messageExpression ignored when more than one violation detected

[klehelley]

OPA Gatekeeper versions: v3.18.2, v3.20.1

I have observed working with the K8sPSPHostFilesystem constraint template that often the reported error is the following default error message rather than the one defined in the messageExpression property:

message: 'failed expression: (has(request.operation) && request.operation == "UPDATE")
  || size(variables.badHostPaths) == 0'

I've made a few tests and discovered that I have this message when more than one volume is in violation of the rule. If I ensure only one volume is defined in my test pod I retrieve the expected message:

message: 'HostPath volume { hostPath: { path : /var/log }, name: varlog} is not
  allowed, pod: bad-hostpaths. Allowed path: /usr/share/zoneinfo, readOnly: true}'

If I edit the constraint template to replace the newline character, it then works as expected:

# Edited line in constraint template
messageExpression: variables.badHostPaths.join(" +++ ")

message: 'HostPath volume { hostPath: { path : /var/log }, name: varlog} is not
  allowed, pod: bad-hostpaths. Allowed path: /usr/share/zoneinfo, readOnly: true}
  +++ HostPath volume { hostPath: { path : /etc/machine-id }, name: etcmachineid}
  is not allowed, pod: ba...'

It is unclear to me whether this is a known limitation of OPA Gatekeeper, if this behaviour is by design or should actually be fixed. In the latter case, it is unclear to me whether it should be adressed here in the constraint definitions, or in Gatekeeper itself (or its dependencies). Maybe it is already documented and I have missed this piece of information?

[enza252]

Hey @klehelley - this looks a patch is needed on this line that you pointed out.

I just implemented your change on a local copy of this template and it has fixed my issue where this error was being thrown during evaluation:

failed expression: (has(request.operation) && request.operation == "UPDATE") || size(variables.badHostPaths) == 0

Thanks for your suggestion. It's worth opening a PR for this.

[JaydipGabani]

@klehelley are use using VAP generation feature or CEL validation through Gatekeeper? One way to test if this is GK or CEL bug is to check if this persist while using VAP generation feature as well.

[JaydipGabani]

Addiionally, if you can share exact setup when you are facing this error, this may help figure out where the fix may be needed.

[klehelley]

Thanks for the answers, I'll gather additional information and put it here ideally before the end of the day.