nirmata / kyverno-aws-adapter

An adapter for Amazon EKS to use with Kyverno for making policy decisions
Apache License 2.0
11 stars 5 forks source link

nil pointer exception when account not found #68

Closed anusha94 closed 1 year ago

anusha94 commented 1 year ago

Steps to reproduce: Any configuration error with IAM policy, role or serviceaccount leads to this problem.

Container logs:

1.679329918558476e+09   INFO    AWS Adapter config loaded successfully  {"controller": "awsadapterconfig", "controllerGroup": "security.nirmata.io", "controllerKind": "AWSAdapterConfig", "AWSAdapterConfig": {"name":"kyverno-aws-adapter","namespace":"nirmata-aws-adapter"}, "namespace": "nirmata-aws-adapter", "name": "kyverno-aws-adapter", "reconcileID": "6bdac5db-a271-408b-8248-98c9e1091b53"}
1.6793299188088348e+09  INFO    Observed a panic in reconciler: runtime error: invalid memory address or nil pointer dereference    {"controller": "awsadapterconfig", "controllerGroup": "security.nirmata.io", "controllerKind": "AWSAdapterConfig", "AWSAdapterConfig": {"name":"kyverno-aws-adapter","namespace":"nirmata-aws-adapter"}, "namespace": "nirmata-aws-adapter", "name": "kyverno-aws-adapter", "reconcileID": "6bdac5db-a271-408b-8248-98c9e1091b53"}
panic: runtime error: invalid memory address or nil pointer dereference [recovered]
    panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x16324f5]

goroutine 244 [running]:
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile.func1()
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:118 +0x1f4
panic({0x17b20c0, 0x29f0cc0})
    /usr/local/go/src/runtime/panic.go:884 +0x212
github.com/nirmata/kyverno-aws-adapter/controllers.(*AWSAdapterConfigReconciler).Reconcile(0xc0006c45d0, {0x1de5db8, 0xc000713950}, {{{0xc0000d9218?, 0x10?}, {0xc0000d9200?, 0x40dae7?}}})
    /workspace/controllers/awsadapterconfig_controller.go:129 +0x895
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile(0x1de5d10?, {0x1de5db8?, 0xc000713950?}, {{{0xc0000d9218?, 0x18e1b60?}, {0xc0000d9200?, 0x4045d4?}}})
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:121 +0xc8
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler(0xc0002fdcc0, {0x1de5d10, 0xc0007bae40}, {0x1813be0?, 0xc0002bd520?})
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:320 +0x33c
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem(0xc0002fdcc0, {0x1de5d10, 0xc0007bae40})
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:273 +0x1d9
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2()
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:234 +0x85
created by sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2
    /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:230 +0x333

Expected outcome: The container should not panic and show meaningful error messages.

kbeniwal commented 1 year ago

One possible cause because of which I faced this issue and reconciler went into panic is when the program tries to get x.Accounts when x == nil. This condition is not being checked right now. https://github.com/nirmata/kyverno-aws-adapter/blob/c9f3d8a10e5c434d2c9eb758eb64616a52b15205/controllers/awsadapterconfig_controller.go#L128

Also, another issue I see here is when err != nil and len(x.Accounts) == 0, in that case we'll be overwriting the error in the following code. https://github.com/nirmata/kyverno-aws-adapter/blob/c9f3d8a10e5c434d2c9eb758eb64616a52b15205/controllers/awsadapterconfig_controller.go#L129-L131

kbeniwal commented 1 year ago

Fixed by #69.