<commit_before>{{/* This policy is currently in testing phase */}}
{{- if .Values.global.region | contains "qa-" -}}

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: gkingressannotations
spec:
  crd:
    spec:
      names:
        kind: GkIngressAnnotations
      validation:
        openAPIV3Schema:
          properties: {}

  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package ingressannotations

        ingress_annotations[a] {
          obj := input.review.object
          obj.kind == "Ingress"
          obj.metadata.annotations[k]
          contains(k, "ingress.kubernetes.io")
          a = k
        }

        # These annotations have been disabled due to CVE-2021-25742
        disabled_annotations["auth-snippet"]
        disabled_annotations["configuration-snippet"]
        disabled_annotations["server-snippet"]
        disabled_annotations["modsecurity-snippet"]

        violation[{"msg": msg}] {
          count(ingress_annotations) > 0
          found := {a |
            ingress_annotations[k]
            sL := split(k, "/")
            count(sL) == 2
            sL[1] == disabled_annotations[_]
            a = sL[1]
          }
          count(found) > 0
          msg := sprintf("has disabled annotations: %s", [sort(found)])
        }

        # Starting in Ingress Controller >= v0.22.0, ingress definitions using the rewrite-target
        # annotation are not backwards compatible with previous versions. In v0.22.0 and beyond,
        # any substrings within the request URI that need to be passed to the rewritten path must
        # explicitly be defined in a capture group.
        #
        # Captured groups are saved in numbered placeholders, chronologically, in the form $1 ... $n.
        # These placeholders can be used as parameters in the rewrite-target annotation.
        #
        # Example: https://github.com/kubernetes/ingress-nginx/blob/main/docs/examples/rewrite/README.md
        rewrite_target = "rewrite-target"

        violation[{"msg": msg}] {
          count(ingress_annotations) > 0
          obj := input.review.object

          # Check that rewrite annotation exists and get its value.
          ingress_annotations[k]
          endswith(k, rewrite_target)
          v := object.get(obj.metadata.annotations, k, "")
          v != ""

          # Find number for capture group placeholder.
          mL := regex.find_all_string_submatch_n(`\$(\d)`, v, 1)
          count(mL) > 0
          placeholder_no := to_number(mL[0][1])
          placeholder_no != 0 # placeholders are supposed to start from 1.

          # Loop through all rules and paths to check if there is some path value that has the
          # specific number of regex capture group.
          found := {f |
            path := obj.spec.rules[_].http.paths[_].path
            capture_groups := regex.find_n(`\(.*?\)`, path, -1)
            capture_groups_n := count(capture_groups)
            capture_groups_n >= placeholder_no
            f = true
          }

          count(found) == 0
          msg := sprintf("%q annotation expects at least one spec.rules[].http.paths[].path with regex value that has at least %d capture group(s)", [rewrite_target, placeholder_no])
        }

{{- end -}}<commit_msg>system/gatekeeper: split long line<commit_after>{{/* This policy is currently in testing phase */}}
{{- if .Values.global.region | contains "qa-" -}}

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: gkingressannotations
spec:
  crd:
    spec:
      names:
        kind: GkIngressAnnotations
      validation:
        openAPIV3Schema:
          properties: {}

  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package ingressannotations

        ingress_annotations[a] {
          obj := input.review.object
          obj.kind == "Ingress"
          obj.metadata.annotations[k]
          contains(k, "ingress.kubernetes.io")
          a = k
        }

        # These annotations have been disabled due to CVE-2021-25742
        disabled_annotations["auth-snippet"]
        disabled_annotations["configuration-snippet"]
        disabled_annotations["server-snippet"]
        disabled_annotations["modsecurity-snippet"]

        violation[{"msg": msg}] {
          count(ingress_annotations) > 0
          found := {a |
            ingress_annotations[k]
            sL := split(k, "/")
            count(sL) == 2
            sL[1] == disabled_annotations[_]
            a = sL[1]
          }
          count(found) > 0
          msg := sprintf("has disabled annotations: %s", [sort(found)])
        }

        # Starting in Ingress Controller >= v0.22.0, ingress definitions using the rewrite-target
        # annotation are not backwards compatible with previous versions. In v0.22.0 and beyond,
        # any substrings within the request URI that need to be passed to the rewritten path must
        # explicitly be defined in a capture group.
        #
        # Captured groups are saved in numbered placeholders, chronologically, in the form $1 ... $n.
        # These placeholders can be used as parameters in the rewrite-target annotation.
        #
        # Example: https://github.com/kubernetes/ingress-nginx/blob/main/docs/examples/rewrite/README.md
        rewrite_target = "rewrite-target"

        violation[{"msg": msg}] {
          count(ingress_annotations) > 0
          obj := input.review.object

          # Check that rewrite annotation exists and get its value.
          ingress_annotations[k]
          endswith(k, rewrite_target)
          v := object.get(obj.metadata.annotations, k, "")
          v != ""

          # Find number for capture group placeholder.
          mL := regex.find_all_string_submatch_n(`\$(\d)`, v, 1)
          count(mL) > 0
          placeholder_no := to_number(mL[0][1])
          placeholder_no != 0 # placeholders are supposed to start from 1.

          # Loop through all rules and paths to check if there is some path value that has the
          # specific number of regex capture group.
          found := {f |
            path := obj.spec.rules[_].http.paths[_].path
            capture_groups := regex.find_n(`\(.*?\)`, path, -1)
            capture_groups_n := count(capture_groups)
            capture_groups_n >= placeholder_no
            f = true
          }

          count(found) == 0
          msg := sprintf(
            "%q annotation expects at least one spec.rules[].http.paths[].path with regex value that has at least %d capture group(s)",
            [rewrite_target, placeholder_no],
          )
        }

{{- end -}}
{'fraction_non_alphanumeric': 0.10416666666666667, 'fraction_numerical': 0.01079136690647482, 'mean_word_length': 2.1080577550069863, 'pattern_counts': {'":': 4, '<': 3, '<?xml version=': 0, '>': 15, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3632587', 'n_tokens_mistral': 1892, 'n_tokens_neox': 1798, 'n_words': 518}