Merge pull request #283 from GrahamDumpleton/fix-kyverno-rule-selectors

Fix namespace selectors on Kyverno rules.

project-docs/release-notes/version-2.7.0.md

@@ -169,3 +169,11 @@ Bugs Fixed
   definition after the initial workshop environment had been created for a
   workshop, were not being reflected in subsequent workshop sessions created
   after that point.
+
+* Processing of Kyverno rules was not correctly injecting a namespace selector
+  targeting workshop session namespaces when the Kyverno rule used a `match.any`
+  or `match.all` condition. Consequence was that these rules were being applied
+  to all namespaces and thus could have affected other applications deployed to
+  the Kubernetes cluster besides Educates. The affected rules were
+  `disallow-ingress-nginx-custom-snippets`, `restrict-annotations`
+  `restrict-ingress-paths` and `prevent-cr8escape`.

session-manager/handlers/kyverno_rules.py

@@ -34,10 +34,14 @@ def kyverno_environment_rules(workshop_spec, environment_name):
             else:
                 rule["name"] = policy_name
 
-            resources = xget(rule, "match.all", [])
+            # Add a namespace selector to each resource which is a target of the
+            # rule. This is to ensure that the rule is only applied to the
+            # namespaces which are created for a workshop session.
+
+            resources = [condition.get("resources", {}) for condition in xget(rule, "match.all", [])]
 
             if not resources:
-                resources = xget(rule, "match.any", [])
+                resources = [condition.get("resources", {}) for condition in xget(rule, "match.any", [])]
 
             if not resources:
                 resources = [xget(rule, "match.resources", {})]