#!/bin/bash

. ../../third_party/demo-magic/demo-magic.sh

clear

# cmd

p "Deploy the constraint template"

pe "kubectl apply -f k8srequiredlabels_template_usevap.yaml"

p "View Constraint template to see the K8sNativeValidation engine and CEL rules are added"

pe "cat k8srequiredlabels_template_usevap.yaml"

pe "kubectl apply -f owner_must_be_provided.yaml"

pe "cat owner_must_be_provided.yaml"

p "Notice that only audit and validation is added as enforcement points and VAP as enforcement point is not added in the constraint"

p "Let's test the policy"

pe "kubectl create ns test"

p "Note the namespace was blocked by the Gatekeeper webhook as evaluated by the CEL rules"

p ""

p "Now let's add the VAP as enforcement point and update the constraint"

pe "kubectl apply -f owner_must_be_provided_usevap.yaml"

pe "cat owner_must_be_provided_usevap.yaml"

p "VAPBinding with validation action warn should get created automatically with inclusion of VAP as enforcement point with warn action since ConstraintTemplate has CEL and intent to use VAP"

pe "kubectl get ValidatingAdmissionPolicy"

pe "kubectl get ValidatingAdmissionPolicyBinding"

p "Let's test the policy"

pe "kubectl create ns test"

p "Note the warning is generated by the ValidatingAdmissionPolicy admission controller and the namespace is blocked by the Gatekeeper webhook as evaluated by the CEL rules"

p "THE END"

kubectl delete constrainttemplates --all
