feat(cel): add ValidatingPolicy for aws-node IRSA + tests #1328
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Author
|
JimBugwadia
previously approved these changes
Oct 22, 2025
Member
|
The current test structure is failing our expected structure. @syedazeez337 can you please take a look? |
auto-merge was automatically disabled
December 30, 2025 18:57
Head branch was pushed to by a user without write access
syedazeez337
force-pushed
the
feat/cel-require-aws-node-irsa
branch
2 times, most recently
from
8598362 to
002f47d
Compare
Author
|
Hi @fjogeleit |
syedazeez337
force-pushed
the
feat/cel-require-aws-node-irsa
branch
from
952ed97 to
09f087a
Compare
Convert legacy aws/require-aws-node-irsa to a CEL ValidatingPolicy under aws-cel/require-aws-node-irsa, with kyverno test fixtures. Changes: - Add ValidatingPolicy at aws-cel/require-aws-node-irsa/require-aws-node-irsa.yaml - Add chainsaw test with pass/fail/skip scenarios - Add kyverno-test with pass/fail/skip test results - Add artifacthub-pkg.yml metadata Behavior (parity with legacy): - Target: DaemonSet kube-system/aws-node only - Fails when spec.template.spec.serviceAccountName == aws-node - Uses validationActions: Audit Signed-off-by: Azeez Syed <syedazeez337@gmail.com>
syedazeez337
force-pushed
the
feat/cel-require-aws-node-irsa
branch
from
09f087a to
7eee43c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Convert legacy
aws/require-aws-node-irsato a CELValidatingPolicyunderaws-cel/require-aws-node-irsa, withkyverno testfixtures.What changed
Added:
aws-cel/require-aws-node-irsa/policy.yaml(CELValidatingPolicy)Added tests:
aws-cel/require-aws-node-irsa/tests/pass(uses non-aws-nodeSA → pass)aws-cel/require-aws-node-irsa/tests/fail(usesaws-nodeSA → fail)No changes to the legacy sample.
Why
Part of the ongoing migration of sample policies to CEL-based types for better performance, native K8s alignment, and clearer testability.
Behavior (parity with legacy)
DaemonSetkube-system/aws-node only.spec.template.spec.serviceAccountName == "aws-node".validationActions: Audit(equivalent tovalidationFailureAction: Audit).Spec details
matchConstraints.resourceRules:apps/v1,daemonsets,CREATE|UPDATEmatchConditions: name/namespace pinning (kube-system+aws-node)validations[0].expression:object.spec.template.spec.serviceAccountName != "aws-node"How I tested
Notes
aws-nodeSA; use IRSA-specific SA).aws-nodeSA (vs. simply “not equal toaws-node”).