- fix validation to process on patched resource; - format code

pkg/webhooks/common.go

@@ -115,40 +115,40 @@ func containRBACinfo(policies []kyverno.ClusterPolicy) bool {
 }
 
 // extracts the new and old resource as unstructured
-func extractResources(request *v1beta1.AdmissionRequest) (unstructured.Unstructured, unstructured.Unstructured, error) {
+func extractResources(newRaw []byte, request *v1beta1.AdmissionRequest) (unstructured.Unstructured, unstructured.Unstructured, error) {
 	var emptyResource unstructured.Unstructured
-	var err error
+
 	// New Resource
-	newRaw := request.Object.Raw
 	if newRaw == nil {
 		return emptyResource, emptyResource, fmt.Errorf("new resource is not defined")
 	}
-	new, err := convertToUnstructured(newRaw)
+
+	new, err := convertResource(newRaw, request.Kind.Group, request.Kind.Version, request.Kind.Kind, request.Namespace)
 	if err != nil {
 		return emptyResource, emptyResource, fmt.Errorf("failed to convert new raw to unstructured: %v", err)
 	}
-	new.SetGroupVersionKind(schema.GroupVersionKind{Group: request.Kind.Group, Version: request.Kind.Version, Kind: request.Kind.Kind})
+
-	new.SetNamespace(request.Namespace)
 	// Old Resource - Optional
 	oldRaw := request.OldObject.Raw
 	if oldRaw == nil {
-		return *new, emptyResource, nil
+		return new, emptyResource, nil
 	}
-	old, err := convertToUnstructured((oldRaw))
+
+	old, err := convertResource(oldRaw, request.Kind.Group, request.Kind.Version, request.Kind.Kind, request.Namespace)
 	if err != nil {
 		return emptyResource, emptyResource, fmt.Errorf("failed to convert old raw to unstructured: %v", err)
 	}
-	old.SetGroupVersionKind(schema.GroupVersionKind{Group: request.Kind.Group, Version: request.Kind.Version, Kind: request.Kind.Kind})
+	return new, old, err
-	old.SetNamespace(request.Namespace)
-	return *new, *old, err
 }
 
-func convertToUnstructured(data []byte) (*unstructured.Unstructured, error) {
+// convertResource converts raw bytes to an unstructured object
-	resource := &unstructured.Unstructured{}
+func convertResource(raw []byte, group, version, kind, namespace string) (unstructured.Unstructured, error) {
-	err := resource.UnmarshalJSON(data)
+	obj, err := engine.ConvertToUnstructured(raw)
 	if err != nil {
-		glog.V(4).Infof("failed to unmarshall resource: %v", err)
+		return unstructured.Unstructured{}, fmt.Errorf("failed to convert raw to unstructured: %v", err)
-		return nil, err
 	}
-	return resource, nil
+
+	obj.SetGroupVersionKind(schema.GroupVersionKind{Group: group, Version: version, Kind: kind})
+	obj.SetNamespace(namespace)
+	return *obj, nil
 }

pkg/webhooks/server.go

@@ -17,7 +17,6 @@ import (
 	kyvernolister "github.com/nirmata/kyverno/pkg/client/listers/kyverno/v1"
 	"github.com/nirmata/kyverno/pkg/config"
 	client "github.com/nirmata/kyverno/pkg/dclient"
-	"github.com/nirmata/kyverno/pkg/engine"
 	"github.com/nirmata/kyverno/pkg/event"
 	"github.com/nirmata/kyverno/pkg/policy"
 	"github.com/nirmata/kyverno/pkg/policystore"
@@ -27,7 +26,6 @@ import (
 	"github.com/nirmata/kyverno/pkg/webhookconfig"
 	v1beta1 "k8s.io/api/admission/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
 	rbacinformer "k8s.io/client-go/informers/rbac/v1"
 	rbaclister "k8s.io/client-go/listers/rbac/v1"
 	"k8s.io/client-go/tools/cache"
@@ -209,23 +207,20 @@ func (ws *WebhookServer) handleAdmissionRequest(request *v1beta1.AdmissionReques
 	glog.V(4).Infof("Time: webhook GetRoleRef %v", time.Since(startTime))
 
 	// convert RAW to unstructured
-	resource, err := engine.ConvertToUnstructured(request.Object.Raw)
+	resource, err := convertResource(request.Object.Raw, request.Kind.Group, request.Kind.Version, request.Kind.Kind, request.Namespace)
 	if err != nil {
-		msg := fmt.Sprintf("unable to convert raw resource to unstructured: %v", err)
+		glog.Errorf(err.Error())
-		glog.Errorf(msg)
+
 		return &v1beta1.AdmissionResponse{
 			Allowed: false,
 			Result: &metav1.Status{
 				Status:  "Failure",
-				Message: msg,
+				Message: err.Error(),
 			},
 		}
 	}
 
-	// if not then set it from the api request
+	if checkPodTemplateAnn(resource) {
-	resource.SetGroupVersionKind(schema.GroupVersionKind{Group: request.Kind.Group, Version: request.Kind.Version, Kind: request.Kind.Kind})
-	resource.SetNamespace(request.Namespace)
-	if checkPodTemplateAnn(*resource) {
 		return &v1beta1.AdmissionResponse{
 			Allowed: true,
 			Result: &metav1.Status{
@@ -235,7 +230,7 @@ func (ws *WebhookServer) handleAdmissionRequest(request *v1beta1.AdmissionReques
 	}
 
 	// MUTATION
-	ok, patches, msg := ws.HandleMutation(request, *resource, policies, roles, clusterRoles)
+	ok, patches, msg := ws.HandleMutation(request, resource, policies, roles, clusterRoles)
 	if !ok {
 		glog.V(4).Infof("Deny admission request:  %v/%s/%s", request.Kind, request.Namespace, request.Name)
 		return &v1beta1.AdmissionResponse{

pkg/webhooks/validation.go

@@ -53,7 +53,7 @@ func (ws *WebhookServer) HandleValidation(request *v1beta1.AdmissionRequest, pol
 	}
 
 	// Get new and old resource
-	newR, oldR, err := extractResources(request)
+	newR, oldR, err := extractResources(patchedResource, request)
 	if err != nil {
 		// as resource cannot be parsed, we skip processing
 		glog.Error(err)