Add policy to exclude env vars.

changelog.d/+103-policy-env-vars-exclude.added.md

@@ -0,0 +1 @@
+Add policy to exclude env vars.

mirrord/operator/src/crd/policy.rs

@@ -1,3 +1,5 @@
+use std::collections::HashSet;
+
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -51,6 +53,17 @@ pub struct MirrordPolicySpec {
     // TODO: make the k8s list type be set/map to prevent duplicates.
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
+
+    /// List of environment variables that should be excluded when using mirrord.
+    ///
+    /// These environment variables won't be retrieved from the target even if the user
+    /// specifies them in their `feature.env.include` mirrord config.
+    ///
+    /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
+    /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
+    /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
+    #[serde(default)]
+    pub env_vars_exclude: HashSet<String>,
 }
 
 /// Custom cluster-wide resource for policies that limit what mirrord features users can use.
@@ -78,6 +91,17 @@ pub struct MirrordClusterPolicySpec {
     // TODO: make the k8s list type be set/map to prevent duplicates.
     /// List of features and operations blocked by this policy.
     pub block: Vec<BlockedFeature>,
+
+    /// List of environment variables that should be excluded when using mirrord.
+    ///
+    /// These environment variables won't be retrieved from the target even if the user
+    /// specifies them in their `feature.env.include` mirrord config.
+    ///
+    /// Variable names can be matched using `*` and `?` where `?` matches exactly one occurrence of
+    /// any character and `*` matches arbitrary many (including zero) occurrences of any character,
+    /// e.g. `DATABASE_*` will match `DATABASE_URL` and `DATABASE_PORT`.
+    #[serde(default)]
+    pub env_vars_exclude: HashSet<String>,
 }
 
 #[test]

tests/src/operator/policies.rs

@@ -127,6 +127,7 @@ fn block_steal_without_qualifiers() -> PolicyTestCase {
                 target_path: None,
                 selector: None,
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: No,
@@ -145,6 +146,7 @@ fn block_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -163,6 +165,7 @@ fn block_unfiltered_steal_with_path_pattern() -> PolicyTestCase {
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -181,6 +184,7 @@ fn block_unfiltered_steal_with_deployment_path_pattern() -> PolicyTestCase {
                 target_path: Some("deploy/*service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::StealWithoutFilter],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_a_can_steal: OnlyWithFilter,
@@ -205,6 +209,7 @@ fn block_steal_with_label_selector() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -230,6 +235,7 @@ fn block_steal_with_unmatching_policy() -> PolicyTestCase {
                     )])),
                 }),
                 block: vec![BlockedFeature::Steal],
+                env_vars_exclude: Default::default(),
             },
         ),
         service_b_can_steal: EvenWithoutFilter,
@@ -370,6 +376,7 @@ pub async fn create_cluster_policy_and_try_to_mirror(
                 target_path: Some("*-service-a*".into()),
                 selector: None,
                 block: vec![BlockedFeature::Mirror],
+                env_vars_exclude: Default::default(),
             },
         ),
     )