mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-01-20 18:52:16 +00:00
Code Activity

Merge pull request #2112 from realshuting/bugfixes/inconsistent-polr

Browse source 
Fix inconsistent polr for audit policy
This commit is contained in:
Pooja Singh 2021-07-09 18:12:46 +05:30 • committed by GitHub
commit 20ac2a6556
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkg/policymutation/policymutation.go
View file

@ -267,7 +267,7 @@ func CanAutoGen(policy *kyverno.ClusterPolicy, log logr.Logger) (applyAutoGen bo
if match.ResourceDescription.Name != "" || match.ResourceDescription.Selector != nil ||
exclude.ResourceDescription.Name != "" || exclude.ResourceDescription.Selector != nil {
log.Info("skip generating rule on pod controllers: Name / Selector in resource description may not be applicable.", "rule", rule.Name)
log.V(3).Info("skip generating rule on pod controllers: Name / Selector in resource description may not be applicable.", "rule", rule.Name)
return false, "none"
}

10
pkg/webhooks/server.go
View file

@ -443,13 +443,6 @@ func (ws *WebhookServer) resourceValidation(request *v1beta1.AdmissionRequest) *
// Get namespace policies from the cache for the requested resource namespace
nsPolicies := ws.pCache.GetPolicyObject(policycache.ValidateEnforce, request.Kind.Kind, request.Namespace)
policies = append(policies, nsPolicies...)
if len(policies) == 0 {
// push admission request to audit handler, this won't block the admission request
ws.auditHandler.Add(request.DeepCopy())
logger.V(4).Info("no enforce validation policies; returning AdmissionResponse.Allowed: true")
return &v1beta1.AdmissionResponse{Allowed: true}
}
var roles, clusterRoles []string
var err error
@ -501,6 +494,9 @@ func (ws *WebhookServer) resourceValidation(request *v1beta1.AdmissionRequest) *
}
}
// push admission request to audit handler, this won't block the admission request
ws.auditHandler.Add(request.DeepCopy())
return &v1beta1.AdmissionResponse{
Allowed: true,
Result: &metav1.Status{