diff --git a/pkg/engine/mutate/overlay.go b/pkg/engine/mutate/overlay.go index 3c93e33b27..9b672bf622 100644 --- a/pkg/engine/mutate/overlay.go +++ b/pkg/engine/mutate/overlay.go @@ -10,6 +10,8 @@ import ( "strings" "time" + "github.com/nirmata/kyverno/pkg/policy" + "github.com/golang/glog" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" @@ -111,6 +113,14 @@ func ProcessOverlay(ctx context.EvalInterface, rule kyverno.Rule, resource unstr return resp, resource } + err = policy.ValidateResource(patchedResource.UnstructuredContent(), patchedResource.GetKind()) + if err != nil { + glog.V(4).Infoln(err) + resp.Success = false + resp.Message = fmt.Sprintf("failed to validate patchedResource: %v", err) + return resp, resource + } + // rule application succesfuly resp.Success = true resp.Message = fmt.Sprintf("successfully processed overlay") diff --git a/pkg/engine/mutate/patches.go b/pkg/engine/mutate/patches.go index bf22778e60..9d3f1dae18 100644 --- a/pkg/engine/mutate/patches.go +++ b/pkg/engine/mutate/patches.go @@ -6,6 +6,8 @@ import ( "strings" "time" + "github.com/nirmata/kyverno/pkg/policy" + "github.com/golang/glog" kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1" "github.com/nirmata/kyverno/pkg/engine/response" @@ -82,6 +84,14 @@ func ProcessPatches(rule kyverno.Rule, resource unstructured.Unstructured) (resp return resp, resource } + err = policy.ValidateResource(patchedResource.UnstructuredContent(), patchedResource.GetKind()) + if err != nil { + glog.V(4).Infoln(err) + resp.Success = false + resp.Message = fmt.Sprintf("failed to validate patchedResource: %v", err) + return resp, resource + } + // JSON patches processed succesfully resp.Success = true resp.Message = fmt.Sprintf("succesfully process JSON patches") diff --git a/pkg/engine/policy/validate.go b/pkg/engine/policy/validate.go index b6e4fd6b28..90e0a2cf8b 100644 --- a/pkg/engine/policy/validate.go +++ b/pkg/engine/policy/validate.go @@ -8,6 +8,8 @@ import ( "strconv" "strings" + "github.com/nirmata/kyverno/pkg/policy" + kyverno "github.com/nirmata/kyverno/pkg/api/kyverno/v1" "github.com/nirmata/kyverno/pkg/engine/anchor" rbacv1 "k8s.io/api/rbac/v1" @@ -70,6 +72,12 @@ func Validate(p kyverno.ClusterPolicy) error { } } } + + err := policy.ValidatePolicyMutation(p) + if err != nil { + return fmt.Errorf("Policy has invalid mutations : %v", err) + } + return nil }