diff --git a/charts/kyverno-policies/Chart.yaml b/charts/kyverno-policies/Chart.yaml index cde155af7b..5eddb3def0 100644 --- a/charts/kyverno-policies/Chart.yaml +++ b/charts/kyverno-policies/Chart.yaml @@ -29,3 +29,5 @@ annotations: description: Support for customLabels, they were ignored up to now - kind: removed description: "Walk back change in PSS policy to send to to_upper" + - kind: fixed + description: Skip DELETE requests on policies using deny statements diff --git a/charts/kyverno-policies/ci/test-preconditions-values.yaml b/charts/kyverno-policies/ci/test-preconditions-values.yaml index df4e8e9d1f..a23ffa3243 100644 --- a/charts/kyverno-policies/ci/test-preconditions-values.yaml +++ b/charts/kyverno-policies/ci/test-preconditions-values.yaml @@ -12,8 +12,18 @@ policyPreconditions: - key: "{{ request.object.metadata.name }}" operator: NotEquals value: "dcgm-exporter*" + disallow-capabilities: + all: + - key: "{{ request.object.metadata.name }}" + operator: NotEquals + value: "dcgm-exporter*" adding-capabilities-strict: all: - key: "{{ request.object.metadata.name }}" operator: NotEquals value: "dcgm-exporter*" + restrict-volume-types: + all: + - key: "{{ request.object.metadata.name }}" + operator: NotEquals + value: "dcgm-exporter*" diff --git a/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml b/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml index 9bb70d2da6..993a7c776f 100644 --- a/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml +++ b/charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml @@ -43,9 +43,26 @@ spec: exclude: {{- toYaml . | nindent 8 }} {{- end }} - {{- with index .Values "policyPreconditions" $name }} + {{- $preconditions := index .Values "policyPreconditions" $name }} + {{- if $preconditions }} + {{- with $preconditions }} preconditions: - {{- toYaml . | nindent 8 }} + {{- if .all }} + all: + - key: "{{`{{ request.operation || 'BACKGROUND' }}`}}" + operator: NotEquals + value: DELETE + {{- toYaml .all | nindent 8 }} + {{- else }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + {{- else }} + preconditions: + all: + - key: "{{`{{ request.operation || 'BACKGROUND' }}`}}" + operator: NotEquals + value: DELETE {{- end }} validate: message: >- diff --git a/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml b/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml index 28180a7f93..f5e221c70b 100644 --- a/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml +++ b/charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml @@ -45,9 +45,26 @@ spec: exclude: {{- toYaml . | nindent 8 }} {{- end }} - {{- with index .Values "policyPreconditions" $name }} + {{- $preconditions := index .Values "policyPreconditions" $name }} + {{- if $preconditions }} + {{- with $preconditions }} preconditions: - {{- toYaml . | nindent 8 }} + {{- if .all }} + all: + - key: "{{`{{ request.operation || 'BACKGROUND' }}`}}" + operator: NotEquals + value: DELETE + {{- toYaml .all | nindent 8 }} + {{- else }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- end }} + {{- else }} + preconditions: + all: + - key: "{{`{{ request.operation || 'BACKGROUND' }}`}}" + operator: NotEquals + value: DELETE {{- end }} validate: message: >-