SKIP UPGRADE: Update disallow-deprecated-apis to include precondition check for api version

Related to https://github.com/kyverno/policies/pull/332

• Includes updates to match fix in upstream policy
• Disables disallow-deprecated-apis in test-values.yaml

assigned to @rob.ferguson

changed title from Update disallow-deprecated-apis to include precondition check for api version to DEBUG - Update disallow-deprecated-apis to include precondition check for api version

added 1 commit

• 047da059 - Update disallow-deprecated-apis to include precondition check for api version

Compare with previous version

added 1 commit

• c25ca668 - Update disallow-deprecated-apis to include precondition check for api version

Compare with previous version

I have disabled the deprecated-apis test policy in test-values.yaml because it never becomes ready. I believe it is caused by this issue - https://github.com/kyverno/kyverno/issues/3580

@michaelmcleroy Just wanted to summarize and get your thoughts. In the process of testing some of the other Kyverno policy changes I noticed main was failing to do a clean install. I poked around at it and determined it was running into an issue with the disallow-deprecated-apis policy. During the install it was failing with:

Release "kyverno-policies" does not exist. Installing it now.
W0816 20:29:21.690654    1182 warnings.go:70] Policies that match Pods apply to all Pods including those created and managed by controllers excluded from autogen. Use preconditions to exclude the Pods managed by controllers which are excluded from autogen. Refer to https://kyverno.io/docs/writing-policies/autogen/ for details.
Error: admission webhook "validate-policy.kyverno.svc" denied the request: the kind defined in the any match resource is invalid: unable to convert GVK to GVR for kinds [admissionregistration.k8s.io/v1beta1/ValidatingWebhookConfiguration admissionregistration.k8s.io/v1beta1/MutatingWebhookConfiguration apiextensions.k8s.io/v1beta1/CustomResourceDefinition apiregistration.k8s.io/v1beta1/APIService authentication.k8s.io/v1beta1/TokenReview authorization.k8s.io/v1beta1/SubjectAccessReview authorization.k8s.io/v1beta1/LocalSubjectAccessReview authorization.k8s.io/v1beta1/SelfSubjectAccessReview certificates.k8s.io/v1beta1/CertificateSigningRequest coordination.k8s.io/v1beta1/Lease extensions/v1beta1/Ingress networking.k8s.io/v1beta1/Ingress networking.k8s.io/v1beta1/IngressClass rbac.authorization.k8s.io/v1beta1/ClusterRole rbac.authorization.k8s.io/v1beta1/ClusterRoleBinding rbac.authorization.k8s.io/v1beta1/Role rbac.authorization.k8s.io/v1beta1/RoleBinding scheduling.k8s.io/v1beta1/PriorityClass storage.k8s.io/v1beta1/CSIDriver storage.k8s.io/v1beta1/CSINode storage.k8s.io/v1beta1/StorageClass storage.k8s.io/v1beta1/VolumeAttachment], err: kind 'ValidatingWebhookConfiguration' not found in apiVersion 'admissionregistration.k8s.io/v1beta1'

I searched around and saw that they had updated the upstream policy to workaround this issue by adding a precondition that would check for the appropriate apiVersion. Assuming that would fix our issue in CI I created this MR. Unfortunately I ended up running into a different issue arising from the use of a wildcard * in the amended policy. That error is:

E0817 18:47:21.842887       1 configmanager.go:334] WebhookConfigManager/reconcileWebhook "msg"="failed to update webhook configurations for policy" "error"="unable to update admissionregistration.k8s.io/v1/ValidatingWebhookConfiguration: kyverno-resource-validating-webhook-cfg: ValidatingWebhookConfiguration.admissionregistration.k8s.io \"kyverno-resource-validating-webhook-cfg\" is invalid: webhooks[1].rules[0].apiVersions: Invalid value: []string{\"v1\", \"v1beta1\", \"v2beta1\", \"*\"}: if '*' is present, must not specify other API versions" "namespace"="" "policy"="check-deprecated-apis"

The issue is mentioned as being partially fixed in the release notes for 1.7.2 but awaiting a complete fix in 1.7.3 or 1.8.0.

I think this means we probably need to temporarily disable the disallow-deprecated-apis in the test-values.yaml and wait for an upstream fix.

added statusreview label

changed title from DEBUG - Update disallow-deprecated-apis to include precondition check for api version to Update disallow-deprecated-apis to include precondition check for api version

changed the description

requested review from @michaelmcleroy

requested review from @toladipupo

resolved all threads

changed title from Update disallow-deprecated-apis to include precondition check for api version to SKIP UPGRADE: Update disallow-deprecated-apis to include precondition check for api version

Added SKIP UPGRADE so that the pipeline passes. Since this is broken on main the upgrade pipeline will never succeed (and this is ok).

added 1 commit

• 555a794a - Apply comment to disable deprecated api policy

Compare with previous version

added 1 commit

• 972c673a - apply pattern to deprecated HPA kinds

Compare with previous version

resolved all threads

added 1 commit

• 7931141c - Include autoscaling/v2beta1 api version

Compare with previous version

mentioned in merge request !32 (merged)

approved this merge request

merged

mentioned in commit 557e7b78