Merge pull request #63 from Peefy/add-more-argo-application-validatio…

…n-modules

feat: add more argo application validation modules

argo-application-field-validation/kcl.mod

@@ -1,5 +1,5 @@
 [package]
 name = "argo-application-field-validation"
-version = "0.1.0"
+version = "0.1.1"
 description = "`argo-application-field-validation` is a kcl validation module, which can be used to perform some validation on Argo `Application` fields."
 

argo-application-field-validation/main.k

@@ -5,7 +5,10 @@ validate = lambda item {
     if item.kind == "Application" and item.apiVersion.startswith("argoproj.io"):
         path = item?.spec?.source?.path
         chart = item?.spec?.source?.chart
+        server = item?.destination?.server
+        name = item?.spec?.destination?.name
         assert (path or chart) and not (path and chart), "`spec.source.path` OR `spec.source.chart` should be specified but never both."
+        assert (server or name) and not (server and name), "`spec.destination.server` OR `spec.destination.name` should be specified but never both."
     item
 }
 # Validate All resource

argo-application-prevent-default-project/README.md

@@ -0,0 +1,7 @@
+## Introduction
+
+`argo-application-prevent-default-project` is a KCL validation module, which can be used to perform some validation on Argo `Application` fields.
+
+## Resource
+
+The code source and document are [here](https://github.com/kcl-lang/artifacthub/tree/main/argo-application-prevent-default-project)

argo-application-prevent-default-project/kcl.mod

@@ -0,0 +1,5 @@
+[package]
+name = "argo-application-prevent-default-project"
+edition = "0.0.1"
+version = "0.0.1"
+

argo-application-prevent-default-project/main.k

@@ -0,0 +1,29 @@
+import yaml
+
+# Define the validation function
+validate = lambda item {
+    if item.kind == "Application" and item.apiVersion.startswith("argoproj.io"):
+        project = item?.spec?.project or "default"
+        assert project != "default", "The default project may not be used in an Application."
+    item
+}
+# Validate All resource
+items = [validate(i) for i in option("items") or []]
+
+if option("__test__"):
+    validate(yaml.decode("""\
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: goodapp
+  namespace: default
+spec:
+  project: biz
+  source:
+    repoURL: https://github.com/argoproj/argocd-example-apps.git
+    targetRevision: HEAD
+    path: guestbook
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: guestbook
+    """))

argo-applicationset-name-matches-project/README.md

@@ -0,0 +1,7 @@
+## Introduction
+
+`argo-applicationset-name-matches-project` is a KCL validation module, which can be used to perform some validation on Argo `Application` fields.
+
+## Resource
+
+The code source and document are [here](https://github.com/kcl-lang/artifacthub/tree/main/argo-applicationset-name-matches-project)

argo-applicationset-name-matches-project/kcl.mod

@@ -0,0 +1,4 @@
+[package]
+name = "argo-applicationset-name-matches-project"
+version = "0.0.1"
+

argo-applicationset-name-matches-project/main.k

@@ -0,0 +1,39 @@
+import yaml
+
+# Define the validation function
+validate = lambda item {
+    if item.kind == "ApplicationSet" and item.apiVersion.startswith("argoproj.io"):
+        project = item?.spec?.template?.spec?.project
+        assert project == item.metadata.name, "The name must match the project."
+    item
+}
+# Validate All resource
+items = [validate(i) for i in option("items") or []]
+
+if option("__test__"):
+    validate(yaml.decode("""\
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: guestbook
+spec:
+  generators:
+  - list:
+      elements:
+      - cluster: engineering-dev
+        url: https://1.2.3.4
+      - cluster: engineering-prod
+        url: https://2.4.6.8
+  template:
+    metadata:
+      name: '{{cluster}}-guestbook'
+    spec:
+      project: guestbook
+      source:
+        repoURL: https://github.com/infra-team/cluster-deployments.git
+        targetRevision: HEAD
+        path: guestbook/{{cluster}}
+      destination:
+        server: '{{url}}'
+        namespace: guestbook
+    """))

argo-appproject-clusterresourceblacklist/README.md

@@ -0,0 +1,7 @@
+## Introduction
+
+`argo-appproject-clusterresourceblacklist` is a KCL validation module, which can be used to perform some validation on Argo `Application` fields.
+
+## Resource
+
+The code source and document are [here](https://github.com/kcl-lang/artifacthub/tree/main/argo-appproject-clusterresourceblacklist)

argo-appproject-clusterresourceblacklist/kcl.mod

@@ -0,0 +1,5 @@
+[package]
+name = "argo-appproject-clusterresourceblacklist"
+edition = "0.0.1"
+version = "0.0.1"
+

argo-appproject-clusterresourceblacklist/main.k

@@ -0,0 +1,35 @@
+"""An AppProject may optionally specify clusterResourceBlacklist which is a blacklisted
+group of cluster resources. This is often a good practice to ensure AppProjects do
+not allow more access than needed. This policy is a combination of two rules which
+enforce that all AppProjects specify clusterResourceBlacklist and that their group
+and kind have wildcards as values.
+"""
+import yaml
+
+# Define the validation function
+validate = lambda item {
+    if item.kind == "AppProject" and item.apiVersion.startswith("argoproj.io"):
+        assert item.spec.clusterResourceBlacklist, "AppProject must specify clusterResourceBlacklist."
+        assert any l in item.spec.clusterResourceBlacklist {
+            "*" in l.group
+        }, "Wildcards must be present in group and kind for clusterResourceBlacklist."
+    item
+}
+# Validate All resource
+items = [validate(i) for i in option("items") or []]
+
+if option("__test__"):
+    validate(yaml.decode("""\
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: goodappproj
+spec:
+  description: Test Project
+  destinations:
+  - namespace: default
+    server: https://kubernetes.default.svc
+  clusterResourceBlacklist:
+  - group: '*'
+    kind: '*'
+    """))

argo-workflow/README.md

@@ -4,4 +4,4 @@
 
 ## Resource
 
-Code source and document is [here](https://github.com/kcl-lang/artifacthub/tree/main/argo-workflow)
+The code source and documents are [here](https://github.com/kcl-lang/artifacthub/tree/main/argo-workflow)

argo-workflow/kcl.mod

@@ -1,7 +1,7 @@
 [package]
 name = "argo-workflow"
 edition = "*"
-version = "0.0.1"
+version = "0.0.2"
 description = "`argo-workflow` is the argo-workflow spec definition"
 
 [dependencies]