fix(kyverno): guard CRD spec getters with optional chaining

[vikash7485]

Summary

Fixes potential runtime crashes (TypeError: Cannot read properties of undefined (reading 'rules')) when rendering Kyverno policies (Policy, ClusterPolicy, ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy, ImageValidatingPolicy) whose Kubernetes resource payloads omit or partially initialize the .spec object field.

Root Cause

KyvernoPolicyBase in src/resources/kyvernoPolicy.ts and CEL policy wrappers (ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy, ImageValidatingPolicy) in src/resources/celPolicies.ts dereferenced this.spec directly without optional chaining. When a resource's .spec field is undefined during streaming or mock loading, calling getters like .rules, .validationFailureAction, .background, or .validationCount threw an unhandled TypeError.

Changes Made

• plugins/kyverno/src/resources/kyvernoPolicy.ts:
  • Updated rules, validationFailureAction, and background getters to evaluate this.spec?.....
• plugins/kyverno/src/resources/celPolicies.ts:
  • Updated validationActions, validationCount, isAdmissionEnabled, isBackgroundEnabled, mutationCount, generateCount, schedule, imagePatterns, and attestorCount getters to evaluate this.spec?.....
• plugins/kyverno/src/resources/kyvernoPolicy.test.ts:
  • Added unit regression test suite verifying that all policy classes gracefully return default fallbacks when .spec is undefined.

How to Test

1. Run npm test inside plugins/kyverno to execute the new unit test suite in src/resources/kyvernoPolicy.test.ts.
2. Verify that mock objects constructed with { kind: 'Policy', metadata: { name: 'test' } } evaluate .rules, .validationFailureAction, and .background without throwing runtime errors.

[illume]

Thanks for working on this.

The commit messages could use some tidying up to match our contribution guidelines. We use Linux kernel style — the contributing guide has the details, and git log shows good examples.

Commits that need attention

• fix(kyverno): guard CRD spec getters with optional chaining — Missing area: description prefix — e.g. frontend: HomeButton: Fix so it navigates to home or backend: config: Add enable-dynamic-clusters flag.

Commit guidelines

• Use atomic commits focused on a single change.
• Use the title format <area>: <Description of changes> — description must start with a capital letter.
• Keep the title under 72 characters (soft requirement).
• Explain the intention and why the change is needed.
• Make commit titles meaningful and describe what changed.
• Do not add code that a later commit rewrites; squash or reorder commits instead.
• Do not include Fixes #NN in commit messages.

Good examples:

• frontend: HomeButton: Fix so it navigates to home
• backend: config: Add enable-dynamic-clusters flag

[Copilot]

Copilot review overview

🟡 Changes recommended

The new fixtures omit a type-required spec, causing typechecking failures until the resource interfaces reflect the supported payload shape.

Review effort: Balanced
Findings: 1

Open (1)

• Make policy spec types optional for missing-spec fixtures · New

What changed in this PR

Adds safe defaults for Kyverno resources whose spec is missing or incomplete.

Changes:

• Guards traditional and CEL policy getters with optional chaining.
• Adds regression coverage for missing specifications.

File	Description
kyverno/​src/​resources/​kyvernoPolicy.ts	Safeguards standard policy getters.
kyverno/​src/​resources/​celPolicies.ts	Safeguards CEL policy getters.
kyverno/​src/​resources/​kyvernoPolicy.test.ts	Tests missing-spec fallback behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.