Repository navigation
fix(kyverno): record reviewed RBAC exclusions as a current skip - #3906
Conversation
The privileged-RBAC policy exempted its reviewed roles with a rule `exclude`, which produces no result, so the warnings those roles had before they were accepted stayed in their reports indefinitely (14 on prod). Express the same exact kind|namespace|name identities as a false precondition instead, so each background scan records a current skip. The shape test pins the new precondition verbatim and asserts, from the policy report, that exactly the reviewed fixtures skip and their same-name lookalikes still fail; kyverno test pairs rows by name alone, so those rows move out of it. Fixes #3900 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@coderabbitai review |
Tried as a user, at head
|
|
|
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Why
The policy-report dashboard shows 14 privileged-RBAC warnings (12 cluster-wide, 2 namespaced) for roles the platform has already reviewed and accepted. They were reported before being accepted, and the way the policy exempts them records nothing new, so the old warnings never go away. They inflate the count and make a real new warning harder to spot.
What
The reviewed exemptions now record a current "skipped" result on every background scan, so an accepted role shows as accepted and its old warning is replaced. The list of exempted roles, and the rule that each exemption covers exactly one role in one place, are unchanged. Deployment is unchanged too: Flux applies it and the next hourly scan clears the 14 warnings.
Fixes #3900