mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-30 19:35:06 +00:00
Code Activity

fix: mutation policy inconsistent patching for ephemeralContainers (#5121)

Browse source 
* fix: mutation policy consistent patching for ephemeralContainers

Signed-off-by: praddy26 <pradeep.vaishnav4@gmail.com>
Co-authored-by: Vyankatesh Kudtarkar <vyankateshkd@gmail.com>
This commit is contained in:
Pradeep Lakshmi Narasimha 2022-10-26 10:50:32 +05:30 • committed by GitHub
parent e4bf66e756
commit c3740d1c5b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 123 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
pkg/engine/mutate/patch/strategicPreprocessing.go
View file

@ -139,7 +139,8 @@ func processListOfMaps(logger logr.Logger, pattern, resource *yaml.RNode) error
var lastGlobalAnchorError error = nil
for _, resourceElement := range resourceElements {
if err := preProcessRecursive(logger, patternElement, resourceElement); err != nil {
patternElementCopy := patternElement.Copy()
if err := preProcessRecursive(logger, patternElementCopy, resourceElement); err != nil {
logger.V(3).Info("anchor mismatch", "reason", err.Error())
if isConditionError(err) {
continue
@ -157,7 +158,7 @@ func processListOfMaps(logger logr.Logger, pattern, resource *yaml.RNode) error
// global anchor has passed, there is no need to return an error
anyGlobalConditionPassed = true
} else {
if err := handlePatternName(pattern, patternElement, resourceElement); err != nil {
if err := handlePatternName(pattern, patternElementCopy, resourceElement); err != nil {
return errors.Wrap(err, "failed to update name in pattern")
}
}

120
pkg/engine/mutate/patch/strategicPreprocessing_test.go
View file

@ -16,6 +16,126 @@ func Test_preProcessStrategicMergePatch_multipleAnchors(t *testing.T) {
rawResource []byte
expectedPatch []byte
}{
{
rawPolicy: []byte(`{
"spec": {
"containers": [
{
"(name)": "*",
"securityContext": {
"+(allowPrivilegeEscalation)": false,
"+(capabilities)": {
"drop": [
"NET_CAP"
]
},
"+(privileged)": false
}
}
],
"initContainers": [
{
"(name)": "*",
"securityContext": {
"+(allowPrivilegeEscalation)": false,
"+(capabilities)": {
"drop": [
"NET_ADMIN"
]
},
"+(privileged)": false
}
}
]
}
}`),
rawResource: []byte(`{
"apiVersion": "v1",
"kind": "Pod",
"metadata": {
"name": "mutation-debug",
"namespace": "amritapuri"
},
"spec": {
"containers": [
{
"name": "sleepy-container-1",
"image": "docker.io/library/ubuntu"
},
{
"name": "sleepy-container-2",
"image": "docker.io/library/ubuntu"
}
],
"initContainers": [
{
"name": "init-container-1",
"image": "docker.io/library/ubuntu"
},
{
"name": "init-container-2",
"image": "docker.io/library/ubuntu"
}
]
}
}`),
expectedPatch: []byte(`{
"spec": {
"containers": [
{
"name": "sleepy-container-1",
"securityContext": {
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"NET_CAP"
]
},
"privileged": false
}
},
{
"name": "sleepy-container-2",
"securityContext": {
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"NET_CAP"
]
},
"privileged": false
}
}
],
"initContainers": [
{
"name": "init-container-1",
"securityContext": {
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"NET_ADMIN"
]
},
"privileged": false
}
},
{
"name": "init-container-2",
"securityContext": {
"allowPrivilegeEscalation": false,
"capabilities": {
"drop": [
"NET_ADMIN"
]
},
"privileged": false
}
}
]
}
}`),
},
{
rawPolicy: []byte(`{
"metadata": {