GK not enforcing PodDisruptionBudget

[wcushen]

Ultimately what I am trying to achieve is a bit more complex than the below example, however I have simplified it here - as I feel there is something fundamental I am missing that causes it not to enforce a number of rego policy I have produced for PodDisruptionBudget.

Template:

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8sallowedpdbdisruptions
spec:
  crd:
    spec:
      names:
        kind: K8sAllowedPDBDisruptions
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sallowedpdbdisruptions
        
          violation[{"msg": msg}] {
          not input.request.object.spec["maxUnavailable"]
          msg := "spec.maxUnavailable must be defined"
        }

Constraint:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedPDBDisruptions
metadata:
  name: pdb-min-disruptions
spec:
  enforcementAction: deny
  match:
    kinds:
    - apiGroups:
      - "*"
      kinds:
      - PodDisruptionBudget

Allowed PDB, expected to be denied

apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: my-pdb-minAvailable
  namespace: will-dest
spec:
  minAvailable: 1

[maxsmythe]

Have you tried creating a policy with a known-working template from the library to make sure everything is wired up correctly?

I think there may be a bug in the Rego code: input.request -> input.review

[wcushen]

@maxsmythe Unfortunately, I'm not faring any better with input.review

- rego: |
      package k8sallowedpdbdisruptions

      violation[{"msg": msg}] {
        not input.review.object.spec.maxUnavailable
        msg := "spec.maxUnavailable must be defined"
      }
    target: admission.k8s.gatekeeper.sh

apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
  name: my-pdb-minAvailable
  namespace: will-dest
spec:
  minAvailable: 1

Confirmed that other policies are enforcing fine too:

 [cushenw@aaa001l ~] $ oc create deployment will-test --image=docker.io/linuxserver/nginx -- bash -c "sleep 1d" --requests='cpu=100m,memory=50Mi' --limits='cpu=100m,memory=50Mi'
error: failed to create deployment: admission webhook "validation.gatekeeper.sh" denied the request: [repo-is-allowed] container <nginx> has an invalid image repo <docker.io/linuxserver/nginx>, allowed repos are ["XXX.service.anq", "XXX.service.anq", "quay.io"]