Preserve whitespace

examples/container-deny-latest-tag/src.rego

@@ -3,6 +3,21 @@
 # Using the latest tag on images can cause unexpected problems in production. By specifying a pinned version
 # we can have higher confidence that our applications are immutable and do not change unexpectedly.
 #
+# The following snippet is an example of how to satisfy this requirement:
+#
+# ```
+# apiVersion: apps/v1
+# kind: Deployment
+# metadata:
+#   name: redis
+# spec:
+#   template:
+#     spec:
+#       containers:
+#         - name: redis
+#           image: redis:6.2
+# ```
+#
 # @kinds apps/DaemonSet apps/Deployment apps/StatefulSet core/Pod
 package container_deny_latest_tag
 

examples/policies-no-rego.md

@@ -241,6 +241,21 @@ _source: [psp-deny-privileged](psp-deny-privileged)_
 Using the latest tag on images can cause unexpected problems in production. By specifying a pinned version
 we can have higher confidence that our applications are immutable and do not change unexpectedly.
 
+The following snippet is an example of how to satisfy this requirement:
+
+ ```
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+   name: redis
+ spec:
+   template:
+     spec:
+       containers:
+         - name: redis
+           image: redis:6.2
+```
+
 
 _source: [container-deny-latest-tag](container-deny-latest-tag)_
 

examples/policies.md

@@ -584,6 +584,21 @@ _source: [psp-deny-privileged](psp-deny-privileged)_
 Using the latest tag on images can cause unexpected problems in production. By specifying a pinned version
 we can have higher confidence that our applications are immutable and do not change unexpectedly.
 
+The following snippet is an example of how to satisfy this requirement:
+
+ ```
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+   name: redis
+ spec:
+   template:
+     spec:
+       containers:
+         - name: redis
+           image: redis:6.2
+```
+
 ### Rego
 
 ```rego

internal/commands/create.go

@@ -91,19 +91,15 @@ func runCreateCommand(path string) error {
 			return fmt.Errorf("writing template: %w", err)
 		}
 
-		if viper.GetBool("skip-constraints") {
+		if viper.GetBool("skip-constraints") || violation.SkipConstraint() {
 			continue
 		}
 
-		// skip Constraint generation if there are parameters on the template
+		// Skip Constraint generation if there are parameters on the template.
 		if len(violation.Parameters()) > 0 {
 			continue
 		}
 
-		if violation.SkipConstraint() {
-			continue
-		}
-
 		constraint, err := getConstraint(violation)
 		if err != nil {
 			return fmt.Errorf("get constraint: %w", err)
@@ -179,14 +175,13 @@ func getOpenAPISchemaProperties(r rego.Rego) map[string]apiextensionsv1beta1.JSO
 }
 
 func getConstraint(violation rego.Rego) (unstructured.Unstructured, error) {
-	constraint := unstructured.Unstructured{}
-
 	gvk := schema.GroupVersionKind{
 		Group:   "constraints.gatekeeper.sh",
 		Version: "v1beta1",
 		Kind:    violation.Kind(),
 	}
 
+	constraint := unstructured.Unstructured{}
 	constraint.SetGroupVersionKind(gvk)
 	constraint.SetName(violation.Name())
 
@@ -200,22 +195,18 @@ func getConstraint(violation rego.Rego) (unstructured.Unstructured, error) {
 
 	matchers, err := violation.Matchers()
 	if err != nil {
-		return constraint, err
-	}
-	if len(matchers.KindMatchers) == 0 {
-		return constraint, nil
+		return unstructured.Unstructured{}, fmt.Errorf("matchers: %w", err)
 	}
 
 	if len(matchers.KindMatchers) != 0 {
-		err := setKindMatcher(&constraint, matchers.KindMatchers)
-		if err != nil {
-			return constraint, err
+		if err := setKindMatcher(&constraint, matchers.KindMatchers); err != nil {
+			return unstructured.Unstructured{}, fmt.Errorf("set kind matcher: %w", err)
 		}
 	}
+
 	if len(matchers.MatchLabelsMatcher) != 0 {
-		err := setMatchLabelsMatcher(&constraint, matchers.MatchLabelsMatcher)
-		if err != nil {
-			return constraint, err
+		if err := setMatchLabelsMatcher(&constraint, matchers.MatchLabelsMatcher); err != nil {
+			return unstructured.Unstructured{}, fmt.Errorf("set match labels matcher: %w", err)
 		}
 	}
 
@@ -234,6 +225,7 @@ func setKindMatcher(constraint *unstructured.Unstructured, kindMatchers []rego.K
 		if kindMatcher.APIGroup == "core" {
 			apiGroup = ""
 		}
+
 		apiGroups = appendIfNotExists(apiGroups, apiGroup)
 	}
 

internal/commands/document.go

@@ -146,7 +146,7 @@ func getDocumentation(path string, outputDirectory string) (map[rego.Severity][]
 
 		matchers, err := policy.Matchers()
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("matchers: %w", err)
 		}
 		resources := matchers.KindMatchers.String()
 		if resources == "" {

internal/rego/matchers.go

@@ -19,8 +19,8 @@ func (k KindMatchers) String() string {
 	for _, kindMatcher := range k {
 		result += kindMatcher.APIGroup + "/" + kindMatcher.Kind + " "
 	}
-	result = strings.TrimSpace(result)
 
+	result = strings.TrimSpace(result)
 	return result
 }
 
@@ -38,25 +38,27 @@ func (m MatchLabelsMatcher) String() string {
 	for k, v := range m {
 		result += fmt.Sprintf("%s=%s ", k, v)
 	}
+
 	return strings.TrimSpace(result)
 }
 
 // Matchers returns all of the matchers found in the rego file.
 func (r Rego) Matchers() (Matchers, error) {
 	var matchers Matchers
 	for _, comment := range r.headerComments {
-		if strings.HasPrefix(comment, "@kinds") {
+		if commentStartsWith(comment, "@kinds") {
 			var err error
 			matchers.KindMatchers, err = getKindMatchers(comment)
 			if err != nil {
-				return matchers, err
+				return Matchers{}, fmt.Errorf("get kind matchers: %w", err)
 			}
 		}
-		if strings.HasPrefix(comment, "@matchlabels") {
+
+		if commentStartsWith(comment, "@matchlabels") {
 			var err error
 			matchers.MatchLabelsMatcher, err = getMatchLabelsMatcher(comment)
 			if err != nil {
-				return matchers, err
+				return Matchers{}, fmt.Errorf("get match labels matcher: %w", err)
 			}
 		}
 	}
@@ -65,11 +67,10 @@ func (r Rego) Matchers() (Matchers, error) {
 }
 
 func getKindMatchers(comment string) ([]KindMatcher, error) {
-	var kindMatchers []KindMatcher
-
 	kindMatcherText := strings.TrimSpace(strings.SplitAfter(comment, "@kinds")[1])
 	kindMatcherGroups := strings.Split(kindMatcherText, " ")
 
+	var kindMatchers []KindMatcher
 	for _, kindMatcherGroup := range kindMatcherGroups {
 		kindMatcherSegments := strings.Split(kindMatcherGroup, "/")
 		if len(kindMatcherSegments) != 2 {
@@ -89,15 +90,19 @@ func getKindMatchers(comment string) ([]KindMatcher, error) {
 
 func getMatchLabelsMatcher(comment string) (MatchLabelsMatcher, error) {
 	matcher := make(map[string]string)
-
 	matcherText := strings.TrimSpace(strings.SplitAfter(comment, "@matchlabels")[1])
-
 	for _, token := range strings.Fields(matcherText) {
 		split := strings.Split(token, "=")
 		if len(split) != 2 {
 			return nil, fmt.Errorf("invalid @matchlabels annotation token: %s", token)
 		}
+
 		matcher[split[0]] = split[1]
 	}
+
 	return matcher, nil
 }
+
+func commentStartsWith(comment string, keyword string) bool {
+	return strings.HasPrefix(strings.TrimSpace(comment), keyword)
+}