No warning displayed on kubectl apply with enforcementAction warn about gatekeeper

[andrevcf]

Confirmed the problem with multi-line violation message.
With single-line message it works!

K8S server: v1.28.4
Gatekeeper: openpolicyagent/gatekeeper:v3.17.0

[ritazh]

@globalundo can you please share your ConstraintTemplate, constraint, and request that should have returned a warning?
For constraints using warn enforcementAction, gatekeeper should be returning a 299 status code:

gatekeeper/pkg/webhook/policy.go

Line 69 in 45e4552

const httpStatusWarning = 299

[globalundo]

@ritazh while preparing a minimal set of ConstraintTemplate, constraint, and request to reproduce the issue, I have managed to locate an exact issue:

• in all our constants we have a multi-line violation message.
• a violation is printed correctly when enforcementAction is deny
• no message is printed if enforcementAction is warn

Here's a minimal example:

---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AlwaysDeny
metadata:
  name: deny-all-requests-in-namespace
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "default"
---
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: AlwaysDenyMultiline
metadata:
  name: deny-all-requests-in-namespace-multiline
spec:
  enforcementAction: deny
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    namespaces:
      - "default"
---
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: alwaysdenymultiline
spec:
  crd:
    spec:
      names:
        kind: AlwaysDenyMultiline
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package alwaysdeny

        violation[{"msg": "All requests are denied by this policy \n multiline message"}] {
          true
        }
---
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: alwaysdeny
spec:
  crd:
    spec:
      names:
        kind: AlwaysDeny
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package alwaysdeny

        violation[{"msg": "All requests are denied by this policy."}] {
          true
        }

Now, with enforcementAction:deny

$ kubectl run -i --rm --tty podinfo -n default --image=stefanprodan/podinfo  --restart=Never 
Error from server (Forbidden): admission webhook "validation.gatekeeper.sh" denied the request: [deny-all-requests-in-namespace-multiline] All requests are denied by this policy 
 multiline message
[deny-all-requests-in-namespace] All requests are denied by this policy.

However, with enforcementAction:warn only a single line violation message is present:

$ kubectl run -i --rm --tty podinfo -n default --image=stefanprodan/podinfo  --restart=Never 
Warning: [deny-all-requests-in-namespace] All requests are denied by this policy.

The multi-line warning message did work in previous OPA Gatekeeper version, but I can not pinpoint at after what version this has stopped working.

[maxsmythe]

I don't think Gatekeeper has changed any of its violation-reporting-via-webhook logic recently. Is this perhaps related to a Kubernetes or kubectl version change?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.