constraint status error in 3.17.0-rc

[ritazh]

Using cel expression https://github.com/open-policy-agent/gatekeeper-library/blob/master/artifacthub/library/general/requiredlabels/1.1.1/template.yaml#L47 and 3.17.0-rc results in
failed expression or Conditions are not satisfied to generate ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding, cannot generate ValidatingAdmissionPolicyBinding

[ritazh]

This seems to be caused by https://github.com/open-policy-agent/gatekeeper/blob/master/pkg/controller/constraint/constraint_controller.go#L565
A constraint status error is generated even when vap engine and "generateVap" is not present.

[Markieta]

@ritazh I seem to be encountering this issue on v3.17.0. I thought it might've been related to the recent template library updates, but those still work on v3.16.3.

Examples below:

pss-baseline-v2022-host-namespaces-hostnetwork:

failed expression: (has(request.operation) && request.operation == "UPDATE") || (!has(variables.params.hostNetwork) || !variables.params.hostNetwork ? (has(variables.anyObject.spec.hostNetwork) && !variables.anyObject.spec.hostNetwork) : true)

pss-baseline-v2022-proc-mount-type:

failed expression: (has(request.operation) && request.operation == "UPDATE") || size(variables.badContainers) == 0

&

ProcMount type is not allowed, container: kube-proxy. Allowed procMount types: default

[maxsmythe]

Might be bugs in the VAP-CEL in the constraint template. hostnamespaces-hostnetwork may be fixed by this:

open-policy-agent/gatekeeper-library#589

if you had been exempting kube-proxy container, this PR may fix that:
open-policy-agent/gatekeeper-library#588