Type Assertion Paranoia

controllers/configurationpolicy_controller.go

@@ -1140,11 +1140,11 @@ func (r *ConfigurationPolicyReconciler) handleObjectTemplates(plc policyv1.Confi
  // violations for enforce configurationpolicies are already handled in handleObjects,
  // so we only need to generate a violation if the remediationAction is set to inform
  if !handled && !enforce {
- objData := map[string]interface{}{
- "indx":  indx,
- "kind": kind,
- "desiredName": templateObjs[indx].name,
- "namespaced": templateObjs[indx].isNamespaced,
+ objData := templateIdentifier{
+ index: indx,
+ kind: kind,
+ desiredName: templateObjs[indx].name,
+ namespaced: templateObjs[indx].isNamespaced,
  }
 
  statusUpdateNeeded := createInformStatus(
@@ -1335,6 +1335,13 @@ func addConditionToStatus(
  return updateNeeded
 }
 
+type templateIdentifier struct {
+ desiredName string
+ index int
+ kind string
+ namespaced bool
+}
+
 // createInformStatus updates the status field for a configurationpolicy with remediationAction=inform
 // based on how many compliant/noncompliant objects are found when processing the templates in the configurationpolicy
 func createInformStatus(
@@ -1344,18 +1351,9 @@ func createInformStatus(
  compliantObjects,
  nonCompliantObjects map[string]map[string]interface{},
  plc *policyv1.ConfigurationPolicy,
- objData map[string]interface{},
+ objData templateIdentifier,
 ) bool {
- //nolint:forcetypeassert
- desiredName := objData["desiredName"].(string)
- //nolint:forcetypeassert
- indx := objData["indx"].(int)
- //nolint:forcetypeassert
- kind := objData["kind"].(string)
- //nolint:forcetypeassert
- namespaced := objData["namespaced"].(bool)
-
- if kind == "" {
+ if objData.kind == "" {
  return false
  }
 
@@ -1374,7 +1372,7 @@ func createInformStatus(
  compObjs = compliantObjects
  }
 
- return createStatus(desiredName, kind, compObjs, namespaced, plc, indx, compliant, objShouldExist)
+ return createStatus(objData, compObjs, plc, compliant, objShouldExist)
 }
 
 // handleObjects controls the processing of each individual object template within a configurationpolicy
@@ -1623,6 +1621,12 @@ func (r *ConfigurationPolicyReconciler) handleSingleObj(
  },
  }
 
+ objData := templateIdentifier{
+ kind: obj.gvr.Resource,
+ namespaced: obj.namespaced,
+ index: obj.index,
+ }
+
  if !exists && obj.shouldExist {
  // it is a musthave and it does not exist, so it must be created
  if strings.EqualFold(string(remediation), string(policyv1.Enforce)) {
@@ -1638,8 +1642,7 @@ func (r *ConfigurationPolicyReconciler) handleSingleObj(
  // object is missing and will be created, so send noncompliant "does not exist" event first
  // (this check has already happened, but we send the event here to avoid the status flipping on an
  // error)
- _ = createStatus("", obj.gvr.Resource, compliantObject, obj.namespaced, obj.policy,
- obj.index, false, true)
+ _ = createStatus(objData, compliantObject, obj.policy, false, true)
  obj.policy.Status.ComplianceState = policyv1.NonCompliant
  statusStr := convertPolicyStatusToString(obj.policy)
  objLog.Info("Sending a noncompliant status event (object missing)", "policy", obj.policy.Name, "status",
@@ -1685,8 +1688,7 @@ func (r *ConfigurationPolicyReconciler) handleSingleObj(
  if strings.EqualFold(string(remediation), string(policyv1.Enforce)) {
  log.V(2).Info("Entering `does not exist` and `must not have`")
 
- statusUpdateNeeded = createStatus("", obj.gvr.Resource, compliantObject, obj.namespaced, obj.policy,
- obj.index, compliant, false)
+ statusUpdateNeeded = createStatus(objData, compliantObject, obj.policy, compliant, false)
  }
  }
 
@@ -1707,8 +1709,7 @@ func (r *ConfigurationPolicyReconciler) handleSingleObj(
 
  if triedUpdate && !strings.Contains(msg, "Error validating the object") {
  // object has a mismatch and needs an update to be enforced, throw violation for mismatch
- _ = createStatus("", obj.gvr.Resource, compliantObject, obj.namespaced, obj.policy, obj.index,
- false, true)
+ _ = createStatus(objData, compliantObject, obj.policy, false, true)
  obj.policy.Status.ComplianceState = policyv1.NonCompliant
  statusStr := convertPolicyStatusToString(obj.policy)
  objLog.Info("Sending an update policy status event", "policy", obj.policy.Name, "status", statusStr)
@@ -1748,8 +1749,7 @@ func (r *ConfigurationPolicyReconciler) handleSingleObj(
 
  statusUpdateNeeded = addConditionToStatus(obj.policy, obj.index, true, reason, msg)
  } else {
- statusUpdateNeeded = createStatus("", obj.gvr.Resource, compliantObject, obj.namespaced, obj.policy,
- obj.index, compliant, true)
+ statusUpdateNeeded = createStatus(objData, compliantObject, obj.policy, compliant, true)
  }
  created := false
  creationInfo = &policyv1.ObjectProperties{
@@ -1978,7 +1978,7 @@ func buildNameList(
  }
 
  if match {
- kindNameList = append(kindNameList, uObj.Object["metadata"].(map[string]interface{})["name"].(string))
+ kindNameList = append(kindNameList, uObj.GetName())
  }
  }
 
@@ -2264,6 +2264,11 @@ func mergeSpecsHelper(templateVal, existingVal interface{}, ctype string) interf
  return templateVal.(string)
 }
 
+type countedVal struct {
+ value interface{}
+ count int
+}
+
 // mergeArrays is a helper function that takes a list from the existing object and merges in all the data that is
 // different in the template. This way, comparing the merged object to the one that exists on the cluster will tell
 // you whether the existing object is compliant with the template
@@ -2280,18 +2285,15 @@ func mergeArrays(newArr []interface{}, old []interface{}, ctype string) (result
  }
 
  // create a set with a key for each unique item in the list
- oldItemSet := map[string]map[string]interface{}{}
+ oldItemSet := make(map[string]*countedVal)
 
  for _, val2 := range old {
  key := fmt.Sprint(val2)
 
  if entry, ok := oldItemSet[key]; ok {
- oldItemSet[key]["count"] = entry["count"].(int) + 1
+ entry.count++
  } else {
- oldItemSet[key] = map[string]interface{}{
- "count": 1,
- "value": val2,
- }
+ oldItemSet[key] = &countedVal{value: val2, count: 1}
  }
  }
 
@@ -2306,10 +2308,8 @@ func mergeArrays(newArr []interface{}, old []interface{}, ctype string) (result
  seen[key] = true
  }
 
- data := oldItemSet[key]
  count := 0
- reqCount := data["count"]
- val2 := data["value"]
+ val2 := oldItemSet[key].value
  // for each list item in the existing array, iterate through the template array and try to find a match
  for newArrIdx, val1 := range newArrCopy {
  if idxWritten[newArrIdx] {
@@ -2353,14 +2353,14 @@ func mergeArrays(newArr []interface{}, old []interface{}, ctype string) (result
 
  // If the result of merging val1 (template) into val2 (existing value) matched val2 for the required count,
  // move on to the next existing value.
- if count == reqCount {
+ if count == oldItemSet[key].count {
  break
  }
  }
  // if an item in the existing object cannot be found in the template, we add it to the template array
  // to produce the merged array
- if count < reqCount.(int) {
- for i := 0; i < (reqCount.(int) - count); i++ {
+ if count < oldItemSet[key].count {
+ for i := 0; i < (oldItemSet[key].count - count); i++ {
  newArr = append(newArr, val2)
  }
  }
@@ -2423,7 +2423,7 @@ func handleSingleKey(
 
  updateNeeded := false
 
- if isDenylisted(key) {
+ if key == "apiVersion" || key == "kind" {
  log.V(2).Info("Ignoring the key since it is deny listed", "key", key)
 
  return "", false, nil, true
@@ -2594,10 +2594,15 @@ func (r *ConfigurationPolicyReconciler) checkAndUpdateResource(
 
  // only look at labels and annotations for metadata - configurationPolicies do not update other metadata fields
  if key == "metadata" {
- mergedAnnotations := mergedObj.(map[string]interface{})["annotations"]
- mergedLabels := mergedObj.(map[string]interface{})["labels"]
- obj.object.UnstructuredContent()["metadata"].(map[string]interface{})["annotations"] = mergedAnnotations
- obj.object.UnstructuredContent()["metadata"].(map[string]interface{})["labels"] = mergedLabels
+ // if it's not the right type, the map will be empty
+ mdMap, _ := mergedObj.(map[string]interface{})
+
+ // if either isn't found, they'll just be empty
+ mergedAnnotations, _, _ := unstructured.NestedStringMap(mdMap, "annotations")
+ mergedLabels, _, _ := unstructured.NestedStringMap(mdMap, "labels")
+
+ obj.object.SetAnnotations(mergedAnnotations)
+ obj.object.SetLabels(mergedLabels)
  } else {
  obj.object.UnstructuredContent()[key] = mergedObj
  }

controllers/configurationpolicy_controller_test.go

@@ -458,11 +458,11 @@ func TestCreateInformStatus(t *testing.T) {
  },
  }
  objNamespaced := true
- objData := map[string]interface{}{
- "indx":  0,
- "kind": "Secret",
- "desiredName": "myobject",
- "namespaced": objNamespaced,
+ objData := templateIdentifier{
+ index: 0,
+ kind: "Secret",
+ desiredName: "myobject",
+ namespaced: objNamespaced,
  }
  mustNotHave := false
  numCompliant := 0