From 8d3ae7c5c9cdd692f2101a88f570fa7432d39998 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Guilherme=20Vanz?= <jguilhermevanz@suse.com>
Date: Mon, 8 Apr 2024 16:33:10 -0300
Subject: [PATCH] fix: check if settings field is not nil.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The settings fields could be nil when user does not define the settings
for some of the resource type. Therefore, when the policy access the
field to check if it should ignores the values defined by the user, the
policy must check if the settings is not nil first. Thus, a method has
been added to encapsulate this logic.

Signed-off-by: José Guilherme Vanz <jguilhermevanz@suse.com>
---
 settings.go |  8 ++++++++
 validate.go | 21 ++++++++++-----------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/settings.go b/settings.go
index 4534f77..e012e3c 100644
--- a/settings.go
+++ b/settings.go
@@ -23,6 +23,14 @@ type Settings struct {
 	IgnoreImages []string               `json:"ignoreImages,omitempty"`
 }
 
+func (s *Settings) shouldIgnoreCpuValues() bool {
+	return s.Cpu != nil && s.Cpu.IgnoreValues
+}
+
+func (s *Settings) shouldIgnoreMemoryValues() bool {
+	return s.Memory != nil && s.Memory.IgnoreValues
+}
+
 func (r *ResourceConfiguration) valid() error {
 	if (!r.MaxLimit.IsZero() || !r.DefaultLimit.IsZero() || !r.DefaultRequest.IsZero()) && r.IgnoreValues {
 		return fmt.Errorf("ignoreValues cannot be true when any quantities are defined")
diff --git a/validate.go b/validate.go
index 3e537ee..64f71fe 100644
--- a/validate.go
+++ b/validate.go
@@ -29,15 +29,15 @@ func adjustResourceRequest(container *corev1.Container, resourceName string, res
 }
 
 func validateContainerResourceLimits(container *corev1.Container, settings *Settings) error {
-	if container.Resources.Limits == nil && settings.Cpu.IgnoreValues && settings.Memory.IgnoreValues {
+	if container.Resources.Limits == nil && settings.shouldIgnoreCpuValues() && settings.shouldIgnoreMemoryValues() {
 		return fmt.Errorf("container does not have any resource limits")
 	}
 
-	if settings.Cpu.IgnoreValues && missingResourceQuantity(container.Resources.Limits, "cpu") {
+	if settings.shouldIgnoreCpuValues() && missingResourceQuantity(container.Resources.Limits, "cpu") {
 		return fmt.Errorf("container does not have a cpu limit")
 	}
 
-	if settings.Memory.IgnoreValues && missingResourceQuantity(container.Resources.Limits, "memory") {
+	if settings.shouldIgnoreMemoryValues() && missingResourceQuantity(container.Resources.Limits, "memory") {
 		return fmt.Errorf("container does not have a memory limit")
 	}
 
@@ -45,17 +45,17 @@ func validateContainerResourceLimits(container *corev1.Container, settings *Sett
 }
 
 func validateContainerResourceRequests(container *corev1.Container, settings *Settings) error {
-	if container.Resources.Requests == nil && settings.Cpu.IgnoreValues && settings.Memory.IgnoreValues {
+	if container.Resources.Requests == nil && settings.shouldIgnoreCpuValues() && settings.shouldIgnoreMemoryValues() {
 		return fmt.Errorf("container does not have any resource requests")
 	}
 
 	_, found := container.Resources.Requests["cpu"]
-	if !found && settings.Cpu.IgnoreValues {
+	if !found && settings.shouldIgnoreCpuValues() {
 		return fmt.Errorf("container does not have a cpu request")
 	}
 
 	_, found = container.Resources.Requests["memory"]
-	if !found && settings.Memory.IgnoreValues {
+	if !found && settings.shouldIgnoreMemoryValues() {
 		return fmt.Errorf("container does not have a memory request")
 	}
 
@@ -66,8 +66,8 @@ func validateContainerResourceRequests(container *corev1.Container, settings *Se
 // We only check for the presence of the limits/requests, not their values.
 // Returns an error if the limits/requests are not set and IgnoreValues is set to true.
 func validateContainerResources(container *corev1.Container, settings *Settings) error {
-	if container.Resources == nil && (settings.Cpu.IgnoreValues || settings.Memory.IgnoreValues) {
-		missing := fmt.Sprintf("required Cpu:%t, Memory:%t", settings.Cpu.IgnoreValues, settings.Memory.IgnoreValues)
+	if container.Resources == nil && ( settings.shouldIgnoreCpuValues() || settings.shouldIgnoreMemoryValues()) {
+		missing := fmt.Sprintf("required Cpu:%t, Memory:%t", settings.shouldIgnoreCpuValues(), settings.shouldIgnoreMemoryValues())
 		return fmt.Errorf("container does not have any resource limits or requests: %s", missing)
 	}
 	if err := validateContainerResourceLimits(container, settings); err != nil {
@@ -128,7 +128,7 @@ func validateAndAdjustContainerResourceLimit(container *corev1.Container, resour
 // Return `true` when the container has been mutated.
 func validateAndAdjustContainerResourceLimits(container *corev1.Container, settings *Settings) (bool, error) {
 	mutated := false
-	if settings.Memory.IgnoreValues {
+	if settings.shouldIgnoreMemoryValues() {
 		return false, nil
 	}
 	if settings.Memory != nil {
@@ -139,7 +139,7 @@ func validateAndAdjustContainerResourceLimits(container *corev1.Container, setti
 		}
 	}
 
-	if settings.Cpu.IgnoreValues {
+	if settings.shouldIgnoreCpuValues() {
 		return false, nil
 	}
 	if settings.Cpu != nil {
@@ -240,6 +240,5 @@ func validate(payload []byte) ([]byte, error) {
 	} else {
 		return kubewarden.RejectRequest(kubewarden.Message(err.Error()), kubewarden.Code(400))
 	}
-
 	return kubewarden.AcceptRequest()
 }