# SPDX-License-Identifier: AGPL-3.0-or-later
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
  name: fluxer-api-approved-image
  labels:
    app.kubernetes.io/part-of: fluxer
    app.kubernetes.io/name: api-image-policy
spec:
  failurePolicy: Fail
  paramKind:
    apiVersion: v1
    kind: ConfigMap
  matchConstraints:
    resourceRules:
      - apiGroups: ["apps"]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["deployments"]
  matchConditions:
    - name: fluxer-api-deployments
      expression: "request.namespace == 'fluxer' && (object.metadata.name == 'api' || object.metadata.name == 'api-canary')"
  variables:
    - name: containerName
      expression: "object.metadata.name == 'api' ? 'api' : 'api-canary'"
    - name: targetContainers
      expression: "object.spec.template.spec.containers.filter(c, c.name == variables.containerName)"
  validations:
    - expression: "params.data[\"tag\"].matches(\"^[1-9][0-9]{3}\\\\.[1-9][0-9]{2,3}\\\\.(0|[1-9][0-9]{0,5})$\")"
      message: "approved fluxer-api tag must be a Fluxer CalVer value"
    - expression: "params.data[\"previousTag\"] == \"\" || params.data[\"previousTag\"].matches(\"^[1-9][0-9]{3}\\\\.[1-9][0-9]{2,3}\\\\.(0|[1-9][0-9]{0,5})$\")"
      message: "previous approved fluxer-api tag must be empty or a Fluxer CalVer value"
    - expression: "variables.targetContainers.size() == 1"
      message: "api deployment must have exactly one target api container"
    - expression: "variables.targetContainers.all(c, (c.image == params.data[\"image\"] && c.env.exists(e, e.name == \"BUILD_VERSION\" && e.value == params.data[\"tag\"])) || (params.data[\"previousImage\"] != \"\" && c.image == params.data[\"previousImage\"] && c.env.exists(e, e.name == \"BUILD_VERSION\" && e.value == params.data[\"previousTag\"])))"
      messageExpression: "params.data[\"previousImage\"] == \"\" ? \"api deployment image and BUILD_VERSION must match \" + params.data[\"image\"] : \"api deployment image and BUILD_VERSION must match approved image \" + params.data[\"image\"] + \" or temporary rollback image \" + params.data[\"previousImage\"]"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: fluxer-api-approved-image
  labels:
    app.kubernetes.io/part-of: fluxer
    app.kubernetes.io/name: api-image-policy
spec:
  policyName: fluxer-api-approved-image
  validationActions: [Deny]
  paramRef:
    name: fluxer-api-approved-image
    namespace: fluxer
    parameterNotFoundAction: Deny