Skip to content

Policies always deny when using the SDK #9

@mdnfiras

Description

@mdnfiras

Description:

All policies built with the SDK are always denying. An error is always detected when in reality there is no error.

Reproduce:

A fresh kubernetes cluster is running and reachable by kubectl.

Clone, install dependencies, compile, and apply any JSPolicy and its JSPolicyBundle. I chose validate-namespace for this example:

git clone https://github.com/loft-sh/jspolicy-sdk.git
cd jspolicy-sdk
npm install
npm run compile
kubectl apply -f policies/validate-namespace.yaml
kubectl apply -f policies/validate-namespace.bundle.yaml

Create namespace test and create any resource in it. This totally respects the validate-namespace.mycompany.tld policy we just created:

kubectl create ns test
kubectl create secret generic testing --from-literal=mykey=myvalue -n test

Expectation:

The resource is successfully created.

Bug:

error: failed to create secret admission webhook "validate-namespace.mycompany.tld" denied the request: Request denied because of the following errors:
-

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions