Default behavior for invalid constraint parameters - Allow or deny? about gatekeeper-library HOT 2 CLOSED

We talked about this some in the meeting today. Here are some points that were brought up:

• Rejecting a user request because the admin has misconfigured a constraint misdirects feedback -- ideally the admin should have their request rejected if they misconfigure a constraint
• Parameter JSONSchemas are insufficient because some constraints have complex parameter validation where the validity of one field may depend on the value of a different field
  • To handle cases like this, it might be neat to have programmable constraint validation, though there are no plans to actively work on this just yet (not enough time)
• It would be great if we had a system where an admin could test their defined constraints by throwing known bad and good inputs against them and making sure each fails/passes
  • Admins are likely best capable of knowing the set of bad inputs, as they are selecting parameters with an eye to preventing specific bad outcomes

Long term, I think the most interesting thing would be to write such a testing framework.

Short term, I'd recommend applying the constraints/templates on a test cluster and testing good and bad resources against the constraints, much like the agile bank demo.

from gatekeeper-library.

This issue/PR has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

from gatekeeper-library.