When I use ** in the target field under match, Forseti Config Validator errors out.
Policy:
apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPStorageLocationConstraintV1
metadata:
name: allow_some_storage_location
annotations:
description: Checks Cloud Storage bucket locations against allowed or disallowed
locations.
spec:
severity: high
match:
target: ["**/project/*"]
parameters:
mode: "allowlist"
locations:
- asia-southeast1
exemptions: []
Error message snippet:
failed to evaluate review: core.dependencies.audit:25: eval_builtin_error: re_match: error parsing regexp: missing argument to repetition operator: `*`
From the CV regex matching tests, it seems such feature is supported.
It's a very useful feature to help make sure policy target can always match the ancestry path no matter what composite_root_resources in the forseti server config is.
When I use ** in the
targetfield undermatch, Forseti Config Validator errors out.Policy:
Error message snippet:
From the CV regex matching tests, it seems such feature is supported.
It's a very useful feature to help make sure policy target can always match the ancestry path no matter what
composite_root_resourcesin the forseti server config is.