Send compliance events on the hosting cluster

If the controller was configured with a target cluster that was not the
same as the cluster the controller was in, then the compliance events
were being created on the wrong cluster. Now they are correctly created
on the cluster hosting the controller, which is where the policy
framework will be looking for them.

Refs:
 - https://issues.redhat.com/browse/ACM-2249

Signed-off-by: Justin Kulikauskas <jkulikau@redhat.com>

controllers/configurationpolicy_controller.go

@@ -2520,10 +2520,7 @@ func (r *ConfigurationPolicyReconciler) sendComplianceEvent(instance *policyv1.C
  event.Type = "Warning"
  }
 
- eventClient := r.TargetK8sClient.CoreV1().Events(instance.Namespace)
- _, err := eventClient.Create(context.TODO(), event, metav1.CreateOptions{})
-
- return err
+ return r.Create(context.TODO(), event)
 }
 
 // convertPolicyStatusToString to be able to pass the status as event

test/e2e/case21_alternative_kubeconfig_test.go

@@ -4,6 +4,7 @@ package e2e
 
 import (
  "context"
+ "fmt"
  "os"
 
  . "github.com/onsi/ginkgo/v2"
@@ -18,10 +19,12 @@ import (
 
 var _ = Describe("Test an alternative kubeconfig for policy evaluation", Ordered, Label("hosted-mode"), func() {
  const (
- envName = "TARGET_KUBECONFIG_PATH"
- namespaceName = "e2e-test-ns"
- policyName = "create-ns"
- policyYAML = "../resources/case21_alternative_kubeconfig/policy.yaml"
+ envName = "TARGET_KUBECONFIG_PATH"
+ namespaceName = "e2e-test-ns"
+ policyName = "create-ns"
+ policyYAML = "../resources/case21_alternative_kubeconfig/policy.yaml"
+ parentPolicyName = "parent-create-ns"
+ parentPolicyYAML = "../resources/case21_alternative_kubeconfig/parent-policy.yaml"
  )
 
  var targetK8sClient *kubernetes.Clientset
@@ -41,15 +44,34 @@ var _ = Describe("Test an alternative kubeconfig for policy evaluation", Ordered
  AfterAll(func() {
  deleteConfigPolicies([]string{policyName})
 
- err := targetK8sClient.CoreV1().Namespaces().Delete(context.TODO(), namespaceName, metav1.DeleteOptions{})
+ err := clientManagedDynamic.Resource(gvrPolicy).Namespace(testNamespace).Delete(
+ context.TODO(), parentPolicyName, metav1.DeleteOptions{},
+ )
+ if !errors.IsNotFound(err) {
+ Expect(err).To(BeNil())
+ }
+
+ err = targetK8sClient.CoreV1().Namespaces().Delete(context.TODO(), namespaceName, metav1.DeleteOptions{})
  if !errors.IsNotFound(err) {
  Expect(err).To(BeNil())
  }
  })
 
  It("should create the namespace using the alternative kubeconfig", func() {
+ By("Creating parent policy " + parentPolicyName + " on " + testNamespace)
+ utils.Kubectl("apply", "-f", parentPolicyYAML, "-n", testNamespace)
+ parent := utils.GetWithTimeout(clientManagedDynamic, gvrPolicy,
+ parentPolicyName, testNamespace, true, defaultTimeoutSeconds)
+ Expect(parent).NotTo(BeNil())
+
  By("Creating the " + policyName + " policy")
- utils.Kubectl("apply", "-f", policyYAML, "-n", testNamespace)
+ plcDef := utils.ParseYaml(policyYAML)
+ ownerRefs := plcDef.GetOwnerReferences()
+ ownerRefs[0].UID = parent.GetUID()
+ plcDef.SetOwnerReferences(ownerRefs)
+ _, err := clientManagedDynamic.Resource(gvrConfigPolicy).Namespace(testNamespace).
+ Create(context.TODO(), plcDef, metav1.CreateOptions{})
+ Expect(err).To(BeNil())
 
  By("Verifying that the " + policyName + " policy is compliant")
  Eventually(func() interface{} {
@@ -61,7 +83,12 @@ var _ = Describe("Test an alternative kubeconfig for policy evaluation", Ordered
  }, defaultTimeoutSeconds, 1).Should(Equal("Compliant"))
 
  By("Verifying that the " + policyName + " was created using the alternative kubeconfig")
- _, err := targetK8sClient.CoreV1().Namespaces().Get(context.TODO(), namespaceName, metav1.GetOptions{})
+ _, err = targetK8sClient.CoreV1().Namespaces().Get(context.TODO(), namespaceName, metav1.GetOptions{})
  Expect(err).To(BeNil())
+
+ By("Verifying that a compliance event was created on the parent policy")
+ compParentEvents := utils.GetMatchingEvents(clientManaged, testNamespace, parentPolicyName,
+ fmt.Sprintf("policy: %v/%v", testNamespace, policyName), "^Compliant;", defaultTimeoutSeconds)
+ Expect(compParentEvents).NotTo(BeEmpty())
  })
 })

test/resources/case21_alternative_kubeconfig/parent-policy.yaml

@@ -0,0 +1,22 @@
+apiVersion: policy.open-cluster-management.io/v1
+kind: Policy
+metadata:
+ name: parent-create-ns
+spec:
+ remediationAction: inform
+ disabled: false
+ policy-templates:
+ - objectDefinition:
+ apiVersion: policy.open-cluster-management.io/v1
+ kind: ConfigurationPolicy
+ metadata:
+ name: create-ns
+ spec:
+ remediationAction: enforce
+ object-templates:
+ - complianceType: musthave
+ objectDefinition:
+ apiVersion: v1
+ kind: Namespace
+ metadata:
+ name: e2e-test-ns

test/resources/case21_alternative_kubeconfig/policy.yaml

@@ -2,6 +2,11 @@ apiVersion: policy.open-cluster-management.io/v1
 kind: ConfigurationPolicy
 metadata:
  name: create-ns
+ ownerReferences:
+ - apiVersion: policy.open-cluster-management.io/v1
+ kind: Policy
+ name: parent-create-ns
+ uid: 12345678-90ab-cdef-1234-567890abcdef # must be replaced before creation
 spec:
  remediationAction: enforce
  object-templates: