diff --git a/pkg/controllers/validatingadmissionpolicy-generate/controller.go b/pkg/controllers/validatingadmissionpolicy-generate/controller.go index 44e7c82bdf..2ff42d52f0 100644 --- a/pkg/controllers/validatingadmissionpolicy-generate/controller.go +++ b/pkg/controllers/validatingadmissionpolicy-generate/controller.go @@ -297,6 +297,10 @@ func (c *controller) buildValidatingAdmissionPolicyBinding(vapbinding *admission return nil } +func constructVapBindingName(vapName string) string { + return vapName + "-binding" +} + func (c *controller) reconcile(ctx context.Context, logger logr.Logger, key, namespace, name string) error { policy, err := c.getClusterPolicy(name) if err != nil { @@ -326,34 +330,50 @@ func (c *controller) reconcile(ctx context.Context, logger logr.Logger, key, nam return nil } + vapName := policy.GetName() + vapBindingName := constructVapBindingName(vapName) + + observedVAP, vapErr := c.getValidatingAdmissionPolicy(vapName) + observedVAPbinding, vapBindingErr := c.getValidatingAdmissionPolicyBinding(vapBindingName) if ok, msg := canGenerateVAP(spec); !ok { + // delete the ValidatingAdmissionPolicy if exist + if vapErr == nil { + err = c.client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicies().Delete(ctx, vapName, metav1.DeleteOptions{}) + if err != nil { + return err + } + } + // delete the ValidatingAdmissionPolicyBinding if exist + if vapBindingErr == nil { + err = c.client.AdmissionregistrationV1alpha1().ValidatingAdmissionPolicyBindings().Delete(ctx, vapBindingName, metav1.DeleteOptions{}) + if err != nil { + return err + } + } c.updateClusterPolicyStatus(ctx, *policy, false, msg) return nil } - polName := policy.GetName() - observedVAP, err := c.getValidatingAdmissionPolicy(polName) - if err != nil { - if !apierrors.IsNotFound(err) { - c.updateClusterPolicyStatus(ctx, *policy, false, err.Error()) - return err + if vapErr != nil { + if !apierrors.IsNotFound(vapErr) { + c.updateClusterPolicyStatus(ctx, *policy, false, vapErr.Error()) + return vapErr } observedVAP = &admissionregistrationv1alpha1.ValidatingAdmissionPolicy{ ObjectMeta: metav1.ObjectMeta{ - Name: polName, + Name: vapName, }, } } - observedVAPbinding, err := c.getValidatingAdmissionPolicyBinding(polName + "-binding") - if err != nil { - if !apierrors.IsNotFound(err) { - c.updateClusterPolicyStatus(ctx, *policy, false, err.Error()) - return err + if vapBindingErr != nil { + if !apierrors.IsNotFound(vapBindingErr) { + c.updateClusterPolicyStatus(ctx, *policy, false, vapBindingErr.Error()) + return vapBindingErr } observedVAPbinding = &admissionregistrationv1alpha1.ValidatingAdmissionPolicyBinding{ ObjectMeta: metav1.ObjectMeta{ - Name: polName + "-binding", + Name: vapBindingName, }, } } diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/01-policy.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/01-policy.yaml new file mode 100644 index 0000000000..b088ed7601 --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/01-policy.yaml @@ -0,0 +1,6 @@ +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +apply: +- policy.yaml +assert: +- policy-assert.yaml diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/02-validatingadmissionpolicy.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/02-validatingadmissionpolicy.yaml new file mode 100644 index 0000000000..46046dc432 --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/02-validatingadmissionpolicy.yaml @@ -0,0 +1,5 @@ +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +assert: +- validatingadmissionpolicy.yaml +- validatingadmissionpolicybinding.yaml diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/03-update-policy.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/03-update-policy.yaml new file mode 100644 index 0000000000..39fdbd9529 --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/03-update-policy.yaml @@ -0,0 +1,6 @@ +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +apply: +- updated-policy.yaml +assert: +- policy-assert.yaml diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/04-check-validatingadmissionpolicy.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/04-check-validatingadmissionpolicy.yaml new file mode 100644 index 0000000000..e0f0473f3d --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/04-check-validatingadmissionpolicy.yaml @@ -0,0 +1,5 @@ +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +error: +- validatingadmissionpolicy.yaml +- validatingadmissionpolicybinding.yaml diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/policy-assert.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/policy-assert.yaml new file mode 100644 index 0000000000..d7a1d096eb --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/policy-assert.yaml @@ -0,0 +1,9 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: disallow-host-path-cel +status: + conditions: + - reason: Succeeded + status: "True" + type: Ready diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/policy.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/policy.yaml new file mode 100644 index 0000000000..c268493f9e --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/policy.yaml @@ -0,0 +1,23 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: disallow-host-path-cel +spec: + validationFailureAction: Enforce + background: false + rules: + - name: host-path-cel + match: + any: + - resources: + kinds: + - Deployment + - StatefulSet + operations: + - CREATE + - UPDATE + validate: + cel: + expressions: + - expression: "!has(object.spec.template.spec.volumes) || object.spec.template.spec.volumes.all(volume, !has(volume.hostPath))" + message: "HostPath volumes are forbidden. The field spec.template.spec.volumes[*].hostPath must be unset." diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/updated-policy.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/updated-policy.yaml new file mode 100644 index 0000000000..30fcd114c4 --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/updated-policy.yaml @@ -0,0 +1,25 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: disallow-host-path-cel +spec: + validationFailureAction: Enforce + background: true + rules: + - name: host-path-cel + match: + any: + - resources: + kinds: + - Deployment + - StatefulSet + operations: + - CREATE + - UPDATE + namespaces: + - prod + validate: + cel: + expressions: + - expression: "!has(object.spec.template.spec.volumes) || object.spec.template.spec.volumes.all(volume, !has(volume.hostPath))" + message: "HostPath volumes are forbidden. The field spec.template.spec.volumes[*].hostPath must be unset." diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/validatingadmissionpolicy.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/validatingadmissionpolicy.yaml new file mode 100644 index 0000000000..eae2295c81 --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/validatingadmissionpolicy.yaml @@ -0,0 +1,29 @@ +apiVersion: admissionregistration.k8s.io/v1alpha1 +kind: ValidatingAdmissionPolicy +metadata: + labels: + app.kubernetes.io/managed-by: kyverno + name: disallow-host-path-cel + ownerReferences: + - apiVersion: kyverno.io/v1 + kind: ClusterPolicy + name: disallow-host-path-cel +spec: + failurePolicy: Fail + matchConstraints: + resourceRules: + - apiGroups: + - apps + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - deployments + - statefulsets + validations: + - expression: '!has(object.spec.template.spec.volumes) || object.spec.template.spec.volumes.all(volume, + !has(volume.hostPath))' + message: HostPath volumes are forbidden. The field spec.template.spec.volumes[*].hostPath + must be unset. diff --git a/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/validatingadmissionpolicybinding.yaml b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/validatingadmissionpolicybinding.yaml new file mode 100644 index 0000000000..bb58d5a1a3 --- /dev/null +++ b/test/conformance/kuttl/generate-validating-admission-policy/clusterpolicy/cornercases/check-deletion-of-vaps-after-modifying-kyverno-policy/validatingadmissionpolicybinding.yaml @@ -0,0 +1,13 @@ +apiVersion: admissionregistration.k8s.io/v1alpha1 +kind: ValidatingAdmissionPolicyBinding +metadata: + labels: + app.kubernetes.io/managed-by: kyverno + name: disallow-host-path-cel-binding + ownerReferences: + - apiVersion: kyverno.io/v1 + kind: ClusterPolicy + name: disallow-host-path-cel +spec: + policyName: disallow-host-path-cel + validationActions: [Deny]