Skip to content

fix: skip policy reports with PolicyException in background scan

This pull request addresses a bug where background policy report scans would overwrite correct admission-time skip status (due to a PolicyException) with a fail result. Previously, the background reports logic did not check if a rule result was due to a PolicyException, leading to untrusted or misleading policy reports for affected resources.

The fix updates the report result conversion logic so that, during background scans, if a rule result is due to a PolicyException (that is, ruleResult.IsException() returns true), the result is recorded as skip instead of fail. This ensures PolicyExceptions are honored consistently in both admission and background contexts, as intended.​

This change is a bug fix: it makes Kyverno's policy reporting correct and trustworthy when exceptions are present, especially matching the documented behavior for PolicyExceptions.

Related issue Fixes #14213

Proposed Changes Bug fix in pkg/utils/report/results.go: when converting a rule result, if a PolicyException triggered the skip, set the result status as skip.

No other files changed; logic is backward compatible.

User-facing Impact For users, this means that exceptions applied to a resource (such as pods admitted with an exception) will stay reported as skip even after future background scans, and will not flip to fail unexpectedly. Reports and dashboards using PolicyReports will now remain accurate.

Documentation This brings Kyverno's background reporting into full alignment with its PolicyException documentation and expectations for background scans

Merge request reports

Loading