[Bug] [CLI] Error on mutate.foreach loop with precondition
Kyverno CLI Version
1.15.0
Description
A mutate cluster policy with a foreach loop containing preconditions with existence/non-existence expressions throws the error Failed to parse value type doesn't match key type
This appears to be a similar bug to #3131 (closed) (which has been resolved) but affecting mutate rather than validate.
Steps to reproduce
- Apply this policy
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: all-mutate-vpa-enforce-resource-policy
spec:
validationFailureAction: Audit
rules:
match:
any:
- resources:
kinds:
- VerticalPodAutoscaler
mutate:
foreach:
- list: request.object.spec.resourcePolicy.containerPolicies[]
patchesJson6902: |-
- path: /spec/resourcePolicy/containerPolicies/{{elementIndex}}/maxAllowed/memory
op: add
value: '16Gi'
preconditions:
any:
- key: '{{ element.maxAllowed.memory || '''' }}'
message: maxAllowed.memory not found. Setting that to 16Gi
operator: Equals
value: ""
- list: request.object.spec.resourcePolicy.containerPolicies[]
patchesJson6902: |-
- path: /spec/resourcePolicy/containerPolicies/{{elementIndex}}/maxAllowed/memory
op: replace
value: '16Gi'
preconditions:
any:
- key: '{{ element.maxAllowed.memory || '''' }}'
message: maxAllowed.memory specified is greater than maximum allowed.
Setting that to 16Gi
operator: GreaterThan
value: 16Gi
name: all-mutate-set-max-memory-allowed
- Create a resource that will match the resource kind. In this example
VerticalPodAutoscaler
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
name: vpa-test-500mi
namespace: system-test
labels:
test: kyverno-mutation
spec:
targetRef:
apiVersion: apps/v1
kind: Deployment
name: nonexistent-deployment
updatePolicy:
updateMode: "Off"
resourcePolicy:
containerPolicies:
- containerName: test-container
maxAllowed:
memory: '500Mi'
controlledResources: ['memory']
- view error in log
error: parse error:
level: error
logger: engine.mutate
message: Failed to parse value type doesn't match key type
new.kind: VerticalPodAutoscaler
new.name: vpa-test-500mi
new.namespace: system-test
policy.apply: All
policy.name: all-mutate-vpa-enforce-resource-policy
policy.namespace:
rule.name: all-mutate-set-max-memory-allowed
Expected behavior
Each rule in the list should successfully be executed
Screenshots
No response
Kyverno logs
Slack discussion
No response
Troubleshooting
-
I have read and followed the troubleshooting guide. -
I have searched other issues in this repository and mine is not recorded.