mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-04-08 18:15:48 +00:00
Code Activity

fix: disallow all in autogen annotation (#3537)

Browse source 
Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
This commit is contained in:
Charles-Edouard Brétéché 2022-04-04 18:10:57 +02:00 • committed by GitHub
parent d4a71a53c2
commit 1cee8894e0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 42 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
api/kyverno/v1/clusterpolicy_test.go
View file

@ -38,3 +38,17 @@ func Test_ClusterPolicy_IsNamespaced(t *testing.T) {
assert.Equal(t, namespaced.IsNamespaced(), true)
assert.Equal(t, notNamespaced.IsNamespaced(), false)
}
func Test_ClusterPolicy_Autogen_All(t *testing.T) {
subject := ClusterPolicy{
ObjectMeta: metav1.ObjectMeta{
Name: "policy",
Annotations: map[string]string{
PodControllersAnnotation: "all",
},
},
}
errs := subject.Validate(nil)
assert.Equal(t, len(errs), 1)
assert.Equal(t, errs[0].Error(), "metadata.annotations: Forbidden: Autogen annotation does not support 'all' anymore, remove the annotation or set it to a valid value")
}

1
api/kyverno/v1/clusterpolicy_types.go
View file

@ -95,6 +95,7 @@ func (p *ClusterPolicy) IsReady() bool {
// namespaced means that the policy is bound to a namespace and therefore
// should not filter/generate cluster wide resources.
func (p *ClusterPolicy) Validate(clusterResources sets.String) (errs field.ErrorList) {
errs = append(errs, ValidateAutogenAnnotation(field.NewPath("metadata").Child("annotations"), p.GetAnnotations())...)
errs = append(errs, ValidatePolicyName(field.NewPath("name"), p.Name)...)
errs = append(errs, p.Spec.Validate(field.NewPath("spec"), p.IsNamespaced(), clusterResources)...)
return errs

15
api/kyverno/v1/policy_test.go
View file

@ -37,3 +37,18 @@ func Test_Policy_IsNamespaced(t *testing.T) {
assert.Equal(t, namespaced.IsNamespaced(), false)
assert.Equal(t, notNamespaced.IsNamespaced(), false)
}
func Test_Policy_Autogen_All(t *testing.T) {
subject := Policy{
ObjectMeta: metav1.ObjectMeta{
Name: "policy",
Namespace: "abcd",
Annotations: map[string]string{
PodControllersAnnotation: "all",
},
},
}
errs := subject.Validate(nil)
assert.Equal(t, len(errs), 1)
assert.Equal(t, errs[0].Error(), "metadata.annotations: Forbidden: Autogen annotation does not support 'all' anymore, remove the annotation or set it to a valid value")
}

1
api/kyverno/v1/policy_types.go
View file

@ -96,6 +96,7 @@ func (p *Policy) IsReady() bool {
// namespaced means that the policy is bound to a namespace and therefore
// should not filter/generate cluster wide resources.
func (p *Policy) Validate(clusterResources sets.String) (errs field.ErrorList) {
errs = append(errs, ValidateAutogenAnnotation(field.NewPath("metadata").Child("annotations"), p.GetAnnotations())...)
errs = append(errs, ValidatePolicyName(field.NewPath("name"), p.Name)...)
errs = append(errs, p.Spec.Validate(field.NewPath("spec"), p.IsNamespaced(), clusterResources)...)
return errs

11
api/kyverno/v1/utils.go
View file

@ -29,6 +29,17 @@ func ToJSON(in apiextensions.JSON) *apiextv1.JSON {
return &out
}
// ValidatePolicyName validates policy name
func ValidateAutogenAnnotation(path *field.Path, annotations map[string]string) (errs field.ErrorList) {
value, ok := annotations[PodControllersAnnotation]
if ok {
if value == "all" {
errs = append(errs, field.Forbidden(path, "Autogen annotation does not support 'all' anymore, remove the annotation or set it to a valid value"))
}
}
return errs
}
// ValidatePolicyName validates policy name
func ValidatePolicyName(path *field.Path, name string) (errs field.ErrorList) {
// policy name is stored in the label of the report change request