Allow for configuration policies

Summary:
Implements a rough interface for validating configuration against
arbitrary policy rules. Policies are provided as YAML and passed via the
command line as file paths or remote URIs.

The format of policies is:

    enforcements:
      - path: <path>
        rule: <rule>

Where `<path>` is a YAML-ish path to a config field and `<rule>` is any
expression our config validator understands (expressions built in by the
validator library and custom tags defined in `config.validation.go`).

Example policy:

    enforcements:
      - path: variants.production.base
        rule: oneof=debian:jessie debian:stretch
      - path: variants.production.runs.as
        rule: ne=foo
      - path: variants.production.node.dependencies
        rule: isfalse

Command flag parsing was implemented in `main.go` to support the new
`--policy=uri` flag and improve existing handling of `--version` and the
usage statement.

Test Plan: Run `go test ./...`.

Reviewers: thcipriani, demon, hashar, mmodell, #release-engineering-team

Reviewed By: thcipriani, #release-engineering-team

Tags: #release-engineering-team

Differential Revision: https://phabricator.wikimedia.org/D999

1 files changed, 13 insertions, 22 deletions

diff --git a/vendor/gopkg.in/go-playground/validator.v9/validator.go b/vendor/gopkg.in/go-playground/validator.v9/validator.go
index f180a9c..483e0a2 100644
--- a/vendor/gopkg.in/go-playground/validator.v9/validator.go
+++ b/vendor/gopkg.in/go-playground/validator.v9/validator.go
@@ -14,24 +14,19 @@ type validate struct {
 	ns             []byte
 	actualNs       []byte
 	errs           ValidationErrors
+	includeExclude map[string]struct{} // reset only if StructPartial or StructExcept are called, no need otherwise
+	ffn            FilterFunc
+	slflParent     reflect.Value // StructLevel & FieldLevel
+	slCurrent      reflect.Value // StructLevel & FieldLevel
+	flField        reflect.Value // StructLevel & FieldLevel
+	cf             *cField       // StructLevel & FieldLevel
+	ct             *cTag         // StructLevel & FieldLevel
+	misc           []byte        // misc reusable
+	str1           string        // misc reusable
+	str2           string        // misc reusable
+	fldIsPointer   bool          // StructLevel & FieldLevel
 	isPartial      bool
 	hasExcludes    bool
-	includeExclude map[string]struct{} // reset only if StructPartial or StructExcept are called, no need otherwise
-
-	ffn FilterFunc
-
-	// StructLevel & FieldLevel fields
-	slflParent   reflect.Value
-	slCurrent    reflect.Value
-	flField      reflect.Value
-	fldIsPointer bool
-	cf           *cField
-	ct           *cTag
-
-	// misc reusable values
-	misc []byte
-	str1 string
-	str2 string
 }
 
 // parent and current will be the same the first run of validateStruct
@@ -127,7 +122,6 @@ func (v *validate) traverseField(ctx context.Context, parent reflect.Value, curr
 			}
 
 			if kind == reflect.Invalid {
-
 				v.errs = append(v.errs,
 					&fieldError{
 						v:              v.v,
@@ -378,14 +372,13 @@ OUTER:
 				v.misc = append(v.misc, '|')
 				v.misc = append(v.misc, ct.tag...)
 
-				if len(ct.param) > 0 {
+				if ct.hasParam {
 					v.misc = append(v.misc, '=')
 					v.misc = append(v.misc, ct.param...)
 				}
 
-				if ct.next == nil || ct.next.typeof != typeOr { // ct.typeof != typeOr
+				if ct.isBlockEnd || ct.next == nil {
 					// if we get here, no valid 'or' value and no more tags
-
 					v.str1 = string(append(ns, cf.altName...))
 
 					if v.v.hasTagNameFunc {
@@ -474,9 +467,7 @@ OUTER:
 				)
 
 				return
-
 			}
-
 			ct = ct.next
 		}
 	}