change the order for variable validation: add allowed vars first
@@ -27,10 +27,6 @@ func ContainsVariablesOtherThanObject(policy kyverno.ClusterPolicy) error {
filterVars := []string{"request.object", "request.namespace"}
ctx := context.NewContext(filterVars...)
- if rule, err = variables.SubstituteAllInRule(log.Log, ctx, rule); !checkNotFoundErr(err) {
- return fmt.Errorf("variable substitution failed for rule %s: %s", rule.Name, err.Error())
- }
-
for _, contextEntry := range rule.Context {
if contextEntry.APICall != nil {
ctx.AddBuiltInVars(contextEntry.Name)
@@ -41,6 +37,10 @@ func ContainsVariablesOtherThanObject(policy kyverno.ClusterPolicy) error {
}
}
+ if rule, err = variables.SubstituteAllInRule(log.Log, ctx, rule); !checkNotFoundErr(err) {
+ return fmt.Errorf("variable substitution failed for rule %s: %s", rule.Name, err.Error())
+ }
+
if rule.AnyAllConditions != nil {
if err = validatePreConditions(idx, ctx, rule.AnyAllConditions); err != nil {
return err
