fix: reports aggregation (#9697)

* chore: rename admission to ephemeral in reports aggregation controller

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix: reports aggregation

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* second queue

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* cleanup

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* nit

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* flag

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

charts/kyverno/README.md

@@ -343,7 +343,7 @@ The chart values are organised per component.
 | features.protectManagedResources.enabled | bool | `false` | Enables the feature |
 | features.registryClient.allowInsecure | bool | `false` | Allow insecure registry |
 | features.registryClient.credentialHelpers | list | `["default","google","amazon","azure","github"]` | Enable registry client helpers |
-| features.reports.chunkSize | int | `1000` | Reports chunk size |
+| features.reports.chunkSize | int | `0` | Reports chunk size |
 | features.ttlController.reconciliationInterval | string | `"1m"` | Reconciliation interval for the label based cleanup manager |
 | features.tuf.enabled | bool | `false` | Enables the feature |
 | features.tuf.root | string | `nil` | Tuf root |

charts/kyverno/values.yaml

@@ -672,7 +672,7 @@ features:
     - github
   reports:
     # -- Reports chunk size
-    chunkSize: 1000
+    chunkSize: 0
   ttlController:
     # -- Reconciliation interval for the label based cleanup manager
     reconciliationInterval: 1m

cmd/reports-controller/main.go

@@ -54,7 +54,6 @@ func createReportControllers(
 	aggregateReports bool,
 	policyReports bool,
 	validatingAdmissionPolicyReports bool,
-	reportsChunkSize int,
 	backgroundScanWorkers int,
 	client dclient.Interface,
 	kyvernoClient versioned.Interface,
@@ -97,12 +96,11 @@ func createReportControllers(
 				aggregatereportcontroller.ControllerName,
 				aggregatereportcontroller.NewController(
 					kyvernoClient,
+					client,
 					metadataFactory,
 					kyvernoV1.Policies(),
 					kyvernoV1.ClusterPolicies(),
 					vapInformer,
-					resourceReportController,
-					reportsChunkSize,
 				),
 				aggregatereportcontroller.Workers,
 			))
@@ -150,7 +148,6 @@ func createrLeaderControllers(
 	aggregateReports bool,
 	policyReports bool,
 	validatingAdmissionPolicyReports bool,
-	reportsChunkSize int,
 	backgroundScanWorkers int,
 	kubeInformer kubeinformers.SharedInformerFactory,
 	kyvernoInformer kyvernoinformer.SharedInformerFactory,
@@ -169,7 +166,6 @@ func createrLeaderControllers(
 		aggregateReports,
 		policyReports,
 		validatingAdmissionPolicyReports,
-		reportsChunkSize,
 		backgroundScanWorkers,
 		dynamicClient,
 		kyvernoClient,
@@ -205,7 +201,7 @@ func main() {
 	flagset.BoolVar(&aggregateReports, "aggregateReports", true, "Enable or disable aggregated policy reports.")
 	flagset.BoolVar(&policyReports, "policyReports", true, "Enable or disable policy reports.")
 	flagset.BoolVar(&validatingAdmissionPolicyReports, "validatingAdmissionPolicyReports", false, "Enable or disable validating admission policy reports.")
-	flagset.IntVar(&reportsChunkSize, "reportsChunkSize", 1000, "Max number of results in generated reports, reports will be split accordingly if there are more results to be stored.")
+	flagset.IntVar(&reportsChunkSize, "reportsChunkSize", 0, "Max number of results in generated reports, reports will be split accordingly if there are more results to be stored.")
 	flagset.IntVar(&backgroundScanWorkers, "backgroundScanWorkers", backgroundscancontroller.Workers, "Configure the number of background scan workers.")
 	flagset.DurationVar(&backgroundScanInterval, "backgroundScanInterval", time.Hour, "Configure background scan interval.")
 	flagset.IntVar(&maxQueuedEvents, "maxQueuedEvents", 1000, "Maximum events to be queued.")
@@ -242,6 +238,11 @@ func main() {
 	// setup
 	ctx, setup, sdown := internal.Setup(appConfig, "kyverno-reports-controller", skipResourceFilters)
 	defer sdown()
+	// show warnings
+	if reportsChunkSize != 0 {
+		logger := setup.Logger.WithName("wanings")
+		logger.Info("Warning: reportsChunkSize is deprecated and will be removed in 1.13.")
+	}
 	// THIS IS AN UGLY FIX
 	// ELSE KYAML IS NOT THREAD SAFE
 	kyamlopenapi.Schema()
@@ -326,7 +327,6 @@ func main() {
 				aggregateReports,
 				policyReports,
 				validatingAdmissionPolicyReports,
-				reportsChunkSize,
 				backgroundScanWorkers,
 				kubeInformer,
 				kyvernoInformer,

config/install-latest-testing.yaml

@@ -52947,7 +52947,7 @@ spec:
             - --v=2
             - --omitEvents=PolicyApplied,PolicySkipped
             - --enablePolicyException=true
-            - --reportsChunkSize=1000
+            - --reportsChunkSize=0
             - --allowInsecureRegistry=false
             - --registryCredentialHelpers=default,google,amazon,azure,github
             

pkg/controllers/report/aggregate/controller.go

@@ -13,17 +13,19 @@ import (
 	"github.com/kyverno/kyverno/pkg/client/clientset/versioned"
 	kyvernov1informers "github.com/kyverno/kyverno/pkg/client/informers/externalversions/kyverno/v1"
 	kyvernov1listers "github.com/kyverno/kyverno/pkg/client/listers/kyverno/v1"
+	"github.com/kyverno/kyverno/pkg/clients/dclient"
 	"github.com/kyverno/kyverno/pkg/controllers"
-	"github.com/kyverno/kyverno/pkg/controllers/report/resource"
 	controllerutils "github.com/kyverno/kyverno/pkg/utils/controller"
 	reportutils "github.com/kyverno/kyverno/pkg/utils/report"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/labels"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/dynamic"
 	admissionregistrationv1alpha1informers "k8s.io/client-go/informers/admissionregistration/v1alpha1"
 	admissionregistrationv1alpha1listers "k8s.io/client-go/listers/admissionregistration/v1alpha1"
 	metadatainformers "k8s.io/client-go/metadata/metadatainformer"
@@ -37,24 +39,24 @@ const (
 	ControllerName = "aggregate-report-controller"
 	maxRetries     = 10
 	enqueueDelay   = 10 * time.Second
+	deletionGrace  = time.Minute * 2
 )
 
 type controller struct {
 	// clients
-	client versioned.Interface
+	client  versioned.Interface
+	dclient dclient.Interface
 
 	// listers
-	polLister  kyvernov1listers.PolicyLister
-	cpolLister kyvernov1listers.ClusterPolicyLister
-	vapLister  admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyLister
+	polLister   kyvernov1listers.PolicyLister
+	cpolLister  kyvernov1listers.ClusterPolicyLister
+	vapLister   admissionregistrationv1alpha1listers.ValidatingAdmissionPolicyLister
+	ephrLister  cache.GenericLister
+	cephrLister cache.GenericLister
 
-	// queue
-	queue workqueue.RateLimitingInterface
-
-	// cache
-	metadataCache resource.MetadataCache
-
-	chunkSize int
+	// queues
+	frontQueue workqueue.RateLimitingInterface
+	backQueue  workqueue.RateLimitingInterface
 }
 
 type policyMapEntry struct {
@@ -64,34 +66,41 @@ type policyMapEntry struct {
 
 func NewController(
 	client versioned.Interface,
+	dclient dclient.Interface,
 	metadataFactory metadatainformers.SharedInformerFactory,
 	polInformer kyvernov1informers.PolicyInformer,
 	cpolInformer kyvernov1informers.ClusterPolicyInformer,
 	vapInformer admissionregistrationv1alpha1informers.ValidatingAdmissionPolicyInformer,
-	metadataCache resource.MetadataCache,
-	chunkSize int,
 ) controllers.Controller {
 	ephrInformer := metadataFactory.ForResource(reportsv1.SchemeGroupVersion.WithResource("ephemeralreports"))
 	cephrInformer := metadataFactory.ForResource(reportsv1.SchemeGroupVersion.WithResource("clusterephemeralreports"))
 	polrInformer := metadataFactory.ForResource(policyreportv1alpha2.SchemeGroupVersion.WithResource("policyreports"))
 	cpolrInformer := metadataFactory.ForResource(policyreportv1alpha2.SchemeGroupVersion.WithResource("clusterpolicyreports"))
 	c := controller{
-		client:        client,
-		polLister:     polInformer.Lister(),
-		cpolLister:    cpolInformer.Lister(),
-		queue:         workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), ControllerName),
-		metadataCache: metadataCache,
-		chunkSize:     chunkSize,
+		client:      client,
+		dclient:     dclient,
+		polLister:   polInformer.Lister(),
+		cpolLister:  cpolInformer.Lister(),
+		ephrLister:  ephrInformer.Lister(),
+		cephrLister: cephrInformer.Lister(),
+		frontQueue:  workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), ControllerName),
+		backQueue:   workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), ControllerName),
+	}
+	if _, _, err := controllerutils.AddDelayedDefaultEventHandlers(logger, ephrInformer.Informer(), c.frontQueue, enqueueDelay); err != nil {
+		logger.Error(err, "failed to register event handlers")
+	}
+	if _, _, err := controllerutils.AddDelayedDefaultEventHandlers(logger, cephrInformer.Informer(), c.frontQueue, enqueueDelay); err != nil {
+		logger.Error(err, "failed to register event handlers")
 	}
 	enqueueAll := func() {
 		if list, err := polrInformer.Lister().List(labels.Everything()); err == nil {
 			for _, item := range list {
-				c.queue.AddAfter(controllerutils.MetaObjectToName(item.(*metav1.PartialObjectMetadata)), enqueueDelay)
+				c.backQueue.AddAfter(controllerutils.MetaObjectToName(item.(*metav1.PartialObjectMetadata)), enqueueDelay)
 			}
 		}
 		if list, err := cpolrInformer.Lister().List(labels.Everything()); err == nil {
 			for _, item := range list {
-				c.queue.AddAfter(controllerutils.MetaObjectToName(item.(*metav1.PartialObjectMetadata)), enqueueDelay)
+				c.backQueue.AddAfter(controllerutils.MetaObjectToName(item.(*metav1.PartialObjectMetadata)), enqueueDelay)
 			}
 		}
 	}
@@ -122,47 +131,18 @@ func NewController(
 			logger.Error(err, "failed to register event handlers")
 		}
 	}
-	metadataCache.AddEventHandler(func(eventType resource.EventType, uid types.UID, _ schema.GroupVersionKind, res resource.Resource) {
-		// if it's a deletion, nothing to do
-		if eventType == resource.Deleted {
-			return
-		}
-		if res.Namespace == "" {
-			c.queue.AddAfter(string(uid), enqueueDelay)
-		} else {
-			c.queue.AddAfter(res.Namespace+"/"+string(uid), enqueueDelay)
-		}
-	})
-	enqueueFromEphemeral := func(obj metav1.Object) {
-		switch reportutils.GetSource(obj) {
-		case "background-scan":
-			c.queue.AddAfter(controllerutils.MetaObjectToName(obj), enqueueDelay)
-		case "admission":
-			obj := cache.ObjectName{Namespace: obj.GetNamespace(), Name: string(reportutils.GetResourceUid(obj))}
-			c.queue.AddAfter(obj.String(), enqueueDelay)
-		}
-	}
-	if _, err := controllerutils.AddEventHandlersT(
-		ephrInformer.Informer(),
-		func(obj metav1.Object) { enqueueFromEphemeral(obj) },
-		func(_, obj metav1.Object) { enqueueFromEphemeral(obj) },
-		func(obj metav1.Object) { enqueueFromEphemeral(obj) },
-	); err != nil {
-		logger.Error(err, "failed to register event handlers")
-	}
-	if _, err := controllerutils.AddEventHandlersT(
-		cephrInformer.Informer(),
-		func(obj metav1.Object) { enqueueFromEphemeral(obj) },
-		func(_, obj metav1.Object) { enqueueFromEphemeral(obj) },
-		func(obj metav1.Object) { enqueueFromEphemeral(obj) },
-	); err != nil {
-		logger.Error(err, "failed to register event handlers")
-	}
 	return &c
 }
 
 func (c *controller) Run(ctx context.Context, workers int) {
-	controllerutils.Run(ctx, logger, ControllerName, time.Second, c.queue, workers, maxRetries, c.reconcile)
+	var group wait.Group
+	group.StartWithContext(ctx, func(ctx context.Context) {
+		controllerutils.Run(ctx, logger, ControllerName, time.Second, c.frontQueue, workers, maxRetries, c.frontReconcile)
+	})
+	group.StartWithContext(ctx, func(ctx context.Context) {
+		controllerutils.Run(ctx, logger, ControllerName, time.Second, c.backQueue, workers, maxRetries, c.backReconcile)
+	})
+	group.Wait()
 }
 
 func (c *controller) createPolicyMap() (map[string]policyMapEntry, error) {
@@ -222,29 +202,7 @@ func (c *controller) createVapMap() (sets.Set[string], error) {
 	return results, nil
 }
 
-func (c *controller) getBackgroundScanReport(ctx context.Context, namespace, name string) (kyvernov1alpha2.ReportInterface, error) {
-	if namespace == "" {
-		report, err := c.client.ReportsV1().ClusterEphemeralReports().Get(ctx, name, metav1.GetOptions{})
-		if err != nil {
-			if apierrors.IsNotFound(err) {
-				return nil, nil
-			}
-			return nil, err
-		}
-		return report, nil
-	} else {
-		report, err := c.client.ReportsV1().EphemeralReports(namespace).Get(ctx, name, metav1.GetOptions{})
-		if err != nil {
-			if apierrors.IsNotFound(err) {
-				return nil, nil
-			}
-			return nil, err
-		}
-		return report, nil
-	}
-}
-
-func (c *controller) getEphemeralReports(ctx context.Context, namespace, name string) ([]kyvernov1alpha2.ReportInterface, error) {
+func (c *controller) findEphemeralReports(ctx context.Context, namespace, name string) ([]kyvernov1alpha2.ReportInterface, error) {
 	selector, err := reportutils.SelectorResourceUidEquals(types.UID(name))
 	if err != nil {
 		return nil, err
@@ -282,7 +240,7 @@ func (c *controller) getEphemeralReports(ctx context.Context, namespace, name st
 	return results, nil
 }
 
-func (c *controller) getPolicyReport(ctx context.Context, namespace, name string) (kyvernov1alpha2.ReportInterface, error) {
+func (c *controller) getReport(ctx context.Context, namespace, name string) (kyvernov1alpha2.ReportInterface, error) {
 	if namespace == "" {
 		report, err := c.client.Wgpolicyk8sV1alpha2().ClusterPolicyReports().Get(ctx, name, metav1.GetOptions{})
 		if err != nil {
@@ -304,123 +262,187 @@ func (c *controller) getPolicyReport(ctx context.Context, namespace, name string
 	}
 }
 
-func (c *controller) getReports(ctx context.Context, namespace, name string) ([]kyvernov1alpha2.ReportInterface, kyvernov1alpha2.ReportInterface, error) {
-	ephemeralReports, err := c.getEphemeralReports(ctx, namespace, name)
-	if err != nil {
-		return nil, nil, err
+func (c *controller) lookupEphemeralReportMeta(_ context.Context, namespace, name string) (*metav1.PartialObjectMetadata, error) {
+	if namespace == "" {
+		obj, err := c.cephrLister.Get(name)
+		if err != nil {
+			return nil, err
+		}
+		return obj.(*metav1.PartialObjectMetadata), nil
+	} else {
+		obj, err := c.ephrLister.ByNamespace(namespace).Get(name)
+		if err != nil {
+			return nil, err
+		}
+		return obj.(*metav1.PartialObjectMetadata), nil
 	}
-	backgroundReport, err := c.getBackgroundScanReport(ctx, namespace, name)
-	if err != nil {
-		return nil, nil, err
-	}
-	return ephemeralReports, backgroundReport, nil
 }
 
-func (c *controller) reconcile(ctx context.Context, logger logr.Logger, _, namespace, name string) error {
-	uid := types.UID(name)
-	resource, gvk, exists := c.metadataCache.GetResourceHash(uid)
-	if exists {
-		ephemeralReports, backgroundReport, err := c.getReports(ctx, namespace, name)
+func (c *controller) getEphemeralReport(ctx context.Context, namespace, name string) (kyvernov1alpha2.ReportInterface, error) {
+	if namespace == "" {
+		obj, err := c.client.ReportsV1().ClusterEphemeralReports().Get(ctx, name, metav1.GetOptions{})
 		if err != nil {
+			return nil, err
+		}
+		return obj, err
+	} else {
+		obj, err := c.client.ReportsV1().EphemeralReports(namespace).Get(ctx, name, metav1.GetOptions{})
+		if err != nil {
+			return nil, err
+		}
+		return obj, err
+	}
+}
+
+func (c *controller) deleteEphemeralReport(ctx context.Context, namespace, name string) error {
+	if namespace == "" {
+		return c.client.ReportsV1().ClusterEphemeralReports().Delete(ctx, name, metav1.DeleteOptions{})
+	} else {
+		return c.client.ReportsV1().EphemeralReports(namespace).Delete(ctx, name, metav1.DeleteOptions{})
+	}
+}
+
+func (c *controller) findResource(ctx context.Context, reportMeta *metav1.PartialObjectMetadata) (*unstructured.Unstructured, error) {
+	gvr := reportutils.GetResourceGVR(reportMeta)
+	dyn := c.dclient.GetDynamicInterface().Resource(gvr)
+	namespace, name := reportutils.GetResourceNamespaceAndName(reportMeta)
+	var iface dynamic.ResourceInterface
+	if namespace == "" {
+		iface = dyn
+	} else {
+		iface = dyn.Namespace(namespace)
+	}
+	resource, err := iface.Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		if !apierrors.IsNotFound(err) {
+			return nil, err
+		}
+		return nil, nil
+	}
+	return resource, nil
+}
+
+func (c *controller) adopt(ctx context.Context, reportMeta *metav1.PartialObjectMetadata) bool {
+	resource, err := c.findResource(ctx, reportMeta)
+	if err != nil {
+		return false
+	}
+	if resource == nil {
+		return false
+	}
+	report, err := c.getEphemeralReport(ctx, reportMeta.GetNamespace(), reportMeta.GetName())
+	if err != nil {
+		return false
+	}
+	if report == nil {
+		return false
+	}
+	controllerutils.SetOwner(report, resource.GetAPIVersion(), resource.GetKind(), resource.GetName(), resource.GetUID())
+	reportutils.SetResourceUid(report, resource.GetUID())
+	if _, err := updateReport(ctx, report, c.client); err != nil {
+		return false
+	}
+	return true
+}
+
+func (c *controller) frontReconcile(ctx context.Context, logger logr.Logger, _, namespace, name string) error {
+	reportMeta, err := c.lookupEphemeralReportMeta(ctx, namespace, name)
+	// try to lookup metadata from lister
+	if err != nil {
+		if !apierrors.IsNotFound(err) {
 			return err
 		}
-		policyReport, err := c.getPolicyReport(ctx, namespace, name)
-		if err != nil {
+		return nil
+	}
+	// check if it is owned already
+	if len(reportMeta.OwnerReferences) != 0 {
+		defer func() {
+			obj := cache.ObjectName{Namespace: namespace, Name: string(reportMeta.OwnerReferences[0].UID)}
+			c.backQueue.Add(obj.String())
+		}()
+		return nil
+	}
+	// try to find the owner
+	if c.adopt(ctx, reportMeta) {
+		return nil
+	}
+	// if not found and too old, forget about it
+	if isTooOld(reportMeta) {
+		return c.deleteEphemeralReport(ctx, reportMeta.GetNamespace(), reportMeta.GetName())
+	}
+	// else try again later
+	c.frontQueue.AddAfter(controllerutils.MetaObjectToName(reportMeta), enqueueDelay)
+	return nil
+}
+
+func (c *controller) backReconcile(ctx context.Context, logger logr.Logger, _, namespace, name string) (err error) {
+	var reports []kyvernov1alpha2.ReportInterface
+	// get the report
+	// if we don't have a report, we will eventually create one
+	report, err := c.getReport(ctx, namespace, name)
+	if err != nil {
+		return err
+	}
+	if report == nil {
+		reports = append(reports, report)
+	}
+	// get ephemeral reports
+	ephemeralReports, err := c.findEphemeralReports(ctx, namespace, name)
+	if err != nil {
+		if !apierrors.IsNotFound(err) {
 			return err
 		}
-		create := false
-		scope := &corev1.ObjectReference{
-			Kind:       gvk.Kind,
-			Namespace:  namespace,
-			Name:       resource.Name,
-			UID:        uid,
-			APIVersion: gvk.GroupVersion().String(),
-		}
-		if policyReport == nil {
-			create = true
-			policyReport = reportutils.NewPolicyReport(namespace, name, scope)
-			controllerutils.SetOwner(policyReport, gvk.GroupVersion().String(), gvk.Kind, resource.Name, uid)
-		}
-		// aggregate reports
-		policyMap, err := c.createPolicyMap()
-		if err != nil {
-			return err
-		}
-		vapMap, err := c.createVapMap()
-		if err != nil {
-			return err
-		}
-		merged := map[string]policyreportv1alpha2.PolicyReportResult{}
-		var reports []kyvernov1alpha2.ReportInterface
-		reports = append(reports, policyReport)
-		reports = append(reports, backgroundReport)
-		reports = append(reports, ephemeralReports...)
-		mergeReports(policyMap, vapMap, merged, uid, reports...)
-		var results []policyreportv1alpha2.PolicyReportResult
-		for _, result := range merged {
-			results = append(results, result)
-		}
-		if len(results) == 0 {
-			if !create {
-				if err := deleteReport(ctx, policyReport, c.client); err != nil {
-					return err
-				}
-			}
-		} else {
-			reportutils.SetResults(policyReport, results...)
-			if create {
-				if _, err := reportutils.CreateReport(ctx, policyReport, c.client); err != nil {
-					return err
-				}
-			} else {
-				if _, err := updateReport(ctx, policyReport, c.client); err != nil {
-					return err
+	}
+	// if there was no error aggregating the report we can delete ephemeral reports
+	defer func() {
+		if err == nil {
+			for _, ephemeralReport := range ephemeralReports {
+				if err := deleteReport(ctx, ephemeralReport, c.client); err != nil {
+					logger.Error(err, "failed to delete ephemeral report")
 				}
 			}
 		}
-		for _, ephemeralReport := range ephemeralReports {
-			if err := deleteReport(ctx, ephemeralReport, c.client); err != nil {
-				return err
-			}
-		}
-		if backgroundReport != nil {
-			if err := deleteReport(ctx, backgroundReport, c.client); err != nil {
-				return err
-			}
+	}()
+	// aggregate reports
+	policyMap, err := c.createPolicyMap()
+	if err != nil {
+		return err
+	}
+	vapMap, err := c.createVapMap()
+	if err != nil {
+		return err
+	}
+	reports = append(reports, ephemeralReports...)
+	merged := map[string]policyreportv1alpha2.PolicyReportResult{}
+	mergeReports(policyMap, vapMap, merged, types.UID(name), reports...)
+	var results []policyreportv1alpha2.PolicyReportResult
+	for _, result := range merged {
+		results = append(results, result)
+	}
+	if len(results) == 0 {
+		if report != nil {
+			return deleteReport(ctx, report, c.client)
 		}
 	} else {
-		policyReport, err := c.getPolicyReport(ctx, namespace, name)
-		if err != nil {
-			return err
+		if report == nil {
+			owner := ephemeralReports[0].GetOwnerReferences()[0]
+			scope := &corev1.ObjectReference{
+				Kind:       owner.Kind,
+				Namespace:  namespace,
+				Name:       owner.Name,
+				UID:        owner.UID,
+				APIVersion: owner.APIVersion,
+			}
+			report = reportutils.NewPolicyReport(namespace, name, scope)
+			controllerutils.SetOwner(report, owner.APIVersion, owner.Kind, owner.Name, owner.UID)
 		}
-		if policyReport == nil {
-			return nil
-		}
-		ephemeralReports, backgroundReport, err := c.getReports(ctx, namespace, name)
-		if err != nil {
-			return err
-		}
-		// aggregate reports
-		policyMap, err := c.createPolicyMap()
-		if err != nil {
-			return err
-		}
-		vapMap, err := c.createVapMap()
-		if err != nil {
-			return err
-		}
-		merged := map[string]policyreportv1alpha2.PolicyReportResult{}
-		var reports []kyvernov1alpha2.ReportInterface
-		reports = append(reports, policyReport)
-		reports = append(reports, backgroundReport)
-		reports = append(reports, ephemeralReports...)
-		mergeReports(policyMap, vapMap, merged, uid, reports...)
-		var results []policyreportv1alpha2.PolicyReportResult
-		for _, result := range merged {
-			results = append(results, result)
-		}
-		if len(results) == 0 {
-			if err := deleteReport(ctx, policyReport, c.client); err != nil {
+		reportutils.SetResults(report, results...)
+		if report.GetResourceVersion() == "" {
+			if _, err := reportutils.CreateReport(ctx, report, c.client); err != nil {
+				return err
+			}
+		} else {
+			if _, err := updateReport(ctx, report, c.client); err != nil {
 				return err
 			}
 		}

pkg/controllers/report/aggregate/utils.go

@@ -3,12 +3,14 @@ package aggregate
 import (
 	"context"
 	"errors"
+	"time"
 
 	kyvernov1alpha2 "github.com/kyverno/kyverno/api/kyverno/v1alpha2"
 	policyreportv1alpha2 "github.com/kyverno/kyverno/api/policyreport/v1alpha2"
 	"github.com/kyverno/kyverno/pkg/client/clientset/versioned"
 	controllerutils "github.com/kyverno/kyverno/pkg/utils/controller"
 	reportutils "github.com/kyverno/kyverno/pkg/utils/report"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/sets"
 )
@@ -56,3 +58,7 @@ func updateReport(ctx context.Context, report kyvernov1alpha2.ReportInterface, c
 	}
 	return reportutils.UpdateReport(ctx, report, client)
 }
+
+func isTooOld(reportMeta *metav1.PartialObjectMetadata) bool {
+	return reportMeta.GetCreationTimestamp().Add(deletionGrace).Before(time.Now())
+}

pkg/utils/report/metadata.go

@@ -194,7 +194,7 @@ func GetResourceGVR(report metav1.Object) schema.GroupVersionResource {
 	return schema.GroupVersionResource{Resource: arg}
 }
 
-func GetResourceNamespaceAndName(report kyvernov1alpha2.ReportInterface) (string, string) {
+func GetResourceNamespaceAndName(report metav1.Object) (string, string) {
 	return controllerutils.GetAnnotation(report, AnnotationResourceNamespace), controllerutils.GetAnnotation(report, AnnotationResourceName)
 }