Warnings or Errors on deprecated things.

[floriangeigl]

Hi friends 👋

yesterday I started to use kyverno and had a hard time in doing so. I wanted to create a annotation blocking policy for all namespace with a few excludes. So I combined the annotation example and the dynamically exclude namespace example. Unfortunately, the dynamically exclude namespace example used an deprecated operator. (I've updated the example yesterday with a PR.

So why did I have a hard time? The problem for me was, that applying the policy containing the deprecated operator did not show any error or warning. It simply didn't work and it took me a looong time (2h) to find out about the deprecated operator here: https://kyverno.io/docs/writing-policies/preconditions/#operators

So what's the idea: It would be really great, if the validation could look out for deprecated things like this operator and give errors or warning. Would have saved me 1h 59min ;) Probably it's just this specific deprecated operator not working - probably it's more. I don't know, but at least I wanted to bring up this idea of improving the feedback mechanism here.

cheers
Florian

[JimBugwadia]

Hi @floriangeigl - sorry to hear about the difficult experience!

The expectation is that the older syntax should still work. So, looks like there was a problem during the conversion. Can you please log an issue with what exactly did not work?

After 3+ releases, the older syntax would be removed which would provide a schema validation error.

Charles proposed a improved way to handle validation in the contributors meeting today:

kyverno/kyverno#3369

The plan is to review and incorporate.

[floriangeigl]

Hi @JimBugwadia ,

I've attached the example that didn't work (without error or warning) and the one that did work (using the new operator). They really only differ in the used Operator in line 36. Sry the files have a .txt file ending - github did not allow me to attach .yaml files. The use-case I was trying to solve: Block annotations by prefix in all namespace, but allow them in a list of excluded namespaces.

not_working.txt
working.txt

[chipzoller]

This is also related to kyverno/kyverno#3251.