+
background
bool
diff --git a/pkg/controllers/policycache/controller.go b/pkg/controllers/policycache/controller.go
index 3093b0ed51..a5993530b5 100644
--- a/pkg/controllers/policycache/controller.go
+++ b/pkg/controllers/policycache/controller.go
@@ -99,7 +99,12 @@ func (c *controller) reconcile(ctx context.Context, logger logr.Logger, key, nam
}
return err
}
- return c.cache.Set(key, policy, c.client.Discovery())
+ if policy.AdmissionProcessingEnabled() {
+ return c.cache.Set(key, policy, c.client.Discovery())
+ } else {
+ c.cache.Unset(key)
+ return nil
+ }
}
func (c *controller) loadPolicy(namespace, name string) (kyvernov1.PolicyInterface, error) {
diff --git a/pkg/controllers/webhook/controller.go b/pkg/controllers/webhook/controller.go
index aef354c08e..6d9091f000 100644
--- a/pkg/controllers/webhook/controller.go
+++ b/pkg/controllers/webhook/controller.go
@@ -628,12 +628,14 @@ func (c *controller) buildResourceMutatingWebhookConfiguration(ctx context.Conte
}
c.recordPolicyState(config.MutatingWebhookConfigurationName, policies...)
for _, p := range policies {
- spec := p.GetSpec()
- if spec.HasMutate() || spec.HasVerifyImages() {
- if spec.GetFailurePolicy(ctx) == kyvernov1.Ignore {
- c.mergeWebhook(ignore, p, false)
- } else {
- c.mergeWebhook(fail, p, false)
+ if p.AdmissionProcessingEnabled() {
+ spec := p.GetSpec()
+ if spec.HasMutate() || spec.HasVerifyImages() {
+ if spec.GetFailurePolicy(ctx) == kyvernov1.Ignore {
+ c.mergeWebhook(ignore, p, false)
+ } else {
+ c.mergeWebhook(fail, p, false)
+ }
}
}
}
@@ -750,12 +752,14 @@ func (c *controller) buildResourceValidatingWebhookConfiguration(ctx context.Con
}
c.recordPolicyState(config.ValidatingWebhookConfigurationName, policies...)
for _, p := range policies {
- spec := p.GetSpec()
- if spec.HasValidate() || spec.HasGenerate() || spec.HasMutate() || spec.HasVerifyImageChecks() || spec.HasVerifyManifests() {
- if spec.GetFailurePolicy(ctx) == kyvernov1.Ignore {
- c.mergeWebhook(ignore, p, true)
- } else {
- c.mergeWebhook(fail, p, true)
+ if p.AdmissionProcessingEnabled() {
+ spec := p.GetSpec()
+ if spec.HasValidate() || spec.HasGenerate() || spec.HasMutate() || spec.HasVerifyImageChecks() || spec.HasVerifyManifests() {
+ if spec.GetFailurePolicy(ctx) == kyvernov1.Ignore {
+ c.mergeWebhook(ignore, p, true)
+ } else {
+ c.mergeWebhook(fail, p, true)
+ }
}
}
}
diff --git a/pkg/validation/policy/validate.go b/pkg/validation/policy/validate.go
index 8ce0009ef9..68c90d4044 100644
--- a/pkg/validation/policy/validate.go
+++ b/pkg/validation/policy/validate.go
@@ -179,6 +179,14 @@ func Validate(policy, oldPolicy kyvernov1.PolicyInterface, client dclient.Interf
return warnings, err
}
}
+ if !policy.AdmissionProcessingEnabled() && !policy.BackgroundProcessingEnabled() {
+ return warnings, fmt.Errorf("disabling both admission and background processing is not allowed")
+ }
+ if !policy.AdmissionProcessingEnabled() {
+ if spec.HasMutate() || spec.HasGenerate() || spec.HasVerifyImages() {
+ return warnings, fmt.Errorf("disabling admission processing is only allowed with validation policies")
+ }
+ }
if err := immutableGenerateFields(policy, oldPolicy); err != nil {
return warnings, err
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/01-policy.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/01-policy.yaml
new file mode 100644
index 0000000000..57d0184b5b
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/01-policy.yaml
@@ -0,0 +1,10 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+apply:
+- file: policy-validate.yaml
+- file: policy-mutate.yaml
+ shouldFail: true
+- file: policy-generate.yaml
+ shouldFail: true
+- file: policy-verify-image.yaml
+ shouldFail: true
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/README.md b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/README.md
new file mode 100644
index 0000000000..610d979c5e
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/README.md
@@ -0,0 +1,7 @@
+## Description
+
+This test tries to create various policies with `admission` set to `false`.
+
+## Expected Behavior
+
+Policies containing mutation, image verification or generation rules should be rejected.
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-generate.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-generate.yaml
new file mode 100644
index 0000000000..c81b03bebc
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-generate.yaml
@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v2beta1
+kind: ClusterPolicy
+metadata:
+ name: generate
+spec:
+ validationFailureAction: Audit
+ admission: false
+ background: true
+ rules:
+ - name: generate
+ match:
+ any:
+ - resources:
+ kinds:
+ - Namespace
+ generate:
+ apiVersion: v1
+ kind: Secret
+ name: regcred
+ namespace: "{{request.object.metadata.name}}"
+ synchronize: true
+ clone:
+ namespace: default
+ name: regcred
\ No newline at end of file
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-mutate.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-mutate.yaml
new file mode 100644
index 0000000000..2095b90f5a
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-mutate.yaml
@@ -0,0 +1,22 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+ name: mutate
+spec:
+ validationFailureAction: Audit
+ admission: false
+ background: true
+ rules:
+ - name: mutate
+ match:
+ resources:
+ kinds:
+ - Pod
+ - Service
+ - ConfigMap
+ - Secret
+ mutate:
+ patchStrategicMerge:
+ metadata:
+ labels:
+ foo: bar
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-validate.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-validate.yaml
new file mode 100644
index 0000000000..49e9184d56
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-validate.yaml
@@ -0,0 +1,17 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+ name: validate
+spec:
+ validationFailureAction: Audit
+ admission: false
+ background: true
+ rules:
+ - name: validate
+ match:
+ any:
+ - resources:
+ kinds:
+ - Pod
+ validate:
+ deny: {}
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-verify-image.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-verify-image.yaml
new file mode 100644
index 0000000000..84169ccd46
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/admission-disabled/policy-verify-image.yaml
@@ -0,0 +1,26 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+ name: verify-image
+spec:
+ validationFailureAction: Audit
+ admission: false
+ background: true
+ rules:
+ - name: verify-image
+ match:
+ any:
+ - resources:
+ kinds:
+ - Pod
+ verifyImages:
+ - imageReferences:
+ - "ghcr.io/kyverno/test-verify-image:*"
+ attestors:
+ - entries:
+ - keys:
+ publicKeys: |-
+ -----BEGIN PUBLIC KEY-----
+ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
+ 5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
+ -----END PUBLIC KEY-----
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/01-policy.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/01-policy.yaml
new file mode 100644
index 0000000000..cc374cb853
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/01-policy.yaml
@@ -0,0 +1,5 @@
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+apply:
+- file: policy.yaml
+ shouldFail: true
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/README.md b/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/README.md
new file mode 100644
index 0000000000..7e39604238
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/README.md
@@ -0,0 +1,7 @@
+## Description
+
+This test tries to create a policy with both `admission` and `background` set to `false`.
+
+## Expected Behavior
+
+Policy should be rejected.
diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/policy.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/policy.yaml
new file mode 100644
index 0000000000..0370eaa4f7
--- /dev/null
+++ b/test/conformance/kuttl/policy-validation/cluster-policy/all-disabled/policy.yaml
@@ -0,0 +1,17 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+ name: all-disabled
+spec:
+ validationFailureAction: Audit
+ admission: false
+ background: false
+ rules:
+ - name: validate
+ match:
+ any:
+ - resources:
+ kinds:
+ - Pod
+ validate:
+ deny: {}
|