diff --git a/.github/actions/run-tests/action.yaml b/.github/actions/run-tests/action.yaml index c45ed0574e..a521de73a7 100644 --- a/.github/actions/run-tests/action.yaml +++ b/.github/actions/run-tests/action.yaml @@ -181,6 +181,15 @@ runs: make kind-install-kyverno - name: Wait for kyverno ready uses: ./.github/actions/kyverno-wait-ready + # install kubectl-evict plugin needed for testing eviction subresource trigger + - name: Install kubectl-evict + shell: bash + run: | + set -e + GOBIN=$(go env GOPATH)/bin + go install github.com/ueokande/kubectl-evict@latest + echo 'Adding kubectl-evict directory to PATH...' + echo "${GOBIN}" >> "${GITHUB_PATH}" # run tests - name: Test with Chainsaw if: ${{ steps.determine-next-version.outputs.next_version != 'main' }} diff --git a/pkg/background/generate/controller.go b/pkg/background/generate/controller.go index 8d24b7fe85..92a1e2c93a 100644 --- a/pkg/background/generate/controller.go +++ b/pkg/background/generate/controller.go @@ -193,7 +193,7 @@ func (c *GenerateController) getTriggerForCreateOperation(spec kyvernov2.UpdateR c.log.Error(err, "failed to extract resources from admission review request") return nil, err } - trigger = &newResource + return &newResource, nil } } return trigger, err diff --git a/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/README.md b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/README.md new file mode 100644 index 0000000000..99a63c3c49 --- /dev/null +++ b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/README.md @@ -0,0 +1,11 @@ +## Description + +This test assures generation of resource with a pod/eviction sub-resource acting as a trigger. + +## Expected Behavior + +The test passes and `configmap` `zk-kafka-address` is created. + +## Reference Issue(s) + +[11573](https://github.com/kyverno/kyverno/issues/11573) \ No newline at end of file diff --git a/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/chainsaw-step-03-assert-1-1.yaml b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/chainsaw-step-03-assert-1-1.yaml new file mode 100755 index 0000000000..7f3aa259c1 --- /dev/null +++ b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/chainsaw-step-03-assert-1-1.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +data: + KAFKA_ADDRESS: 192.168.10.13:9092,192.168.10.14:9092,192.168.10.15:9092 + ZK_ADDRESS: 192.168.10.10:2181,192.168.10.11:2181,192.168.10.12:2181 +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/managed-by: kyverno + generate.kyverno.io/policy-name: zk-kafka-address + generate.kyverno.io/policy-namespace: "" + generate.kyverno.io/rule-name: k-kafka-address + generate.kyverno.io/trigger-group: policy + generate.kyverno.io/trigger-kind: Eviction + generate.kyverno.io/trigger-namespace: test-generate-eviction + generate.kyverno.io/trigger-version: v1 + somekey: somevalue + name: zk-kafka-address + namespace: test-generate-eviction diff --git a/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/chainsaw-test.yaml b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/chainsaw-test.yaml new file mode 100755 index 0000000000..dc97acd484 --- /dev/null +++ b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/chainsaw-test.yaml @@ -0,0 +1,56 @@ +apiVersion: chainsaw.kyverno.io/v1alpha1 +kind: Test +metadata: + name: generate-on-eviction-subresource-trigger +spec: + steps: + - name: create policy + use: + template: ../../../../../../_step-templates/create-policy.yaml + with: + bindings: + - name: file + value: policy.yaml + - name: step-01 + try: + - apply: + file: namespace.yaml + - name: wait policy ready + use: + template: ../../../../../../_step-templates/cluster-policy-ready.yaml + with: + bindings: + - name: name + value: zk-kafka-address + - try: + - assert: + file: namespace-ready.yaml + - name: step-02 + try: + - command: + args: + - run + - nginx + - --image=nginx + - -n + - test-generate-eviction + entrypoint: kubectl + - command: + args: + - wait + - --for=condition=Ready + - pod/nginx + - -n + - test-generate-eviction + entrypoint: kubectl + - command: + args: + - evict + - nginx + - -n + - test-generate-eviction + entrypoint: kubectl + - name: step-03 + try: + - assert: + file: chainsaw-step-03-assert-1-1.yaml \ No newline at end of file diff --git a/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/namespace-ready.yaml b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/namespace-ready.yaml new file mode 100644 index 0000000000..828321db7c --- /dev/null +++ b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/namespace-ready.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: test-generate-eviction +status: + phase: Active diff --git a/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/namespace.yaml b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/namespace.yaml new file mode 100644 index 0000000000..164d63eb81 --- /dev/null +++ b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: test-generate-eviction diff --git a/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/policy.yaml b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/policy.yaml new file mode 100644 index 0000000000..0c1de63c19 --- /dev/null +++ b/test/conformance/chainsaw/generate/clusterpolicy/standard/data/nosync/generate-on-eviction-subresource-trigger/policy.yaml @@ -0,0 +1,29 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: zk-kafka-address +spec: + rules: + - name: k-kafka-address + match: + any: + - resources: + kinds: + - "Pod/eviction" + generate: + # generateExisting does not work for sub-resources + generateExisting: false + # synchronization does not work for sub-resources + synchronize: false + apiVersion: v1 + kind: ConfigMap + name: zk-kafka-address + namespace: "{{request.namespace}}" + data: + kind: ConfigMap + metadata: + labels: + somekey: somevalue + data: + ZK_ADDRESS: "192.168.10.10:2181,192.168.10.11:2181,192.168.10.12:2181" + KAFKA_ADDRESS: "192.168.10.13:9092,192.168.10.14:9092,192.168.10.15:9092"