genpolicy: support raw block devices

[burgerdev]

Which feature do you think can be improved?

The genpolicy tool.

How can it be improved?

genpolicy should accept Kubernetes resources that use volumeDevice and create an appropriate policy for these devices.

Additional Information

This should work:

cargo run -- -p rules.rego -j genpolicy-settings.json -u <<EOF
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: voldev
spec:
  replicas: 1
  serviceName: voldev
  selector:
    matchLabels:
      app: voldev
  template:
    metadata:
      labels:
        app: voldev
    spec:
      containers:
      - command:
        - /bin/sh
        - -c
        - |
          stat /dev/csi0
          tail -f /dev/null
        image: alpine:3.19.1
        name: voldev
        volumeDevices:
        - devicePath: /dev/csi0
          name: state
      runtimeClassName: kata-cc-isolation
  volumeClaimTemplates:
  - metadata:
      name: state
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi
      storageClassName: default
      volumeMode: Block
EOF

Right now, it produces an error because some of the fields are not defined:

thread 'main' panicked at src/yaml.rs:341:9:
Unsupported field: spec.template.spec.containers.0.volumeDevices
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

The structs need to be modified to understand volumeDevices and the policy needs to be adjusted to allow the defined devices.

cc @danmihai1