[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: skip generating VAP when an exception is defined #9386

Merged
merged 5 commits into from
Jan 18, 2024
Merged

feat: skip generating VAP when an exception is defined #9386

merged 5 commits into from
Jan 18, 2024

Conversation

MariamFahmy98
Copy link
Contributor

Explanation

This PR skips generating ValidatingAdmissionPolicy in case an exception is created

Related issue

Closes #8733

Milestone of this PR

/milestone 1.12

Documentation (optional)

My PR contains new or altered behavior to Kyverno.

What type of PR is this

/kind feature

Proposed Changes

Proof Manifests

  1. Create a Kyverno policy:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-host-path
spec:
  validationFailureAction: Audit
  background: false
  rules:
    - name: host-path
      match:
        all:
        - resources:
            kinds:
            - Deployment
            - StatefulSet
            operations:
            - CREATE
            - UPDATE
            selector:
              matchLabels:
                app: critical
      validate:
        cel:
          expressions:
            - expression: "!has(object.spec.template.spec.volumes) || object.spec.template.spec.volumes.all(volume, !has(volume.hostPath))"
              message: "HostPath volumes are forbidden. The field spec.template.spec.volumes[*].hostPath must be unset."
  1. Check the generated VAP and its binding:
$ kubectl get validatingadmissionpolicybindings.admissionregistration.k8s.io 
NAME                         POLICYNAME           PARAMREF   AGE
disallow-host-path-binding   disallow-host-path   <unset>    18s

$ kubectl get validatingadmissionpolicy
NAME                 VALIDATIONS   PARAMKIND   AGE
disallow-host-path   1             <unset>     22s
  1. check the Kyverno policy status:
status:
  validatingadmissionpolicy:
    generated: true
    message: ""
  1. Create a policy exception:
apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
  name: delta-exception
  namespace: delta
spec:
  exceptions:
  - policyName: disallow-host-path
    ruleNames:
    - host-path
  match:
    any:
    - resources:
        kinds:
        - Deployment
        namespaces:
        - delta
        names:
        - important-tool*
  1. check if there is a corresponding VAP/binding:
$ kubectl get validatingadmissionpolicy
No resources found

$ kubectl get validatingadmissionpolicybindings
No resources found
  1. check the Kyverno policy status:
status:
  validatingadmissionpolicy:
    generated: false
    message: 'skip generating ValidatingAdmissionPolicy: a policy exception is configured.'

Checklist

  • I have read the contributing guidelines.
  • I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
  • This is a bug fix and I have added unit tests that prove my fix is effective.
  • This is a feature and I have added CLI tests that are applicable.
  • My PR needs to be cherry picked to a specific release branch which is .
  • My PR contains new or altered behavior to Kyverno and
    • CLI support should be added and my PR doesn't contain that functionality.

Further Comments

@MariamFahmy98 MariamFahmy98 added this to the Kyverno Release 1.12.0 milestone Jan 12, 2024
@codecov Codecov
Copy link
codecov bot commented Jan 12, 2024 •
edited
Loading

Codecov Report

Attention: 57 lines in your changes are missing coverage. Please review.

Comparison is base (b4acbde) 32.90% compared to head (5806861) 32.83%.

Files Patch % Lines
...s/validatingadmissionpolicy-generate/controller.go 0.00% 41 Missing ⚠️
.../validatingadmissionpolicy-generate/policycheck.go 0.00% 10 Missing ⚠️
api/kyverno/v2/policy_exception_types.go 0.00% 2 Missing ⚠️
api/kyverno/v2alpha1/policy_exception_types.go 0.00% 2 Missing ⚠️
api/kyverno/v2beta1/policy_exception_types.go 0.00% 2 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #9386      +/-   ##
==========================================
- Coverage   32.90%   32.83%   -0.08%     
==========================================
  Files         326      326              
  Lines       26130    26186      +56     
==========================================
  Hits         8598     8598              
- Misses      16734    16790      +56     
  Partials      798      798

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@JimBugwadia JimBugwadia self-requested a review January 17, 2024 18:01
@MariamFahmy98
feat: skip generating VAP when an exception is defined
061aaed 
Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>
@MariamFahmy98 MariamFahmy98 enabled auto-merge (squash) January 18, 2024 09:14
@MariamFahmy98 MariamFahmy98 merged commit a791d9a into kyverno:main Jan 18, 2024
229 of 233 checks passed
@MariamFahmy98 MariamFahmy98 mentioned this pull request Jan 30, 2024
Closed
@MariamFahmy98 MariamFahmy98 deleted the feat-8733 branch January 30, 2024 11:42
@MariamFahmy98 MariamFahmy98 mentioned this pull request Feb 8, 2024
Merged
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@JimBugwadia JimBugwadia JimBugwadia approved these changes

@chipzoller chipzoller Awaiting requested review from chipzoller

@eddycharly eddycharly Awaiting requested review from eddycharly eddycharly is a code owner

@realshuting realshuting Awaiting requested review from realshuting realshuting is a code owner

Assignees
No one assigned
Labels
Documentation Update Documentation milestone 1.12.0
Projects
None yet
Milestone
Kyverno Release 1.12.0
2 participants
@MariamFahmy98 @JimBugwadia