[Feature] Extract context information from an array when passing to message

[kurktchiev]

Problem Statement

Currently, if I would like my user message to include information stored in an Array, there is no way to traverse the objects of the array and extract the field I am looking for to send back to the end user. I want my user message to include information stored in an Array, and there is no way to traverse the array's objects in that context

Solution Description

Lets say we have the following Reference JSON, I want to be able to grab tasks[*].taskArn or tasks[*].containers[*].containerArn and provide it in my message block as proper identification for my end users:

{
  "failures": [],
  "tasks": [
    {
      "taskArn": "arn:aws:ecs:us-east-1:012345678910:task/1dc5c17a-422b-4dc4-b493-371970c6c4d6",
      "overrides": {
        "containerOverrides": [
          {
            "name": "simple-app"
          },
          {
            "name": "busybox"
          }
        ]
      },
      "lastStatus": "RUNNING",
      "containerInstanceArn": "arn:aws:ecs:us-east-1:012345678910:container-instance/default/5991d8da-1d59-49d2-a31f-4230f9e73140",
      "createdAt": 1476822811.295,
      "version": 0,
      "clusterArn": "arn:aws:ecs:us-east-1:012345678910:cluster/default",
      "startedAt": 1476822833.998,
      "desiredStatus": "RUNNING",
      "taskDefinitionArn": "arn:aws:ecs:us-east-1:012345678910:task-definition/console-sample-app-dynamic-ports:1",
      "startedBy": "ecs-svc/9223370560032507596",
      "containers": [
        {
          "containerArn": "arn:aws:ecs:us-east-1:012345678910:container/4df26bb4-f057-467b-a079-961675296e64",
          "taskArn": "arn:aws:ecs:us-east-1:012345678910:task/default/1dc5c17a-422b-4dc4-b493-371970c6c4d6",
          "lastStatus": "RUNNING",
          "name": "simple-app",
          "networkBindings": [
            {
              "protocol": "tcp",
              "bindIP": "0.0.0.0",
              "containerPort": 80,
              "hostPort": 32774
            }
          ]
        },
        {
          "containerArn": "arn:aws:ecs:us-east-1:012345678910:container/e09064f7-7361-4c87-8ab9-8d073bbdbcb9",
          "taskArn": "arn:aws:ecs:us-east-1:012345678910:task/default/1dc5c17a-422b-4dc4-b493-371970c6c4d6",
          "lastStatus": "RUNNING",
          "name": "busybox",
          "networkBindings": []
        }
      ]
    }
  ]
}

Alternatives

No response

Additional Context

No response

Slack discussion

No response

Research

• I have searched other issues in this repository and mine is not recorded.

[eddycharly]

@kurktchiev do you have a sample policy I can work with ?

[kurktchiev]

Sure, if i want to add a container ARN to the message of the policy below, I do not have a way to

apiVersion: json.kyverno.io/v1alpha1
kind: ValidatingPolicy
metadata:
  name: validate-ecs-task-and-definition-memory-hard-limit
  annotations:
    policies.kyverno.io/title: Validate ECS Task Definition Memory Hard Limit
    policies.kyverno.io/category: ECS Best Practices
    policies.kyverno.io/severity: low
    policies.kyverno.io/description: >-
      This policy checks if Amazon Elastic Container Service
      (ECS) task definitions and tasks have a set memory limit for its container definitions.
      If a memory limit is not set for a container, it can consume excessive memory, potentially starving other containers running on the same host.
      Therefore, it is crucial to enforce a hard memory limit on each container to prevent resource contention.
      If a container exceeds its memory limit, it will be terminated by ECS.
spec:
  rules:
    - name: validate-ecs-task-memory-hard-limit
      match:
        all:
         - source: aws.ecs
         - detail-type: "ECS Task State Change"
         - detail:
            lastStatus: 'PROVISIONING'
      assert:
        all:
          - message: From Lambda - Memory limit for containers in the task should be set in the container definitions of its task
            check:
              detail:
                ~.(containers):
                    (!memory): false

[eddycharly]

Thanks, it doesn't work directly with the payload you posted in the issue description right ?

[kurktchiev]

It should if you modify the match and drop the source and detail-type

[eddycharly]

Look at this https://kyverno.github.io/kyverno-json/main/_playground/?content=H4sIAAAAAAAAA8VU32%2FbNhD%2BV25%2BaoDQkWxFsvQwoO2KLUAbBEvbl7oYTtQ5Zk2RAkk59YLsb99Rqn8ESIACe5gMGOLxvu%2FuPn3kw6SzWsndpJpgpz6T88qaCr55a6ab3ZacsVNlL7Yp6m6N6dJslGkq%2BIxaNRiUubsZ4EvTUkCOYLU0AAZbqmA7JpEg6UVAvxFoGtHQShkVuIxoqbVuJ9boGqFVq0LEojE2YNz3AxfA0KEif9pQUEHToQ%2BCd29v4SOXgN8O9PBhoIc%2FmB7e7%2Bmfp5PMccfJ1UD0hnyAG4cyKEn%2BZZQnflWBUdrev5zWkJdOdWFQ9lcxJgJ8XCs%2F5u9ArkluPKgVvG7xb%2B79nUbP1eGtNQGVIQe35Lbczh79ihs9g6gqHBX1rF4zBD2scUuA4CnAqDMMEsPKOlDBgzwwn%2BCne%2FqrFWOf4LhZ%2FjADX6TAI8E584FEEyO%2BbwnoO8vmFdcfGc55zEAmKNR6Bz4gT2LuwIY1Vz%2FQeHC9McOGAd4Czy6CtfVhepSMHHF1GkpyR9L1klkhWCDDGzKOHP30tHcmJJTrk5kZ0Dn%2BfCaAI2%2F7iIy7sUu2%2FhMZjqg4GDV%2B0O%2B0wNDOvdIaaoJArlWGDdVAvYt%2BYjbfkRzc7HpNe1%2BLF8%2FJswcjPug9uVDtlxzQ%2BmQVOVuWHu%2BYdjk5mMdX8PDAM%2F%2Flg2OBXx01%2F%2FJ1eli8duYMHh%2BXk1NCGL1ZPY3F55%2FpCc%2FZMwmDTX8ZZzmrYIXas30n55MOd9piw3fOkYDxAk5bqQD5D%2B99xbJUvRfEJ0KkVZLO5tllXizKNKkOgIusWc3yus7EKrksRJYXtcCkKEWZp3lxOStzyrPYYtT3Z9ljLp%2FeFfY6XKSNvJRpgSKbzWqRNTITdVbOxbxIyyKRucyaPBaIB%2FeWL7CeRf%2Fz0%2FX11fXvxyvRq7bTJLDrhhiFe%2Bs2b%2FhK5a8y2kKwL22w0uoKguxGVWvOuLqpIJkOvzF4mP3GsiVg8SMcD8wYmc%2BKIvuPslJSJnm2KkQxz1ORyUUhFliXYtEkxbyum1rW5f8va937XW2%2FP6cpfPnKnnv8F9NkmW%2FoBgAA

The message: "Containers: {{ to_string(containers[].containerArn) }}" processes the input payload but i guess it's not what you want.

Can we use the simple example above to clarify what you want ?

[kurktchiev]

Ok so using the above as an example, lets say container 1 fails, but container 2 doesn't. What you provide above just dumps out all container ARNs, which is better than nothing but not useful as I still am not pointing the user to the specific failure.

[kurktchiev]

Or if we take the example further how can I pull out the Task ARN from the original JSON reference block, when a container ends up failing, considering that the Task list is an Array and the containers are an Array?

[eddycharly]

Ok so you want to get the specific sub-element that caused the error right ?

[kurktchiev]

Yes I want to contextualize my errors

[eddycharly]

This is a tricky one 🥵

Basically kyverno-json is all about projecting data and passing the projected data to children until we hit a leaf.
Contextualizing would mean doing something AFTER children have been processed (sort of prolog vs epilog).

I can imaging different solutions:

• introduce a prolog syntax, allowing action AFTER children execution (this is only a technical block, doesn't provide the full solution but a good starting point)
• introduce a more granular checks concept that could work the same as today but with smaller pieces so that you can access the context at the granularity you need

Example solution 1 (prolog):

      assert:
        all:
          - check:
              detail:
                ~.(containers)/(join(' ', ['container needs memory', containerArn])): # expression behind the / is the prolog
                    (!memory): false

Example solution 2 (small checks):

      checks:
         container-needs-memory:
            message: container needs memory {{ containerArn }}
            assert:
               (!memory): false
      assert:
        all:
          - with:
              list: containers
            checks:
            -  container-needs-memory

[eddycharly]

Or maybe just this:

apiVersion: json.kyverno.io/v1alpha1
kind: ValidatingPolicy
metadata:
  name: validate-ecs-task-and-definition-memory-hard-limit
  annotations:
    policies.kyverno.io/title: Validate ECS Task Definition Memory Hard Limit
    policies.kyverno.io/category: ECS Best Practices
    policies.kyverno.io/severity: low
    policies.kyverno.io/description: >-
      This policy checks if Amazon Elastic Container Service
      (ECS) task definitions and tasks have a set memory limit for its container definitions.
      If a memory limit is not set for a container, it can consume excessive memory, potentially starving other containers running on the same host.
      Therefore, it is crucial to enforce a hard memory limit on each container to prevent resource contention.
      If a container exceeds its memory limit, it will be terminated by ECS.
spec:
  rules:
    - name: validate-ecs-task-memory-hard-limit
      match:
        all:
         - source: aws.ecs
         - detail-type: "ECS Task State Change"
         - detail:
            lastStatus: 'PROVISIONING'
      assert:
        all:
          - message: container needs memory {{ containerArn }}
            with:
               list: containers
            check:
              detail:
                  memory: {}

[kurktchiev]

how would that work if we are in a nested array situation?

[eddycharly]

you can project as much as you want

[kurktchiev]

can you provide an example? maybe I am not understanding the vision here

[eddycharly]

you rebuild the objects you need, leveraging jp flattening and projections features

[eddycharly]

using things like:

• multiselect and multiselect-hash
• all kind of projections

[eddycharly]

I've been playing around with the idea and have a working prototype:

apiVersion: json.kyverno.io/v1alpha1
kind: ValidatingPolicy
metadata:
  name: validate-ecs-task-and-definition-memory-hard-limit
  annotations:
    policies.kyverno.io/title: Validate ECS Task Definition Memory Hard Limit
    policies.kyverno.io/category: ECS Best Practices
    policies.kyverno.io/severity: low
    policies.kyverno.io/description: >-
      This policy checks if Amazon Elastic Container Service
      (ECS) task definitions and tasks have a set memory limit for its container definitions.
      If a memory limit is not set for a container, it can consume excessive memory, potentially starving other containers running on the same host.
      Therefore, it is crucial to enforce a hard memory limit on each container to prevent resource contention.
      If a container exceeds its memory limit, it will be terminated by ECS.
spec:
  rules:
    - name: validate-ecs-task-memory-hard-limit
      assert:
        all:
          - with: >-
                ~.(tasks[].let $taskArn = taskArn in containers[].{taskArn:$taskArn,container:@})[]
            check:
                container:
                    memory: {}
            message: >-
                container {{ container.containerArn }}
                in task {{ taskArn }}
                needs memory

WDYT ?

[eddycharly]

Prototype here #471