Report missing policy or params in status of ValidatingAdmissionPolicyBindings

[jpbetz]

If a ValidatingAdmissionPolicyBinding references a non-existent policy in the spec.policyName field the binding silently does nothing.

xref:

kubernetes/staging/src/k8s.io/api/admissionregistration/v1alpha1/types.go

Line 363 in 5550bd5

// If the referenced resource does not exist, this binding is considered invalid and will be ignored

We have informally referred to a binding in this state as "mis-configured", but there is no way for a user to know that a binding is in this state short of attempting API requests that should be denied and noticing that they are allowed (which is clearly not a good way to check).

Part of the problem is that without a the matchConditions of the policy, the policy binding doesn't even know what API requests it should match.

We should report this state into the status of binding resources.

Also, when the policy has a paramKind and the spec.paramRef refers to a non-existent resource, or the wrong type of resource, there is also a problem. The behavior for this case is different-- the policy is configured mis-configured and the failurePolicy is triggered. We should still report status for this case though?

A last case: The policy does not have a paramKind but the binding has a spec.paramRef. In this case we ignore the paramRef (since it is not needed). I don't know if we need to report this to status. It is reasonable to add unused paramRefs to bindings in preparation for adding a paramKind to a policy, so maybe this is OK?

[jpbetz]

/assign @ritazh

[jpbetz]

/triage accepted
/sig api-machinery

[shubham-singh-748]

hey can you please specify the followings:-

1. what type of resources need to create, user, group or any kind of resource
2. Required attributes for the resources, like name, id, etc..
3. Creating resource using appropriate APIs or console system.

[k8s-triage-robot]

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

• Confirm that this issue is still relevant with /triage accepted (org members only)
• Close this issue with /close

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

[cici37]

/triage accepted