Skip to content

[Bug] Set a default value for the user info in CEL

Kyverno Version

1.15.0

Description

We have to provide a default user.Info when creating the attributes record so request.userInfo.username exists during CEL evaluation.

https://github.com/kyverno/kyverno/blob/aaf4cc14d77c825c5d1d3b71284a114e6355f0d4/pkg/admissionpolicy/validate.go#L163-L167

policy validating-node-p4sa-audience/validating-node-p4sa-audience error: expression '![ "system:addon-manager", "system:serviceaccount:kube-system:cronjob-controller", "system:serviceaccount:kube-system:daemon-set-controller", "system:serviceaccount:kube-system:deployment-controller", "system:serviceaccount:kube-system:job-controller", "system:serviceaccount:kube-system:replicaset-controller", "system:serviceaccount:kube-system:replication-controller", "system:serviceaccount:kube-system:statefulset-controller", "system:high-scale-checkpointing-controller" ].exists(sa, sa == request.userInfo.username)' resulted in error: no such key: username

Slack discussion

No response

Troubleshooting

  • I have read and followed the documentation AND the troubleshooting guide.
  • I have searched other issues in this repository and mine is not recorded.