kyverno · MariamFahmy98 · May 6, 2025 · May 6, 2025 · May 6, 2025
diff --git a/cmd/cli/kubectl-kyverno/commands/apply/command.go b/cmd/cli/kubectl-kyverno/commands/apply/command.go
@@ -585,8 +585,15 @@ func (c *ApplyCommandConfig) applyImageValidatingPolicies(
 	return responses, nil
 }
 
-func (c *ApplyCommandConfig) loadResources(out io.Writer, paths []string, policies []kyvernov1.PolicyInterface, vap []admissionregistrationv1.ValidatingAdmissionPolicy, dClient dclient.Interface) ([]*unstructured.Unstructured, []*unstructured.Unstructured, error) {
-	resources, err := common.GetResourceAccordingToResourcePath(out, nil, paths, c.Cluster, policies, vap, dClient, c.Namespace, c.PolicyReport, c.ClusterWideResources, "")
+func (c *ApplyCommandConfig) loadResources(out io.Writer, paths []string, policies []kyvernov1.PolicyInterface, vaps []admissionregistrationv1.ValidatingAdmissionPolicy, dClient dclient.Interface) ([]*unstructured.Unstructured, []*unstructured.Unstructured, error) {
+	genericPolicies := make([]engineapi.GenericPolicy, 0, len(policies)+len(vaps))
+	for _, pol := range policies {
+		genericPolicies = append(genericPolicies, engineapi.NewKyvernoPolicy(pol))
+	}
+	for _, pol := range vaps {
+		genericPolicies = append(genericPolicies, engineapi.NewValidatingAdmissionPolicy(&pol))
+	}
+	resources, err := common.GetResourceAccordingToResourcePath(out, nil, paths, c.Cluster, genericPolicies, dClient, c.Namespace, c.PolicyReport, c.ClusterWideResources, "")
 	if err != nil {
 		return resources, nil, fmt.Errorf("failed to load resources (%w)", err)
 	}

diff --git a/cmd/cli/kubectl-kyverno/commands/test/test.go b/cmd/cli/kubectl-kyverno/commands/test/test.go
@@ -85,10 +85,17 @@
 	if err != nil {
 		return nil, fmt.Errorf("error: failed to load policies (%s)", err)
 	}
+	genericPolicies := make([]engineapi.GenericPolicy, 0, len(results.Policies)+len(results.VAPs))
+	for _, pol := range results.Policies {
+		genericPolicies = append(genericPolicies, engineapi.NewKyvernoPolicy(pol))
+	}
+	for _, pol := range results.VAPs {
+		genericPolicies = append(genericPolicies, engineapi.NewValidatingAdmissionPolicy(&pol))
+	}
 	// resources
 	fmt.Fprintln(out, "  Loading resources", "...")
 	resourceFullPath := path.GetFullPaths(testCase.Test.Resources, testDir, isGit)
-	resources, err := common.GetResourceAccordingToResourcePath(out, testCase.Fs, resourceFullPath, false, results.Policies, results.VAPs, dClient, "", false, false, testDir)
+	resources, err := common.GetResourceAccordingToResourcePath(out, testCase.Fs, resourceFullPath, false, genericPolicies, dClient, "", false, false, testDir)
 	if err != nil {
 		return nil, fmt.Errorf("error: failed to load resources (%s)", err)
 	}
@@ -110,7 +117,7 @@
 		}
 	}
 	targetResourcesPath := path.GetFullPaths(testCase.Test.TargetResources, testDir, isGit)
-	targetResources, err := common.GetResourceAccordingToResourcePath(out, testCase.Fs, targetResourcesPath, false, results.Policies, results.VAPs, dClient, "", false, false, testDir)
+	targetResources, err := common.GetResourceAccordingToResourcePath(out, testCase.Fs, targetResourcesPath, false, genericPolicies, dClient, "", false, false, testDir)
 	if err != nil {
 		return nil, fmt.Errorf("error: failed to load target resources (%s)", err)
 	}

diff --git a/cmd/cli/kubectl-kyverno/utils/common/common.go b/cmd/cli/kubectl-kyverno/utils/common/common.go
@@ -15,8 +15,8 @@
 	"github.com/kyverno/kyverno/cmd/cli/kubectl-kyverno/source"
 	"github.com/kyverno/kyverno/pkg/autogen"
 	"github.com/kyverno/kyverno/pkg/clients/dclient"
+	engineapi "github.com/kyverno/kyverno/pkg/engine/api"
 	kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
-	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
@@ -29,8 +29,7 @@
 	fs billy.Filesystem,
 	resourcePaths []string,
 	cluster bool,
-	policies []kyvernov1.PolicyInterface,
-	validatingAdmissionPolicies []admissionregistrationv1.ValidatingAdmissionPolicy,
+	policies []engineapi.GenericPolicy,
 	dClient dclient.Interface,
 	namespace string,
 	policyReport bool,
@@ -79,15 +78,15 @@
 				}
 			}
 			if clusterWideResources {
-				resources, err = GetResources(out, policies, validatingAdmissionPolicies, resourcePaths, dClient, cluster, "", policyReport, clusterWideResources)
+				resources, err = GetResources(out, policies, resourcePaths, dClient, cluster, "", policyReport, clusterWideResources)
 				if err != nil {
 					return resources, err
 				}
 				if namespace == "" {
 					return resources, nil
 				}
 			}
-			namespaceResources, err := GetResources(out, policies, validatingAdmissionPolicies, resourcePaths, dClient, cluster, namespace, policyReport, false)
+			namespaceResources, err := GetResources(out, policies, resourcePaths, dClient, cluster, namespace, policyReport, false)
 			if err != nil {
 				return resources, err
 			}

diff --git a/cmd/cli/kubectl-kyverno/utils/common/fetch.go b/cmd/cli/kubectl-kyverno/utils/common/fetch.go
@@ -13,7 +13,9 @@
 	"github.com/kyverno/kyverno/cmd/cli/kubectl-kyverno/log"
 	"github.com/kyverno/kyverno/cmd/cli/kubectl-kyverno/resource"
 	"github.com/kyverno/kyverno/pkg/admissionpolicy"
+	"github.com/kyverno/kyverno/pkg/autogen"
 	"github.com/kyverno/kyverno/pkg/clients/dclient"
+	engineapi "github.com/kyverno/kyverno/pkg/engine/api"
 	kubeutils "github.com/kyverno/kyverno/pkg/utils/kube"
 	utils "github.com/kyverno/kyverno/pkg/utils/restmapper"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
@@ -28,8 +30,7 @@
 // - the k8s cluster, if given
 func GetResources(
 	out io.Writer,
-	policies []kyvernov1.PolicyInterface,
-	validatingAdmissionPolicies []admissionregistrationv1.ValidatingAdmissionPolicy,
+	policies []engineapi.GenericPolicy,
 	resourcePaths []string,
 	dClient dclient.Interface,
 	cluster bool,
@@ -41,35 +42,63 @@
 	var err error
 
 	if cluster && dClient != nil {
-		if len(policies) > 0 {
-			matchedResources := &KyvernoResources{
-				policies:             policies,
-				clusterWideResources: clusterWideResources,
-			}
-
-			resources, err = matchedResources.FetchResourcesFromPolicy(out, resourcePaths, dClient, namespace, policyReport)
-			if err != nil {
-				return resources, err
-			}
+		resources, err = fetchResourcesFromPolicy(out, policies, resourcePaths, dClient, namespace, policyReport, clusterWideResources)
+		if err != nil {
+			return resources, err
 		}
+	} else if len(resourcePaths) > 0 {
+		resources, err = whenClusterIsFalse(out, resourcePaths, policyReport)
+		if err != nil {
+			return resources, err
+		}
+	}
+	return resources, err
+}
 
-		if len(validatingAdmissionPolicies) > 0 {
-			matchedResources := &ValidatingAdmissionResources{
-				policies:             validatingAdmissionPolicies,
-				clusterWideResources: clusterWideResources,
-			}
+func fetchResourcesFromPolicy(
+	out io.Writer,
+	policies []engineapi.GenericPolicy,
+	resourcePaths []string,
+	dClient dclient.Interface,
+	namespace string,
+	policyReport bool,
+	clusterWideResources bool,
+) ([]*unstructured.Unstructured, error) {
+	var resources []*unstructured.Unstructured
+	var err error
 
-			resources, err = matchedResources.FetchResourcesFromPolicy(out, resourcePaths, dClient, namespace, policyReport)
+	resourceTypesMap := make(map[schema.GroupVersionKind]bool)
+	var subresourceMap map[schema.GroupVersionKind]v1alpha1.Subresource
+
+	for _, policy := range policies {
+		if kpol := policy.AsKyvernoPolicy(); kpol != nil {
+			for _, rule := range autogen.Default.ComputeRules(kpol, "") {
+				var resourceTypesInRule map[schema.GroupVersionKind]bool
+				resourceTypesInRule, subresourceMap = GetKindsFromRule(rule, dClient, clusterWideResources)
+				for resourceKind := range resourceTypesInRule {
+					resourceTypesMap[resourceKind] = true
+				}
+			}
+		} else if vap := policy.AsValidatingAdmissionPolicy(); vap != nil {
+			definition := vap.GetDefinition()
+			var resourceTypesInRule map[schema.GroupVersionKind]bool
+			resourceTypesInRule, subresourceMap = getKindsFromValidatingAdmissionPolicy(*definition, dClient, clusterWideResources)
 			if err != nil {
 				return resources, err
 			}
-		}
-	} else if len(resourcePaths) > 0 {
-		resources, err = whenClusterIsFalse(out, resourcePaths, policyReport)
-		if err != nil {
-			return resources, err
+			for resourceKind := range resourceTypesInRule {
+				resourceTypesMap[resourceKind] = true
+			}
 		}
 	}
+
+	resourceTypes := make([]schema.GroupVersionKind, 0, len(resourceTypesMap))
+	for kind := range resourceTypesMap {
+		resourceTypes = append(resourceTypes, kind)
+	}
+
+	resources, err = whenClusterIsTrue(out, resourceTypes, subresourceMap, dClient, namespace, resourcePaths, policyReport)
+
 	return resources, err
 }
 

diff --git a/cmd/cli/kubectl-kyverno/utils/common/kyverno_resources_types.go b/cmd/cli/kubectl-kyverno/utils/common/kyverno_resources_types.go
diff --git a/cmd/cli/kubectl-kyverno/utils/common/validating_admission_resources.go b/cmd/cli/kubectl-kyverno/utils/common/validating_admission_resources.go