1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
kyverno/pkg/engine/validate/validate.go
Liang Deng 8298a9a858
fix: validate pattern premature skip (#9155)
Signed-off-by: Liang Deng <283304489@qq.com>
Co-authored-by: shuting <shuting@nirmata.com>
2024-01-29 13:06:39 +00:00

261 lines
8.7 KiB
Go

package validate
import (
"fmt"
"sort"
"strconv"
"github.com/go-logr/logr"
"github.com/kyverno/kyverno/pkg/engine/anchor"
"github.com/kyverno/kyverno/pkg/engine/pattern"
"github.com/kyverno/kyverno/pkg/engine/wildcards"
"go.uber.org/multierr"
)
type PatternError struct {
Err error
Path string
Skip bool
}
func (e *PatternError) Error() string {
if e.Err == nil {
return ""
}
return e.Err.Error()
}
// MatchPattern is a start of element-by-element pattern validation process.
// It assumes that validation is started from root, so "/" is passed
func MatchPattern(logger logr.Logger, resource, pattern interface{}) error {
// newAnchorMap - to check anchor key has values
ac := anchor.NewAnchorMap()
elemPath, err := validateResourceElement(logger, resource, pattern, pattern, "/", ac)
if err != nil {
if skip(err) {
logger.V(2).Info("resource skipped", "reason", ac.AnchorError.Error())
return &PatternError{err, "", true}
}
if fail(err) {
logger.V(2).Info("failed to apply rule on resource", "msg", ac.AnchorError.Error())
return &PatternError{err, elemPath, false}
}
// check if an anchor defined in the policy rule is missing in the resource
if ac.KeysAreMissing() {
logger.V(3).Info("missing anchor in resource")
return &PatternError{err, "", false}
}
return &PatternError{err, elemPath, false}
}
return nil
}
func skip(err error) bool {
// if conditional or global anchors report errors, the rule does not apply to the resource
return anchor.IsConditionalAnchorError(err) || anchor.IsGlobalAnchorError(err)
}
func fail(err error) bool {
// if negation anchors report errors, the rule will fail
return anchor.IsNegationAnchorError(err)
}
// validateResourceElement detects the element type (map, array, nil, string, int, bool, float)
// and calls corresponding handler
// Pattern tree and resource tree can have different structure. In this case validation fails
func validateResourceElement(log logr.Logger, resourceElement, patternElement, originPattern interface{}, path string, ac *anchor.AnchorMap) (string, error) {
switch typedPatternElement := patternElement.(type) {
// map
case map[string]interface{}:
typedResourceElement, ok := resourceElement.(map[string]interface{})
if !ok {
log.V(4).Info("Pattern and resource have different structures.", "path", path, "expected", fmt.Sprintf("%T", patternElement), "current", fmt.Sprintf("%T", resourceElement))
return path, fmt.Errorf("pattern and resource have different structures. Path: %s. Expected %T, found %T", path, patternElement, resourceElement)
}
// CheckAnchorInResource - check anchor key exists in resource and update the AnchorKey fields.
ac.CheckAnchorInResource(typedPatternElement, typedResourceElement)
return validateMap(log, typedResourceElement, typedPatternElement, originPattern, path, ac)
// array
case []interface{}:
typedResourceElement, ok := resourceElement.([]interface{})
if !ok {
log.V(4).Info("Pattern and resource have different structures.", "path", path, "expected", fmt.Sprintf("%T", patternElement), "current", fmt.Sprintf("%T", resourceElement))
return path, fmt.Errorf("validation rule failed at path %s, resource does not satisfy the expected overlay pattern", path)
}
return validateArray(log, typedResourceElement, typedPatternElement, originPattern, path, ac)
// elementary values
case string, float64, int, int64, bool, nil:
/*Analyze pattern */
switch resource := resourceElement.(type) {
case []interface{}:
for _, res := range resource {
if !pattern.Validate(log, res, patternElement) {
return path, fmt.Errorf("resource value '%v' does not match '%v' at path %s", resourceElement, patternElement, path)
}
}
return "", nil
default:
if !pattern.Validate(log, resourceElement, patternElement) {
return path, fmt.Errorf("resource value '%v' does not match '%v' at path %s", resourceElement, patternElement, path)
}
}
default:
log.V(4).Info("Pattern contains unknown type", "path", path, "current", fmt.Sprintf("%T", patternElement))
return path, fmt.Errorf("failed at '%s', pattern contains unknown type", path)
}
return "", nil
}
// If validateResourceElement detects map element inside resource and pattern trees, it goes to validateMap
// For each element of the map we must detect the type again, so we pass these elements to validateResourceElement
func validateMap(log logr.Logger, resourceMap, patternMap map[string]interface{}, origPattern interface{}, path string, ac *anchor.AnchorMap) (string, error) {
patternMap = wildcards.ExpandInMetadata(patternMap, resourceMap)
// check if there is anchor in pattern
// Phase 1 : Evaluate all the anchors
// Phase 2 : Evaluate non-anchors
anchors, resources := anchor.GetAnchorsResourcesFromMap(patternMap)
keys := make([]string, 0, len(anchors))
for k := range anchors {
keys = append(keys, k)
}
sort.Strings(keys)
// Evaluate anchors
var skipErrors []error
var applyCount int
for _, key := range keys {
patternElement := anchors[key]
// get handler for each pattern in the pattern
// - Conditional
// - Existence
// - Equality
handler := anchor.CreateElementHandler(key, patternElement, path)
handlerPath, err := handler.Handle(validateResourceElement, resourceMap, origPattern, ac)
if err != nil {
if skip(err) {
skipErrors = append(skipErrors, err)
continue
}
return handlerPath, err
}
applyCount++
}
if applyCount == 0 && len(skipErrors) > 0 {
return path, &PatternError{
Err: multierr.Combine(skipErrors...),
Path: path,
Skip: true,
}
}
// Evaluate resources
// getSortedNestedAnchorResource - keeps the anchor key to start of the list
sortedResourceKeys := getSortedNestedAnchorResource(resources)
for e := sortedResourceKeys.Front(); e != nil; e = e.Next() {
key := e.Value.(string)
handler := anchor.CreateElementHandler(key, resources[key], path)
handlerPath, err := handler.Handle(validateResourceElement, resourceMap, origPattern, ac)
if err != nil {
return handlerPath, err
}
}
return "", nil
}
func validateArray(log logr.Logger, resourceArray, patternArray []interface{}, originPattern interface{}, path string, ac *anchor.AnchorMap) (string, error) {
if len(patternArray) == 0 {
return path, fmt.Errorf("pattern Array empty")
}
switch typedPatternElement := patternArray[0].(type) {
case map[string]interface{}:
// This is special case, because maps in arrays can have anchors that must be
// processed with the special way affecting the entire array
elemPath, err := validateArrayOfMaps(log, resourceArray, typedPatternElement, originPattern, path, ac)
if err != nil {
return elemPath, err
}
case string, float64, int, int64, bool, nil:
elemPath, err := validateResourceElement(log, resourceArray, typedPatternElement, originPattern, path, ac)
if err != nil {
return elemPath, err
}
default:
// In all other cases - detect type and handle each array element with validateResourceElement
if len(resourceArray) < len(patternArray) {
return "", fmt.Errorf("validate Array failed, array length mismatch, resource Array len is %d and pattern Array len is %d", len(resourceArray), len(patternArray))
}
var applyCount int
var skipErrors []error
for i, patternElement := range patternArray {
currentPath := path + strconv.Itoa(i) + "/"
elemPath, err := validateResourceElement(log, resourceArray[i], patternElement, originPattern, currentPath, ac)
if err != nil {
if skip(err) {
skipErrors = append(skipErrors, err)
continue
}
return elemPath, err
}
applyCount++
}
if applyCount == 0 && len(skipErrors) > 0 {
return path, &PatternError{
Err: multierr.Combine(skipErrors...),
Path: path,
Skip: true,
}
}
}
return "", nil
}
// validateArrayOfMaps gets anchors from pattern array map element, applies anchors logic
// and then validates each map due to the pattern
func validateArrayOfMaps(log logr.Logger, resourceMapArray []interface{}, patternMap map[string]interface{}, originPattern interface{}, path string, ac *anchor.AnchorMap) (string, error) {
applyCount := 0
skipErrors := make([]error, 0)
for i, resourceElement := range resourceMapArray {
// check the types of resource element
// expect it to be a map, but can be anything ?:(
currentPath := path + strconv.Itoa(i) + "/"
returnPath, err := validateResourceElement(log, resourceElement, patternMap, originPattern, currentPath, ac)
if err != nil {
if skip(err) {
skipErrors = append(skipErrors, err)
continue
}
return returnPath, err
}
applyCount++
}
if applyCount == 0 && len(skipErrors) > 0 {
return path, &PatternError{
Err: multierr.Combine(skipErrors...),
Path: path,
Skip: true,
}
}
return "", nil
}