fix: check if settings field is not nil.

e2e.bats

@@ -20,7 +20,7 @@
   	--settings-json '{"cpu": {"maxLimit": "3m", "defaultRequest" : "2m", "defaultLimit" : "2m"}, "memory" : {"maxLimit": "3G", "defaultRequest" : "2G", "defaultLimit" : "2G"}}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*true') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -eq 0 ]
 }
 
@@ -29,7 +29,7 @@
   	--settings-json '{"cpu": {"maxLimit": "3m", "defaultRequest" : "2m", "defaultLimit" : "2m"}, "memory" : {"maxLimit": "3G", "defaultRequest" : "2G", "defaultLimit" : "2G"}}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*true') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -eq 0 ]
 }
 
@@ -38,7 +38,7 @@
   	--settings-json '{"cpu": {"maxLimit": "1m", "defaultRequest" : "1m", "defaultLimit" : "1m"}, "memory" : {"maxLimit": "1G", "defaultRequest" : "1G", "defaultLimit" : "1G"}, "ignoreImages": ["image:latest"]}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*false') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":false') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -eq 0 ]
 }
 
@@ -47,7 +47,7 @@
   	--settings-json '{"cpu": {"maxLimit": "1m", "defaultRequest" : "1m", "defaultLimit" : "1m"}, "memory" : {"maxLimit": "1G", "defaultRequest" : "1G", "defaultLimit" : "1G"}, "ignoreImages": ["image:*", "registry.k8s.io/pause*"]}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*true') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -eq 0 ]
 }
 
@@ -56,7 +56,7 @@
   	--settings-json '{"cpu": {"maxLimit": "4", "defaultRequest" : "2", "defaultLimit" : "2"}, "memory" : {"maxLimit": "4G", "defaultRequest" : "2G", "defaultLimit" : "2G"}}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*true') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -ne 0 ]
 }
 
@@ -65,7 +65,7 @@
     	--settings-json '{"cpu": {"ignoreValues": true}, "memory" : {"ignoreValues": true}}'
 
     [ "$status" -eq 0 ]
-    [ $(expr "$output" : '.*allowed.*false') -ne 0 ]
+    [ $(expr "$output" : '.*allowed":false') -ne 0 ]
     [ $(expr "$output" : '.*patch.*') -eq 0 ]
 }
 
@@ -74,22 +74,40 @@
   	--settings-json '{"cpu": {"maxLimit": "4", "defaultRequest" : "2", "defaultLimit" : "2"}, "memory" : {"maxLimit": "4G", "defaultRequest" : "2G", "defaultLimit" : "2G"}}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*true') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -ne 0 ]
 }
 @test "reject containers with no resources when ignoreValues is true" {
   run kwctl run annotated-policy.wasm -r test_data/pod_without_resources.json \
   	--settings-json '{"cpu": {"ignoreValues": true}, "memory" : {"ignoreValues": true}}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*false') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":false') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -eq 0 ]
 }
 @test "allow containers while ignoring resources" {
   run kwctl run annotated-policy.wasm -r test_data/pod_within_range.json \
   	--settings-json '{"cpu": {"ignoreValues": true}, "memory" : {"ignoreValues": true}}'
 
   [ "$status" -eq 0 ]
-  [ $(expr "$output" : '.*allowed.*true') -ne 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
+  [ $(expr "$output" : '.*patch.*') -eq 0 ]
+}
+
+@test "allow containers while ignoring cpu resources with missing memory settings" {
+  run kwctl run annotated-policy.wasm -r test_data/pod_within_range.json \
+  	--settings-json '{"cpu": {"ignoreValues": true}}'
+
+  [ "$status" -eq 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
+  [ $(expr "$output" : '.*patch.*') -eq 0 ]
+}
+
+@test "allow containers while ignoring memory resources with missing cpu settings" {
+  run kwctl run annotated-policy.wasm -r test_data/pod_within_range.json \
+  	--settings-json '{"memory": {"ignoreValues": true}}'
+
+  [ "$status" -eq 0 ]
+  [ $(expr "$output" : '.*allowed":true') -ne 0 ]
   [ $(expr "$output" : '.*patch.*') -eq 0 ]
 }

settings.go

@@ -23,6 +23,14 @@ type Settings struct {
 	IgnoreImages []string               `json:"ignoreImages,omitempty"`
 }
 
+func (s *Settings) shouldIgnoreCpuValues() bool {
+	return s.Cpu != nil && s.Cpu.IgnoreValues
+}
+
+func (s *Settings) shouldIgnoreMemoryValues() bool {
+	return s.Memory != nil && s.Memory.IgnoreValues
+}
+
 func (r *ResourceConfiguration) valid() error {
 	if (!r.MaxLimit.IsZero() || !r.DefaultLimit.IsZero() || !r.DefaultRequest.IsZero()) && r.IgnoreValues {
 		return fmt.Errorf("ignoreValues cannot be true when any quantities are defined")

validate.go

@@ -29,33 +29,33 @@ func adjustResourceRequest(container *corev1.Container, resourceName string, res
 }
 
 func validateContainerResourceLimits(container *corev1.Container, settings *Settings) error {
-	if container.Resources.Limits == nil && settings.Cpu.IgnoreValues && settings.Memory.IgnoreValues {
+	if container.Resources.Limits == nil && settings.shouldIgnoreCpuValues() && settings.shouldIgnoreMemoryValues() {
 		return fmt.Errorf("container does not have any resource limits")
 	}
 
-	if settings.Cpu.IgnoreValues && missingResourceQuantity(container.Resources.Limits, "cpu") {
+	if settings.shouldIgnoreCpuValues() && missingResourceQuantity(container.Resources.Limits, "cpu") {
 		return fmt.Errorf("container does not have a cpu limit")
 	}
 
-	if settings.Memory.IgnoreValues && missingResourceQuantity(container.Resources.Limits, "memory") {
+	if settings.shouldIgnoreMemoryValues() && missingResourceQuantity(container.Resources.Limits, "memory") {
 		return fmt.Errorf("container does not have a memory limit")
 	}
 
 	return nil
 }
 
 func validateContainerResourceRequests(container *corev1.Container, settings *Settings) error {
-	if container.Resources.Requests == nil && settings.Cpu.IgnoreValues && settings.Memory.IgnoreValues {
+	if container.Resources.Requests == nil && settings.shouldIgnoreCpuValues() && settings.shouldIgnoreMemoryValues() {
 		return fmt.Errorf("container does not have any resource requests")
 	}
 
 	_, found := container.Resources.Requests["cpu"]
-	if !found && settings.Cpu.IgnoreValues {
+	if !found && settings.shouldIgnoreCpuValues() {
 		return fmt.Errorf("container does not have a cpu request")
 	}
 
 	_, found = container.Resources.Requests["memory"]
-	if !found && settings.Memory.IgnoreValues {
+	if !found && settings.shouldIgnoreMemoryValues() {
 		return fmt.Errorf("container does not have a memory request")
 	}
 
@@ -66,8 +66,8 @@ func validateContainerResourceRequests(container *corev1.Container, settings *Se
 // We only check for the presence of the limits/requests, not their values.
 // Returns an error if the limits/requests are not set and IgnoreValues is set to true.
 func validateContainerResources(container *corev1.Container, settings *Settings) error {
-	if container.Resources == nil && (settings.Cpu.IgnoreValues || settings.Memory.IgnoreValues) {
-		missing := fmt.Sprintf("required Cpu:%t, Memory:%t", settings.Cpu.IgnoreValues, settings.Memory.IgnoreValues)
+	if container.Resources == nil && ( settings.shouldIgnoreCpuValues() || settings.shouldIgnoreMemoryValues()) {
+		missing := fmt.Sprintf("required Cpu:%t, Memory:%t", settings.shouldIgnoreCpuValues(), settings.shouldIgnoreMemoryValues())
 		return fmt.Errorf("container does not have any resource limits or requests: %s", missing)
 	}
 	if err := validateContainerResourceLimits(container, settings); err != nil {
@@ -128,7 +128,7 @@ func validateAndAdjustContainerResourceLimit(container *corev1.Container, resour
 // Return `true` when the container has been mutated.
 func validateAndAdjustContainerResourceLimits(container *corev1.Container, settings *Settings) (bool, error) {
 	mutated := false
-	if settings.Memory.IgnoreValues {
+	if settings.shouldIgnoreMemoryValues() {
 		return false, nil
 	}
 	if settings.Memory != nil {
@@ -139,7 +139,7 @@ func validateAndAdjustContainerResourceLimits(container *corev1.Container, setti
 		}
 	}
 
-	if settings.Cpu.IgnoreValues {
+	if settings.shouldIgnoreCpuValues() {
 		return false, nil
 	}
 	if settings.Cpu != nil {
@@ -240,6 +240,5 @@ func validate(payload []byte) ([]byte, error) {
 	} else {
 		return kubewarden.RejectRequest(kubewarden.Message(err.Error()), kubewarden.Code(400))
 	}
-
 	return kubewarden.AcceptRequest()
 }

validate_test.go

@@ -539,6 +539,58 @@ func TestIgroreValues(t *testing.T) {
 				"cpu": &oneCoreCpuQuantity,
 			},
 		}, "container does not have a memory request"},
+		{"no memory settings", corev1.Container{
+			Image: "image1:latest",
+			Resources: &corev1.ResourceRequirements{
+				Limits: map[string]*apimachinery_pkg_api_resource.Quantity{
+					"cpu":    &oneCoreCpuQuantity,
+					"memory": &oneGiMemoryQuantity,
+				},
+				Requests: map[string]*apimachinery_pkg_api_resource.Quantity{
+					"cpu": &oneCoreCpuQuantity,
+				},
+			},
+		}, Settings{
+			Cpu: &ResourceConfiguration{
+				DefaultLimit:   oneCore,
+				DefaultRequest: oneCore,
+				MaxLimit:       oneCore,
+			},
+			Memory: nil,
+		}, &corev1.ResourceRequirements{
+			Limits: map[string]*apimachinery_pkg_api_resource.Quantity{
+				"cpu":    &oneCoreCpuQuantity,
+				"memory": &oneGiMemoryQuantity,
+			},
+			Requests: map[string]*apimachinery_pkg_api_resource.Quantity{
+				"cpu": &oneCoreCpuQuantity,
+			},
+		}, ""},
+		{"no cpu settings", corev1.Container{
+			Image: "image1:latest",
+			Resources: &corev1.ResourceRequirements{
+				Limits: map[string]*apimachinery_pkg_api_resource.Quantity{
+					"memory": &oneGiMemoryQuantity,
+				},
+				Requests: map[string]*apimachinery_pkg_api_resource.Quantity{
+					"memory": &oneGiMemoryQuantity,
+				},
+			},
+		}, Settings{
+			Cpu: nil,
+			Memory: &ResourceConfiguration{
+				DefaultLimit:   oneGi,
+				DefaultRequest: oneGi,
+				MaxLimit:       oneGi,
+			},
+		}, &corev1.ResourceRequirements{
+			Limits: map[string]*apimachinery_pkg_api_resource.Quantity{
+				"memory": &oneGiMemoryQuantity,
+			},
+			Requests: map[string]*apimachinery_pkg_api_resource.Quantity{
+				"memory": &oneGiMemoryQuantity,
+			},
+		}, ""},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {