feat: kubesphere 4.0 (#6115)

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

* feat: kubesphere 4.0

Signed-off-by: ci-bot <ci-bot@kubesphere.io>

---------

Signed-off-by: ci-bot <ci-bot@kubesphere.io>
Co-authored-by: ks-ci-bot <ks-ci-bot@example.com>
Co-authored-by: joyceliu <joyceliu@yunify.com>

vendor/github.com/open-policy-agent/opa/internal/planner/rules.go

@@ -98,6 +98,7 @@ func (t *ruletrie) Rules() []*ast.Rule {
 		//
 		// and we're retrieving a.b, we want Rules() to include the rule body
 		// of a.b.c.
+		// FIXME: We need to go deeper than just immediate children (?)
 		for _, rs := range t.children {
 			if r := rs[len(rs)-1].rules; r != nil {
 				rules = append(rules, r...)
@@ -157,13 +158,50 @@ func (t *ruletrie) Lookup(key ast.Ref) *ruletrie {
 	return node
 }
 
+func (t *ruletrie) LookupShallowest(key ast.Ref) *ruletrie {
+	node := t
+	for _, elem := range key {
+		node = node.Get(elem.Value)
+		if node == nil {
+			return nil
+		}
+		if len(node.rules) > 0 {
+			return node
+		}
+	}
+	return node
+}
+
+// TODO: Collapse rules with overlapping extent to same node(?)
 func (t *ruletrie) LookupOrInsert(key ast.Ref) *ruletrie {
-	if val := t.Lookup(key); val != nil {
+	if val := t.LookupShallowest(key); val != nil {
+
 		return val
 	}
 	return t.Insert(key)
 }
 
+func (t *ruletrie) DescendantRules() []*ast.Rule {
+	if len(t.children) == 0 {
+		return t.rules
+	}
+
+	rules := make([]*ast.Rule, len(t.rules), len(t.rules)+len(t.children)) // could be too little
+	copy(rules, t.rules)
+
+	for _, cs := range t.children {
+		for _, c := range cs {
+			rules = append(rules, c.DescendantRules()...)
+		}
+	}
+
+	return rules
+}
+
+func (t *ruletrie) ChildrenCount() int {
+	return len(t.children)
+}
+
 func (t *ruletrie) Children() []ast.Value {
 	if t == nil {
 		return nil