From 3a69702b490cb7afe4cc026b34369932bf808ce7 Mon Sep 17 00:00:00 2001 From: Mariam Fahmy Date: Tue, 13 Aug 2024 12:25:29 +0300 Subject: [PATCH] fix: check permissions for validate.cel subrules only (#10829) Signed-off-by: Mariam Fahmy Co-authored-by: Jim Bugwadia --- pkg/validation/policy/actions.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/validation/policy/actions.go b/pkg/validation/policy/actions.go index acbf33f2952a..1cbbe3b2ae35 100644 --- a/pkg/validation/policy/actions.go +++ b/pkg/validation/policy/actions.go @@ -55,7 +55,7 @@ func validateActions(idx int, rule *kyvernov1.Rule, client dclient.Interface, mo } // In case generateValidatingAdmissionPolicy flag is set to true, check the required permissions. - if toggle.FromContext(context.TODO()).GenerateValidatingAdmissionPolicy() { + if rule.HasValidateCEL() && toggle.FromContext(context.TODO()).GenerateValidatingAdmissionPolicy() { authCheck := authChecker.NewSelfChecker(client.GetKubeClient().AuthorizationV1().SelfSubjectAccessReviews()) // check if the controller has the required permissions to generate validating admission policies. if !validatingadmissionpolicy.HasValidatingAdmissionPolicyPermission(authCheck) {