Merge pull request #120 from cruise-automation/filter-istio-virtual-s…

…ervices Filter out Istio Virtual Services from Admission Requests correctly
cruise-automation · Aug 20, 2021 · 5cc97be · 5cc97be
2 parents 2f3c20d + eb5ec6c
commit 5cc97be
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 3 deletions.
diff --git a/charts/k-rail/Chart.yaml b/charts/k-rail/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v1
 name: k-rail
 description: Kubernetes security tool for policy enforcement
 home: https://github.com/cruise-automation/k-rail
-version: v3.5.0
+version: v3.5.1
 maintainers:
   - name: cruise-automation
     url: https://cruise-automation.github.io/k-rail/
diff --git a/charts/k-rail/values.yaml b/charts/k-rail/values.yaml
@@ -110,6 +110,9 @@ config:
     - name: "pod_empty_dir_size_limit"
       enabled: True
       report_only: False
+    - name: "pod_no_root_user"
+      enabled: True
+      report_only: False
     - name: "pod_default_seccomp_policy"
       enabled: True
       report_only: False
@@ -131,6 +134,9 @@ config:
     - name: "service_require_loadbalancer_exemption"
       enabled: True
       report_only: False
+    - name: "service_require_virtualservice_gateway_exemption"
+      enabled: True
+      report_only: False
     - name: "cluster_role_binding_no_anonymous_subject"
       enabled: True
       report_only: False

diff --git a/policies/virtualservice/require_virtualservice_gateway_exemption_test.go b/policies/virtualservice/require_virtualservice_gateway_exemption_test.go
@@ -150,7 +150,7 @@ func TestPolicyRequireVirtualServiceGatewayExemption_Validate(t *testing.T) {
 				Namespace: "namespace",
 				Name:      "name",
 				Object:    runtime.RawExtension{Raw: raw},
-				Resource:  metav1.GroupVersionResource{Group: "", Version: "v1beta1", Resource: "virtualservices"},
+				Resource:  metav1.GroupVersionResource{Group: "networking.istio.io", Version: "v1beta1", Resource: "virtualservices"},
 			}
 
 			v := PolicyRequireVirtualServiceGatewayExemption{}

diff --git a/resource/virtual_service.go b/resource/virtual_service.go
@@ -78,7 +78,7 @@ func GetVirtualServiceResource(ctx context.Context, ar *admissionv1.AdmissionReq
 
 func decodeVirtualServiceResource(ar *admissionv1.AdmissionRequest) *VirtualServiceResource {
 	switch ar.Resource {
-	case metav1.GroupVersionResource{Group: "", Version: "v1beta1", Resource: "virtualservices"}, metav1.GroupVersionResource{Group: "", Version: "v1alpha3", Resource: "virtualservices"}:
+	case metav1.GroupVersionResource{Group: "networking.istio.io", Version: "v1beta1", Resource: "virtualservices"}, metav1.GroupVersionResource{Group: "networking.istio.io", Version: "v1alpha3", Resource: "virtualservices"}:
 		vsvc := VirtualService{}
 		if err := decodeObject(ar.Object.Raw, &vsvc); err != nil {
 			return nil