fix validation checks for foreach and nested foreach
@@ -2,7 +2,6 @@ package validate
import (
"fmt"
- "strings"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
commonAnchors "github.com/kyverno/kyverno/pkg/engine/anchor"
@@ -110,17 +109,13 @@ func (v *Validate) validateForEach(foreach kyvernov1.ForEachValidation) error {
return fmt.Errorf("foreach.list is required")
}
- if !strings.HasPrefix(foreach.List, "request.object") && !strings.HasPrefix(foreach.List, "request.userInfo") {
- return fmt.Errorf("foreach.list must start with either 'request.object' or 'request.userInfo', e.g. 'request.object.spec.containers', 'request.userInfo.groups'")
- }
-
count := foreachElemCount(foreach)
if count == 0 {
- return fmt.Errorf("one of pattern, anyPattern, deny must be specified")
+ return fmt.Errorf("one of pattern, anyPattern, deny, or a nested foreach must be specified")
}
if count > 1 {
- return fmt.Errorf("only one of pattern, anyPattern, deny can be specified")
+ return fmt.Errorf("only one of pattern, anyPattern, deny, or a nested foreach can be specified")
}
return nil
@@ -140,5 +135,9 @@ func foreachElemCount(foreach kyvernov1.ForEachValidation) int {
count++
}
+ if foreach.ForEachValidation != nil {
+ count++
+ }
+
return count
}
