mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-15 17:51:20 +00:00
Code Activity

refactor: remove more pointers from engine api (#6651)

Browse source 
* refactor: remove more pointers from engine api

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* debug

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2023-03-23 13:58:52 +01:00 committed by GitHub
parent 6f65b4416e
commit dd7ecff386
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
31 changed files with 99 additions and 100 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
cmd/cli/kubectl-kyverno/utils/common/common.go
View file

@ -523,9 +523,9 @@ OuterLoop:
} }
verifyImageResponse, _ := eng.VerifyAndPatchImages(context.TODO(), policyContext) verifyImageResponse, _ := eng.VerifyAndPatchImages(context.TODO(), policyContext)
if verifyImageResponse != nil && !verifyImageResponse.IsEmpty() { if !verifyImageResponse.IsEmpty() {
engineResponses = append(engineResponses, verifyImageResponse) engineResponses = append(engineResponses, &verifyImageResponse)
info = ProcessValidateEngineResponse(c.Policy, verifyImageResponse, resPath, c.Rc, c.PolicyReport, c.AuditWarn) info = ProcessValidateEngineResponse(c.Policy, &verifyImageResponse, resPath, c.Rc, c.PolicyReport, c.AuditWarn)
} }
var policyHasGenerate bool var policyHasGenerate bool

4
pkg/controllers/report/background/controller.go
View file

@ -309,8 +309,8 @@ func (c *controller) reconcileReport(
if result.Error != nil { if result.Error != nil {
return result.Error return result.Error
} else { } else {
ruleResults = append(ruleResults, reportutils.EngineResponseToReportResults(result.EngineResponse)...) ruleResults = append(ruleResults, reportutils.EngineResponseToReportResults(*result.EngineResponse)...)
utils.GenerateEvents(logger, c.eventGen, c.config, result.EngineResponse) utils.GenerateEvents(logger, c.eventGen, c.config, *result.EngineResponse)
} }
} }
} }

10
pkg/controllers/report/utils/events.go
View file

@ -7,7 +7,7 @@ import (
"github.com/kyverno/kyverno/pkg/event" "github.com/kyverno/kyverno/pkg/event"
) )
func GenerateEvents(logger logr.Logger, eventGen event.Interface, config config.Configuration, results ...*engineapi.EngineResponse) { func GenerateEvents(logger logr.Logger, eventGen event.Interface, config config.Configuration, results ...engineapi.EngineResponse) {
for _, result := range results { for _, result := range results {
var eventInfos []event.Info var eventInfos []event.Info
eventInfos = append(eventInfos, generateFailEvents(logger, result)...) eventInfos = append(eventInfos, generateFailEvents(logger, result)...)
@ -19,7 +19,7 @@ func GenerateEvents(logger logr.Logger, eventGen event.Interface, config config.
} }
} }
func generateSuccessEvents(log logr.Logger, ers ...*engineapi.EngineResponse) (eventInfos []event.Info) { func generateSuccessEvents(log logr.Logger, ers ...engineapi.EngineResponse) (eventInfos []event.Info) {
for _, er := range ers { for _, er := range ers {
logger := log.WithValues("policy", er.Policy.GetName(), "kind", er.Resource.GetKind(), "namespace", er.Resource.GetNamespace(), "name", er.Resource.GetName()) logger := log.WithValues("policy", er.Policy.GetName(), "kind", er.Resource.GetKind(), "namespace", er.Resource.GetNamespace(), "name", er.Resource.GetName())
if !er.IsFailed() { if !er.IsFailed() {
@ -31,7 +31,7 @@ func generateSuccessEvents(log logr.Logger, ers ...*engineapi.EngineResponse) (e
return eventInfos return eventInfos
} }
func generateExceptionEvents(log logr.Logger, ers ...*engineapi.EngineResponse) (eventInfos []event.Info) { func generateExceptionEvents(log logr.Logger, ers ...engineapi.EngineResponse) (eventInfos []event.Info) {
for _, er := range ers { for _, er := range ers {
for i, ruleResp := range er.PolicyResponse.Rules { for i, ruleResp := range er.PolicyResponse.Rules {
isException := ruleResp.Exception != nil isException := ruleResp.Exception != nil
@ -43,14 +43,14 @@ func generateExceptionEvents(log logr.Logger, ers ...*engineapi.EngineResponse)
return eventInfos return eventInfos
} }
func generateFailEvents(log logr.Logger, ers ...*engineapi.EngineResponse) (eventInfos []event.Info) { func generateFailEvents(log logr.Logger, ers ...engineapi.EngineResponse) (eventInfos []event.Info) {
for _, er := range ers { for _, er := range ers {
eventInfos = append(eventInfos, generateFailEventsPerEr(log, er)...) eventInfos = append(eventInfos, generateFailEventsPerEr(log, er)...)
} }
return eventInfos return eventInfos
} }
func generateFailEventsPerEr(log logr.Logger, er *engineapi.EngineResponse) []event.Info { func generateFailEventsPerEr(log logr.Logger, er engineapi.EngineResponse) []event.Info {
var eventInfos []event.Info var eventInfos []event.Info
logger := log.WithValues( logger := log.WithValues(
"policy", er.Policy.GetName(), "policy", er.Policy.GetName(),

2
pkg/controllers/report/utils/scanner.go
View file

@ -111,5 +111,5 @@ func (s *scanner) validateImages(ctx context.Context, resource unstructured.Unst
if len(response.PolicyResponse.Rules) > 0 { if len(response.PolicyResponse.Rules) > 0 {
s.logger.Info("validateImages", "policy", policy, "response", response) s.logger.Info("validateImages", "policy", policy, "response", response)
} }
return response, nil return &response, nil
} }

2
pkg/engine/api/engine.go
View file

@ -28,7 +28,7 @@ type Engine interface {
VerifyAndPatchImages( VerifyAndPatchImages(
ctx context.Context, ctx context.Context,
policyContext PolicyContext, policyContext PolicyContext,
) (*EngineResponse, *ImageVerificationMetadata) ) (EngineResponse, ImageVerificationMetadata)
// ApplyBackgroundChecks checks for validity of generate and mutateExisting rules on the resource // ApplyBackgroundChecks checks for validity of generate and mutateExisting rules on the resource
// 1. validate variables to be substitute in the general ruleInfo (match,exclude,condition) // 1. validate variables to be substitute in the general ruleInfo (match,exclude,condition)

6
pkg/engine/api/engineresponse.go
View file

@ -35,7 +35,7 @@ func Resource(policyContext PolicyContext) unstructured.Unstructured {
func NewEngineResponseFromPolicyContext( func NewEngineResponseFromPolicyContext(
policyContext PolicyContext, policyContext PolicyContext,
policyResponse *PolicyResponse, policyResponse *PolicyResponse,
) *EngineResponse { ) EngineResponse {
return NewEngineResponse( return NewEngineResponse(
Resource(policyContext), Resource(policyContext),
policyContext.Policy(), policyContext.Policy(),
@ -49,8 +49,8 @@ func NewEngineResponse(
policy kyvernov1.PolicyInterface, policy kyvernov1.PolicyInterface,
namespaceLabels map[string]string, namespaceLabels map[string]string,
policyResponse *PolicyResponse, policyResponse *PolicyResponse,
) *EngineResponse { ) EngineResponse {
response := &EngineResponse{ response := EngineResponse{
Resource: resource, Resource: resource,
Policy: policy, Policy: policy,
NamespaceLabels: namespaceLabels, NamespaceLabels: namespaceLabels,

8
pkg/engine/api/imageverifymetadata.go
View file

@ -68,11 +68,9 @@ func (ivm *ImageVerificationMetadata) Patches(hasAnnotations bool, log logr.Logg
} }
} }
func (ivm *ImageVerificationMetadata) Merge(other *ImageVerificationMetadata) { func (ivm *ImageVerificationMetadata) Merge(other ImageVerificationMetadata) {
if other != nil { for k, v := range other.Data {
for k, v := range other.Data { ivm.Add(k, v)
ivm.Add(k, v)
}
} }
} }

6
pkg/engine/api/imageverifymetadata_test.go
View file

@ -218,7 +218,7 @@ func TestImageVerificationMetadata_Merge(t *testing.T) {
Data map[string]bool Data map[string]bool
} }
type args struct { type args struct {
other *ImageVerificationMetadata other ImageVerificationMetadata
} }
tests := []struct { tests := []struct {
name string name string
@ -234,7 +234,7 @@ func TestImageVerificationMetadata_Merge(t *testing.T) {
}, },
}, },
args: args{ args: args{
other: &ImageVerificationMetadata{ other: ImageVerificationMetadata{
Data: map[string]bool{ Data: map[string]bool{
"test": false, "test": false,
}, },
@ -252,7 +252,7 @@ func TestImageVerificationMetadata_Merge(t *testing.T) {
}, },
}, },
args: args{ args: args{
other: &ImageVerificationMetadata{ other: ImageVerificationMetadata{
Data: map[string]bool{ Data: map[string]bool{
"test2": false, "test2": false,
}, },

4
pkg/engine/background.go
View file

@ -47,7 +47,7 @@ func (e *engine) filterRules(
if e.configuration.ToFilter(kind, namespace, name) { if e.configuration.ToFilter(kind, namespace, name) {
logger.Info("resource excluded") logger.Info("resource excluded")
return *resp return resp
} }
applyRules := policy.GetSpec().GetApplyRules() applyRules := policy.GetSpec().GetApplyRules()
@ -61,7 +61,7 @@ func (e *engine) filterRules(
} }
} }
return *resp return resp
} }
func (e *engine) filterRule( func (e *engine) filterRule(

2
pkg/engine/engine.go
View file

@ -57,7 +57,7 @@ func (e *engine) Mutate(
func (e *engine) VerifyAndPatchImages( func (e *engine) VerifyAndPatchImages(
ctx context.Context, ctx context.Context,
policyContext engineapi.PolicyContext, policyContext engineapi.PolicyContext,
) (*engineapi.EngineResponse, *engineapi.ImageVerificationMetadata) { ) (engineapi.EngineResponse, engineapi.ImageVerificationMetadata) {
logger := internal.LoggerWithPolicyContext(logging.WithName("engine.verify"), policyContext) logger := internal.LoggerWithPolicyContext(logging.WithName("engine.verify"), policyContext)
return e.verifyAndPatchImages(ctx, logger, policyContext) return e.verifyAndPatchImages(ctx, logger, policyContext)
} }

4
pkg/engine/generation.go
View file

@ -41,7 +41,7 @@ func (e *engine) filterGenerateRules(
} }
if e.configuration.ToFilter(kind, namespace, name) { if e.configuration.ToFilter(kind, namespace, name) {
logger.Info("resource excluded") logger.Info("resource excluded")
return *resp return resp
} }
for _, rule := range autogen.ComputeRules(policyContext.Policy()) { for _, rule := range autogen.ComputeRules(policyContext.Policy()) {
logger := internal.LoggerWithRule(logger, rule) logger := internal.LoggerWithRule(logger, rule)
@ -49,5 +49,5 @@ func (e *engine) filterGenerateRules(
resp.PolicyResponse.Rules = append(resp.PolicyResponse.Rules, *ruleResp) resp.PolicyResponse.Rules = append(resp.PolicyResponse.Rules, *ruleResp)
} }
} }
return *resp return resp
} }

17
pkg/engine/imageVerify.go
View file

@ -23,21 +23,24 @@ func (e *engine) verifyAndPatchImages(
ctx context.Context, ctx context.Context,
logger logr.Logger, logger logr.Logger,
policyContext engineapi.PolicyContext, policyContext engineapi.PolicyContext,
) (*engineapi.EngineResponse, *engineapi.ImageVerificationMetadata) { ) (engineapi.EngineResponse, engineapi.ImageVerificationMetadata) {
policy := policyContext.Policy() policy := policyContext.Policy()
resp := engineapi.NewEngineResponseFromPolicyContext(policyContext, nil) resp := engineapi.NewEngineResponseFromPolicyContext(policyContext, nil)
startTime := time.Now() startTime := time.Now()
defer func() { defer func() {
internal.BuildResponse(policyContext, resp, startTime) logger.V(4).Info(
logger.V(4).Info("processed image verification rules", "processed image verification rules",
"time", resp.PolicyResponse.Stats.ProcessingTime.String(), "time", resp.PolicyResponse.Stats.ProcessingTime.String(),
"applied", resp.PolicyResponse.Stats.RulesAppliedCount, "successful", resp.IsSuccessful()) "applied", resp.PolicyResponse.Stats.RulesAppliedCount,
"successful", resp.IsSuccessful(),
)
}() }()
policyContext.JSONContext().Checkpoint() policyContext.JSONContext().Checkpoint()
defer policyContext.JSONContext().Restore() defer policyContext.JSONContext().Restore()
ivm := &engineapi.ImageVerificationMetadata{} ivm := engineapi.ImageVerificationMetadata{}
rules := autogen.ComputeRules(policyContext.Policy()) rules := autogen.ComputeRules(policyContext.Policy())
applyRules := policy.GetSpec().GetApplyRules() applyRules := policy.GetSpec().GetApplyRules()
@ -49,7 +52,7 @@ func (e *engine) verifyAndPatchImages(
"pkg/engine", "pkg/engine",
fmt.Sprintf("RULE %s", rule.Name), fmt.Sprintf("RULE %s", rule.Name),
func(ctx context.Context, span trace.Span) { func(ctx context.Context, span trace.Span) {
e.doVerifyAndPatch(ctx, logger, policyContext, rule, resp, ivm) e.doVerifyAndPatch(ctx, logger, policyContext, rule, &resp, &ivm)
}, },
) )
@ -57,7 +60,7 @@ func (e *engine) verifyAndPatchImages(
break break
} }
} }
internal.BuildResponse(policyContext, &resp, startTime)
return resp, ivm return resp, ivm
} }

6
pkg/engine/imageVerify_test.go
View file

@ -167,7 +167,7 @@ func testVerifyAndPatchImages(
cmResolver engineapi.ConfigmapResolver, cmResolver engineapi.ConfigmapResolver,
pContext engineapi.PolicyContext, pContext engineapi.PolicyContext,
cfg config.Configuration, cfg config.Configuration,
) (*engineapi.EngineResponse, *engineapi.ImageVerificationMetadata) { ) (engineapi.EngineResponse, engineapi.ImageVerificationMetadata) {
e := NewEngine( e := NewEngine(
cfg, cfg,
nil, nil,
@ -769,11 +769,9 @@ func Test_MarkImageVerified(t *testing.T) {
assert.NilError(t, err) assert.NilError(t, err)
engineResponse, verifiedImages := testVerifyAndPatchImages(context.TODO(), registryclient.NewOrDie(), nil, policyContext, cfg) engineResponse, verifiedImages := testVerifyAndPatchImages(context.TODO(), registryclient.NewOrDie(), nil, policyContext, cfg)
assert.Assert(t, engineResponse != nil)
assert.Equal(t, len(engineResponse.PolicyResponse.Rules), 1) assert.Equal(t, len(engineResponse.PolicyResponse.Rules), 1)
assert.Equal(t, engineResponse.PolicyResponse.Rules[0].Status, engineapi.RuleStatusPass) assert.Equal(t, engineResponse.PolicyResponse.Rules[0].Status, engineapi.RuleStatusPass)
assert.Assert(t, verifiedImages != nil)
assert.Assert(t, verifiedImages.Data != nil) assert.Assert(t, verifiedImages.Data != nil)
assert.Equal(t, len(verifiedImages.Data), 1) assert.Equal(t, len(verifiedImages.Data), 1)
assert.Equal(t, verifiedImages.IsVerified(image), true) assert.Equal(t, verifiedImages.IsVerified(image), true)
@ -862,11 +860,9 @@ func Test_ParsePEMDelimited(t *testing.T) {
assert.NilError(t, err) assert.NilError(t, err)
engineResponse, verifiedImages := testVerifyAndPatchImages(context.TODO(), registryclient.NewOrDie(), nil, policyContext, cfg) engineResponse, verifiedImages := testVerifyAndPatchImages(context.TODO(), registryclient.NewOrDie(), nil, policyContext, cfg)
assert.Assert(t, engineResponse != nil)
assert.Equal(t, len(engineResponse.PolicyResponse.Rules), 1) assert.Equal(t, len(engineResponse.PolicyResponse.Rules), 1)
assert.Equal(t, engineResponse.PolicyResponse.Rules[0].Status, engineapi.RuleStatusPass) assert.Equal(t, engineResponse.PolicyResponse.Rules[0].Status, engineapi.RuleStatusPass)
assert.Assert(t, verifiedImages != nil)
assert.Assert(t, verifiedImages.Data != nil) assert.Assert(t, verifiedImages.Data != nil)
assert.Equal(t, len(verifiedImages.Data), 1) assert.Equal(t, len(verifiedImages.Data), 1)
assert.Equal(t, verifiedImages.IsVerified(image), true) assert.Equal(t, verifiedImages.IsVerified(image), true)

6
pkg/engine/mutation.go
View file

@ -33,8 +33,7 @@ func (e *engine) mutate(
logger.V(4).Info("start mutate policy processing", "startTime", startTime) logger.V(4).Info("start mutate policy processing", "startTime", startTime)
startMutateResultResponse(resp, policy, matchedResource) startMutateResultResponse(&resp, policy, matchedResource)
defer endMutateResultResponse(logger, resp, startTime)
policyContext.JSONContext().Checkpoint() policyContext.JSONContext().Checkpoint()
defer policyContext.JSONContext().Restore() defer policyContext.JSONContext().Restore()
@ -167,7 +166,8 @@ func (e *engine) mutate(
} }
resp.PatchedResource = matchedResource resp.PatchedResource = matchedResource
return *resp endMutateResultResponse(logger, &resp, startTime)
return resp
} }
func mutateResource(rule *kyvernov1.Rule, ctx engineapi.PolicyContext, resource unstructured.Unstructured, logger logr.Logger) *mutate.Response { func mutateResource(rule *kyvernov1.Rule, ctx engineapi.PolicyContext, resource unstructured.Unstructured, logger logr.Logger) *mutate.Response {

2
pkg/engine/validation.go
View file

@ -40,7 +40,7 @@ func (e *engine) validate(
defer logger.V(4).Info("finished policy processing", "processingTime", policyResponse.Stats.ProcessingTime.String(), "validationRulesApplied", policyResponse.Stats.RulesAppliedCount) defer logger.V(4).Info("finished policy processing", "processingTime", policyResponse.Stats.ProcessingTime.String(), "validationRulesApplied", policyResponse.Stats.RulesAppliedCount)
engineResponse := engineapi.NewEngineResponseFromPolicyContext(policyContext, nil) engineResponse := engineapi.NewEngineResponseFromPolicyContext(policyContext, nil)
engineResponse.PolicyResponse = *policyResponse engineResponse.PolicyResponse = *policyResponse
return *internal.BuildResponse(policyContext, engineResponse, startTime) return *internal.BuildResponse(policyContext, &engineResponse, startTime)
} }
func (e *engine) validateResource( func (e *engine) validateResource(

8
pkg/event/events.go
View file

@ -9,7 +9,7 @@ import (
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
) )
func NewPolicyFailEvent(source Source, reason Reason, engineResponse *engineapi.EngineResponse, ruleResp *engineapi.RuleResponse, blocked bool) Info { func NewPolicyFailEvent(source Source, reason Reason, engineResponse engineapi.EngineResponse, ruleResp *engineapi.RuleResponse, blocked bool) Info {
return Info{ return Info{
Kind: getPolicyKind(engineResponse.Policy), Kind: getPolicyKind(engineResponse.Policy),
Name: engineResponse.Policy.GetName(), Name: engineResponse.Policy.GetName(),
@ -47,7 +47,7 @@ func getPolicyKind(policy kyvernov1.PolicyInterface) string {
return "ClusterPolicy" return "ClusterPolicy"
} }
func NewPolicyAppliedEvent(source Source, engineResponse *engineapi.EngineResponse) Info { func NewPolicyAppliedEvent(source Source, engineResponse engineapi.EngineResponse) Info {
resource := engineResponse.Resource resource := engineResponse.Resource
var bldr strings.Builder var bldr strings.Builder
defer bldr.Reset() defer bldr.Reset()
@ -68,7 +68,7 @@ func NewPolicyAppliedEvent(source Source, engineResponse *engineapi.EngineRespon
} }
} }
func NewResourceViolationEvent(source Source, reason Reason, engineResponse *engineapi.EngineResponse, ruleResp *engineapi.RuleResponse) Info { func NewResourceViolationEvent(source Source, reason Reason, engineResponse engineapi.EngineResponse, ruleResp *engineapi.RuleResponse) Info {
var bldr strings.Builder var bldr strings.Builder
defer bldr.Reset() defer bldr.Reset()
@ -123,7 +123,7 @@ func NewBackgroundSuccessEvent(policy, rule string, source Source, r *unstructur
return events return events
} }
func NewPolicyExceptionEvents(engineResponse *engineapi.EngineResponse, ruleResp *engineapi.RuleResponse) []Info { func NewPolicyExceptionEvents(engineResponse engineapi.EngineResponse, ruleResp *engineapi.RuleResponse) []Info {
exceptionName, exceptionNamespace := ruleResp.Exception.GetName(), ruleResp.Exception.GetNamespace() exceptionName, exceptionNamespace := ruleResp.Exception.GetName(), ruleResp.Exception.GetNamespace()
policyMessage := fmt.Sprintf("resource %s was skipped from rule %s due to policy exception %s/%s", resourceKey(engineResponse.PatchedResource), ruleResp.Name, exceptionNamespace, exceptionName) policyMessage := fmt.Sprintf("resource %s was skipped from rule %s due to policy exception %s/%s", resourceKey(engineResponse.PatchedResource), ruleResp.Name, exceptionNamespace, exceptionName)
var exceptionMessage string var exceptionMessage string

4
pkg/utils/annotations.go
View file

@ -33,7 +33,7 @@ var OperationToPastTense = map[string]string{
"test": "tested", "test": "tested",
} }
func GenerateAnnotationPatches(engineResponses []*engineapi.EngineResponse, log logr.Logger) [][]byte { func GenerateAnnotationPatches(engineResponses []engineapi.EngineResponse, log logr.Logger) [][]byte {
var annotations map[string]string var annotations map[string]string
var patchBytes [][]byte var patchBytes [][]byte
for _, er := range engineResponses { for _, er := range engineResponses {
@ -91,7 +91,7 @@ func GenerateAnnotationPatches(engineResponses []*engineapi.EngineResponse, log
return patchBytes return patchBytes
} }
func annotationFromEngineResponses(engineResponses []*engineapi.EngineResponse, log logr.Logger) []byte { func annotationFromEngineResponses(engineResponses []engineapi.EngineResponse, log logr.Logger) []byte {
annotationContent := make(map[string]string) annotationContent := make(map[string]string)
for _, engineResponse := range engineResponses { for _, engineResponse := range engineResponses {
if !engineResponse.IsSuccessful() { if !engineResponse.IsSuccessful() {

16
pkg/utils/annotations_test.go
View file

@ -28,7 +28,7 @@ func newPolicyResponse(rule string, patchesStr []string, status engineapi.RuleSt
} }
} }
func newEngineResponse(policy, rule string, patchesStr []string, status engineapi.RuleStatus, annotation map[string]interface{}) *engineapi.EngineResponse { func newEngineResponse(policy, rule string, patchesStr []string, status engineapi.RuleStatus, annotation map[string]interface{}) engineapi.EngineResponse {
p := &kyvernov1.ClusterPolicy{ p := &kyvernov1.ClusterPolicy{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
Name: policy, Name: policy,
@ -49,7 +49,7 @@ func newEngineResponse(policy, rule string, patchesStr []string, status engineap
func Test_empty_annotation(t *testing.T) { func Test_empty_annotation(t *testing.T) {
patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }` patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }`
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, nil) engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, nil)
annPatches := GenerateAnnotationPatches([]*engineapi.EngineResponse{engineResponse}, logging.GlobalLogger()) annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
expectedPatches := `{"path":"/metadata/annotations","op":"add","value":{"policies.kyverno.io/last-applied-patches":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}}` expectedPatches := `{"path":"/metadata/annotations","op":"add","value":{"policies.kyverno.io/last-applied-patches":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}}`
assert.Equal(t, string(annPatches[0]), expectedPatches) assert.Equal(t, string(annPatches[0]), expectedPatches)
} }
@ -60,7 +60,7 @@ func Test_exist_annotation(t *testing.T) {
} }
patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }` patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }`
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, annotation) engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, annotation)
annPatches := GenerateAnnotationPatches([]*engineapi.EngineResponse{engineResponse}, logging.GlobalLogger()) annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
expectedPatches := `{"path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","op":"add","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}` expectedPatches := `{"path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","op":"add","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}`
assert.Equal(t, string(annPatches[0]), expectedPatches) assert.Equal(t, string(annPatches[0]), expectedPatches)
} }
@ -71,7 +71,7 @@ func Test_exist_kyverno_annotation(t *testing.T) {
} }
patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }` patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }`
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, annotation) engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, annotation)
annPatches := GenerateAnnotationPatches([]*engineapi.EngineResponse{engineResponse}, logging.GlobalLogger()) annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
expectedPatches := `{"path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","op":"add","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}` expectedPatches := `{"path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","op":"add","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}`
assert.Equal(t, string(annPatches[0]), expectedPatches) assert.Equal(t, string(annPatches[0]), expectedPatches)
} }
@ -81,10 +81,10 @@ func Test_annotation_nil_patch(t *testing.T) {
"policies.kyverno.patches": "old-annotation", "policies.kyverno.patches": "old-annotation",
} }
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, engineapi.RuleStatusPass, annotation) engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, engineapi.RuleStatusPass, annotation)
annPatches := GenerateAnnotationPatches([]*engineapi.EngineResponse{engineResponse}, logging.GlobalLogger()) annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
assert.Assert(t, annPatches == nil) assert.Assert(t, annPatches == nil)
engineResponseNew := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{""}, engineapi.RuleStatusPass, annotation) engineResponseNew := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{""}, engineapi.RuleStatusPass, annotation)
annPatchesNew := GenerateAnnotationPatches([]*engineapi.EngineResponse{engineResponseNew}, logging.GlobalLogger()) annPatchesNew := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponseNew}, logging.GlobalLogger())
assert.Assert(t, annPatchesNew == nil) assert.Assert(t, annPatchesNew == nil)
} }
@ -93,7 +93,7 @@ func Test_annotation_failed_Patch(t *testing.T) {
"policies.kyverno.patches": "old-annotation", "policies.kyverno.patches": "old-annotation",
} }
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, engineapi.RuleStatusFail, annotation) engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", nil, engineapi.RuleStatusFail, annotation)
annPatches := GenerateAnnotationPatches([]*engineapi.EngineResponse{engineResponse}, logging.GlobalLogger()) annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
assert.Assert(t, annPatches == nil) assert.Assert(t, annPatches == nil)
} }
@ -103,7 +103,7 @@ func Test_exist_patches(t *testing.T) {
} }
patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }` patchStr := `{ "op": "replace", "path": "/spec/containers/0/imagePullPolicy", "value": "IfNotPresent" }`
engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, annotation) engineResponse := newEngineResponse("mutate-container", "default-imagepullpolicy", []string{patchStr}, engineapi.RuleStatusPass, annotation)
annPatches := GenerateAnnotationPatches([]*engineapi.EngineResponse{engineResponse}, logging.GlobalLogger()) annPatches := GenerateAnnotationPatches([]engineapi.EngineResponse{engineResponse}, logging.GlobalLogger())
expectedPatches1 := `{"path":"/metadata/annotations/policies.kyverno.io~1patches","op":"remove"}` expectedPatches1 := `{"path":"/metadata/annotations/policies.kyverno.io~1patches","op":"remove"}`
expectedPatches2 := `{"path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","op":"add","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}` expectedPatches2 := `{"path":"/metadata/annotations/policies.kyverno.io~1last-applied-patches","op":"add","value":"default-imagepullpolicy.mutate-container.kyverno.io: replaced /spec/containers/0/imagePullPolicy\n"}`
assert.Equal(t, string(annPatches[0]), expectedPatches1) assert.Equal(t, string(annPatches[0]), expectedPatches1)

4
pkg/utils/engine/response.go
View file

@ -6,7 +6,7 @@ import (
) )
// IsResponseSuccessful return true if all responses are successful // IsResponseSuccessful return true if all responses are successful
func IsResponseSuccessful(engineReponses []*engineapi.EngineResponse) bool { func IsResponseSuccessful(engineReponses []engineapi.EngineResponse) bool {
for _, er := range engineReponses { for _, er := range engineReponses {
if !er.IsSuccessful() { if !er.IsSuccessful() {
return false return false
@ -18,7 +18,7 @@ func IsResponseSuccessful(engineReponses []*engineapi.EngineResponse) bool {
// BlockRequest returns true when: // BlockRequest returns true when:
// 1. a policy fails (i.e. creates a violation) and validationFailureAction is set to 'enforce' // 1. a policy fails (i.e. creates a violation) and validationFailureAction is set to 'enforce'
// 2. a policy has a processing error and failurePolicy is set to 'Fail` // 2. a policy has a processing error and failurePolicy is set to 'Fail`
func BlockRequest(er *engineapi.EngineResponse, failurePolicy kyvernov1.FailurePolicyType) bool { func BlockRequest(er engineapi.EngineResponse, failurePolicy kyvernov1.FailurePolicyType) bool {
if er.IsFailed() && er.GetValidationFailureAction().Enforce() { if er.IsFailed() && er.GetValidationFailureAction().Enforce() {
return true return true
} }

2
pkg/utils/report/new.go
View file

@ -27,7 +27,7 @@ func NewAdmissionReport(namespace, name string, gvr schema.GroupVersionResource,
return report return report
} }
func BuildAdmissionReport(resource unstructured.Unstructured, request *admissionv1.AdmissionRequest, responses ...*engineapi.EngineResponse) kyvernov1alpha2.ReportInterface { func BuildAdmissionReport(resource unstructured.Unstructured, request *admissionv1.AdmissionRequest, responses ...engineapi.EngineResponse) kyvernov1alpha2.ReportInterface {
report := NewAdmissionReport(resource.GetNamespace(), string(request.UID), schema.GroupVersionResource(request.Resource), resource) report := NewAdmissionReport(resource.GetNamespace(), string(request.UID), schema.GroupVersionResource(request.Resource), resource)
SetResponses(report, responses...) SetResponses(report, responses...)
return report return report

4
pkg/utils/report/results.go
View file

@ -81,7 +81,7 @@ func severityFromString(severity string) policyreportv1alpha2.PolicySeverity {
return "" return ""
} }
func EngineResponseToReportResults(response *engineapi.EngineResponse) []policyreportv1alpha2.PolicyReportResult { func EngineResponseToReportResults(response engineapi.EngineResponse) []policyreportv1alpha2.PolicyReportResult {
key, _ := cache.MetaNamespaceKeyFunc(response.Policy) key, _ := cache.MetaNamespaceKeyFunc(response.Policy)
var results []policyreportv1alpha2.PolicyReportResult var results []policyreportv1alpha2.PolicyReportResult
for _, ruleResult := range response.PolicyResponse.Rules { for _, ruleResult := range response.PolicyResponse.Rules {
@ -153,7 +153,7 @@ func SetResults(report kyvernov1alpha2.ReportInterface, results ...policyreportv
report.SetSummary(CalculateSummary(results)) report.SetSummary(CalculateSummary(results))
} }
func SetResponses(report kyvernov1alpha2.ReportInterface, engineResponses ...*engineapi.EngineResponse) { func SetResponses(report kyvernov1alpha2.ReportInterface, engineResponses ...engineapi.EngineResponse) {
var ruleResults []policyreportv1alpha2.PolicyReportResult var ruleResults []policyreportv1alpha2.PolicyReportResult
for _, result := range engineResponses { for _, result := range engineResponses {
SetPolicyLabel(report, result.Policy) SetPolicyLabel(report, result.Policy)

6
pkg/webhooks/resource/imageverification/handler.go
View file

@ -79,9 +79,9 @@ func (h *imageVerificationHandler) handleVerifyImages(
if len(policies) == 0 { if len(policies) == 0 {
return true, "", nil, nil return true, "", nil, nil
} }
var engineResponses []*engineapi.EngineResponse var engineResponses []engineapi.EngineResponse
var patches [][]byte var patches [][]byte
verifiedImageData := &engineapi.ImageVerificationMetadata{} verifiedImageData := engineapi.ImageVerificationMetadata{}
for _, policy := range policies { for _, policy := range policies {
tracing.ChildSpan( tracing.ChildSpan(
ctx, ctx,
@ -148,7 +148,7 @@ func (v *imageVerificationHandler) handleAudit(
resource unstructured.Unstructured, resource unstructured.Unstructured,
request *admissionv1.AdmissionRequest, request *admissionv1.AdmissionRequest,
namespaceLabels map[string]string, namespaceLabels map[string]string,
engineResponses ...*engineapi.EngineResponse, engineResponses ...engineapi.EngineResponse,
) { ) {
createReport := v.admissionReports createReport := v.admissionReports
if admissionutils.IsDryRun(request) { if admissionutils.IsDryRun(request) {

12
pkg/webhooks/resource/mutation/mutation.go
View file

@ -79,7 +79,7 @@ func (v *mutationHandler) applyMutations(
request *admissionv1.AdmissionRequest, request *admissionv1.AdmissionRequest,
policies []kyvernov1.PolicyInterface, policies []kyvernov1.PolicyInterface,
policyContext *engine.PolicyContext, policyContext *engine.PolicyContext,
) ([]byte, []*engineapi.EngineResponse, error) { ) ([]byte, []engineapi.EngineResponse, error) {
if len(policies) == 0 { if len(policies) == 0 {
return nil, nil, nil return nil, nil, nil
} }
@ -89,7 +89,7 @@ func (v *mutationHandler) applyMutations(
} }
var patches [][]byte var patches [][]byte
var engineResponses []*engineapi.EngineResponse var engineResponses []engineapi.EngineResponse
for _, policy := range policies { for _, policy := range policies {
spec := policy.GetSpec() spec := policy.GetSpec()
@ -117,8 +117,10 @@ func (v *mutationHandler) applyMutations(
} }
} }
policyContext = currentContext.WithNewResource(engineResponse.PatchedResource) if engineResponse != nil {
engineResponses = append(engineResponses, engineResponse) policyContext = currentContext.WithNewResource(engineResponse.PatchedResource)
engineResponses = append(engineResponses, *engineResponse)
}
// registering the kyverno_policy_results_total metric concurrently // registering the kyverno_policy_results_total metric concurrently
go webhookutils.RegisterPolicyResultsMetricMutation(context.TODO(), v.log, v.metrics, string(request.Operation), policy, *engineResponse) go webhookutils.RegisterPolicyResultsMetricMutation(context.TODO(), v.log, v.metrics, string(request.Operation), policy, *engineResponse)
@ -171,7 +173,7 @@ func (h *mutationHandler) applyMutation(ctx context.Context, request *admissionv
return &engineResponse, policyPatches, nil return &engineResponse, policyPatches, nil
} }
func logMutationResponse(patches [][]byte, engineResponses []*engineapi.EngineResponse, logger logr.Logger) { func logMutationResponse(patches [][]byte, engineResponses []engineapi.EngineResponse, logger logr.Logger) {
if len(patches) != 0 { if len(patches) != 0 {
logger.V(4).Info("created patches", "count", len(patches)) logger.V(4).Info("created patches", "count", len(patches))
} }

12
pkg/webhooks/resource/validation/validation.go
View file

@ -89,7 +89,7 @@ func (v *validationHandler) HandleValidation(
return true, "", nil return true, "", nil
} }
var engineResponses []*engineapi.EngineResponse var engineResponses []engineapi.EngineResponse
failurePolicy := kyvernov1.Ignore failurePolicy := kyvernov1.Ignore
for _, policy := range policies { for _, policy := range policies {
tracing.ChildSpan( tracing.ChildSpan(
@ -112,7 +112,7 @@ func (v *validationHandler) HandleValidation(
go webhookutils.RegisterPolicyResultsMetricValidation(ctx, logger, v.metrics, string(request.Operation), policyContext.Policy(), engineResponse) go webhookutils.RegisterPolicyResultsMetricValidation(ctx, logger, v.metrics, string(request.Operation), policyContext.Policy(), engineResponse)
go webhookutils.RegisterPolicyExecutionDurationMetricValidate(ctx, logger, v.metrics, string(request.Operation), policyContext.Policy(), engineResponse) go webhookutils.RegisterPolicyExecutionDurationMetricValidate(ctx, logger, v.metrics, string(request.Operation), policyContext.Policy(), engineResponse)
engineResponses = append(engineResponses, &engineResponse) engineResponses = append(engineResponses, engineResponse)
if !engineResponse.IsSuccessful() { if !engineResponse.IsSuccessful() {
logger.V(2).Info("validation failed", "action", policy.GetSpec().ValidationFailureAction, "policy", policy.GetName(), "failed rules", engineResponse.GetFailedRules()) logger.V(2).Info("validation failed", "action", policy.GetSpec().ValidationFailureAction, "policy", policy.GetName(), "failed rules", engineResponse.GetFailedRules())
return return
@ -147,14 +147,14 @@ func (v *validationHandler) buildAuditResponses(
resource unstructured.Unstructured, resource unstructured.Unstructured,
request *admissionv1.AdmissionRequest, request *admissionv1.AdmissionRequest,
namespaceLabels map[string]string, namespaceLabels map[string]string,
) ([]*engineapi.EngineResponse, error) { ) ([]engineapi.EngineResponse, error) {
gvr := schema.GroupVersionResource(request.Resource) gvr := schema.GroupVersionResource(request.Resource)
policies := v.pCache.GetPolicies(policycache.ValidateAudit, gvr, request.SubResource, request.Namespace) policies := v.pCache.GetPolicies(policycache.ValidateAudit, gvr, request.SubResource, request.Namespace)
policyContext, err := v.pcBuilder.Build(request) policyContext, err := v.pcBuilder.Build(request)
if err != nil { if err != nil {
return nil, err return nil, err
} }
var responses []*engineapi.EngineResponse var responses []engineapi.EngineResponse
for _, policy := range policies { for _, policy := range policies {
tracing.ChildSpan( tracing.ChildSpan(
ctx, ctx,
@ -163,7 +163,7 @@ func (v *validationHandler) buildAuditResponses(
func(ctx context.Context, span trace.Span) { func(ctx context.Context, span trace.Span) {
policyContext := policyContext.WithPolicy(policy).WithNamespaceLabels(namespaceLabels) policyContext := policyContext.WithPolicy(policy).WithNamespaceLabels(namespaceLabels)
response := v.engine.Validate(ctx, policyContext) response := v.engine.Validate(ctx, policyContext)
responses = append(responses, &response) responses = append(responses, response)
go webhookutils.RegisterPolicyResultsMetricValidation(ctx, v.log, v.metrics, string(request.Operation), policyContext.Policy(), response) go webhookutils.RegisterPolicyResultsMetricValidation(ctx, v.log, v.metrics, string(request.Operation), policyContext.Policy(), response)
go webhookutils.RegisterPolicyExecutionDurationMetricValidate(ctx, v.log, v.metrics, string(request.Operation), policyContext.Policy(), response) go webhookutils.RegisterPolicyExecutionDurationMetricValidate(ctx, v.log, v.metrics, string(request.Operation), policyContext.Policy(), response)
}, },
@ -177,7 +177,7 @@ func (v *validationHandler) handleAudit(
resource unstructured.Unstructured, resource unstructured.Unstructured,
request *admissionv1.AdmissionRequest, request *admissionv1.AdmissionRequest,
namespaceLabels map[string]string, namespaceLabels map[string]string,
engineResponses ...*engineapi.EngineResponse, engineResponses ...engineapi.EngineResponse,
) { ) {
createReport := v.admissionReports createReport := v.admissionReports
if admissionutils.IsDryRun(request) { if admissionutils.IsDryRun(request) {

6
pkg/webhooks/resource/validation_test.go
View file

@ -1077,7 +1077,7 @@ func TestValidate_failure_action_overrides(t *testing.T) {
} }
failurePolicy := kyvernov1.Fail failurePolicy := kyvernov1.Fail
blocked := webhookutils.BlockRequest([]*engineapi.EngineResponse{&er}, failurePolicy, log.WithName("WebhookServer")) blocked := webhookutils.BlockRequest([]engineapi.EngineResponse{er}, failurePolicy, log.WithName("WebhookServer"))
assert.Assert(t, tc.blocked == blocked) assert.Assert(t, tc.blocked == blocked)
}) })
} }
@ -1143,7 +1143,7 @@ func Test_RuleSelector(t *testing.T) {
assert.Assert(t, resp.PolicyResponse.Stats.RulesErrorCount == 0) assert.Assert(t, resp.PolicyResponse.Stats.RulesErrorCount == 0)
log := log.WithName("Test_RuleSelector") log := log.WithName("Test_RuleSelector")
blocked := webhookutils.BlockRequest([]*engineapi.EngineResponse{&resp}, kyvernov1.Fail, log) blocked := webhookutils.BlockRequest([]engineapi.EngineResponse{resp}, kyvernov1.Fail, log)
assert.Assert(t, blocked == true) assert.Assert(t, blocked == true)
applyOne := kyvernov1.ApplyOne applyOne := kyvernov1.ApplyOne
@ -1155,6 +1155,6 @@ func Test_RuleSelector(t *testing.T) {
assert.Assert(t, resp.PolicyResponse.Stats.RulesAppliedCount == 1) assert.Assert(t, resp.PolicyResponse.Stats.RulesAppliedCount == 1)
assert.Assert(t, resp.PolicyResponse.Stats.RulesErrorCount == 0) assert.Assert(t, resp.PolicyResponse.Stats.RulesErrorCount == 0)
blocked = webhookutils.BlockRequest([]*engineapi.EngineResponse{&resp}, kyvernov1.Fail, log) blocked = webhookutils.BlockRequest([]engineapi.EngineResponse{resp}, kyvernov1.Fail, log)
assert.Assert(t, blocked == false) assert.Assert(t, blocked == false)
} }

4
pkg/webhooks/utils/block.go
View file

@ -23,7 +23,7 @@ func getAction(hasViolations bool, i int) string {
// returns true -> if there is even one policy that blocks resource request // returns true -> if there is even one policy that blocks resource request
// returns false -> if all the policies are meant to report only, we dont block resource request // returns false -> if all the policies are meant to report only, we dont block resource request
func BlockRequest(engineResponses []*engineapi.EngineResponse, failurePolicy kyvernov1.FailurePolicyType, log logr.Logger) bool { func BlockRequest(engineResponses []engineapi.EngineResponse, failurePolicy kyvernov1.FailurePolicyType, log logr.Logger) bool {
for _, er := range engineResponses { for _, er := range engineResponses {
if engineutils.BlockRequest(er, failurePolicy) { if engineutils.BlockRequest(er, failurePolicy) {
log.V(2).Info("blocking admission request", "policy", er.Policy.GetName()) log.V(2).Info("blocking admission request", "policy", er.Policy.GetName())
@ -35,7 +35,7 @@ func BlockRequest(engineResponses []*engineapi.EngineResponse, failurePolicy kyv
} }
// GetBlockedMessages gets the error messages for rules with error or fail status // GetBlockedMessages gets the error messages for rules with error or fail status
func GetBlockedMessages(engineResponses []*engineapi.EngineResponse) string { func GetBlockedMessages(engineResponses []engineapi.EngineResponse) string {
if len(engineResponses) == 0 { if len(engineResponses) == 0 {
return "" return ""
} }

22
pkg/webhooks/utils/block_test.go
View file

@ -72,7 +72,7 @@ func TestBlockRequest(t *testing.T) {
}, },
} }
type args struct { type args struct {
engineResponses []*engineapi.EngineResponse engineResponses []engineapi.EngineResponse
failurePolicy kyvernov1.FailurePolicyType failurePolicy kyvernov1.FailurePolicyType
log logr.Logger log logr.Logger
} }
@ -83,7 +83,7 @@ func TestBlockRequest(t *testing.T) {
}{{ }{{
name: "failure - enforce", name: "failure - enforce",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -101,7 +101,7 @@ func TestBlockRequest(t *testing.T) {
}, { }, {
name: "failure - audit", name: "failure - audit",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -119,7 +119,7 @@ func TestBlockRequest(t *testing.T) {
}, { }, {
name: "error - fail", name: "error - fail",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -137,7 +137,7 @@ func TestBlockRequest(t *testing.T) {
}, { }, {
name: "error - ignore", name: "error - ignore",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -155,7 +155,7 @@ func TestBlockRequest(t *testing.T) {
}, { }, {
name: "warning - ignore", name: "warning - ignore",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -173,7 +173,7 @@ func TestBlockRequest(t *testing.T) {
}, { }, {
name: "warning - fail", name: "warning - fail",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, auditPolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -216,7 +216,7 @@ func TestGetBlockedMessages(t *testing.T) {
}, },
} }
type args struct { type args struct {
engineResponses []*engineapi.EngineResponse engineResponses []engineapi.EngineResponse
} }
tests := []struct { tests := []struct {
name string name string
@ -225,7 +225,7 @@ func TestGetBlockedMessages(t *testing.T) {
}{{ }{{
name: "failure - enforce", name: "failure - enforce",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -241,7 +241,7 @@ func TestGetBlockedMessages(t *testing.T) {
}, { }, {
name: "error - enforce", name: "error - enforce",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {
@ -257,7 +257,7 @@ func TestGetBlockedMessages(t *testing.T) {
}, { }, {
name: "error and failure - enforce", name: "error and failure - enforce",
args: args{ args: args{
engineResponses: []*engineapi.EngineResponse{ engineResponses: []engineapi.EngineResponse{
engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{ engineapi.NewEngineResponse(resource, enforcePolicy, nil, &engineapi.PolicyResponse{
Rules: []engineapi.RuleResponse{ Rules: []engineapi.RuleResponse{
{ {

2
pkg/webhooks/utils/error.go
View file

@ -7,7 +7,7 @@ import (
engineapi "github.com/kyverno/kyverno/pkg/engine/api" engineapi "github.com/kyverno/kyverno/pkg/engine/api"
) )
func GetErrorMsg(engineReponses []*engineapi.EngineResponse) string { func GetErrorMsg(engineReponses []engineapi.EngineResponse) string {
var str []string var str []string
var resourceInfo string var resourceInfo string
for _, er := range engineReponses { for _, er := range engineReponses {

2
pkg/webhooks/utils/event.go
View file

@ -6,7 +6,7 @@ import (
) )
// GenerateEvents generates event info for the engine responses // GenerateEvents generates event info for the engine responses
func GenerateEvents(engineResponses []*engineapi.EngineResponse, blocked bool) []event.Info { func GenerateEvents(engineResponses []engineapi.EngineResponse, blocked bool) []event.Info {
var events []event.Info var events []event.Info
// - Some/All policies fail or error // - Some/All policies fail or error
// - report failure events on policy // - report failure events on policy

2
pkg/webhooks/utils/warning.go
View file

@ -6,7 +6,7 @@ import (
engineapi "github.com/kyverno/kyverno/pkg/engine/api" engineapi "github.com/kyverno/kyverno/pkg/engine/api"
) )
func GetWarningMessages(engineResponses []*engineapi.EngineResponse) []string { func GetWarningMessages(engineResponses []engineapi.EngineResponse) []string {
var warnings []string var warnings []string
for _, er := range engineResponses { for _, er := range engineResponses {
for _, rule := range er.PolicyResponse.Rules { for _, rule := range er.PolicyResponse.Rules {

8
pkg/webhooks/utils/warning_test.go
View file

@ -11,7 +11,7 @@ import (
func TestGetWarningMessages(t *testing.T) { func TestGetWarningMessages(t *testing.T) {
type args struct { type args struct {
engineResponses []*engineapi.EngineResponse engineResponses []engineapi.EngineResponse
} }
tests := []struct { tests := []struct {
name string name string
@ -23,11 +23,11 @@ func TestGetWarningMessages(t *testing.T) {
want: nil, want: nil,
}, { }, {
name: "enmpty response", name: "enmpty response",
args: args{[]*engineapi.EngineResponse{}}, args: args{[]engineapi.EngineResponse{}},
want: nil, want: nil,
}, { }, {
name: "warning", name: "warning",
args: args{[]*engineapi.EngineResponse{ args: args{[]engineapi.EngineResponse{
{ {
Policy: &v1.ClusterPolicy{ Policy: &v1.ClusterPolicy{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{
@ -50,7 +50,7 @@ func TestGetWarningMessages(t *testing.T) {
}, },
}, { }, {
name: "multiple rules", name: "multiple rules",
args: args{[]*engineapi.EngineResponse{ args: args{[]engineapi.EngineResponse{
{ {
Policy: &v1.ClusterPolicy{ Policy: &v1.ClusterPolicy{
ObjectMeta: metav1.ObjectMeta{ ObjectMeta: metav1.ObjectMeta{