Refactor to use get_ns

Signed-off-by: Andrew Jeffery <andrew.jeffery@thehutgroup.com>
open-policy-agent · Jan 21, 2020 · d5758dc · d5758dc
1 parent 998f631
commit d5758dc
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 20 deletions.
diff --git a/pkg/target/regolib/src.rego b/pkg/target/regolib/src.rego
@@ -269,6 +269,16 @@ get_ns[out] {
   out := data["{{.DataRoot}}"].cluster["v1"]["Namespace"][input.review.namespace]
 }
 
+get_ns[out] {
+  is_ns(input.review.kind)
+  out := input.review.object.metadata.name
+}
+
+get_ns[out] {
+  not is_ns(input.review.kind)
+  out := input.review.namespace
+}
+
 matches_namespaces(match) {
   not has_field(match, "namespaces")
 }
@@ -285,16 +295,9 @@ doesnt_match_excludednamespaces(match) {
 
 doesnt_match_excludednamespaces(match) {
   has_field(match, "excludedNamespaces")
-  not is_ns(input.review.kind)
-  ns := {n | n = match.excludedNamespaces[_]}
-  count({input.review.namespace} - ns) != 0
-}
-
-doesnt_match_excludednamespaces(match) {
-  has_field(match, "excludedNamespaces")
-  is_ns(input.review.kind)
-  ns := {n | n = match.excludedNamespaces[_]}
-  count({input.review.object.metadata.name} - ns) != 0
+  get_ns[ns]
+  nss := {n | n = match.excludedNamespaces[_]}
+  count({ns} - nss) != 0
 }
 
 matches_nsselector(match) {

diff --git a/pkg/target/target_template_source.go b/pkg/target/target_template_source.go
@@ -274,6 +274,16 @@ get_ns[out] {
   out := {{.DataRoot}}.cluster["v1"]["Namespace"][input.review.namespace]
 }
 
+get_ns[out] {
+  is_ns(input.review.kind)
+  out := input.review.object.metadata.name
+}
+
+get_ns[out] {
+  not is_ns(input.review.kind)
+  out := input.review.namespace
+}
+
 matches_namespaces(match) {
   not has_field(match, "namespaces")
 }
@@ -290,16 +300,9 @@ doesnt_match_excludednamespaces(match) {
 
 doesnt_match_excludednamespaces(match) {
   has_field(match, "excludedNamespaces")
-  not is_ns(input.review.kind)
-  ns := {n | n = match.excludedNamespaces[_]}
-  count({input.review.namespace} - ns) != 0
-}
-
-doesnt_match_excludednamespaces(match) {
-  has_field(match, "excludedNamespaces")
-  is_ns(input.review.kind)
-  ns := {n | n = match.excludedNamespaces[_]}
-  count({input.review.object.metadata.name} - ns) != 0
+  get_ns[ns]
+  nss := {n | n = match.excludedNamespaces[_]}
+  count({ns} - nss) != 0
 }
 
 matches_nsselector(match) {