Skip to content

Commit 75eb217

Browse files
committed
fix: compliant with mustnothave and objectselector
When a mustnothave ConfigurationPolicy returns objects from the objectSelector but no objects match the policy, the status wasn't populated. This populates a compliant status for this case. ref: https://issues.redhat.com/browse/ACM-25562 Signed-off-by: Dale Haiducek <[email protected]>
1 parent 5c83c5b commit 75eb217

File tree

5 files changed

+76
-12
lines changed

5 files changed

+76
-12
lines changed

controllers/configurationpolicy_controller.go

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1880,6 +1880,30 @@ func (r *ConfigurationPolicyReconciler) determineDesiredObjects(
18801880
}
18811881
}
18821882

1883+
// If no objects were matched, return a compliant event since this is
1884+
// mustnothave and no objects were found.
1885+
if len(targetedObjects) == 0 {
1886+
var namespaces []string
1887+
for ns := range relevantNsNames {
1888+
namespaces = append(namespaces, ns)
1889+
}
1890+
1891+
sort.Strings(namespaces)
1892+
1893+
nsMsg := "namespace"
1894+
if len(namespaces) > 1 {
1895+
nsMsg = "namespaces:"
1896+
}
1897+
1898+
event := &objectTmplEvalEvent{
1899+
compliant: true,
1900+
reason: "",
1901+
message: fmt.Sprintf("%s missing as expected in %s %s", scopedGVR.Resource, nsMsg, strings.Join(namespaces, ", ")),
1902+
}
1903+
1904+
return nil, &scopedGVR, event, nil
1905+
}
1906+
18831907
return targetedObjects, &scopedGVR, nil, nil
18841908
}
18851909

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
namespace: default
5+
name: wrong-configmap
6+
labels:
7+
isLower: 'true'
8+
privileged: 'no'
9+
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Diffs:
2+
# Compliance messages:
3+
Compliant; notification - configmaps missing as expected in namespace default
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: policy.open-cluster-management.io/v1
2+
kind: ConfigurationPolicy
3+
metadata:
4+
name: policy-mustnothave-objselector
5+
spec:
6+
object-templates:
7+
- complianceType: mustnothave
8+
objectDefinition:
9+
apiVersion: v1
10+
kind: ConfigMap
11+
metadata:
12+
labels:
13+
isLower: 'true'
14+
privileged: 'yes'
15+
namespace: default
16+
objectSelector:
17+
matchLabels:
18+
isLower: 'true'
19+
recordDiff: InStatus
20+
recreateOption: None
21+
pruneObjectBehavior: DeleteAll
22+
remediationAction: inform
23+
severity: low

test/dryrun/no_name/with_object_selector/no_name_obj_sel_test.go

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,23 @@ import (
77
"open-cluster-management.io/config-policy-controller/test/dryrun"
88
)
99

10-
//go:embed musthave_mixed_noncompliant/*
11-
var musthaveMixedNoncompliant embed.FS
10+
var (
11+
//go:embed musthave_mixed_noncompliant/*
12+
musthaveMixedNoncompliant embed.FS
13+
//go:embed mustnothave_mixed_noncompliant/*
14+
mustnothaveMixedNoncompliant embed.FS
15+
//go:embed mustnothave_unmatched/*
16+
mustnothaveUnmatched embed.FS
1217

13-
func TestMusthaveMixedNonCompliant(t *testing.T) {
14-
t.Run("Test only selected and incorrect objects are marked as violations",
15-
dryrun.Run(musthaveMixedNoncompliant))
16-
}
17-
18-
//go:embed mustnothave_mixed_noncompliant/*
19-
var mustnothaveMixedNoncompliant embed.FS
18+
testCases = map[string]embed.FS{
19+
"Test only selected and incorrect objects are marked as violations": musthaveMixedNoncompliant,
20+
"Test only selected and matched objects are marked as violations": mustnothaveMixedNoncompliant,
21+
"Test no matched objects for mustnothave is compliant": mustnothaveUnmatched,
22+
}
23+
)
2024

21-
func TestMustnothaveMixedNonCompliant(t *testing.T) {
22-
t.Run("Test only selected and matched objects are marked as violations",
23-
dryrun.Run(mustnothaveMixedNoncompliant))
25+
func TestNoNameObjSelector(t *testing.T) {
26+
for name, testFiles := range testCases {
27+
t.Run(name, dryrun.Run(testFiles))
28+
}
2429
}

0 commit comments

Comments
 (0)