe"),
108 livenessProbeConfigured: has("livenessProbe"),
109 securityContext: (.securityContext | security_context_projection),
110 ports: [
111 (.ports // [])[]
112 | {
113 containerPort: .containerPort,
114 hostPort: .hostPort,
115 protocol: .protocol
116 }
117 | compact
118 ]
119 }
120 | compact;
121
122 def volume_projection:
123 . as $volume
124 | {
125 name: .name,
126 types: (
127 [
128 "awsElasticBlockStore",
129 "azureDisk",
130 "azureFile",
131 "cephfs",
132 "cinder",
133 "configMap",
134 "csi",
135 "downwardAPI",
136 "emptyDir",
137 "ephemeral",
138 "fc",
139 "flexVolume",
140 "flocker",
141 "gcePersistentDisk",
142 "gitRepo",
143 "glusterfs",
144 "hostPath",
145 "iscsi",
146 "nfs",
147 "persistentVolumeClaim",
148 "photonPersistentDisk",
149 "portworxVolume",
150 "projected",
151 "quobyte",
152 "rbd",
153 "scaleIO",
154 "secret",
155 "storageos",
156 "vsphereVolume"
157 ]
158 | map(. as $type | select($volume | has($type)))
159 )
160 }
161 | compact;
162
163 def pod_spec_projection:
164 {
165 hostPID: (.hostPID // false),
166 hostIPC: (.hostIPC // false),
167 hostNetwork: (.hostNetwork // false),
168 securityContext: (.securityContext | security_context_projection),
169 containers: [(.containers // [])[] | container_projection],
170 initContainers: [(.initContainers // [])[] | container_projection],
171 ephemeralContainers: [(.ephemeralContainers // [])[] | container_projection],
172 volumes: [(.volumes // [])[] | volume_projection],
173 podAntiAffinityConfigured: (.affinity.podAntiAffinity != null),
174 topologySpreadConstraintsConfigured:
175 (((.topologySpreadConstraints // []) | length) > 0)
176 }
177 | compact;
178
179 def workload_projection:
180 {
181 apiVersion: .apiVersion,
182 kind: .kind,
183 metadata: (.metadata | metadata_projection),
184 spec: {
185 replicas: .spec.replicas,
186 template: {
187 metadata: (.spec.template.metadata | metadata_projection),
188 spec: (.spec.template.spec | pod_spec_projection)
189 }
190 }
191 }
192 | compact;
193
194 def cronjob_projection:
195 {
196 apiVersion: .apiVersion,
197 kind: .kind,
198 metadata: (.metadata | metadata_projection),
199 spec: {
200 jobTemplate: {
201 spec: {
202 template: {
203 metadata:
204 (.spec.jobTemplate.spec.template.metadata | metadata_projection),
205 spec:
206 (.spec.jobTemplate.spec.template.spec | pod_spec_projection)
207 }
208 }
209 }
210 }
211 }
212 | compact;
213
214 def pod_projection:
215 {
216 apiVersion: .apiVersion,
217 kind: .kind,
218 metadata: (.metadata | metadata_projection),
219 spec: (.spec | pod_spec_projection)
220 }
221 | compact;
222
223 def service_selector_key:
224 (.spec.selector // {})
225 | to_entries
226 | sort_by(.key)
227 | tojson;
228
229 def service_projection($all):
230 . as $service
231 | {
232 apiVersion: .apiVersion,
233 kind: .kind,
234 metadata: (.metadata | metadata_projection),
235 selectorDuplicateCount: (
236 if (($service.spec.selector // {}) | length) == 0 then
237 0
238 else
239 [
240 $all[]
241 | select(.kind == "Service")
242 | select(
243 (.metadata.namespace // "default")
244 == ($service.metadata.namespace // "default")
245 )
246 | select(
247 service_selector_key
248 == ($service | service_selector_key)
249 )
250 ]
251 | length
252 end
253 )
254 }
255 | compact;
256
257 def pdb_projection:
258 {
259 apiVersion: .apiVersion,
260 kind: .kind,
261 metadata: (.metadata | metadata_projection),
262 spec: {
263 minAvailable: .spec.minAvailable,
264 maxUnavailable: .spec.maxUnavailable
265 }
266 }
267 | compact;
268
269 def storageclass_projection:
270 {
271 apiVersion: .apiVersion,
272 kind: .kind,
273 metadata: (.metadata | metadata_projection),
274 provisioner: .provisioner
275 }
276 | compact;
277
278 (.items // []) as $all
279 | {
280 apiVersion: .apiVersion,
281 kind: .kind,
282 items: [
283 $all[]
284 | if .kind == "CronJob" then
285 cronjob_projection
286 elif .kind == "Pod" then
287 pod_projection
288 elif .kind == "Service" then
289 service_projection($all)
290 elif .kind == "PodDisruptionBudget" then
291 pdb_projection
292 elif .kind == "StorageClass" then
293 storageclass_projection
294 elif (
295 .kind == "Deployment"
296 or .kind == "StatefulSet"
297 or .kind == "DaemonSet"
298 or .kind == "Job"
299 ) then
300 workload_projection
301 else
302 empty
303 end
304 ]
305 }