#753 - Validate conflicting match and exclude

[shravanshetty1]

fixes #753

[realshuting]

Do we need to check the name of the resource? It's possible to have the same pod name, say "test-pod" in different namespaces.

[shravanshetty1]

If there are 2 pods with same name in different name space:
Currently we can write:

match:
	resources:
		name: test-pod
		kinds:
			-Pod
exclude:
	resources:
		name: test-pod
		kinds:
			-Pod
		namespace:
			-namespace1

With this PR user will be forced to write:

match:
	resources:
		name: test-pod
		kinds:
			-Pod
exclude:
	resources:
		namespace:
			-namespace1

[realshuting]

If I write the following policy, it will be rejected:

match:
  resources:
    name: test-pod
    kinds:
      - Pod
    namespaces:
      - namespace1
exclude:
  resources:
    name: test-pod
    kinds:
      - Pod
    namespaces:
      - namespace2

[shravanshetty1]

The above exclude block will never apply since its only matching pod from namespace1

Lets assume - this is what you meant:

match:
  resources:
    name: test-pod
    kinds:
      - Pod
    namespaces:
      - namespace1
      - namespace2
exclude:
  resources:
    name: test-pod
    kinds:
      - Pod
    namespaces:
      - namespace2

This will be rejected since its logically equivalent to this

match:
  resources:
    name: test-pod
    kinds:
      - Pod
    namespaces:
      - namespace1

[shravanshetty1]

After further analysis the following policy will be rejected even though its valid

match:
  resources:
    namespaces:
      - namespace1
      - namespace2
exclude:
  resources:
    kinds:
      - Pod
    namespaces:
      - namespace2

Maybe we should reconsider this change

[realshuting]

Have you tested with all best practices? How's the performance look like if someone imports all policies?

[shravanshetty1]

Have you tested with all best practices? How's the performance look like if someone imports all policies?

yes, this should not be a bottle neck