mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity

fix: namespaced policy not validated in engine (#4653)

Browse source 
* fix: namespaced policy not validated in engine

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

* fix test

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

Signed-off-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
Co-authored-by: Prateek Pandey <prateek.pandey@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2022-09-26 06:47:37 +02:00 committed by GitHub
parent e8839a3ff7
commit 4d7e1281de
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
pkg/engine/validation.go
View file

@ -99,6 +99,16 @@ func validateResource(log logr.Logger, ctx *PolicyContext) *response.EngineRespo
matchCount := 0
applyRules := ctx.Policy.GetSpec().GetApplyRules()
if ctx.Policy.IsNamespaced() {
polNs := ctx.Policy.GetNamespace()
if ctx.NewResource.Object != nil && (ctx.NewResource.GetNamespace() != polNs || ctx.NewResource.GetNamespace() == "") {
return resp
}
if ctx.OldResource.Object != nil && (ctx.OldResource.GetNamespace() != polNs || ctx.OldResource.GetNamespace() == "") {
return resp
}
}
for i := range rules {
rule := &rules[i]
hasValidate := rule.HasValidate()

3
test/cli/test/jmespath-brackets/policy.yaml
View file

@ -25,10 +25,9 @@ spec:
test: ""
---
apiVersion: kyverno.io/v1
kind: Policy
kind: ClusterPolicy
metadata:
name: namespace-validation
namespace: kyverno
spec:
validationFailureAction: enforce
background: false