kyverno: [BUG] Rule stats are off!

I configured a policy in a cluster. Here is what I see for the stats:

λ kubectl get clusterpolicies require-pod-probes -o yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  annotations:
    policies.kyverno.io/category: Workload Management
    policies.kyverno.io/description: Liveness and readiness probes need to be configured
      to correctly manage a pods lifecycle during deployments, restarts, and upgrades.
      For each pod, a periodic `livenessProbe` is performed by the kubelet to determine
      if the pod's containers are running or need to be restarted. A `readinessProbe`
      is used by services and deployments to determine if the pod is ready to receive
      network traffic.
  creationTimestamp: "2019-11-26T07:20:29Z"
  generation: 2
  name: require-pod-probes
  resourceVersion: "185701"
  selfLink: /apis/kyverno.io/v1/clusterpolicies/require-pod-probes
  uid: 397193da-101d-11ea-a668-00155d0ce172
spec:
  rules:
  - match:
      resources:
        kinds:
        - Pod
    name: validate-livenessProbe-readinessProbe
    validate:
      message: Liveness and readiness probes are required
      pattern:
        spec:
          containers:
          - livenessProbe:
              periodSeconds: '>0'
            readinessProbe:
              periodSeconds: '>0'
  validationFailureAction: enforce
status:
  Rules:
  - appliedCount: 0
    averageExecutionTime: 16.53µs
    mutationsCount: 0
    ruleName: validate-livenessProbe-readinessProbe
    violationCount: 14435
  averageGenerationRulesExecutionTime: 0s
  averageMutationRulesExecutionTime: 0s
  averageValidationRulesExecutionTime: 0s
  resourcesBlockedCount: 1
  rulesAppliedCount: 14435
  violationCount: 2

The violationCount and rulesAppliedCount show 14435!

We should only record the admission controller requests and not internal evaluation.

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 23 (23 by maintainers)

Commits related to this issue

Most upvoted comments

@shivdudhani Yes,after adding namespace it worked.