Description of problem:

When Pod security policy is created and the status is changed from inform to enforce, the status is toggling. Not able to enforce pod security policy.

How to fix
Set default value when Kube API value omitted

ref: https://issues.redhat.com/browse/ACM-3109

Signed-off-by: Yi Rae Kim <yikim@redhat.com>

controllers/configurationpolicy_controller_test.go

@@ -764,79 +764,90 @@ func TestShouldHandleSingleKeyFalse(t *testing.T) {
 
  var update, skip bool
 
- tests := [][]map[string]interface{}{
+ type ExpectResult struct {
+ key string
+ expect bool
+ }
+
+ type TestSingleKey struct {
+ input map[string]interface{}
+ fromAPI map[string]interface{}
+ expectResult ExpectResult
+ }
+
+ tests := []TestSingleKey{
  {
- {
+ input: map[string]interface{}{
  "hostIPC": false,
  "container": "test",
  },
- {
+ fromAPI: map[string]interface{}{
  "container": "test",
  },
- {
- "key": "hostIPC",
- "expect": false,
+ expectResult: ExpectResult{
+ "hostIPC",
+ false,
  },
  },
  {
- {
+ input: map[string]interface{}{
  "container": map[string]interface{}{
  "image": "nginx1.7.9",
  "name": "nginx",
  "hostIPC": false,
  },
  },
- {
+ fromAPI: map[string]interface{}{
  "container": map[string]interface{}{
  "image": "nginx1.7.9",
  "name": "nginx",
  },
  },
- {
- "key": "container",
- "expect": false,
+ expectResult: ExpectResult{
+ "container",
+ false,
  },
  },
  {
- {
+ input: map[string]interface{}{
  "hostIPC": true,
  "container": "test",
  },
- {
+ fromAPI: map[string]interface{}{
  "container": "test",
  },
- {
- "key": "hostIPC",
- "expect": true,
+ expectResult: ExpectResult{
+ "hostIPC",
+ true,
  },
  },
  {
- {
+ input: map[string]interface{}{
  "container": map[string]interface{}{
  "image": "nginx1.7.9",
  "name": "nginx",
  "hostIPC": true,
  },
  },
- {
+ fromAPI: map[string]interface{}{
  "container": map[string]interface{}{
  "image": "nginx1.7.9",
  "name": "nginx",
  },
  },
- {
- "key": "container",
- "expect": true,
+ expectResult: ExpectResult{
+ "container",
+ true,
  },
  },
  }
 
  for _, test := range tests {
- unstruct.Object = test[0]
- unstructObj.Object = test[1]
- key := test[2]["key"]
- _, update, _, skip = handleSingleKey(key.(string), unstruct, &unstructObj, "musthave")
- assert.Equal(t, update, test[2]["expect"])
+ unstruct.Object = test.input
+ unstructObj.Object = test.fromAPI
+ key := test.expectResult.key
+ _, update, _, skip = handleSingleKey(key, unstruct, &unstructObj, "musthave")
+ assert.Equal(t, update, test.expectResult.expect)
  assert.False(t, skip)
  }
 }

go.mod

@@ -103,5 +103,4 @@ replace (
  golang.org/x/text => golang.org/x/text v0.3.8 // CVE-2022-32149
  gopkg.in/yaml.v2 => gopkg.in/yaml.v2 v2.4.0 // CVE-2022-3064
  k8s.io/client-go => k8s.io/client-go v0.23.9
- open-cluster-management.io/governance-policy-propagator => github.com/stolostron/governance-policy-propagator v0.0.0-20220727212642-86a318ab17cf
 )

test/e2e/case12_list_compare_test.go

@@ -367,7 +367,6 @@ var _ = Describe("Test list handling for musthave", func() {
 
  deleteConfigPolicies(policies)
  }
- BeforeAll(cleanup)
  It("should only add the list item with the rounded byte value once", func() {
  By("Creating " + case12ByteCreate + " and " + case12ByteInform + " on managed")
  utils.Kubectl("apply", "-f", case12ByteCreateYaml, "-n", testNamespace)

test/e2e/case25_related_object_metric_test.go

@@ -63,12 +63,13 @@ var _ = Describe("Test related object metrics", Ordered, func() {
  clientManagedDynamic, gvrConfigPolicy, opt, 0, false, defaultTimeoutSeconds)
  utils.GetWithTimeout(
  clientManagedDynamic, gvrConfigMap, relatedObject, "default", false, defaultTimeoutSeconds)
+ }
 
+ It("should clean up", cleanup)
+ It("should have no common related object metrics after clean up", func() {
  By("Checking metric endpoint for related object gauges")
  Eventually(func() interface{} {
  return utils.GetMetrics("common_related_objects")
  }, defaultTimeoutSeconds, 1).Should(Equal([]string{}))
- }
-
- AfterAll(cleanup)
+ })
 })