fix(policy chart): fix the merging of policyExclude customizations to avoid wrong overrides (#11653)

Signed-off-by: Caio Begotti <caiobegotti@gmail.com>

charts/kyverno-policies/Chart.yaml

@@ -26,3 +26,5 @@ annotations:
       description: Remove spec.validationFailureAction field from policies as it is deprecated
     - kind: added
       description: Add spec.validate[*].failureAction field to policies
+    - kind: fixed
+      description: Fix the merging of policyExclude customizations to avoid wrong overrides

charts/kyverno-policies/templates/baseline/disallow-capabilities.yaml

@@ -31,7 +31,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "adding-capabilities") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/disallow-host-namespaces.yaml

@@ -32,7 +32,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "host-namespaces") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/disallow-host-path.yaml

@@ -31,7 +31,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "host-path") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/disallow-host-ports.yaml

@@ -31,7 +31,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "host-ports-none") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/disallow-host-process.yaml

@@ -32,7 +32,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "host-process-containers") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/disallow-privileged-containers.yaml

@@ -30,7 +30,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "privileged-containers") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/disallow-proc-mount.yaml

@@ -32,7 +32,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "check-proc-mount") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/restrict-apparmor-profiles.yaml

@@ -33,7 +33,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "app-armor") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/restrict-seccomp.yaml

@@ -31,7 +31,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "check-seccomp") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/baseline/restrict-sysctls.yaml

@@ -34,7 +34,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "check-sysctls") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/restricted/disallow-privilege-escalation.yaml

@@ -30,7 +30,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "privilege-escalation") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/restricted/require-run-as-non-root-user.yaml

@@ -30,7 +30,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "run-as-non-root-user") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/restricted/require-run-as-nonroot.yaml

@@ -31,7 +31,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "run-as-non-root") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/restricted/restrict-seccomp-strict.yaml

@@ -33,7 +33,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "check-seccomp-strict") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/kyverno-policies/templates/restricted/restrict-volume-types.yaml

@@ -33,7 +33,7 @@ spec:
         - resources:
             kinds:
               - Pod
-      {{- with index .Values "policyExclude" $name }}
+      {{- with merge (index .Values "policyExclude" "restricted-volumes") (index .Values "policyExclude" $name) }}
       exclude:
         {{- toYaml . | nindent 8 }}
       {{- end }}