mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

744 only user requests will be denied

Browse source
This commit is contained in:
shravan 2020-05-07 14:18:42 +05:30
parent 5ec300a12d
commit 6f01bb4d59
2 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
pkg/engine/validation.go
View file

@ -52,12 +52,15 @@ func Validate(policyContext PolicyContext) (resp response.EngineResponse) {
endResultResponse(logger, &resp, startTime)
}()
// If request is delete, newR will be empty
if reflect.DeepEqual(newR, unstructured.Unstructured{}) {
return *isRequestDenied(logger, ctx, policy, oldR, admissionInfo)
} else {
if denyResp := isRequestDenied(logger, ctx, policy, newR, admissionInfo); !denyResp.IsSuccesful() {
return *denyResp
// deny logic will only be applied to requests from user - system related requests are ignored.
if admissionInfo.AdmissionUserInfo.Username == "kubernetes-admin" {
// If request is delete, newR will be empty
if reflect.DeepEqual(newR, unstructured.Unstructured{}) {
return *isRequestDenied(logger, ctx, policy, oldR, admissionInfo)
} else {
if denyResp := isRequestDenied(logger, ctx, policy, newR, admissionInfo); !denyResp.IsSuccesful() {
return *denyResp
}
}
}

4
pkg/engine/validation_test.go
View file

File diff suppressed because one or more lines are too long