mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 02:18:15 +00:00
Code Activity

fix: CEL policies aren't applied to deleted resources (#10611)

Browse source 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
This commit is contained in:
Mariam Fahmy 2024-07-05 00:46:36 +08:00 • committed by GitHub
parent 1647675190
commit ad6ee93e3b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
29 changed files with 167 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
pkg/engine/handlers/validation/validate_cel.go
View file

@ -47,11 +47,6 @@ func (h validateCELHandler) Process(
_ engineapi.EngineContextLoader,
exceptions []*kyvernov2.PolicyException,
) (unstructured.Unstructured, []engineapi.RuleResponse) {
if engineutils.IsDeleteRequest(policyContext) {
logger.V(3).Info("skipping CEL validation on deleted resource")
return resource, nil
}
// check if there is a policy exception matches the incoming resource
exception := engineutils.MatchesException(exceptions, policyContext, logger)
if exception != nil {
@ -76,16 +71,12 @@ func (h validateCELHandler) Process(
// get resource's name, namespace, GroupVersionResource, and GroupVersionKind
gvr := schema.GroupVersionResource(policyContext.RequestResource())
gvk := resource.GroupVersionKind()
namespaceName := resource.GetNamespace()
resourceName := resource.GetName()
resourceKind, _ := policyContext.ResourceKind()
gvk, _ := policyContext.ResourceKind()
policyKind := policyContext.Policy().GetKind()
policyName := policyContext.Policy().GetName()
object := resource.DeepCopyObject()
// in case of update request, set the oldObject to the current resource before it gets updated
var oldObject runtime.Object
// in case of UPDATE requests, set the oldObject to the current resource before it gets updated
var object, oldObject runtime.Object
oldResource := policyContext.OldResource()
if oldResource.Object == nil {
oldObject = nil
@ -93,6 +84,18 @@ func (h validateCELHandler) Process(
oldObject = oldResource.DeepCopyObject()
}
var ns, name string
// in case of DELETE request, get the name and the namespace from the old object
if resource.Object == nil {
ns = oldResource.GetNamespace()
name = oldResource.GetName()
object = nil
} else {
ns = resource.GetNamespace()
name = resource.GetName()
object = resource.DeepCopyObject()
}
// check if the rule uses parameter resources
hasParam := rule.Validation.CEL.HasParam()
// extract preconditions written as CEL expressions
@ -129,11 +132,11 @@ func (h validateCELHandler) Process(
// Special case, the namespace object has the namespace of itself.
// unset it if the incoming object is a namespace
if gvk.Kind == "Namespace" && gvk.Version == "v1" && gvk.Group == "" {
namespaceName = ""
ns = ""
}
if namespaceName != "" {
if ns != "" {
if h.client != nil {
namespace, err = h.client.GetNamespace(ctx, namespaceName, metav1.GetOptions{})
namespace, err = h.client.GetNamespace(ctx, ns, metav1.GetOptions{})
if err != nil {
return resource, handlers.WithResponses(
engineapi.RuleError(rule.Name, engineapi.Validation, "Error getting the resource's namespace", err),
@ -142,7 +145,7 @@ func (h validateCELHandler) Process(
} else {
namespace = &corev1.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: namespaceName,
Name: ns,
},
}
}
@ -150,16 +153,20 @@ func (h validateCELHandler) Process(
requestInfo := policyContext.AdmissionInfo()
userInfo := internal.NewUser(requestInfo.AdmissionUserInfo.Username, requestInfo.AdmissionUserInfo.UID, requestInfo.AdmissionUserInfo.Groups)
admissionAttributes := admission.NewAttributesRecord(object, oldObject, gvk, namespaceName, resourceName, gvr, "", admission.Operation(policyContext.Operation()), nil, false, &userInfo)
versionedAttr, _ := admission.NewVersionedAttributes(admissionAttributes, admissionAttributes.GetKind(), nil)
authorizer := internal.NewAuthorizer(h.client, resourceKind)
attr := admission.NewAttributesRecord(object, oldObject, gvk, ns, name, gvr, "", admission.Operation(policyContext.Operation()), nil, false, &userInfo)
o := admission.NewObjectInterfacesFromScheme(runtime.NewScheme())
versionedAttr, err := admission.NewVersionedAttributes(attr, attr.GetKind(), o)
if err != nil {
return resource, handlers.WithError(rule, engineapi.Validation, "error while creating versioned attributes", err)
}
authorizer := internal.NewAuthorizer(h.client, gvk)
// validate the incoming object against the rule
var validationResults []validating.ValidateResult
if hasParam {
paramKind := rule.Validation.CEL.ParamKind
paramRef := rule.Validation.CEL.ParamRef
params, err := collectParams(ctx, h.client, paramKind, paramRef, namespaceName)
params, err := collectParams(ctx, h.client, paramKind, paramRef, ns)
if err != nil {
return resource, handlers.WithResponses(
engineapi.RuleError(rule.Name, engineapi.Validation, "error in parameterized resource", err),

3
test/conformance/chainsaw/validate/clusterpolicy/cornercases/cel-messages-upon-resource-failure(deprecated)/policy.yaml
View file

@ -14,6 +14,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
validate:
message: "hostPort must either be unset or set to 0"
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/cornercases/cel-messages-upon-resource-failure/policy.yaml
View file

@ -13,6 +13,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
message: "hostPort must either be unset or set to 0"

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/authorizor-checks/with-permissions/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
validate:
cel:
expressions:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/authorizor-checks/without-permissions/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- Deployment
operations:
- CREATE
- UPDATE
validate:
cel:
expressions:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/cel-preconditions/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
celPreconditions:
- name: "first match condition in CEL"
expression: "object.metadata.name.matches('nginx-pod')"

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/cel-variables/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- Deployment
operations:
- CREATE
- UPDATE
validate:
cel:
variables:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/check-statefulset-namespace/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- StatefulSet
operations:
- CREATE
- UPDATE
validate:
cel:
expressions:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/disallow-host-port/policy.yaml
View file

@ -14,6 +14,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
validate:
cel:
expressions:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/parameter-resources/clusterscoped/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- Namespace
operations:
- CREATE
- UPDATE
validate:
cel:
paramKind:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/parameter-resources/namespaced/match-clusterscoped-resource/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- Namespace
operations:
- CREATE
- UPDATE
validate:
cel:
paramKind:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/parameter-resources/namespaced/set-paramref-namespace/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- Deployment
operations:
- CREATE
- UPDATE
validate:
cel:
paramKind:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel(deprecated)/parameter-resources/namespaced/unset-paramref-namespace/policy.yaml
View file

@ -12,6 +12,9 @@ spec:
- resources:
kinds:
- StatefulSet
operations:
- CREATE
- UPDATE
validate:
cel:
paramKind:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/authorizor-checks/with-permissions/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/authorizor-checks/without-permissions/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- Deployment
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/cel-preconditions/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
celPreconditions:
- name: "first match condition in CEL"
expression: "object.metadata.name.matches('nginx-pod')"

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/cel-variables/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- Deployment
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/check-statefulset-namespace/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- StatefulSet
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

11
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/deny/README.md Normal file
View file

@ -0,0 +1,11 @@
## Description
This test creates a policy that uses CEL expressions to deny the creation/deletion/update of any pod.
## Expected Behavior
Any pod creation/deletion/update is blocked.
## Reference Issue(s)
10576

32
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/deny/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,32 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: deny
spec:
steps:
- name: step-01
try:
- script:
content: kubectl run nginx --image=nginx
- name: step-02
try:
- apply:
file: policy.yaml
- assert:
file: policy-assert.yaml
- name: step-03
try:
- script:
content: "if kubectl run --image=busybox foo\nthen \n exit 1\nelse \n exit
0\nfi\n"
- name: step-04
try:
- script:
content: "if kubectl label pod nginx app=nginx\nthen \n exit 1\nelse \n exit
0\nfi\n"
- name: step-05
try:
- script:
content: "if kubectl delete pod nginx\nthen \n exit 1\nelse \n exit
0\nfi\n"

9
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/deny/policy-assert.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: restrict-operations-on-pod
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

19
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/deny/policy.yaml Normal file
View file

@ -0,0 +1,19 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: restrict-operations-on-pod
spec:
validationFailureAction: Enforce
background: true
rules:
- name: rule-1
match:
any:
- resources:
kinds:
- Pod
validate:
cel:
expressions:
- expression: "false"
message: Create, update and delete on pods is not allowed

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/disallow-host-port/pod-fail.yaml
View file

@ -1,10 +1,11 @@
apiVersion: v1
kind: Pod
metadata:
name: webserver
name: webserver-2
spec:
containers:
- name: webserver
image: nginx:latest
ports:
- hostPort: 80
containerPort: 80

2
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/disallow-host-port/pod-pass.yaml
View file

@ -1,7 +1,7 @@
apiVersion: v1
kind: Pod
metadata:
name: webserver
name: webserver-1
spec:
containers:
- name: webserver

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/disallow-host-port/policy.yaml
View file

@ -13,6 +13,9 @@ spec:
- resources:
kinds:
- Pod
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/parameter-resources/clusterscoped/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- Namespace
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/parameter-resources/namespaced/match-clusterscoped-resource/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- Namespace
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/parameter-resources/namespaced/set-paramref-namespace/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- Deployment
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel:

3
test/conformance/chainsaw/validate/clusterpolicy/standard/cel/parameter-resources/namespaced/unset-paramref-namespace/policy.yaml
View file

@ -11,6 +11,9 @@ spec:
- resources:
kinds:
- StatefulSet
operations:
- CREATE
- UPDATE
validate:
validationFailureAction: Enforce
cel: