diff --git a/pkg/validatingadmissionpolicy/builder.go b/pkg/validatingadmissionpolicy/builder.go index f499e335d1..0ab6280c0e 100644 --- a/pkg/validatingadmissionpolicy/builder.go +++ b/pkg/validatingadmissionpolicy/builder.go @@ -115,7 +115,20 @@ func translateResource(discoveryClient dclient.IDiscovery, matchResources *admis } matchResources.ResourceRules = *rules - matchResources.NamespaceSelector = res.NamespaceSelector + if len(res.Namespaces) > 0 { + namespaceSelector := &metav1.LabelSelector{ + MatchExpressions: []metav1.LabelSelectorRequirement{ + { + Key: "kubernetes.io/metadata.name", + Operator: "In", + Values: res.Namespaces, + }, + }, + } + matchResources.NamespaceSelector = namespaceSelector + } else { + matchResources.NamespaceSelector = res.NamespaceSelector + } matchResources.ObjectSelector = res.Selector return nil } diff --git a/pkg/validatingadmissionpolicy/kyvernopolicy_checker.go b/pkg/validatingadmissionpolicy/kyvernopolicy_checker.go index 02593df538..73d727b4c4 100644 --- a/pkg/validatingadmissionpolicy/kyvernopolicy_checker.go +++ b/pkg/validatingadmissionpolicy/kyvernopolicy_checker.go @@ -90,8 +90,8 @@ func CanGenerateVAP(spec *kyvernov1.Spec) (bool, string) { func checkResources(resource kyvernov1.ResourceDescription) (bool, string) { var msg string - if len(resource.Namespaces) != 0 || len(resource.Annotations) != 0 { - msg = "skip generating ValidatingAdmissionPolicy: Namespaces / Annotations in resource description is not applicable." + if len(resource.Annotations) != 0 { + msg = "skip generating ValidatingAdmissionPolicy: Annotations in resource description is not applicable." return false, msg } if resource.Name != "" && wildcard.ContainsWildcard(resource.Name) { diff --git a/pkg/validatingadmissionpolicy/kyvernopolicy_checker_test.go b/pkg/validatingadmissionpolicy/kyvernopolicy_checker_test.go index da46342416..2f8cfa8d28 100644 --- a/pkg/validatingadmissionpolicy/kyvernopolicy_checker_test.go +++ b/pkg/validatingadmissionpolicy/kyvernopolicy_checker_test.go @@ -30,7 +30,7 @@ func Test_Check_Resources(t *testing.T) { ] } `), - expected: false, + expected: true, }, { name: "resource-with-annotations", diff --git a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/chainsaw-test.yaml b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/chainsaw-test.yaml similarity index 93% rename from test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/chainsaw-test.yaml rename to test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/chainsaw-test.yaml index 35bd7366a3..6ccfb4ee4f 100755 --- a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/chainsaw-test.yaml +++ b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/chainsaw-test.yaml @@ -13,7 +13,7 @@ spec: file: policy-assert.yaml - name: step-02 try: - - error: + - assert: file: validatingadmissionpolicy.yaml - - error: + - assert: file: validatingadmissionpolicybinding.yaml diff --git a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/policy-assert.yaml b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/policy-assert.yaml similarity index 90% rename from test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/policy-assert.yaml rename to test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/policy-assert.yaml index 2ec6beea96..1a80b3edbb 100644 --- a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/policy-assert.yaml +++ b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/policy-assert.yaml @@ -8,5 +8,5 @@ status: status: "True" type: Ready validatingadmissionpolicy: - generated: false + generated: true \ No newline at end of file diff --git a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/policy.yaml b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/policy.yaml similarity index 89% rename from test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/policy.yaml rename to test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/policy.yaml index adad14cc25..01665b6be1 100644 --- a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/policy.yaml +++ b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/policy.yaml @@ -10,12 +10,13 @@ spec: any: - resources: kinds: - - Deployment + - Deployment operations: - CREATE - UPDATE namespaces: - - prod + - production + - staging validate: cel: expressions: diff --git a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicy.yaml b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicy.yaml new file mode 100644 index 0000000000..00a0803760 --- /dev/null +++ b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicy.yaml @@ -0,0 +1,35 @@ +apiVersion: admissionregistration.k8s.io/v1alpha1 +kind: ValidatingAdmissionPolicy +metadata: + labels: + app.kubernetes.io/managed-by: kyverno + name: disallow-host-path-t4 + ownerReferences: + - apiVersion: kyverno.io/v1 + kind: ClusterPolicy + name: disallow-host-path-t4 +spec: + failurePolicy: Fail + matchConstraints: + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - production + - staging + resourceRules: + - apiGroups: + - apps + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - deployments + validations: + - expression: '!has(object.spec.template.spec.volumes) || object.spec.template.spec.volumes.all(volume, + !has(volume.hostPath))' + message: HostPath volumes are forbidden. The field spec.template.spec.volumes[*].hostPath + must be unset. diff --git a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicybinding.yaml b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicybinding.yaml similarity index 50% rename from test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicybinding.yaml rename to test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicybinding.yaml index 26629c6e7a..d9a7084232 100644 --- a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicybinding.yaml +++ b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicybinding.yaml @@ -4,4 +4,10 @@ metadata: labels: app.kubernetes.io/managed-by: kyverno name: disallow-host-path-t4-binding -spec: {} + ownerReferences: + - apiVersion: kyverno.io/v1 + kind: ClusterPolicy + name: disallow-host-path-t4 +spec: + policyName: disallow-host-path-t4 + validationActions: [Audit, Warn] diff --git a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicy.yaml b/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicy.yaml deleted file mode 100644 index 4ac31e925c..0000000000 --- a/test/conformance/chainsaw/generate-validating-admission-policy/clusterpolicy/standard/skip-generate/cpol-match-resource-in-specific-namespace/validatingadmissionpolicy.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: admissionregistration.k8s.io/v1alpha1 -kind: ValidatingAdmissionPolicy -metadata: - labels: - app.kubernetes.io/managed-by: kyverno - name: disallow-host-path-t4 -spec: {}