fix(k8spsphostnetworkingports): CEL fixes for hostNetwork variable and

message

My updates to the suite.yaml file yielded an expected failure due to an
incorrect CEL expression:

```
        unexpected number of violations: got 1 violations but want none: got messages [failed expression: (has(request.operation) && request.operation == "UPDATE") ||
(!has(variables.params.hostNetwork) || !variables.params.hostNetwork ? (has(variables.anyObject.spec.hostNetwork) && !variables.anyObject.spec.hostNetwork) : true)]
```

By contrast, a run of `gator verify -v .
--enable-k8s-native-validation=false` yielded a fully passing
suite.yaml.

This expression was actually failing due to its `messageExpression`, as
non-primitive types cannot be combined with strings as in some
interpreted languages (like rego).  Unfortunately the compiler does not
indicate that the messageExpression is the source of the problem.

Once the message was fixed, I resolved the incorrect violation
expression to fix the bug in the handling of params.hostNetwork.

Signed-off-by: juliankatz <[email protected]>

library/pod-security-policy/host-network-ports/samples/psp-host-network-ports/constraint_block_host_network.yaml

@@ -9,5 +9,3 @@ spec:
         kinds: ["Pod"]
   parameters:
     hostNetwork: false
-    exemptImages:
-    - "nginx"

library/pod-security-policy/host-network-ports/samples/psp-host-network-ports/constraint_port_range_block_host_network.yaml

@@ -0,0 +1,13 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sPSPHostNetworkingPorts
+metadata:
+  name: psp-host-network-ports
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+  parameters:
+    hostNetwork: false
+    min: 80
+    max: 9000

library/pod-security-policy/host-network-ports/samples/psp-host-network-ports/example_allowed.yaml → library/pod-security-policy/host-network-ports/samples/psp-host-network-ports/example_allowed_in_range.yaml

@@ -5,7 +5,6 @@ metadata:
   labels:
     app: nginx-host-networking-ports
 spec:
-  hostNetwork: false
   containers:
   - name: nginx
     image: nginx

library/pod-security-policy/host-network-ports/samples/psp-host-network-ports/example_no_ports_host_network_false.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-host-network-false
+spec:
+  hostNetwork: false
+  containers:
+  - name: nginx
+    image: nginx

library/pod-security-policy/host-network-ports/samples/psp-host-network-ports/example_no_ports_host_network_true.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-host-network-true
+spec:
+  hostNetwork: true
+  containers:
+  - name: nginx
+    image: nginx

library/pod-security-policy/host-network-ports/suite.yaml

@@ -3,19 +3,19 @@ apiVersion: test.gatekeeper.sh/v1alpha1
 metadata:
   name: host-network-ports
 tests:
-- name: use-of-host-networking-ports-blocked
+- name: port-range-with-host-network-allowed
   template: template.yaml
   constraint: samples/psp-host-network-ports/constraint.yaml
   cases:
-  - name: example-disallowed
-    object: samples/psp-host-network-ports/example_disallowed.yaml
+  - name: out-of-range
+    object: samples/psp-host-network-ports/example_disallowed_out_of_range_host_network_true.yaml
     assertions:
     - violations: yes
   - name: example-allowed
-    object: samples/psp-host-network-ports/example_allowed.yaml
+    object: samples/psp-host-network-ports/example_allowed_in_range.yaml
     assertions:
     - violations: no
-  - name: disallowed-ephemeral
+  - name: out-of-range-ephemeral
     object: samples/psp-host-network-ports/disallowed_ephemeral.yaml
     assertions:
     - violations: yes
@@ -27,19 +27,31 @@ tests:
     object: samples/psp-host-network-ports/example_allowed_no_ports.yaml
     assertions:
     - violations: no
-- name: use-of-host-network-blocked
+- name: host-network-forbidden
   template: template.yaml
   constraint: samples/psp-host-network-ports/constraint_block_host_network.yaml
   cases:
-  - name: example-disallowed
-    object: samples/psp-host-network-ports/example_disallowed.yaml
+  - name: hostnetwork-true
+    object: samples/psp-host-network-ports/example_no_ports_host_network_true.yaml
     assertions:
     - violations: yes
-  - name: example-allowed
-    object: samples/psp-host-network-ports/example_allowed.yaml
+  - name: hostnetwork-false
+    object: samples/psp-host-network-ports/example_no_ports_host_network_false.yaml
+    assertions:
+    - violations: no
+- name: port-range-with-host-network-forbidden
+  template: template.yaml
+  constraint: samples/psp-host-network-ports/constraint_port_range_block_host_network.yaml
+  cases:
+  - name: out-of-range-and-host-network-true
+    object: samples/psp-host-network-ports/example_disallowed_out_of_range_host_network_true.yaml
+    assertions:
+    - violations: yes
+  - name: in-range-host-network-false
+    object: samples/psp-host-network-ports/example_allowed_in_range.yaml
     assertions:
     - violations: no
-  - name: disallowed-ephemeral
+  - name: out-of-range-and-host-network-true-ephemeral
     object: samples/psp-host-network-ports/disallowed_ephemeral.yaml
     assertions:
     - violations: yes

library/pod-security-policy/host-network-ports/template.yaml

@@ -78,13 +78,19 @@ spec:
                   (container.ports.all(port, has(port.hostPort) && has(variables.params.max) && port.hostPort > variables.params.max))
                 )
               )
+          - name: isUpdate
+            expression: bool(has(request.operation) && request.operation == "UPDATE")
+          - name: hostNetworkAllowed
+            expression: bool(has(variables.params.hostNetwork) && bool(variables.params.hostNetwork))
+          - name: hostNetworkEnabled
+            expression: bool(has(variables.anyObject.spec.hostNetwork) && bool(variables.anyObject.spec.hostNetwork))
+          - name: hostNetworkViolation
+            expression: bool(variables.hostNetworkEnabled && !variables.hostNetworkAllowed)
           validations:
-          - expression: '(has(request.operation) && request.operation == "UPDATE") || size(variables.badContainers) == 0'
-            messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name + ". Allowed values: " + variables.params'
-          - expression: |
-              (has(request.operation) && request.operation == "UPDATE") || 
-              (!has(variables.params.hostNetwork) || !variables.params.hostNetwork ? (has(variables.anyObject.spec.hostNetwork) && !variables.anyObject.spec.hostNetwork) : true)
-            messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name + ". Allowed values: " + variables.params'
+          - expression: 'variables.isUpdate || size(variables.badContainers) == 0'
+            messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name'
+          - expression: variables.isUpdate || !variables.hostNetworkViolation
+            messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name'
       - engine: Rego
         source:
           rego: |

src/pod-security-policy/host-network-ports/src.cel

@@ -27,10 +27,16 @@ variables:
         (container.ports.all(port, has(port.hostPort) && has(variables.params.max) && port.hostPort > variables.params.max))
       )
     )
+- name: isUpdate
+  expression: bool(has(request.operation) && request.operation == "UPDATE")
+- name: hostNetworkAllowed
+  expression: bool(has(variables.params.hostNetwork) && bool(variables.params.hostNetwork))
+- name: hostNetworkEnabled
+  expression: bool(has(variables.anyObject.spec.hostNetwork) && bool(variables.anyObject.spec.hostNetwork))
+- name: hostNetworkViolation
+  expression: bool(variables.hostNetworkEnabled && !variables.hostNetworkAllowed)
 validations:
-- expression: '(has(request.operation) && request.operation == "UPDATE") || size(variables.badContainers) == 0'
-  messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name + ". Allowed values: " + variables.params'
-- expression: |
-    (has(request.operation) && request.operation == "UPDATE") || 
-    (!has(variables.params.hostNetwork) || !variables.params.hostNetwork ? (has(variables.anyObject.spec.hostNetwork) && !variables.anyObject.spec.hostNetwork) : true)
-  messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name + ". Allowed values: " + variables.params'
+- expression: 'variables.isUpdate || size(variables.badContainers) == 0'
+  messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name'
+- expression: variables.isUpdate || !variables.hostNetworkViolation
+  messageExpression: '"The specified hostNetwork and hostPort are not allowed, pod: " + variables.anyObject.metadata.name'