Allow for configuration policies

Summary:
Implements a rough interface for validating configuration against
arbitrary policy rules. Policies are provided as YAML and passed via the
command line as file paths or remote URIs.

The format of policies is:

    enforcements:
      - path: <path>
        rule: <rule>

Where `<path>` is a YAML-ish path to a config field and `<rule>` is any
expression our config validator understands (expressions built in by the
validator library and custom tags defined in `config.validation.go`).

Example policy:

    enforcements:
      - path: variants.production.base
        rule: oneof=debian:jessie debian:stretch
      - path: variants.production.runs.as
        rule: ne=foo
      - path: variants.production.node.dependencies
        rule: isfalse

Command flag parsing was implemented in `main.go` to support the new
`--policy=uri` flag and improve existing handling of `--version` and the
usage statement.

Test Plan: Run `go test ./...`.

Reviewers: thcipriani, demon, hashar, mmodell, #release-engineering-team

Reviewed By: thcipriani, #release-engineering-team

Tags: #release-engineering-team

Differential Revision: https://phabricator.wikimedia.org/D999

1 files changed, 6 insertions, 6 deletions

diff --git a/config/common.go b/config/common.go
index a597a82..4cc300d 100644
--- a/config/common.go
+++ b/config/common.go
@@ -9,12 +9,12 @@ import (
 //
 type CommonConfig struct {
 	Base         string       `yaml:"base" validate:"omitempty,baseimage"` // name/path to base image
-	Apt          AptConfig    `yaml:"apt"`                                 // APT related configuration
-	Node         NodeConfig   `yaml:"node"`                                // Node related configuration
-	Python       PythonConfig `yaml:"python"`                              // Python related configuration
-	Lives        LivesConfig  `yaml:"lives"`                               // application owner/dir configuration
-	Runs         RunsConfig   `yaml:"runs"`                                // runtime environment configuration
-	SharedVolume Flag         `yaml:"sharedvolume"`                        // define a volume for application
+	Apt          AptConfig    `yaml:"apt"`                                 // APT related
+	Node         NodeConfig   `yaml:"node"`                                // Node related
+	Python       PythonConfig `yaml:"python"`                              // Python related
+	Lives        LivesConfig  `yaml:"lives"`                               // application owner/dir
+	Runs         RunsConfig   `yaml:"runs"`                                // runtime environment
+	SharedVolume Flag         `yaml:"sharedvolume"`                        // use volume for app
 	EntryPoint   []string     `yaml:"entrypoint"`                          // entry-point executable
 }