Disable auto-gen when a rule has mixed of kinds: pod & pod controllers

[realshuting]

Signed-off-by: Shuting Zhao shutting06@gmail.com

Related issue

Closes #1805.

What type of PR is this

/kind bug

Proposed Changes

When there are mixed kinds (Pod & Pod controllers) defined in match.resources.kinds or exclude.resources.kinds, the auto-gen is disabled.

Proof Manifests

Create the following policy:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: block-old-flux
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: block-old-flux
    match:
      resources:
        kinds:
        - Deployment
        - CronJob
        - Job
        - StatefulSet
        - DaemonSet
        - Pod
    validate:
      message: Cannot use old Flux v1 annotation.
      pattern:
        metadata:
          =(annotations):
            X(fluxcd.io/*): "*?"

The auto-gen is automatically disabled by pod-policies.kyverno.io/autogen-controllers: none:

✗ kg cpol block-old-flux -o yaml | k neat
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
  name: block-old-flux
spec:
  background: false
  rules:
  - match:
      resources:
        kinds:
        - Deployment
        - CronJob
        - Job
        - StatefulSet
        - DaemonSet
        - Pod
    name: block-old-flux
    validate:
      message: Cannot use old Flux v1 annotation.
      pattern:
        metadata:
          =(annotations):
            X(fluxcd.io/*): '*?'
  validationFailureAction: enforce

Checklist

• I have read the contributing guidelines.
• I have added tests that prove my fix is effective or that my feature works.
• [] My PR contains new or altered behavior to Kyverno and
  • [] I have added or changed the documentation myself in an existing PR and the link is:
  • [] I have raised an issue in kyverno/website to track the doc update and the link is:
  • [] I have read the PR documentation guide and followed the process including adding proof manifests to this PR.

Further Comments

[JimBugwadia]

One additional question - what happens if the user sets the annotation but there are multiple controllers? Do we need a validation check for that? Any other auto-gen related validation checks we need to add?

[JimBugwadia]

missing "// scenario C"?

[realshuting]

C is handled in https://github.com/kyverno/kyverno/pull/1847/files/2704e40165e020a3b846cf477108220d8ce24e22#diff-15f5667117ad6d93290286aaa292507f75cc3aa9441f9b8f03bdfe1cd31cd6acR320.

[JimBugwadia]

I meant in the comments....

[realshuting]

The comment was added to another place, not so obvious to see:

kyverno/pkg/policymutation/policymutation.go

Lines 320 to 321 in 2704e40

	// generateRulePatches generates rule for podControllers based on scenario A and C
	func generateRulePatches(policy kyverno.ClusterPolicy, controllers string, log logr.Logger) (rulePatches [][]byte, errs []error) {

[realshuting]

what happens if the user sets the annotation but there are multiple controllers?

Good catch! I added the logic to handle this scenario automatically, when the predefined controllers are invalid, Kyverno overwrites it to "none". Added tests:

kyverno/pkg/policymutation/policymutation_test.go

Lines 222 to 229 in ee65334

	name: "rule-with-predefined-invalid-controllers",
	policy: []byte(`{"apiVersion":"kyverno.io/v1","kind":"ClusterPolicy","metadata":{"name":"set-service-labels-env"},"annotations":null,"pod-policies.kyverno.io/autogen-controllers":"DaemonSet,Deployment,StatefulSet","spec":{"background":false,"rules":[{"name":"set-service-label","match":{"resources":{"kinds":["Pod","Deployment"]}},"mutate":{"patchStrategicMerge":{"metadata":{"labels":{"+(service)":"{{request.object.spec.template.metadata.labels.app}}"}}}}}]}}`),
	expectedControllers: "none",
	},
	{
	name: "rule-with-predefined-valid-controllers",
	policy: []byte(`{"apiVersion":"kyverno.io/v1","kind":"ClusterPolicy","metadata":{"name":"set-service-labels-env"},"annotations":null,"pod-policies.kyverno.io/autogen-controllers":"none","spec":{"background":false,"rules":[{"name":"set-service-label","match":{"resources":{"kinds":["Pod","Deployment"]}},"mutate":{"patchStrategicMerge":{"metadata":{"labels":{"+(service)":"{{request.object.spec.template.metadata.labels.app}}"}}}}}]}}`),
	expectedControllers: "none",

[realshuting]

The tests added in the previous PR were duplicated, updated to cover other scenarios.