Skip to main content

Multiple property paths

Sometimes, a property (key/value) that you want to test against will be located in multiple places. For example, if you want to create a custom rule that ensures all container images have a pinned version, you can avoid creating a rule logic that declares all possible paths because checking the value of the image property in two locations can be complex.

  • When kind is Deployment, the value of the property spec.template.spec.containers[].image should have a pinned version

  • When kind is Pod, the value of the property spec.containers[].image should have a pinned version

To avoid this complexity, you can write a JSON Schema with a rule logic that will define the common path and disregard all prefixes:

  • The value of the property **.spec.containers[].image should have a pinned version

Here is an example of what that would look like:

customRules:
- identifier: CUSTOM_CONTAINERS_MISSING_IMAGE_VALUE_VERSION
name: Ensure each container image has a pinned (tag) version [CUSTOM RULE]
defaultMessageOnFailure: |
Not setting image version for your containers is like going to the casino 🎰 - you don't know which version you'll get
schema:
definitions:
imagePattern:
properties:
spec:
properties:
containers:
type: array
items:
properties:
image:
type: string
pattern: ^(?=.*[:|@](?=.+)(?!latest)).*$
allOf:
- $ref: '#/definitions/imagePattern'
additionalProperties:
$ref: '#'
items:
$ref: '#'

The above rule is enforcing the same logic as our built-in rule - ☑️ Ensure each container image has a pinned (tag) version