allowing users to skip policy validation when mutating resources

[vyankyGH]

Signed-off-by: Vyankatesh vyankateshkd@gmail.com

Related issue

closes #2185

Milestone of this PR

/milestone 1.4.3

What type of PR is this

Introduce a key under the spec which allows skipping policy validation checks.

Proposed Changes

Proof Manifests

old_Policy.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: policy-change-memory-limits
  # env array needs to exist (least one env var is present)
  annotations:
    pod-policies.kyverno.io/autogen-controllers: None
spec:
  background: false
  rules:
  - name: pod-containers-1-inject-image
    match:
      resources:
        kinds:
        - Pod
    preconditions:
      all:
      - key: "{{request.object.spec.containers[] | length(@)}}"
        operator: Equals
        value: "1"
    mutate:
      patchesJson6902: |-
        - op: add
          path: "/spec/containers/0/env/-"
          value: {"name":"K8S_IMAGE","value":"{{request.object.spec.containers[0].image}}"}
  - name: pod-containers-2-inject-image
    match:
      resources:
        kinds:
        - Pod
    preconditions:
      all:
      - key: "{{request.object.spec.containers[] | length(@)}}"
        operator: Equals
        value: "2"
    mutate:
      patchesJson6902: |-
        - op: add
          path: "/spec/containers/0/env/-"
          value: {"name":"K8S_IMAGE","value":"{{request.object.spec.containers[0].image}}"}
        - op: add
          path: "/spec/containers/1/env/-"
          value: {"name":"K8S_IMAGE","value":"{{request.object.spec.containers[1].image}}"}

output:

Error from server: error when creating ".\\yamls\\2185\\policy.yaml": admission webhook "validate-policy.kyverno.svc" denied the request: ValidationError(io.k8s.api.core.v1.Pod.spec.containers[1].env): invalid type for io.k8s.api.core.v1.Container.env: got "map", expected "array"
ValidationError(io.k8s.api.core.v1.Pod.spec.containers[1]): missing required field "name" in io.k8s.api.core.v1.Container

After Adding

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: policy-change-memory-limit
  # env array needs to exist (least one env var is present)
  annotations:
    pod-policies.kyverno.io/autogen-controllers: None
spec:
  background: false
  schemaValidation: false
  rules:
  - name: pod-containers-1-inject-image
    match:
      resources:
        kinds:
        - Pod
    preconditions:
      all:
      - key: "{{request.object.spec.containers[] | length(@)}}"
        operator: Equals
        value: "1"
    mutate:
      patchesJson6902: |-
        - op: add
          path: "/spec/containers/0/env/-"
          value: {"name":"K8S_IMAGE","value":"{{request.object.spec.containers[0].image}}"}
  - name: pod-containers-2-inject-image
    match:
      resources:
        kinds:
        - Pod
    preconditions:
      all:
      - key: "{{request.object.spec.containers[] | length(@)}}"
        operator: Equals
        value: "2"
    mutate:
      patchesJson6902: |-
        - op: add
          path: "/spec/containers/0/env/-"
          value: {"name":"K8S_IMAGE","value":"{{request.object.spec.containers[0].image}}"}
        - op: add
          path: "/spec/containers/1/env/-"
          value: {"name":"K8S_IMAGE","value":"{{request.object.spec.containers[1].image}}"}

output:
clusterpolicy.kyverno.io/policy-change-memory-limits created

Checklist

• I have read the contributing guidelines.
• I have added tests that prove my fix is effective or that my feature works.
• My PR contains new or altered behavior to Kyverno and
  • [] I have added or changed the documentation myself in an existing PR and the link is:
  • [] I have raised an issue in kyverno/website to track the doc update and the link is:
  • [] I have read the PR documentation guide and followed the process including adding proof manifests to this PR.

Further Comments

[vyankyGH]

Documentation required.

[realshuting]

Looks good overall, added minor comments.

Let's open an issue to track the doc update.

[vyankyGH]

Looks good overall, added minor comments.

Let's open an issue to track the doc update.

Okay

[chipzoller]

Is this tracking for 1.4.3?

[realshuting]

Is this tracking for 1.4.3?

Yes.