Skip to main content
Version: 1.14

ValidatingAdmissionPolicy migration

Starting from Kubernetes v1.26, the ValidatingAdmissionPolicy provides a way to write custom admission policies in Kubernetes. The policies are written with the Common Expression Language (CEL), extended with some Kubernetes-specific extensions. ValidatingAdmissionPolicy reached stability in Kubernetes v1.30.

Kubewarden provides a CEL policy that is capable of running Kubernetes VAP policies without any modifications. You can read more about the CEL policy in this section of Kubewarden's documentation. This paragraph explains the benefits of running VAP policies using Kubewarden.

This howto explains how the kwctl tool can be used to migrate a VAP policy to Kubewarden.

Migration steps

note

You must use kwctl version 1.14.0 or later to follow this guide.

Given a file containing this YAML definition of a ValidatingAdmissionPolicy:

ValidatingAdmissionPolicy definition
vap.yml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: "force-liveness-probe"
spec:
failurePolicy: Fail
variables:
- name: containers_without_liveness_probe
expression: |
object.spec.template.spec.containers.filter(c, !has(c.livenessProbe)).map(c, c.name)
matchConstraints:
resourceRules:
- apiGroups: ["apps"]
apiVersions: ["v1"]
operations: ["CREATE", "UPDATE"]
resources: ["deployments"]
validations:
- expression: |
size(variables.containers_without_liveness_probe) == 0
messageExpression: |
'These containers are missing a liveness probe: ' + variables.containers_without_liveness_probe.join(' ')
reason: Invalid

And a file containing the ValidatingAdmissionPolicyBinding resource:

ValidatingAdmissionPolicyBinding definition
vap-binding.yml
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: "kw-scaffold-demo"
spec:
policyName: "force-liveness-probe"
validationActions: [Deny]
matchResources:
namespaceSelector:
matchLabels:
docs.kubewarden.io/vap-migration: enabled

You can migrate the policy to Kubewarden by following these steps:

kwctl command for policy migration
$ kwctl scaffold vap \
-p vap.yml \
-b vap-binding.yml

The command produces output similar to this:

Output from the migration
2024-06-24T16:00:16.516062Z  WARN kwctl::scaffold: Using the 'latest' version of the CEL policy could lead to unexpected behavior. It is recommended to use a specific version to avoid breaking changes.
apiVersion: policies.kubewarden.io/v1
kind: ClusterAdmissionPolicy
metadata:
name: kw-scaffold-demo
spec:
module: ghcr.io/kubewarden/policies/cel-policy:latest
settings:
variables:
- expression: |
object.spec.template.spec.containers.filter(c, !has(c.livenessProbe)).map(c, c.name)
name: containers_without_liveness_probe
validations:
- expression: |
size(variables.containers_without_liveness_probe) == 0
messageExpression: |
'These containers are missing a liveness probe: ' + variables.containers_without_liveness_probe.join(' ')
reason: Invalid
rules:
- apiGroups:
- apps
apiVersions:
- v1
resources:
- deployments
operations:
- CREATE
- UPDATE
mutating: false
failurePolicy: Fail
namespaceSelector:
matchLabels:
docs.kubewarden.io/vap-migration: enabled
note

The command warns the user about the usage of the latest version of the CEL policy. It is recommended to use a specific version to avoid breaking changes.

This can be done using the --cel-policy flag, like this:

$ kwctl scaffold vap \
--cel-policy ghcr.io/kubewarden/policies/cel-policy:v1.0.1 \
-p vap.yml \
-b vap-binding.yml