fix: correct resource policy to support GPUs and CPUs (#22)

* fix: correct resource policies

Signed-off-by: Chris Butler <chris.butler@redhat.com>

* chore: release bump

Signed-off-by: Chris Butler <chris.butler@redhat.com>

* fix: recommended changes

Signed-off-by: Chris Butler <chris.butler@redhat.com>

* fix: use generalized solution

Signed-off-by: Chris Butler <chris.butler@redhat.com>

---------

Signed-off-by: Chris Butler <chris.butler@redhat.com>

Author: butler54

Chart.yaml

@@ -7,4 +7,4 @@ keywords:
 - confidential-containers
 name: trustee
 # DO NOT EDIT VERSION HERE, IT IS AUTO-GENERATED BY SEMANTIC-RELEASE
-version: 0.3.3
+version: 0.3.4

README.md

@@ -1,6 +1,6 @@
 # trustee
 
-![Version: 0.3.3](https://img.shields.io/badge/Version-0.3.3-informational?style=flat-square)
+![Version: 0.3.4](https://img.shields.io/badge/Version-0.3.4-informational?style=flat-square)
 
 A Helm chart to provide an opinionated deployment of Trustee in a validated pattern
 

templates/resource-policy.yaml

@@ -8,19 +8,17 @@ metadata:
 data:
   policy.rego: |
     package policy
-
     import rego.v1
 
-    default allow := false
-    {{- if not .Values.kbs.gpu.enabled }}
+    default allow = false
 
     allow if {
-      input["submods"]["cpu0"]["ear.status"] == "affirming"
-    }
-    {{- else }}
+        not any_not_affirming
+        count(input.submods) > 0
 
-    allow if {
-      input["submods"]["cpu0"]["ear.status"] == "affirming"
-      input["submods"]["gpu0"]["ear.status"] == "affirming"
     }
-    {{- end }}
+
+    any_not_affirming if {
+        some _, submod in input.submods
+        submod["ear.status"] != "affirming"
+    }