GoogleCloudPlatform / GoogleCloudPlatform/config-validator
glob(i.e. **) does not work in target match for policies
- Dominant language
- Go
- Stars
- 48
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
When I use ** in the `target` field under `match`, Forseti Config Validator errors out.
Policy:
```
apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPStorageLocationConstraintV1
metadata:
name: allow_some_storage_location
annotations:
description: Checks Cloud Storage bucket locations against allowed or disallowed
locations.
spec:
severity: high
match:
target: ["**/project/*"]
parameters:
mode: "allowlist"
locations:
- asia-southeast1
exemptions: []
```
Error message snippet:
```
failed to evaluate review: core.dependencies.audit:25: eval_builtin_error: re_match: error parsing regexp: missing argument to repetition operator: `*`
```
From the CV regex matching [tests](https://github.com/forseti-security/config-validator/blob/1851e960cf3c357a62948c3de088fd3234f1c372/pkg/gcptarget/gcptarget_test.go), it seems such feature is supported.
It's a very useful feature to help make sure policy target can always match the ancestry path no matter what `composite_root_resources` in the forseti server config is.
Contributor guide
Assessment
This issue has not been assessed yet.