-
Notifications
You must be signed in to change notification settings - Fork 23
fix: Don't fail when PolicyGroup has policies with differing execution modes #1319
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
"container_running_as_user".to_string(), | ||
admission_policy_group::PolicyGroupMember { | ||
module: | ||
"registry://ghcr.io/kubewarden/tests/container-running-as-user:v1.0.4" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pushed this new OCI artifact:
https://github.com/kubewarden/rego-policies-library/pkgs/container/tests%2Fcontainer-running-as-user
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1319 +/- ##
==========================================
+ Coverage 87.47% 87.50% +0.02%
==========================================
Files 34 34
Lines 4936 4947 +11
==========================================
+ Hits 4318 4329 +11
Misses 618 618 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
When building the evaluators of the members of the PolicyGroup, propagate the PolicyExecutionConfiguration from the member metadata. Previously, we were assuming all PolicyExecutionConfiguration were the same. This fixes the bug were the PolicyGroup has members with differing execution configurations, such a Rust Wasm module and an OPA Wasm module. Signed-off-by: Víctor Cuadrado Juan <vcuadradojuan@suse.de>
Tests that each PolicyGroup member has a correct Evaluator with their PolicyExecutionMode. Signed-off-by: Víctor Cuadrado Juan <vcuadradojuan@suse.de>
Signed-off-by: Víctor Cuadrado Juan <vcuadradojuan@suse.de>
255437b
to
4a1d389
Compare
Description
Fix #1318
When building the evaluators of the members of the PolicyGroup,
propagate the PolicyExecutionConfiguration from the member metadata.
Previously, we were assuming all PolicyExecutionConfiguration were the
same. This fixes the bug were the PolicyGroup has members with differing
execution configurations, such a Rust Wasm module and an OPA Wasm
module.
Test
Added an e2e test.
Tried to add a unit test for
Evaluator::new()
, but the amount of scaffolding is quite big, to the point that we would be basically mocking the whole Evaluator creation. Here is a try:Click me
Additional Information
Tradeoff
Potential improvement