You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A generate policy can be written to match and generate the same resource type.
To Reproduce
Create a policy with a generate rule that matches a Deployment and generates a Deployment.
Expected behavior
Kyverno should not allow a creation of a generate policy where the matched kind is the same as the generated kind, and no other filters are provided. This can be added to the policy validation checks.
The same check should also be done when a pod is the matched kind and a pod controller is created, or a pod controller is the matched kind and a pod is created, and no other filters are provided.
Screenshots
If applicable, add screenshots to help explain your problem.
Software version numbers
Describe the bug
A generate policy can be written to match and generate the same resource type.
To Reproduce
Create a policy with a generate rule that matches a Deployment and generates a Deployment.
Expected behavior
Kyverno should not allow a creation of a generate policy where the matched kind is the same as the generated kind, and no other filters are provided. This can be added to the policy validation checks.
The same check should also be done when a pod is the matched kind and a pod controller is created, or a pod controller is the matched kind and a pod is created, and no other filters are provided.
Screenshots
If applicable, add screenshots to help explain your problem.
Additional context
See: https://twitter.com/noelgeorgi/status/1392002713521516544 and #1905.
The text was updated successfully, but these errors were encountered: