diff --git a/pkg/policy/validate.go b/pkg/policy/validate.go index d3817d4d27..689efe030a 100644 --- a/pkg/policy/validate.go +++ b/pkg/policy/validate.go @@ -505,11 +505,29 @@ func ruleForbiddenSectionsHaveVariables(rule *kyvernov1.Rule) error { // hasVariables - check for variables in the policy func hasVariables(policy kyvernov1.PolicyInterface) [][]string { + policy = cleanup(policy) policyRaw, _ := json.Marshal(policy) matches := regex.RegexVariables.FindAllStringSubmatch(string(policyRaw), -1) return matches } +func cleanup(policy kyvernov1.PolicyInterface) kyvernov1.PolicyInterface { + ann := policy.GetAnnotations() + if ann != nil { + ann["kubectl.kubernetes.io/last-applied-configuration"] = "" + policy.SetAnnotations(ann) + } + if policy.GetNamespace() == "" { + pol := policy.(*kyvernov1.ClusterPolicy) + pol.Status.Autogen.Rules = nil + return pol + } else { + pol := policy.(*kyvernov1.Policy) + pol.Status.Autogen.Rules = nil + return pol + } +} + func jsonPatchPathHasVariables(patch string) error { jsonPatch, err := yaml.ToJSON([]byte(patch)) if err != nil { diff --git a/pkg/policy/validate_test.go b/pkg/policy/validate_test.go index 58fd74f583..2e3aec08a7 100644 --- a/pkg/policy/validate_test.go +++ b/pkg/policy/validate_test.go @@ -1085,7 +1085,7 @@ func Test_Namespced_Policy(t *testing.T) { } `) - var policy *kyverno.ClusterPolicy + var policy *kyverno.Policy err := json.Unmarshal(rawPolicy, &policy) assert.NilError(t, err) diff --git a/pkg/utils/yaml/loadpolicy.go b/pkg/utils/yaml/loadpolicy.go index 1cf79c7f2c..3087e081bb 100644 --- a/pkg/utils/yaml/loadpolicy.go +++ b/pkg/utils/yaml/loadpolicy.go @@ -49,26 +49,31 @@ func GetPolicy(bytes []byte) (policies []kyvernov1.PolicyInterface, err error) { } func addPolicy(policies []kyvernov1.PolicyInterface, us *unstructured.Unstructured) ([]kyvernov1.PolicyInterface, error) { - policy := &kyvernov1.ClusterPolicy{} + var policy kyvernov1.PolicyInterface + if us.GetKind() == "ClusterPolicy" { + policy = &kyvernov1.ClusterPolicy{} + } else { + policy = &kyvernov1.Policy{} + } if err := runtime.DefaultUnstructuredConverter.FromUnstructured(us.Object, policy); err != nil { return nil, fmt.Errorf("failed to decode policy: %v", err) } - if policy.TypeMeta.Kind == "" { + if policy.GetKind() == "" { log.V(3).Info("skipping file as policy.TypeMeta.Kind not found") return policies, nil } - if policy.TypeMeta.Kind != "ClusterPolicy" && policy.TypeMeta.Kind != "Policy" { - return nil, fmt.Errorf("resource %s/%s is not a Policy or a ClusterPolicy", policy.Kind, policy.Name) + if policy.GetKind() != "ClusterPolicy" && policy.GetKind() != "Policy" { + return nil, fmt.Errorf("resource %s/%s is not a Policy or a ClusterPolicy", policy.GetKind(), policy.GetName()) } - if policy.Kind == "Policy" { - if policy.Namespace == "" { - policy.Namespace = "default" + if policy.GetKind() == "Policy" { + if policy.GetNamespace() == "" { + policy.SetNamespace("default") } } else { - policy.Namespace = "" + policy.SetNamespace("") } policies = append(policies, policy) return policies, nil diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/01-policy.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/01-policy.yaml new file mode 100644 index 0000000000..b20ef0bd7d --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/01-policy.yaml @@ -0,0 +1,6 @@ +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +apply: +- policy.yaml +assert: +- policy-assert.yaml \ No newline at end of file diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/02-policy.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/02-policy.yaml new file mode 100644 index 0000000000..585b404599 --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/02-policy.yaml @@ -0,0 +1,5 @@ +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +apply: +- file: policy-update.yaml + shouldFail: false diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/README.md b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/README.md new file mode 100644 index 0000000000..3a5e1c3007 --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/README.md @@ -0,0 +1,11 @@ +## Description + +This test ensures the background policy update that does not contain admission userinfo variables should be allowed. + +## Expected Behavior + +The policy update should pass through. + +## Related Issue + +https://github.com/kyverno/kyverno/issues/6938 diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy-assert.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy-assert.yaml new file mode 100644 index 0000000000..277982879c --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy-assert.yaml @@ -0,0 +1,9 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: background-variables-update +status: + conditions: + - reason: Succeeded + status: "True" + type: Ready \ No newline at end of file diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy-update.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy-update.yaml new file mode 100644 index 0000000000..3d67a52e6f --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy-update.yaml @@ -0,0 +1,20 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: background-variables-update +spec: + validationFailureAction: Audit + background: true + rules: + - name: ns-vars-userinfo + match: + any: + - resources: + kinds: + - Pod + validate: + message: The `owner` label is required for all Namespaces. + pattern: + metadata: + labels: + owner: foo \ No newline at end of file diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy.yaml new file mode 100644 index 0000000000..90e89fba89 --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/background-variables-update/policy.yaml @@ -0,0 +1,20 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: background-variables-update +spec: + validationFailureAction: Audit + background: false + rules: + - name: ns-vars-userinfo + match: + any: + - resources: + kinds: + - Pod + validate: + message: The `owner` label is required for all Namespaces. + pattern: + metadata: + labels: + owner: "{{request.userInfo}}" \ No newline at end of file