diff --git a/definitions/install.yaml b/definitions/install.yaml index 1e44e139f7..b16430045f 100644 --- a/definitions/install.yaml +++ b/definitions/install.yaml @@ -227,7 +227,7 @@ spec: containers: - name: kyverno image: nirmata/kyverno:latest - args: ["--filterK8Resources","[Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*]Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][*,kyverno,*]"] + args: ["--filterK8Resources","[Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*][Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][*,kyverno,*]"] ports: - containerPort: 443 securityContext: diff --git a/pkg/webhooks/webhookManager.go b/pkg/webhooks/webhookManager.go index 94f2eece36..118d31a4f8 100644 --- a/pkg/webhooks/webhookManager.go +++ b/pkg/webhooks/webhookManager.go @@ -45,22 +45,13 @@ func (ws *WebhookServer) registerWebhookConfigurations(policy v1alpha1.Policy) e } func (ws *WebhookServer) deregisterWebhookConfigurations(policy v1alpha1.Policy) error { - pt := none glog.V(3).Infof("Retreiving policy type for %s\n", policy.Name) - for _, rule := range policy.Spec.Rules { - if rule.Validation != nil { - pt = pt | validate - } + pt := GetPolicyType([]*v1alpha1.Policy{&policy}, "") - if rule.Mutation != nil { - pt = pt | mutate - } - } + glog.V(3).Infof("Policy to be deleted type==%v\n", pt) - glog.V(3).Infof("Scanning policy type==%v\n", pt) - - existPolicyType := ws.isPolicyTypeExist(pt, policy.Name) + existPolicyType := ws.getExistingPolicyType(policy.Name) glog.V(3).Infof("Found existing policy type==%v\n", existPolicyType) switch existPolicyType { @@ -84,17 +75,24 @@ func (ws *WebhookServer) deregisterWebhookConfigurations(policy v1alpha1.Policy) return nil } -func (ws *WebhookServer) isPolicyTypeExist(pt policyType, policyName string) policyType { - ptype := none +func (ws *WebhookServer) getExistingPolicyType(policyName string) policyType { policies, err := ws.policyLister.List(labels.NewSelector()) if err != nil { glog.Errorf("Failed to get policy list") } - for _, p := range policies { - if p.Name == policyName { - glog.Infof("Skipping policy type check on %s\n", policyName) + return GetPolicyType(policies, policyName) +} + +// GetPolicyType get the type of policies +// excludes is the policy name to be skipped +func GetPolicyType(policyList []*v1alpha1.Policy, excludes string) policyType { + ptype := none + + for _, p := range policyList { + if p.Name == excludes { + glog.Infof("Skipping policy type check on %s\n", excludes) continue }