diff --git a/api/kyverno/v1/rule_types.go b/api/kyverno/v1/rule_types.go index bb439c7dd4..f018c80060 100644 --- a/api/kyverno/v1/rule_types.go +++ b/api/kyverno/v1/rule_types.go @@ -135,5 +135,6 @@ func (r *Rule) Validate(path *field.Path, namespaced bool, clusterResources sets var errs field.ErrorList errs = append(errs, r.ValidateRuleType(path)...) errs = append(errs, r.MatchResources.Validate(path.Child("match"), namespaced, clusterResources)...) + errs = append(errs, r.ExcludeResources.Validate(path.Child("exclude"), namespaced, clusterResources)...) return errs } diff --git a/pkg/policy/validate.go b/pkg/policy/validate.go index 1930347421..72c04fe150 100644 --- a/pkg/policy/validate.go +++ b/pkg/policy/validate.go @@ -1201,39 +1201,7 @@ func validateMatchedResourceDescription(rd kyverno.ResourceDescription) (string, // checkClusterResourceInMatchAndExclude returns false if namespaced ClusterPolicy contains cluster wide resources in // Match and Exclude block func checkClusterResourceInMatchAndExclude(rule kyverno.Rule, clusterResources sets.String, mock bool, res []*metav1.APIResourceList) error { - // Contains Namespaces in Exclude->ResourceDescription - if len(rule.ExcludeResources.ResourceDescription.Namespaces) > 0 { - return fmt.Errorf("namespaced cluster policy : field namespaces not allowed in exclude.resources") - } - if !mock { - // Contains "Cluster Wide Resources" in Exclude->ResourceDescription->Kinds - for _, kind := range rule.ExcludeResources.ResourceDescription.Kinds { - if clusterResources.Has(kind) { - return fmt.Errorf("namespaced policy : cluster-wide resource '%s' not allowed in exclude.resources.kinds", kind) - } - } - - // Contains "Cluster Wide Resources" in Exclude->All->ResourceFilter->ResourceDescription->Kinds - for _, allResourceFilter := range rule.ExcludeResources.All { - fmt.Println(allResourceFilter.ResourceDescription) - for _, kind := range allResourceFilter.ResourceDescription.Kinds { - if clusterResources.Has(kind) { - return fmt.Errorf("namespaced policy : cluster-wide resource '%s' not allowed in match.resources.kinds", kind) - } - } - } - - // Contains "Cluster Wide Resources" in Exclude->Any->ResourceFilter->ResourceDescription->Kinds - for _, allResourceFilter := range rule.ExcludeResources.Any { - fmt.Println(allResourceFilter.ResourceDescription) - for _, kind := range allResourceFilter.ResourceDescription.Kinds { - if clusterResources.Has(kind) { - return fmt.Errorf("namespaced policy : cluster-wide resource '%s' not allowed in match.resources.kinds", kind) - } - } - } - // Check for generate policy // - if resource to be generated is namespaced resource then the namespace field // should be mentioned