522 untested changes

pkg/engine/mutate/overlay.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/nirmata/kyverno/pkg/policy"
+
 	"github.com/golang/glog"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 
@@ -111,6 +113,14 @@ func ProcessOverlay(ctx context.EvalInterface, rule kyverno.Rule, resource unstr
 		return resp, resource
 	}
 
+	err = policy.ValidateResource(patchedResource.UnstructuredContent(), patchedResource.GetKind())
+	if err != nil {
+		glog.V(4).Infoln(err)
+		resp.Success = false
+		resp.Message = fmt.Sprintf("failed to validate patchedResource: %v", err)
+		return resp, resource
+	}
+
 	// rule application succesfuly
 	resp.Success = true
 	resp.Message = fmt.Sprintf("successfully processed overlay")

pkg/engine/mutate/patches.go

@@ -6,6 +6,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/nirmata/kyverno/pkg/policy"
+
 	"github.com/golang/glog"
 	kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
 	"github.com/nirmata/kyverno/pkg/engine/response"
@@ -82,6 +84,14 @@ func ProcessPatches(rule kyverno.Rule, resource unstructured.Unstructured) (resp
 		return resp, resource
 	}
 
+	err = policy.ValidateResource(patchedResource.UnstructuredContent(), patchedResource.GetKind())
+	if err != nil {
+		glog.V(4).Infoln(err)
+		resp.Success = false
+		resp.Message = fmt.Sprintf("failed to validate patchedResource: %v", err)
+		return resp, resource
+	}
+
 	// JSON patches processed succesfully
 	resp.Success = true
 	resp.Message = fmt.Sprintf("succesfully process JSON patches")

pkg/engine/policy/validate.go

@@ -8,6 +8,8 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/nirmata/kyverno/pkg/policy"
+
 	kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1"
 	"github.com/nirmata/kyverno/pkg/engine/anchor"
 	rbacv1 "k8s.io/api/rbac/v1"
@@ -70,6 +72,12 @@ func Validate(p kyverno.ClusterPolicy) error {
 			}
 		}
 	}
+
+	err := policy.ValidatePolicyMutation(p)
+	if err != nil {
+		return fmt.Errorf("Policy has invalid mutations : %v", err)
+	}
+
 	return nil
 }