[BUG] "failed to load context" in logs

[chipzoller]

Software version numbers
State the version numbers of applications involved in the bug.

• Kubernetes version: 1.19.1
• Kyverno version: 1.3.2

Describe the bug
(Follow-up from #1582)

When deleting the Deployment, this gets logged:

I0212 14:21:43.108234       1 validation.go:109] EngineValidate "msg"="failed to load context" "kind"="Deployment" "name"="kyvernodeploy" "namespace"="secrets" "policy"="select-secrets" "rule"="select-secrets-from-volumes" "reason"="failed to substitute variables in context entry volsecret /api/v1/namespaces/{{request.object.metadata.namespace}}/secrets/{{request.object.spec.template.spec.volumes[0].secret.secretName}}: variable request.object.metadata.namespace not resolved at path "

[chipzoller]

The aforementioned message gets logged when deleting a Deployment, but it also gets logged when the (linked issue #1582) Policy targets Deployments, a Deployment is created, but there is a variable substitution problem. While the logging is correct in this instance, notice that it doesn't print the path as well as it gets logged in triplicate when it only needs to be logged once.

Here is the log output from such an event:

I0212 18:42:57.884682       1 validation.go:109] EngineValidate "msg"="failed to load context" "kind"="Deployment" "name"="kyvernodeploy" "namespace"="secrets" "policy"="select-secrets" "rule"="select-secrets-from-volumes" "reason"="failed to substitute variables in context entry volsecret /api/v1/namespaces/{{request.object.metadata.namespace}}/secrets/{{request.object.spec.volumes[0].secret.secretName}}: variable request.object.spec.volumes[0].secret.secretName not resolved at path "
I0212 18:42:57.955102       1 validation.go:109] EngineValidate "msg"="failed to load context" "kind"="Deployment" "name"="kyvernodeploy" "namespace"="secrets" "policy"="select-secrets" "rule"="select-secrets-from-volumes" "reason"="failed to substitute variables in context entry volsecret /api/v1/namespaces/{{request.object.metadata.namespace}}/secrets/{{request.object.spec.volumes[0].secret.secretName}}: variable request.object.spec.volumes[0].secret.secretName not resolved at path "
I0212 18:43:00.127616       1 validation.go:109] EngineValidate "msg"="failed to load context" "kind"="Deployment" "name"="kyvernodeploy" "namespace"="secrets" "policy"="select-secrets" "rule"="select-secrets-from-volumes" "reason"="failed to substitute variables in context entry volsecret /api/v1/namespaces/{{request.object.metadata.namespace}}/secrets/{{request.object.spec.volumes[0].secret.secretName}}: variable request.object.spec.volumes[0].secret.secretName not resolved at path "

[kacejot]

@chipzoller,
Should we validate resources on DELETE operation? The simplest solution here is to turn off validation on delete.

I0212 14:21:43.108234       1 validation.go:109] EngineValidate "msg"="failed to load context" "kind"="Deployment" "name"="kyvernodeploy" "namespace"="secrets" "policy"="select-secrets" "rule"="select-secrets-from-volumes" "reason"="failed to substitute variables in context entry volsecret /api/v1/namespaces/{{request.object.metadata.namespace}}/secrets/{{request.object.spec.template.spec.volumes[0].secret.secretName}}: variable request.object.metadata.namespace not resolved at path "

[chipzoller]

It seems like that may be best. @realshuting for her take.

[realshuting]

@kacejot For the DELETE operation, we should use request.oldObject to lookup values. Can we handle this internally in Kyverno?

[kacejot]

Status: ready for 1.3.5 release