流水线规则

apiVersion: policies.katanomi.dev/v1alpha1
kind: ClusterRule
metadata:
  name: template-label-check
spec:
  when: # when 代表执行之前的校验，只有 when 校验通过，才会执行 filter 中的校验，否则跳过校验
    cel: has(ce.data.raw.status.unitTestsResults)
  filter: # filter 代表对模板信息的过滤
    sql: templatelabels LIKE '%#label:$(params.key)=$(params.value)#%' # 支持 cloudevent sql 语法，详见 https://github.com/cloudevents/spec/blob/main/cesql/spec.md
  params:
    - name: key # 定义的参数名称
      type: string # 定义的参数类型，目前支持 string
      description: 模板需要包含的 label key # 参数描述

exact:
  subject: defult/build/policy

prefix:
  subject: defult

suffix:
  subject: policy

apiVersion: policies.katanomi.dev/v1alpha1
kind: ClusterRule
metadata:
  name: template-name-check
spec:
  params:
    - name: templateName
      type: string
      description: filter with the template name
  filter:
    sql: templatenames LIKE '%#name:$(params.templateName)#%'

apiVersion: policies.katanomi.dev/v1alpha1
kind: ClusterRule
metadata:
  name: template-label-check
spec:
  params:
    - name: key
      type: string
      description: 模板需要包含的 label key
    - name: value
      type: string
      description: 模板需要包含的 label Value
  filter:
    sql: templatelabels LIKE '%#label:$(params.key)=$(params.value)#%'

apiVersion: policies.katanomi.dev/v1alpha1
kind: ClusterRule
metadata:
  name: template-clustertemplate-resolver-check
spec:
  params:
    - name: name
      type: string
      description: 模板名称
  filter:
    sql: templaterefs LIKE '%#resolver:katanomi.dev.clustertemplate|name:$(params.name)#%'

apiVersion: policies.katanomi.dev/v1alpha1
kind: ClusterRule
metadata:
  name: template-gitsource-resolver-check
spec:
  params:
    - name: url
      type: string
      description: 模板所处的代码仓库
    - name: revision
      type: string
      description: 模板代码中 revision
    - name: pathInRepo
      type: string
      description: 模板所处代码仓库位置
  filter:
    sql: templaterefs LIKE '%#resolver:katanomi.dev.gitsource|pathInRepo:$(params.pathInRepo)|revision:$(params.revision)|url:$(params.url)#%'

apiVersion: policies.katanomi.dev/v1alpha1
kind: PolicyRun
metadata:
  name: template-zg2xw-o1tnvs
  namespace: devops
spec:
  # policyRun 对应的阶段
  phase: BuildRunResultChanged

  # 事件信息
  cloudEvent:
    # 事件元信息
    source: /apis/builds.katanomi.dev/v1alpha1/namespaces/devops/build/template
    specversion: "1.0"
    subject: devops/build/template
    type: dev.katanomi.cloudevents.builds.katanomi.dev.build.policycheck.v1alpha1
    # 内置格式化信息
    templatenames: "#name:go-build#"
    templatelabels: "#label:core.katanomi.dev/template.kind=build.builds.katanomi.dev#label:core.katanomi.dev/template.type=snippets#label:katanomi.dev/source=system#"
    templaterefs: "#resolver:katanomi.dev.clustertemplate|name:go-build#"
    # buildSpec buildRun 或者 delivery 资源定义信息
    data:
      raw:
        apiVersion: builds.katanomi.dev/v1alpha1
        kind: Build
        metadata:
          name: check
          namespace: default
        spec: ...
        status: ...

  # buildSpec buildRun 或者 delivery 资源定义信息
  raw:
    apiVersion: builds.katanomi.dev/v1alpha1
    kind: Build
    metadata:
      name: check
      namespace: default
    spec: ...
    status: ...
status:
  checkStatus: # 包含所有对策略的检查结果
    message: "Check Completed: 1 (Succeed: 0, Failed 1, Unknown 0)" # 检查汇总信息
    policies: # 所有涉及到的 policy 的集合
      - checks: # 某个 policy 检查详情
          - params:
              - name: templateName
                value: java
            ruleRef:
              kind: ClusterRule
              name: template-name-check
        policyRef: # policy 相关信息
          apiVersion: policies.katanomi.dev/v1alpha1
          kind: Policy
          name: template-name-check
          namespace: devops
        status: "False" # 当前 Policy 检查结果
    status: "False" # 最终检查结果
    type: Succeeded
  conditions: # 检查 condition 信息
    - lastTransitionTime: "2023-09-13T23:39:55Z"
      status: "True"
      type: CheckReady
    - lastTransitionTime: "2023-09-13T23:39:55Z"
      status: "True"
      type: PolicyFilterReady
    - lastTransitionTime: "2023-09-13T23:39:55Z"
      status: "True"
      type: Succeeded

apiVersion: builds.katanomi.dev/v1alpha1
kind: Build
metadata:
  annotations:
    builds.katanomi.dev/trigger-ignore-message-migrated: "true"
    cpaas.io/displayName: ""
    integrations.katanomi.dev/integration: gitlab-a5fw2h
  name: template-check
  namespace: default
spec:
  # buildSpec 信息，主要包含 tasks 构建流程定义，如果引用模板则包含模板信息与渲染后的 tasks 流程定义信息
  tasks:
    - name: go-unit-test
      params:
        - name: command
          value: |
                        go test -v -json -coverprofile=test-output/coverage-report > test-output/test-report.json
      taskRef:
        kind: ClusterTask
        name: go-unit-test
      timeout: 30m0s
      workspaces:
        - name: source
          workspace: source

  templates:
    - metadata:
        labels:
          core.katanomi.dev/template.kind: build.builds.katanomi.dev
          core.katanomi.dev/template.type: snippets
          katanomi.dev/source: system
        name: go-build
      params:
        - name: tool-image
          value: build-harbor.alauda.cn/devops/builder-go:1.17-ubuntu-ece13f7d
      templateRef:
        params:
          - name: name
            value: go-build
        resolver: katanomi.dev.clustertemplate

apiVersion: deliveries.katanomi.dev/v1alpha1
kind: Delivery
metadata:
  name: delivery
  namespace: default
spec:
  configs:
    stages:
      - context:
          environmentSpec:
            clusterRef:
              apiVersion: clusterregistry.k8s.io/v1alpha1
              kind: Cluster
              name: global
              namespace: cpaas-system
            namespaceRef:
              name: global
        name: sit
        timeout: 0s
  params:
    - artifact:
        annotations:
        integrationClassName: harbor
        secretRef:
          name: harbor-build
          namespace: cpaas-system-global-credentials
        type: OCIContainerImage
        uri: build-harbor.alauda.cn/test/minio/minio/minio
      default: RELEASE.2023-12-13T23-28-55Z
      name: teste
      type: string
  stages:
    - context:
        environmentSpec:
          clusterRef:
            apiVersion: clusterregistry.k8s.io/v1alpha1
            kind: Cluster
            name: global
            namespace: cpaas-system
          namespaceRef:
            name: global
      name: sit
      params:
        - name: artifact
          value: []
      stageRef:
        kind: ClusterStage
        name: deployment-update
      timeout: 0s
  templates:
    - metadata:
        labels:
          core.katanomi.dev/template.kind: delivery.deliveries.katanomi.dev
          core.katanomi.dev/template.type: snippets
          katanomi.dev/source: system
        name: update-deployment
      params:
        - name: deploy-name
          value: test
      templateRef:
        params:
          - name: name
            value: update-deployment
        resolver: katanomi.dev.clustertemplate

apiVersion: builds.katanomi.dev/v1alpha1
kind: BuildRun
metadata:
  name: katanomi
  namespace: devops
spec:
  buildRef:
    name: katanomi
    namespace: devops
  git:
    revision: refs/heads/release-3.15
  serviceAccount:
    name: ""
  status: ""
status:
  codeLintResults:
    - issues:
        count: 0
      name: golangci-lint
      result: Succeeded
  codeScan:
    reportWebURL: https://build.xxx/dashboard
    result: Succeeded
    taskID: AYxsGlHxxx
  codeScanResults:
    - metrics:
        branch:
          coverage:
            new: "0.00"
            total: "53.50"
          duplications:
            new: "0.00"
            total: "0.00"
        codeSize:
          linesOfCode: 12624
        languages:
          - go
          - xml
        ratings:
          maintainability:
            issues: 13
            rate: A
          reliability:
            issues: 0
            rate: A
          securityHotspots:
            issues: 0
            rate: A
          vulnerability:
            issues: 0
            rate: A
        target:
          coverage:
            new: ""
            total: ""
          duplications:
            new: ""
            total: ""
      name: code-scan
      projectID: gitlab.xxx.cn-devops-katanomi
      reportURL: https://build.xxx/dashboard
      result: Succeeded
      taskID: AYxsGlHha7lGyuc9WiM-
  unitTestsResults:
    - coverage:
        lines: "47.8"
      name: golang-test
      testResults:
        failed: 0
        passed: 267
        passedTestsRate: "100.00"
        skipped: 0
      type: unitTest

status:
  vulnScanResults: # 镜像漏洞信息
    - name: image-vlun # task 名称
      result: Successed # 扫描结果
      targets:
        - type: ContainerImage
          uri: build.alauda.cn/nginx:harbor@sha256:fe98dxx # 镜像ID
          highCount: 20 # high 级别漏洞数目
          lowCount: 5 # low 级别漏洞数目
          criticalCount: 3 # critical 级别漏洞数目
          mediumCount: 31 # medium 级别漏洞数目
          unknownCount: 13 # unknown 级别漏洞数目
          cvss: # 漏洞评分系统
            score: "9.8" # 最高漏洞的分数
            severity: Critical #  最高漏洞严重性
            source: nvd # 最高漏洞的 CVSS 分数来源

status:
  codeLintResults: # code lint 结果
    - issues:
        count: 0 # 问题数目
      name: golangci-lint # task 名称
      result: Succeeded #  结果状态，可选值为 Succeeded Failed Canceled

status:
  codeScanResults: # 代码扫描结果
    - name: code-scan # task 名称
      projectID: gitlab-ce.alauda.cn # 扫描项目 ID
      reportURL: https://xxxx # 代码扫描地址
      result: Succeeded #  结果状态，可选值为 Succeeded Failed Canceled
      taskID: AYxr372ra7lGyuc9WiMQ # 扫描任务 ID
      metrics: # 扫描结果
        branch: # 当前分支扫描结果
          coverage: # 覆盖率信息
            new: "0.00"
            total: "53.50"
          duplications: # 重复率信息
            new: "0.00"
            total: "0.00"
        target: # 目标分支扫描结果
          coverage: # 覆盖率信息
            new: ""
            total: ""
          duplications: # 重复率信息
            new: ""
            total: ""

        codeSize: # 代码行数
          linesOfCode: 12624
        languages: # 包含语言
          - go
          - xml
        ratings: # 代码评级
          maintainability: # 可维护性
            issues: 13 # 代码异味数目
            rate: A # 评级
          reliability: # 可靠性
            issues: 0 # 缺陷数目
            rate: A # 评级
          securityHotspots: # 审查安全热点
            issues: 0 # 问题数目
            rate: A # 评级
          vulnerability: # 漏洞
            issues: 0 # 漏洞数目
            rate: A # 评级

status:
  unitTestsResults: # 代码测试结果
    - name: golang-test # 任务名称
      type: unitTest # 测试类型
      coverage: # 测试覆盖率信息
        lines: "47.8" # 行覆盖率
        branches: "44.3" # 分支覆盖率
      testResults: # 测试结果
        failed: 0 # 测试失败 case 数目
        passed: 267 # 测试通过 case 数目
        passedTestsRate: "100.00" # 测试覆盖率
        skipped: 0 # 测试跳过 case 数目

apiVersion: policies.katanomi.dev/v1alpha1
kind: ClusterRule
metadata:
  name: sonarqube-analysis-coverage
spec:
  params:
    - description:
      name: coverage # 阈值变量名称
      type: string
  when:
    cel: has(ce.data.raw.status.codeScanResults) # 当存在代码扫描结果时，其结果值需要满足 filter 的条件
  filter:
    # 测试覆盖率需要大于 params.coverage 变量值，本示例中将覆盖率值配置为变量形式，在策略中引用该规则时配置具体的阈值，也可以在规则中直接定义为具体的阈值，如 8.0
    cel: ce.data.raw.status.codeScanResults.listValidate('metrics.branch.coverage.total', '>', $(params.coverage))