Simplify Disallow hostPorts in CEL expressions

[lavishpal]

Related Issue(s)

fixes #1093

Description

This PR simplify the CEL expression by removing the repeated terms.

Checklist

• I have read the policy contribution guidelines.
• I have added test manifests and resources covering both positive and negative tests that prove this policy works as intended.
• I have added the artifacthub-pkg.yml file and have verified it is complete and correct.

[Chandan-DK]

Hi @lavishpal - Thanks for the contribution!

We can create a variable allContainers to hold all the containers.

      validate:
        cel:
          variables:
            - name: allContainers
              expression: >-
                object.spec.containers + 
                object.spec.?initContainers.orValue([]) + 
                object.spec.?ephemeralContainers.orValue([])

We can then use this variable and simplify expression to:

         expressions:
            - expression: >- 
                variables.allContainers.all(container, 
                container.?ports.orValue([]).all(port, port.?hostPort.orValue(0) == 0))

[lavishpal]

Yes we can use variable, but we can also directly use optional .

[Chandan-DK]

Yes, using the optional syntax directly in the expression is a valid approach and works well. However, it's easier to read the expression when we can generalize a large expression like this into a variable.

object.spec.containers + object.spec.?initContainers.orValue([]) + object.spec.?ephemeralContainers.orValue([])

The newer CEL policies in the library make use of the allContainers variable, and it would help keep it consistent with that.

[lavishpal]

cc : @JimBugwadia

[chipzoller]

Multiple tests failing.

[chipzoller]

Tests are failing.

[lavishpal]

Multiple tests failing.

Can you guide me how to fix these test.

[chipzoller]

Once CI completes, go look at the failing tests and see the logged messages.

[realshuting]

All disallow-host-ports tests failed, something's broken.

[lavishpal]

Yeah i figured out that there is indentation mistake in YAML.

[realshuting]

@lavishpal - are you fixing it?

[lavishpal]

@lavishpal - are you fixing it?

Yeah i will fix it till tomorrow.

[lavishpal]

cc: @realshuting
PTAL

Chip has stepped down from the Kyverno maintainer.

[JimBugwadia]

Thanks @lavishpal! The DCO also needs to be fixed.

[lavishpal]

Hi @JimBugwadia ,
I just Fixed the artifacthub-pkg.yml.
This resolves the Artifact Hub lint failure

[lavishpal]

cc: @JimBugwadia