Fix Gatekeeper manifest wrapping

Fixes when `informGatekeeperPolicies` is set to `true`, the Gatekeeper
manifests are correctly wrapped in a ConfigurationPolicy.

ref: https://issues.redhat.com/browse/ACM-4438
Signed-off-by: Dale Haiducek <[email protected]>

Author: dhaiducek

internal/plugin_test.go

@@ -1190,7 +1190,11 @@ metadata:
 		},
 	}
 	p.Policies = append(p.Policies, policyConf)
-	p.applyDefaults(map[string]interface{}{})
+	p.applyDefaults(map[string]interface{}{
+		"policyDefaults": map[string]interface{}{
+			"informGatekeeperPolicies": false,
+		},
+	})
 
 	err = p.createPolicy(&p.Policies[0])
 	if err != nil {
@@ -1249,7 +1253,11 @@ metadata:
 		},
 	}
 	p.Policies = append(p.Policies, policyConf)
-	p.applyDefaults(map[string]interface{}{})
+	p.applyDefaults(map[string]interface{}{
+		"policyDefaults": map[string]interface{}{
+			"informGatekeeperPolicies": false,
+		},
+	})
 
 	err = p.createPolicy(&p.Policies[0])
 	if err != nil {

internal/utils.go

@@ -174,7 +174,8 @@ func getPolicyTemplates(policyConf *types.PolicyConfig) ([]map[string]interface{
 		extraDeps := policyConf.Manifests[i].ExtraDependencies
 
 		for _, manifest := range manifestGroup {
-			isPolicyTypeManifest, isOcmPolicy, err := isPolicyTypeManifest(manifest)
+			isPolicyTypeManifest, isOcmPolicy, err := isPolicyTypeManifest(
+				manifest, policyConf.InformGatekeeperPolicies)
 			if err != nil {
 				return nil, fmt.Errorf(
 					"%w in manifest path: %s",
@@ -289,7 +290,7 @@ func setTemplateOptions(tmpl map[string]interface{}, ignorePending bool, extraDe
 // - apiVersion and kind fields can't be determined
 // - the manifest is a root policy manifest
 // - the manifest is invalid because it is missing a name
-func isPolicyTypeManifest(manifest map[string]interface{}) (bool, bool, error) {
+func isPolicyTypeManifest(manifest map[string]interface{}, informGatekeeperPolicies bool) (bool, bool, error) {
 	apiVersion, found, err := unstructured.NestedString(manifest, "apiVersion")
 	if !found || err != nil {
 		return false, false, errors.New("invalid or not found apiVersion")
@@ -315,7 +316,7 @@ func isPolicyTypeManifest(manifest map[string]interface{}) (bool, bool, error) {
 	isGkConstraint := strings.HasPrefix(apiVersion, "constraints.gatekeeper.sh")
 	isGkObj := isGkConstraintTemplate || isGkConstraint
 
-	isPolicy := isOcmPolicy || isGkObj
+	isPolicy := isOcmPolicy || (isGkObj && !informGatekeeperPolicies)
 
 	if isPolicy {
 		// metadata.name is required on policy manifests

internal/utils_test.go

@@ -593,10 +593,11 @@ func TestIsPolicyTypeManifest(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
-		manifest        map[string]interface{}
-		wantIsPolicy    bool
-		wantIsOcmPolicy bool
-		wantErr         string
+		manifest                 map[string]interface{}
+		informGatekeeperPolicies bool
+		wantIsPolicy             bool
+		wantIsOcmPolicy          bool
+		wantErr                  string
 	}{
 		"valid RandomPolicy": {
 			manifest: map[string]interface{}{
@@ -622,7 +623,33 @@ func TestIsPolicyTypeManifest(t *testing.T) {
 			wantIsOcmPolicy: true,
 			wantErr:         "",
 		},
-		"valid Gatekeeper Constraint": {
+		"valid Gatekeeper Constraint with expander": {
+			manifest: map[string]interface{}{
+				"apiVersion": "constraints.gatekeeper.sh",
+				"kind":       "Foo",
+				"metadata": map[string]interface{}{
+					"name": "foo",
+				},
+			},
+			informGatekeeperPolicies: true,
+			wantIsPolicy:             false,
+			wantIsOcmPolicy:          false,
+			wantErr:                  "",
+		},
+		"valid Gatekeeper ConstraintTemplate with expander": {
+			manifest: map[string]interface{}{
+				"apiVersion": "templates.gatekeeper.sh",
+				"kind":       "ConstraintTemplate",
+				"metadata": map[string]interface{}{
+					"name": "foo",
+				},
+			},
+			informGatekeeperPolicies: true,
+			wantIsPolicy:             false,
+			wantIsOcmPolicy:          false,
+			wantErr:                  "",
+		},
+		"valid Gatekeeper Constraint without expander": {
 			manifest: map[string]interface{}{
 				"apiVersion": "constraints.gatekeeper.sh",
 				"kind":       "Foo",
@@ -634,7 +661,7 @@ func TestIsPolicyTypeManifest(t *testing.T) {
 			wantIsOcmPolicy: false,
 			wantErr:         "",
 		},
-		"valid Gatekeeper ConstraintTemplate": {
+		"valid Gatekeeper ConstraintTemplate without expander": {
 			manifest: map[string]interface{}{
 				"apiVersion": "templates.gatekeeper.sh",
 				"kind":       "ConstraintTemplate",
@@ -738,7 +765,7 @@ func TestIsPolicyTypeManifest(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			gotIsPolicy, gotIsOcmPolicy, gotErr := isPolicyTypeManifest(test.manifest)
+			gotIsPolicy, gotIsOcmPolicy, gotErr := isPolicyTypeManifest(test.manifest, test.informGatekeeperPolicies)
 			if gotErr != nil {
 				assertEqual(t, gotErr.Error(), test.wantErr)
 			}