diff --git a/pkg/webhooks/utils/block.go b/pkg/webhooks/utils/block.go index 78622ca819..d3b19c6d62 100644 --- a/pkg/webhooks/utils/block.go +++ b/pkg/webhooks/utils/block.go @@ -43,7 +43,7 @@ func GetBlockedMessages(engineResponses []engineapi.EngineResponse) string { for _, er := range engineResponses { ruleToReason := make(map[string]string) for _, rule := range er.PolicyResponse.Rules { - if rule.Status() != engineapi.RuleStatusPass { + if rule.Status() != engineapi.RuleStatusPass && rule.Status() != engineapi.RuleStatusSkip { ruleToReason[rule.Name()] = rule.Message() } } diff --git a/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/README.md b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/README.md new file mode 100644 index 0000000000..d23c4e831b --- /dev/null +++ b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/README.md @@ -0,0 +1,11 @@ +## Description + +This test ensures that the policies that are skipped because of preconditions aren't included in admission requests denial responses + +## Expected Behavior + +The resource will be blocked because it violates the `require-ns-owner-label` policy. As a result, its message will only be displayed. + +## Reference Issue(s) + +#9502 diff --git a/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/chainsaw-test.yaml b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/chainsaw-test.yaml new file mode 100644 index 0000000000..c1b16a36e8 --- /dev/null +++ b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/chainsaw-test.yaml @@ -0,0 +1,35 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + creationTimestamp: null + name: check-message-upon-resource-failure +spec: + steps: + - name: step-01 + try: + - apply: + file: policy-1.yaml + - assert: + file: policy-assert1.yaml + - name: step-02 + try: + - apply: + file: policy-2.yaml + - assert: + file: policy-assert2.yaml + - name: step-03 + try: + - script: + content: kubectl apply -f resource.yaml + check: + # This check ensures the contents of stderr are exactly as shown. + ($stderr): |- + Error from server: error when creating "resource.yaml": admission webhook "validate.kyverno.svc-fail" denied the request: + + resource Namespace//asdfhl was blocked due to the following policies + + require-ns-owner-label: + check-for-namespace-owner-label: 'validation error: The label `uw.systems/owner` + is required. Check policy at https://github.com/utilitywarehouse/system-manifests/tree/master/kyverno/policies/namespaces/require-ns-owner-label.yaml + for allowed label values. rule check-for-namespace-owner-label failed at path + /metadata/labels/uw.systems/owner/' diff --git a/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-1.yaml b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-1.yaml new file mode 100644 index 0000000000..6630214b36 --- /dev/null +++ b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-1.yaml @@ -0,0 +1,46 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: require-ns-owner-label +spec: + validationFailureAction: Enforce + background: false + rules: + - name: check-for-namespace-owner-label + match: + any: + - resources: + kinds: + - Namespace + validate: + message: >- + The label `uw.systems/owner` is required. Check policy at + https://github.com/utilitywarehouse/system-manifests/tree/master/kyverno/policies/namespaces/require-ns-owner-label.yaml + for allowed label values. + pattern: + metadata: + labels: + uw.systems/owner: >- + account-platform + |bill + |billing + |btg-operations + |btg-security + |cbc + |contact-channels + |crm + |customer + |customer-platform + |customer-support + |data + |data-infra + |dev-enablement + |digital-support + |energy + |iam + |insurance + |partner + |payment + |system + |telecom + |unicom diff --git a/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-2.yaml b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-2.yaml new file mode 100644 index 0000000000..85e0f31416 --- /dev/null +++ b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-2.yaml @@ -0,0 +1,28 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: preconditions-check +spec: + validationFailureAction: Enforce + background: false + rules: + - name: check-label + match: + any: + - resources: + kinds: + - Namespace + preconditions: + all: + - key: "{{ request.object.metadata.annotations.foo || '' }}" + operator: Equals + value: foo + validate: + message: >- + The label `uw.systems/owner` is required. Check policy at + https://github.com/utilitywarehouse/system-manifests/tree/master/kyverno/policies/namespaces/require-ns-owner-label.yaml + for allowed label values. + pattern: + metadata: + labels: + uw.systems/foo: bar diff --git a/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert1.yaml b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert1.yaml new file mode 100644 index 0000000000..7041619c19 --- /dev/null +++ b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert1.yaml @@ -0,0 +1,9 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: require-ns-owner-label +status: + conditions: + - reason: Succeeded + status: "True" + type: Ready \ No newline at end of file diff --git a/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert2.yaml b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert2.yaml new file mode 100644 index 0000000000..84062db7e0 --- /dev/null +++ b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/policy-assert2.yaml @@ -0,0 +1,9 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: preconditions-check +status: + conditions: + - reason: Succeeded + status: "True" + type: Ready \ No newline at end of file diff --git a/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/resource.yaml b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/resource.yaml new file mode 100644 index 0000000000..3f9946118a --- /dev/null +++ b/test/conformance/chainsaw/validate/clusterpolicy/cornercases/check-message-upon-resource-failure/resource.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: asdfhl + labels: + app-type: corp + annotations: + cloud.platformzero.com/serviceClass: "xl2" \ No newline at end of file