Best practices vpol

[Mohdcode]

Related Issue(s)

kyverno/kyverno#12085

Description

add best-practices-vpol
dir with prefix add would be converted after the generatePolicy crd release

Checklist

• I have read the policy contribution guidelines.
• I have added test manifests and resources covering both positive and negative tests that prove this policy works as intended.
• I have added the artifacthub-pkg.yml file and have verified it is complete and correct.

[Mohdcode]

would be ready for review once this issue gets completed kyverno/kyverno#13089

[realshuting]

@Mohdcode - there's an issue on CRD support:

Error: failed to run test (failed to apply policies on resource bad-flowschema (failed to map gvk to gvr flowcontrol.apiserver.k8s.io/v1beta2, Kind=FlowSchema (no matches for kind "FlowSchema" in version "flowcontrol.apiserver.k8s.io/v1beta2")

Does this CLI test run in-cluster? And there's another issue for supporting CRDs off-cluster in CLI kyverno/kyverno#13427.

[Mohdcode]

The test fails off-cluster, but it passes on a real cluster. You're right, we need support for CRDs.
I think i should close this issue we can just cover it into crds support issue.

[JimBugwadia]

@Mohdcode - can you please address the test failures so we can get this merged?

Looks like there is an API version mismatch:

Error: failed to run test (failed to apply policies on resource bad-flowschema (failed to map gvk to gvr flowcontrol.apiserver.k8s.io/v1beta2, Kind=FlowSchema (no matches for kind "FlowSchema" in version "flowcontrol.apiserver.k8s.io/v1beta2")
))

[Mohdcode]

Kyverno CLI maintains a static GVK-to-GVR mapping. Because of this limitation, the CLI fails when testing resources whose API versions or kinds aren’t listed there.
Our policy relies on those specific apiVersions and resources, so this is a CLI limitation that needs to be addressed.
I tried implementing a dynamic way to fetch the API discovery data (to make the mapping automatically up-to-date) but wasn’t successful. I’d appreciate guidance or direction on how to make this discovery dynamic instead of relying on the static JSON file.

[JimBugwadia]

@Mohdcode - do we want to allow passing in a mapping?

cc: @fjogeleit @eddycharly

[MariamFahmy98]

Could you please add the new directory to the CI so that the chainsaw tests are executed?

[Mohdcode]

@JimBugwadia I'm not sure if this is something a user would normally do, but I tested it and it works. I can raise a PR for this.
Currently, it requires passing a JSON file into the CLI for it to work, and I’m open to suggestions on whether there’s a better way to handle it. For reference, the JSON I used is:

[
  {
    "Group": {
      "name": "batch",
      "versions": [
        { "groupVersion": "batch/v1beta1", "version": "v1beta1" }
      ],
      "preferredVersion": { "groupVersion": "batch/v1beta1", "version": "v1beta1" }
    },
    "VersionedResources": {
      "v1beta1": [
        {
          "name": "cronjobs",
          "singularName": "cronjob",
          "namespaced": true,
          "kind": "CronJob",
          "verbs": ["create", "delete", "get", "list", "update", "watch"]
        }
      ]
    }
  },
  {
    "Group": {
      "name": "flowcontrol.apiserver.k8s.io",
      "versions": [
        { "groupVersion": "flowcontrol.apiserver.k8s.io/v1beta2", "version": "v1beta2" }
      ],
      "preferredVersion": { "groupVersion": "flowcontrol.apiserver.k8s.io/v1beta2", "version": "v1beta2" }
    },
    "VersionedResources": {
      "v1beta2": [
        {
          "name": "flowschemas",
          "singularName": "flowschema",
          "namespaced": false,
          "kind": "FlowSchema",
          "verbs": ["create", "delete", "get", "list", "update", "watch"]
        }
      ]
    }
  }
]

[JimBugwadia]

@Mohdcode - can you please check the CI errors?

[JimBugwadia]

@realshuting - any thoughts on this?

#1292 (comment)

Is there a better way?

[Mohdcode]

@realshuting - any thoughts on this?

#1292 (comment)

Is there a better way?

we have resolved this issue already in this PR kyverno/kyverno#14503

[Mohdcode]

@Mohdcode - can you please check the CI errors?

Done