[Feature] Update the existing policies to use the new fields

[MariamFahmy98]

Problem Statement

Starting from Kyverno 1.13, the following fields are deprecated:

1. spec.validationFailureAction
2. spec.validationFailureActionOverrides
3. spec.generateExisting
4. spec.mutateExisting

The following fields should be used instead:

1. validate.failureAction (under the validate rule)
2. validate.failureActionOverrides (under the validate rule)
3. verifyImage[*].failureAction (under the verifyImage rule)
4. generate.generateExisting (under the generate rule)
5. mutate.mutateExisting (under the mutate rule)

Solution Description

Use the following fields under their corresponding rules:

1. failureAction
2. failureActionOverrides
3. generateExisting
4. mutateExisting

Example "Good" Resource

No response

Example "Bad" Resource

No response

Other Comments

No response

Slack discussion

No response

Troubleshooting

• I have read and followed the documentation AND the troubleshooting guide.
• I have verified the policy does not exist in the samples library.

[siddhikhapare]

@MariamFahmy98 I would like to work on this.

[Indrranil]

Hi, could this issue be assigned to me?

[Indrranil]

Should we update each policy file manually or is there a preferred automated approach for updating the deprecated fields?
@realshuting @MariamFahmy98

[realshuting]

Nothing is automated per my knowledge.

[Indrranil]

Getting a strict decoding error while testing the updated validation failure action field:

Original:

spec:
 validationFailureAction: Audit

Updated as per issue description:

spec:
 rules:
   - name: require-image-tag
     validate:
       failureAction: Audit

Error when running chainsaw test:
"strict decoding error: unknown field 'spec.rules[0].validate.failureAction'"

Could you help with the correct field structure that works with chainsaw testing? Wasn't able to find relevant examples in the docs.

[Indrranil]

Hi,

I’ve submitted a PR ##1213 that updates the deprecated field spec.validationFailureAction to validate.failureAction in the disallow-latest-tag policy.

This is my initial attempt to ensure I’m following the correct way before moving forward. I’ve verified the following for this PR:

• It passed Kyverno engine tests.
• It passed Chainsaw tests with the updated test files.

Please review this PR, Once confirmed i will proceed with the remaining files and fields.

@realshuting @MariamFahmy98

[Indrranil]

@realshuting @MariamFahmy98