[Bug] Variables in message are not getting evaluated before pushing to webhook/ui

[franznemeth]

We are using policy-reporter to push policy-violations to a service which then handles the further processing and making sure the owner of the violating resource is informed about the violation.

For this we are adapting our kyverno policies to include some metadata in the violation message. This has always worked fine in the past (kyverno chart version: 2.7.0, kyverno version: v1.9.0 and policy-reporter chart version: 2.13.0)

After upgrading to the latest versions for kyverno and policy-reporter this functionality no longer works.

Policy-reporter pushes the message as is to the configured endpoint without first replacing the variable in {{}}.

Here is a policy to test this with:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  annotations:
    policies.kyverno.io/severity: high
    policies.kyverno.io/title: Disallow host namespaces
  name: disallow-host-namespaces
spec:
  admission: true
  background: false
  failurePolicy: Fail
  rules:
  - exclude:
      resources: {}
    generate:
      clone: {}
      cloneList: {}
    match:
      resources:
        kinds:
        - Pod
    mutate: {}
    name: host-namespaces
    validate:
      message: |
        Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must not be set to true. test:{{request.object.metadata.annotations.test||'none'}}
      pattern:
        spec:
          =(hostIPC): "false"
          =(hostNetwork): "false"
          =(hostPID): "false"
  validationFailureAction: Enforce
  webhookTimeoutSeconds: 15

and the following pod to test the validation:

apiVersion: v1
kind: Pod
metadata:
  name: test
  labels:
    app: test
  annotations:
    test: https://example.com/some-url/1
spec:
  hostNetwork: true
  containers:
    - name: bad-hostnetwork
      image: docker.io/library/nginx
      imagePullPolicy: IfNotPresent
  restartPolicy: Always

Applying this pod against a cluster where kyverno is installed gives the following message:

kubectl apply -f test.yaml -n default
Error from server: error when creating "disallow-host-namespaces/host-namespaces/fail.yaml": admission webhook "validate.kyverno.svc-fail" denied the request:

resource Pod/default/bad-hostnetwork was blocked due to the following policies

disallow-host-namespaces:
  host-namespaces: |-
    validation error: Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must not be set to true. test:https://example.com/some-url/1
    . rule host-namespaces failed at path /spec/hostNetwork/

While the push to the endpoint looks like this:

{"message":"Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must not be set to true. test:{{request.object.metadata.annotations.test||'none'}}\n","policy":"disallow-host-namespaces","rule":"host-namespaces","priority":"error","status":"fail","severity":"high","category":"Pod Security Standards (Default)","scored":false,"properties":{"eventName":"disallow-host-namespaces.17a28fa7ec924b5e","resultID":"33991761c902176dd731f6f5b4a88822d330874d","time":"0001-01-01T00:00:00Z"},"resource":{"apiVersion":"","kind":"Pod","name":"test","namespace":"default","uid":""},"creationTimestamp":"0001-01-01T00:00:00Z","source":"Kyverno Event"}