docs: cleanup (kyverno#203)

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

Makefile

@@ -318,7 +318,7 @@ install-cert-manager: $(HELM)
 install-cluster-issuer: ## Install cert-manager cluster issuer
 install-cluster-issuer:
 	@echo Install cert-manager cluster issuer... >&2
-	@kubectl apply -f manifests/cert-manager/cluster-issuer.yaml
+	@kubectl apply -f .manifests/cert-manager/cluster-issuer.yaml
 
 #########
 # ISTIO #
@@ -353,7 +353,6 @@ install-kyverno-sidecar-injector: $(HELM)
 .PHONY: install-kyverno-authz-server
 install-kyverno-authz-server: ## Install kyverno-authz-server chart
 install-kyverno-authz-server: kind-load-image
-install-kyverno-authz-server: codegen-crds
 install-kyverno-authz-server: $(HELM)
 	@echo Install CRDs... >&2
 	@kubectl apply -f $(CRDS_PATH)

pkg/authz/cel/libs/jwt/lib.go

@@ -33,7 +33,7 @@ func (*lib) extendEnv(env *cel.Env) (*cel.Env, error) {
 	// build our function overloads
 	libraryDecls := map[string][]cel.FunctionOpt{
 		"jwt.Decode": {
-			cel.Overload("decode_string_string", []*cel.Type{types.StringType, types.StringType}, TokenType, cel.BinaryBinding(decode)),
+			cel.Overload("decode_string_string", []*cel.Type{types.StringType, types.StringType}, types.DynType, cel.BinaryBinding(decode)),
 		},
 	}
 	// create env options corresponding to our function overloads
@@ -54,11 +54,15 @@ func decode(token ref.Val, key ref.Val) ref.Val {
 	if !ok {
 		return types.MaybeNoSuchOverloadErr(key)
 	}
-	out, err := jwt.Parse(string(t), func(*jwt.Token) (any, error) {
+	parsed, err := jwt.Parse(string(t), func(*jwt.Token) (any, error) {
 		return []byte(k), nil
 	})
 	if err != nil {
-		return types.WrapErr(err)
+		return types.DefaultTypeAdapter.NativeToValue(nil)
 	}
-	return Token{Token: out}
+	return types.DefaultTypeAdapter.NativeToValue(map[string]any{
+		"header": parsed.Header,
+		"claims": parsed.Claims.(jwt.MapClaims),
+		"valid":  parsed.Valid,
+	})
 }

pkg/policy/provider.go

@@ -69,6 +69,7 @@ func (r *policyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctr
 	}
 	compiled, err := r.compiler.Compile(policy)
 	if err != nil {
+		fmt.Println(err)
 		// TODO: not sure we should retry it
 		return ctrl.Result{}, err
 	}

website/docs/cel-extensions/jwt.md

@@ -22,7 +22,7 @@ kind: AuthorizationPolicy
 metadata:
   name: demo
 spec:
-  failurePolicy: Ignore
+  failurePolicy: Fail
   variables:
   - name: token
     expression: >