feat: use -> for explicit bindings (#92)

Signed-off-by: Charles-Edouard Brétéché <[email protected]>
kyverno · Oct 10, 2023 · fe707c0 · fe707c0
1 parent 0eca531
commit fe707c0
Show file tree

Hide file tree

Showing 6 changed files with 17 additions and 17 deletions.
diff --git a/pkg/engine/assert/expression.go b/pkg/engine/assert/expression.go
@@ -10,7 +10,7 @@ import (
 
 var (
 	foreachRegex = regexp.MustCompile(`^~(\w+)?\.(.*)`)
-	bindingRegex = regexp.MustCompile(`(.*)@(\w+)$`)
+	bindingRegex = regexp.MustCompile(`(.*)\s*->\s*(\w+)$`)
 	escapeRegex  = regexp.MustCompile(`^\\(.+)\\$`)
 	engineRegex  = regexp.MustCompile(`^\((?:(\w+):)?(.+)\)$`)
 )

diff --git a/pkg/engine/assert/expression_test.go b/pkg/engine/assert/expression_test.go
@@ -77,7 +77,7 @@ func Test_parseExpressionRegex(t *testing.T) {
 		},
 	}, {
 		name: "binding",
-		in:   "test@foo",
+		in:   "test->foo",
 		want: &expression{
 			foreach:     false,
 			foreachName: "",
@@ -86,7 +86,7 @@ func Test_parseExpressionRegex(t *testing.T) {
 		},
 	}, {
 		name: "binding",
-		in:   "(test)@foo",
+		in:   "(test)->foo",
 		want: &expression{
 			foreach:     false,
 			foreachName: "",
@@ -96,7 +96,7 @@ func Test_parseExpressionRegex(t *testing.T) {
 		},
 	}, {
 		name: "foreach and binding",
-		in:   "~.test@foo",
+		in:   "~.test->foo",
 		want: &expression{
 			foreach:     true,
 			foreachName: "",
@@ -105,7 +105,7 @@ func Test_parseExpressionRegex(t *testing.T) {
 		},
 	}, {
 		name: "foreach and binding",
-		in:   "~.(test)@foo",
+		in:   "~.(test)->foo",
 		want: &expression{
 			foreach:     true,
 			foreachName: "",
@@ -115,11 +115,11 @@ func Test_parseExpressionRegex(t *testing.T) {
 		},
 	}, {
 		name: "escape",
-		in:   `\~(test)@foo\`,
+		in:   `\~(test)->foo\`,
 		want: &expression{
 			foreach:     false,
 			foreachName: "",
-			statement:   "~(test)@foo",
+			statement:   "~(test)->foo",
 			binding:     "",
 		},
 	}, {
@@ -160,7 +160,7 @@ func Test_parseExpressionRegex(t *testing.T) {
 		},
 	}, {
 		name: "escape",
-		in:   `~index.\(test)\@name`,
+		in:   `~index.\(test)\->name`,
 		want: &expression{
 			foreach:     true,
 			foreachName: "index",

diff --git a/testdata/escaped/payload.yaml b/testdata/escaped/payload.yaml
@@ -1,6 +1,6 @@
 foo:
   (bar): 4
-  (bar)@test: 6
+  (bar)->test: 6
   ~foos:
   - 1
   - 2

diff --git a/testdata/escaped/policy.yaml b/testdata/escaped/policy.yaml
@@ -13,14 +13,14 @@ spec:
                 \(bar)\: 4
           - check:
               foo:
-                \(bar)\@test:
+                \(bar)\->test:
                   ($test): 4
           - check:
               foo:
-                \(bar)@test\: 6
+                \(bar)->test\: 6
           - check:
               foo:
-                \(bar)@test\@test:
+                \(bar)->test\->test:
                   ($test): 6
           - check:
               foo:

diff --git a/testdata/pod-no-latest/out.txt b/testdata/pod-no-latest/out.txt
@@ -2,5 +2,5 @@ Loading policies ...
 Loading payload ...
 Pre processing ...
 Running ( evaluating 1 resource against 1 policy ) ...
-- test / pod-no-latest /  FAILED: all[0].check.spec.~foo.containers@foos[0].(at($foos, $foo).image)@foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false; all[0].check.spec.~foo.containers@foos[1].(at($foos, $foo).image)@foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false; all[0].check.spec.~foo.containers@foos[2].(at($foos, $foo).image)@foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false; all[1].check.spec.~.containers@foo[0].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[1].check.spec.~.containers@foo[1].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[1].check.spec.~.containers@foo[2].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[2].check.~index.(spec.containers[*].image)@images[0].(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[2].check.~index.(spec.containers[*].image)@images[1].(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[2].check.~index.(spec.containers[*].image)@images[2].(ends_with(@, ':latest')): Invalid value: true: Expected value: false
+- test / pod-no-latest /  FAILED: all[0].check.spec.~foo.containers->foos[0].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false; all[0].check.spec.~foo.containers->foos[1].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false; all[0].check.spec.~foo.containers->foos[2].(at($foos, $foo).image)->foo.(ends_with($foo, $tag)): Invalid value: true: Expected value: false; all[1].check.spec.~.containers->foo[0].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[1].check.spec.~.containers->foo[1].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[1].check.spec.~.containers->foo[2].image.(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[2].check.~index.(spec.containers[*].image)->images[0].(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[2].check.~index.(spec.containers[*].image)->images[1].(ends_with(@, ':latest')): Invalid value: true: Expected value: false; all[2].check.~index.(spec.containers[*].image)->images[2].(ends_with(@, ':latest')): Invalid value: true: Expected value: false
 Done
diff --git a/testdata/pod-no-latest/policy.yaml b/testdata/pod-no-latest/policy.yaml
@@ -17,22 +17,22 @@ spec:
           all:
           - check:
               spec:
-                ~foo.containers@foos:
-                  (at($foos, $foo).image)@foo:
+                ~foo.containers->foos:
+                  (at($foos, $foo).image)->foo:
                     # an image tag is required
                     (contains($foo, ':')): true
                     # using a mutable image tag e.g. 'latest' is not allowed
                     (ends_with($foo, $tag)): false
           - check:
               spec:
-                ~.containers@foo:
+                ~.containers->foo:
                   image:
                     # an image tag is required
                     (contains(@, ':')): true
                     # using a mutable image tag e.g. 'latest' is not allowed
                     (ends_with(@, ':latest')): false
           - check:
-              ~index.(spec.containers[*].image)@images:
+              ~index.(spec.containers[*].image)->images:
                 # an image tag is required
                 (contains(@, ':')): true
                 # using a mutable image tag e.g. 'latest' is not allowed