fix: Warn instead of panic when API resource not found or forbidden

[viccuad]

Description

Fix #68

• fix: Skip clusterwide resources in getResourcesForPolicies
• fix: Warn instead of panic when API resource not found or forbidden
• Add tests

Test

Added unit tests.

Performed manual integration tests when developing:

1. Deployed kubewarden helm charts from kubewarden/helm-charts@main:

helm upgrade -i --wait --namespace kubewarden --create-namespace kubewarden-crds ./charts/kubewarden-crds
helm upgrade -i --wait --namespace kubewarden --create-namespace kubewarden-controller ./charts/kubewarden-controller --set auditScanner.cronJob.schedule="*/3 * * * *" --set auditScanner.enable=true
helm upgrade -i --wait --namespace kubewarden --create-namespace kubewarden-defaults ./charts/kubewarden-defaults --set recommendedPolicies.enabled=True --set recommendedPolicies.defaultPolicyMode=monitor

2. Deployed a labeled namespace (which is clusterwide), and a safe-labels policy that checks pods, namespaces, an unexistent resource, and secrets (forbidden by the audit-scanner ServiceAccount we ship).

apiVersion: v1
kind: Namespace
metadata:
  name: demo2
  labels:
    cost-center: "123"
---
apiVersion: policies.kubewarden.io/v1
kind: ClusterAdmissionPolicy
metadata:
  annotations:
    io.kubewarden.policy.category: Resource validation
    io.kubewarden.policy.severity: low
  name: safe-labels
spec:
  module: registry://ghcr.io/kubewarden/tests/safe-labels:v0.1.13
  settings:
    denied_labels:
      - cost-center
  mode: protect
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["pods,namespaces, unexistent, secrets"]
      operations:
        - CREATE
  mutating: false
  backgroundAudit: true

3. Without the changes, we get a panic on secrets resource as they are forbidden.

4. With changes applied:
   Deploying the default policies, plus safe-labels policy targetting resources [pods, Pods, namespaces, secrets] (note that Pods is incorrect), we get the following WARN messages, for both Pod (API resource not found) and secrets (API resource forbidden, unknown GVK or ServiceAccount lacks permissions):

audit-scanner-28171311-ls6hw {"level":"info","time":"2023-07-25T09:51:01Z","message":"cluster wide scan started"}
audit-scanner-28171311-ls6hw {"level":"info","dict":{"policies to evaluate":7,"policies skipped":0},"time":"2023-07-25T09:51:01Z","message":"cluster admission policies count"}
audit-scanner-28171311-ls6hw {"level":"warn","resource GVK":"/v1, Resource=Pods","time":"2023-07-25T09:51:01Z","message":"API resource not found"}
audit-scanner-28171311-ls6hw {"level":"info","time":"2023-07-25T09:51:01Z","message":"scan finished"}
audit-scanner-28171311-ls6hw {"level":"info","dict":{"report name":"polr-clusterwide","report ns":"","summary":"{\"pass\":7,\"fail\":1,\"warn\":0,\"error\":0,\"skip\":0}"},"time":"2023-07-25T09:51:01Z","message":"updated ClusterPolicyReport"}
audit-scanner-28171311-ls6hw {"level":"info","time":"2023-07-25T09:51:01Z","message":"all-namespaces scan started"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"default","time":"2023-07-25T09:51:01Z","message":"namespace scan started"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"default","dict":{"policies to evaluate":7,"policies skipped":0},"time":"2023-07-25T09:51:01Z","message":"policy count"}
audit-scanner-28171311-ls6hw {"level":"warn","resource GVK":"/v1, Resource=Pods","time":"2023-07-25T09:51:01Z","message":"API resource not found"}
audit-scanner-28171311-ls6hw {"level":"warn","dict":{"resource GVK":"/v1, Resource=secrets","ns":"default"},"time":"2023-07-25T09:51:01Z","message":"API resource forbidden, unknown GVK or ServiceAccount lacks permissions"}
audit-scanner-28171311-ls6hw {"level":"info","dict":{"report name":"polr-ns-default","report ns":"default","report resourceVersion":"88451","summary":"{\"pass\":6,\"fail\":1,\"warn\":0,\"error\":0,\"skip\":0}"},"time":"2023-07-25T09:51:01Z","message":"updated PolicyReport"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"default","time":"2023-07-25T09:51:01Z","message":"namespace scan finished"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"demo2","time":"2023-07-25T09:51:01Z","message":"namespace scan started"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"demo2","dict":{"policies to evaluate":7,"policies skipped":0},"time":"2023-07-25T09:51:01Z","message":"policy count"}
audit-scanner-28171311-ls6hw {"level":"warn","resource GVK":"/v1, Resource=Pods","time":"2023-07-25T09:51:01Z","message":"API resource not found"}
audit-scanner-28171311-ls6hw {"level":"warn","dict":{"resource GVK":"/v1, Resource=secrets","ns":"demo2"},"time":"2023-07-25T09:51:01Z","message":"API resource forbidden, unknown GVK or ServiceAccount lacks permissions"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"demo2","time":"2023-07-25T09:51:01Z","message":"no pre-existing PolicyReport, will create one at end of the scan if needed"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"demo2","time":"2023-07-25T09:51:01Z","message":"namespace scan finished"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"policy-reporter","time":"2023-07-25T09:51:01Z","message":"namespace scan started"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"policy-reporter","dict":{"policies to evaluate":7,"policies skipped":0},"time":"2023-07-25T09:51:01Z","message":"policy count"}
audit-scanner-28171311-ls6hw {"level":"warn","resource GVK":"/v1, Resource=Pods","time":"2023-07-25T09:51:01Z","message":"API resource not found"}
audit-scanner-28171311-ls6hw {"level":"warn","dict":{"resource GVK":"/v1, Resource=secrets","ns":"policy-reporter"},"time":"2023-07-25T09:51:01Z","message":"API resource forbidden, unknown GVK or ServiceAccount lacks permissions"}
audit-scanner-28171311-ls6hw {"level":"info","dict":{"report name":"polr-ns-policy-reporter","report ns":"policy-reporter","report resourceVersion":"88454","summary":"{\"pass\":6,\"fail\":0,\"warn\":0,\"error\":0,\"skip\":0}"},"time":"2023-07-25T09:51:02Z","message":"updated PolicyReport"}
audit-scanner-28171311-ls6hw {"level":"info","dict":{"report name":"polr-ns-policy-reporter","report ns":"policy-reporter","report resourceVersion":"88456","summary":"{\"pass\":12,\"fail\":0,\"warn\":0,\"error\":0,\"skip\":0}"},"time":"2023-07-25T09:51:02Z","message":"updated PolicyReport"}
audit-scanner-28171311-ls6hw {"level":"info","dict":{"report name":"polr-ns-policy-reporter","report ns":"policy-reporter","report resourceVersion":"88457","summary":"{\"pass\":26,\"fail\":0,\"warn\":0,\"error\":0,\"skip\":0}"},"time":"2023-07-25T09:51:03Z","message":"updated PolicyReport"}
audit-scanner-28171311-ls6hw {"level":"info","namespace":"policy-reporter","time":"2023-07-25T09:51:03Z","message":"namespace scan finished"}
audit-scanner-28171311-ls6hw {"level":"info","time":"2023-07-25T09:51:03Z","message":"all-namespaces scan finished"}
Stream closed EOF for kubewarden/audit-scanner-28171311-ls6hw (audit-scanner)

Additional Information

I recommend review per commit.

Tradeoff

Potential improvement

Refactor the filter packages after first MVP. Opened #74.

[flavio]

Nice fixes, thanks!