fix: add a copy method to the policy context

[MariamFahmy98]

Explanation

In case there is a policy that have two rules; one of which has forEach so it sets the element of the policy context while the other rule which is of type validate.pattern uses the same policy context that has the element set.

This issue arises from the following line:

kyverno/pkg/engine/handlers/validation/validate_resource.go

Line 225 in 25cb47e

policyContext := v.policyContext

Both v.policyContext and policyContext reference the same struct in memory. As a solution, this PR implements a Copy() method for the policy context.

Related issue

Closes #10220

Milestone of this PR

/milestone 1.12.2

Documentation (required for features)

My PR contains new or altered behavior to Kyverno.

• I have sent the draft PR to add or update the documentation and the link is:

What type of PR is this

/kind bug

Proposed Changes

Proof Manifests

1. Create the following policy:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-service-ports
spec:
  validationFailureAction: Enforce
  background: true
  rules:
  - name: restrict-port-range
    match:
      any:
      - resources:
          kinds:
          - Service
    preconditions:
      all:
        - key: "{{ request.object.spec.type }}"
          operator: Equals
          value: 'LoadBalancer'
    validate:
      message: >-
        Only approved ports may be used for LoadBalancer services.
      foreach:
        - list: request.object.spec.ports[]
          deny:
            conditions:
              all:
                - key: "{{ element.port }}"
                  operator: AnyNotIn
                  value:
                    - 22
                    - 80
                    - 443
  - name: restrict-nodeport
    match:
      any:
      - resources:
          kinds:
          - Service
    validate:
      message: "NodePort services are not allowed. This is {{ request.object.spec.type }}"
      pattern:
        spec:
          =(type): "!NodePort"

2. Create the following resource:

apiVersion: v1
kind: Service
metadata:
  name: service-example-port-22
spec:
  selector:
    app: example
  ports:
    - port: 22
      targetPort: 22
  type: LoadBalancer

The resource is successfully created.

We can test it using Kyverno CLI as follows:

./cmd/cli/kubectl-kyverno/kubectl-kyverno apply policy.yaml --resource resource.yaml -p

apiVersion: wgpolicyk8s.io/v1alpha2
kind: ClusterPolicyReport
metadata:
  creationTimestamp: null
  name: merged
results:
- message: rule passed
  policy: restrict-service-ports
  resources:
  - apiVersion: v1
    kind: Service
    name: service-example-port-22
    namespace: default
  result: pass
  rule: restrict-port-range
  scored: true
  source: kyverno
  timestamp:
    nanos: 0
    seconds: 1715695618
- message: validation rule 'restrict-nodeport' passed.
  policy: restrict-service-ports
  resources:
  - apiVersion: v1
    kind: Service
    name: service-example-port-22
    namespace: default
  result: pass
  rule: restrict-nodeport
  scored: true
  source: kyverno
  timestamp:
    nanos: 0
    seconds: 1715695618
summary:
  error: 0
  fail: 0
  pass: 2
  skip: 0
  warn: 0

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove my fix is effective.
• This is a feature and I have added CLI tests that are applicable.
• My PR needs to be cherry picked to a specific release branch which is .
• My PR contains new or altered behavior to Kyverno and
  • CLI support should be added and my PR doesn't contain that functionality.

Further Comments

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 3 lines in your changes are missing coverage. Please review.

Project coverage is 10.20%. Comparing base (e58d712) to head (81a80ed).

Files	Patch %	Lines
pkg/engine/policycontext/policy_context.go	0.00%	2 Missing ⚠️
...kg/engine/handlers/validation/validate_resource.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10236      +/-   ##
==========================================
- Coverage   10.20%   10.20%   -0.01%     
==========================================
  Files        1031     1031              
  Lines       91875    91877       +2     
==========================================
- Hits         9377     9375       -2     
- Misses      81470    81473       +3     
- Partials     1028     1029       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[realshuting]

/cherry-pick release-1.12