Nested objects not validating

[hadiulla]

Hi
I have a policy to restrict certain PVCs to be created.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: foo-pvc
  namespace: foo
spec:
  storageClassName: ""
  volumeName: foo-pv

The policy works fine (gives violation error) when deploying the above PVC. However if the same PVC is deployed as part of statefulset, then statefulset is created successfully and PVC is not created (as expected). But it doesn't show any error or violation when deployed as statefulset.

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx # has to match .spec.template.metadata.labels
  serviceName: "nginx"
  replicas: 3 # by default is 1
  minReadySeconds: 10 # by default is 0
  template:
    metadata:
      labels:
        app: nginx # has to match .spec.selector.matchLabels
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: k8s.gcr.io/nginx-slim:0.8
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: ""
      resources:
        requests:
          storage: 1Gi

NOTE: The policy denies creation of PVC which has value in storageClassName . Doesn't show any violation when deployed from statefulset.

Edit: Here is the policy violation

violation[{"msg": msg}] {
          obj := input.review.object
          not match_class_name(obj)
          msg := sprintf("Dynamic PV provisioning is blocked. Use Static PV provisioning. storageClassName value should be empty but got: %v",[obj.spec.storageClassName])
        }

        match_class_name(obj) {
          obj.spec.storageClassName == ""
        }

[anderseknert]

@hadiulla where's the policy? :)

[hadiulla]

Updated the original question with policy, thanks.

[anderseknert]

Thanks!

Yeah this problem is seen most commonly with pods, where you might have a rule that says "any pod must have a securityContext defined". If you try and deploy a pod it will correctly show you an error, but Kubernetes will still let you deploy e.g. a Deployment with a pod spec where a pod is defined without a securityContext. That deployment isn't going to be able to create the pods defined in the spec though, as those will be blocked later when deployed.

If you want to block the deployment, or statefulset, you'll need to add another rule to your policy, where the correct path for the securityContext — or as in your case, the storageClassName is provided:

violation[{"msg": msg}] {
    obj := input.review.object.spec.volumeClaimTemplates[_]
    not match_class_name(obj)
    msg := sprintf(
    	"Dynamic PV provisioning is blocked. Use Static PV provisioning. storageClassName value should be empty but got: %v",
    	[obj.spec.storageClassName]
    )
}