diff --git a/pkg/services/resourceFilterService_test.go b/pkg/services/resourceFilterService_test.go index de813597..d60067e8 100644 --- a/pkg/services/resourceFilterService_test.go +++ b/pkg/services/resourceFilterService_test.go @@ -92,6 +92,15 @@ func TestPrerequisitesFilters(t *testing.T) { ShouldValidate: false, }, ShouldResourceBeValidated(admissionReviewReq, rootObject)) }) + t.Run("resource should be skipped because it has Secret kind and name related to Helm release metadata", func(t *testing.T) { + admissionReviewReq, rootObject := extractAdmissionReviewReqAndRootObject(templateResource) + admissionReviewReq.Request.Kind.Kind = "Secret" + rootObject.Metadata.Name = "sh.helm.release.v1.my-release2.v3.v3" + rootObject.Metadata.Labels["owner"] = "helm" + assert.Equal(t, ShouldValidatedResourceData{ + ShouldValidate: false, + }, ShouldResourceBeValidated(admissionReviewReq, rootObject)) + }) t.Run("resource should be skipped because namespace is kube-public", func(t *testing.T) { admissionReviewReq, rootObject := extractAdmissionReviewReqAndRootObject(templateResource) admissionReviewReq.Request.Namespace = "kube-public" diff --git a/pkg/services/resourcesFilterService.go b/pkg/services/resourcesFilterService.go index f259c878..895eb3bc 100644 --- a/pkg/services/resourcesFilterService.go +++ b/pkg/services/resourcesFilterService.go @@ -36,6 +36,8 @@ func ShouldResourceBeValidated(admissionReviewReq *admission.AdmissionReview, ro } resourceKind := admissionReviewReq.Request.Kind.Kind + resourceName := rootObject.Metadata.Name + resourceLabels := rootObject.Metadata.Labels managedFields := rootObject.Metadata.ManagedFields userInfo := admissionReviewReq.Request.UserInfo resourceAnnotations := rootObject.Metadata.Annotations @@ -47,6 +49,14 @@ func ShouldResourceBeValidated(admissionReviewReq *admission.AdmissionReview, ro isNamespaceThatShouldBeSkipped := isNamespaceThatShouldBeSkipped(admissionReviewReq) arePrerequisitesMet := isMetadataNameExists && !isUnsupportedKind && !isResourceDeleted && !isNamespaceThatShouldBeSkipped + // if the resource is a helm release metadata, we don't want to validate it + // https://stackoverflow.com/questions/66244697/where-does-helm-store-installation-state + if isHelmReleaseMetadata(resourceName, resourceLabels) { + return ShouldValidatedResourceData{ + ShouldValidate: false, + } + } + if !arePrerequisitesMet { return ShouldValidatedResourceData{ ShouldValidate: false, @@ -137,6 +147,10 @@ func isNamespaceThatShouldBeSkipped(admissionReviewReq *admission.AdmissionRevie return slices.Contains(namespacesToSkip, admissionReviewReq.Request.Namespace) } +func isHelmReleaseMetadata(resourceName string, labels map[string]string) bool { + return strings.Contains(resourceName, "sh.helm.release.v1.") && labels["owner"] == "helm" +} + func isObjectAndOldObjectEqual(admissionReviewReq *admission.AdmissionReview) bool { if admissionReviewReq.Request.OldObject.Raw == nil { return false