fix(reports-controller): Allow UPDATE Operation in Resource Validation for Reports Controller

[Bhargav-InfraCloud]

Explanation

Allow UPDATE operation in validation.

Pass operations list instead of one to check for resources that match the policy's condition block.

Also, decouple the operation list for resource validation from the policy context's operation.

Related issue

9562

Milestone of this PR

NA

Documentation (optional)

NA

What type of PR is this

/kind bug

Proposed Changes

Allow UPDATE operation in validation.

Pass operations list instead of one to check for resources that match the policy's condition block.

Also, decouple the operation list for resource validation from the policy context's operation.

Proof Manifests

Included in issue 9562

Kyverno CLI test manifest (please see docs for latest manifest format at https://kyverno.io/docs/kyverno-cli/). See kyverno/policies for complete examples of all related test files.

NA

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove my fix is effective.
• This is a feature and I have added CLI tests that are applicable.
• My PR needs to be cherry picked to a specific release branch which is .
• My PR contains new or altered behavior to Kyverno and
  • CLI support should be added and my PR doesn't contain that functionality.

Further Comments

NA

[Bhargav-InfraCloud]

Steps to Test

1. Clone the repo and switch to PR branch.
2. Go to repo and run the following to deploy the changes in local KinD cluster:

make kind-create-cluster build-all kind-load-all kind-deploy-all

Note: It creates the KinD cluster(s).

3. Create the following 2 cluster policies.
   With CREATE operation:

kubectl apply -f - <<EOF
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-network-policy-with-create
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: check-netpol
      match:
        resources:
          kinds:
            - Namespace
          operations:
            - CREATE
            - UPDATE
      context:
      - name: network_policies_count
        apiCall:
          urlPath: "/apis/networking.k8s.io/v1/namespaces/{{request.namespace}}/networkpolicies"
          jmesPath: "items[] | length(@)"
      validate:
        message: "Multi-Tenancy & Isolation Checks; The namespace must have a network policy"
        deny:
          conditions:
            any:
            - key: "{{network_policies_count}}"
              operator: LessThan
              value: 1
EOF

Without CREATE operation:

kubectl apply -f - <<EOF
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-network-policy-without-create
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: check-netpol
      match:
        resources:
          kinds:
            - Namespace
          operations:
            - UPDATE
      context:
      - name: network_policies_count
        apiCall:
          urlPath: "/apis/networking.k8s.io/v1/namespaces/{{request.namespace}}/networkpolicies"
          jmesPath: "items[] | length(@)"
      validate:
        message: "Multi-Tenancy & Isolation Checks; The namespace must have a network policy"
        deny:
          conditions:
            any:
            - key: "{{network_policies_count}}"
              operator: LessThan
              value: 1
EOF

4. Check for events. Both should have events unlike earlier when the policy without CREATE doesn't list events.

kubectl get event --field-selector involvedObject.name=require-network-policy-with-create
kubectl get event --field-selector involvedObject.name=require-network-policy-without-create

[ApsTomar]

LGTM

[Bhargav-InfraCloud]

Thanks @ApsTomar