diff --git a/api/kyverno/v1/user_info_types.go b/api/kyverno/v1/user_info_types.go index 32c3505b28..2d1292fe8d 100644 --- a/api/kyverno/v1/user_info_types.go +++ b/api/kyverno/v1/user_info_types.go @@ -35,6 +35,8 @@ func (u *UserInfo) ValidateSubjects(path *field.Path) (errs field.ErrorList) { entry := path.Index(index) if subject.Kind == "" { errs = append(errs, field.Required(entry.Child("kind"), "")) + } else if subject.Kind != rbacv1.GroupKind && subject.Kind != rbacv1.ServiceAccountKind && subject.Kind != rbacv1.UserKind { + errs = append(errs, field.Invalid(entry.Child("kind"), subject.Kind, "kind must be 'User', 'Group', or 'ServiceAccount'")) } if subject.Name == "" { errs = append(errs, field.Required(entry.Child("name"), "")) diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/01-policies.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/01-policies.yaml new file mode 100644 index 0000000000..cc374cb853 --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/01-policies.yaml @@ -0,0 +1,5 @@ +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +apply: +- file: policy.yaml + shouldFail: true diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/README.md b/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/README.md new file mode 100644 index 0000000000..a56a4d0016 --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/README.md @@ -0,0 +1,12 @@ +## Description + +This test tries to create a policy with invalid an invalid subject kind (`Foo`). +Only kinds supported are `User`, `Group`, or `ServiceAccount`. + +## Expected Behavior + +Policy should be rejected. + +## Related Issue + +https://github.com/kyverno/kyverno/issues/7052 \ No newline at end of file diff --git a/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/policy.yaml b/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/policy.yaml new file mode 100644 index 0000000000..aaea8f76ef --- /dev/null +++ b/test/conformance/kuttl/policy-validation/cluster-policy/invalid-subject-kind/policy.yaml @@ -0,0 +1,18 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: temp +spec: + background: false + rules: + - name: test-rule + match: + any: + - resources: + kinds: + - ConfigMap + subjects: + - name: foo + kind: Foo + validate: + deny: {}