feat(kubectl-plugin): add policy ack subcommand by kyledong-suse · Pull Request #734 · rancher-sandbox/runtime-enforcer

kyledong-suse · 2026-07-09T02:32:29Z

What this PR does / why we need it:

Add kubectl-plugin subcommand for policy ack POLICY_NAME <violation-id> [--reason "xxx"]

Which issue(s) this PR fixes

fixes #697

Special notes for your reviewer:

Checklist:

squashed commits into logical changes
includes documentation
adds unit tests
adds or updates e2e tests

Copilot

Pull request overview

Adds a new kubectl runtime-enforcer policy ack subcommand to improve operator UX for acknowledging WorkloadPolicy violations by writing the corresponding acknowledgement annotation.

Changes:

Registers a new policy ack cobra subcommand under the existing policy command.
Implements policy ack logic: resolves policy + violation ID, resolves a reason (flag or interactive prompt), and updates the policy annotation (with --dry-run support).
Adds unit tests and generated CLI docs for the new subcommand.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/kubectlplugin/policy.go	Wires the new `ack` subcommand into the `policy` command.
internal/kubectlplugin/policy_ack.go	Implements the `policy ack` command, completion, validation, and annotation update behavior.
internal/kubectlplugin/policy_ack_test.go	Adds unit tests covering reason resolution, dry-run output, no-op, overwrite, and unknown violation handling.
docs/kubectl-plugin/runtime-enforcer_policy.md	Adds `policy ack` to the policy command documentation index.
docs/kubectl-plugin/runtime-enforcer_policy_ack.md	Adds generated documentation for the new `policy ack` subcommand.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

holyspectral

Thank you!

holyspectral · 2026-07-10T00:44:08Z

+	"strconv"
+	"strings"
+
+	apiv1alpha1 "github.com/rancher-sandbox/runtime-enforcer/api/v1alpha1"


nit: I think we either use v1alpha1 or securityv1alpha1.

Agree, I'll create another PR to rename the usage in kubectlplugin

holyspectral · 2026-07-10T00:48:55Z

 ### SEE ALSO

 * [runtime-enforcer](runtime-enforcer.md)	 - 
+* [runtime-enforcer policy ack](runtime-enforcer_policy_ack.md)	 - Acknowledge a WorkloadPolicy violation
 * [runtime-enforcer policy allow](runtime-enforcer_policy_allow.md)	 - allow executables for a WorkloadPolicy container
 * [runtime-enforcer policy deny](runtime-enforcer_policy_deny.md)	 - deny executables for a WorkloadPolicy container
 * [runtime-enforcer policy monitor](runtime-enforcer_policy_monitor.md)	 - Set WorkloadPolicy mode to monitor


Ah we probably have to also sync this doc to the official doc repo too in addition to the crd ones.

holyspectral · 2026-07-10T00:59:06Z

+func getWorkloadPolicy(
+	ctx context.Context,
+	client securityclient.SecurityV1alpha1Interface,
+	namespace, name string,
+) (*apiv1alpha1.WorkloadPolicy, error) {
+	policy, err := client.WorkloadPolicies(namespace).Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, fmt.Errorf("workloadpolicy %q not found in namespace %q", name, namespace)
+		}
+		return nil, fmt.Errorf(
+			"failed to get WorkloadPolicy %q in namespace %q: %w",
+			name,
+			namespace,
+			err,
+		)
+	}
+	return policy, nil
+}


Perhaps you can make runPolicyExec(), runPolicyModeSet() and waitForWorkloadPolicy() use this helper?

Will do this refactor in the separate PR with renaming the package.

holyspectral · 2026-07-10T01:16:13Z

+	)
+}
+
+func updateAckWorkloadPolicy(


Not sure if you can use this helper elsewhere too.

I'll check in the refactor PR later.

dottorblaster

Just some sparse comments, feel free to address the ones you see fit for, then we are good to merge. Thanks!

dottorblaster

LGTM

Signed-off-by: Kyle Dong <kyle.dong@suse.com>

kyledong-suse self-assigned this Jul 9, 2026

kyledong-suse temporarily deployed to ci July 9, 2026 02:32 — with GitHub Actions Inactive

kyledong-suse force-pushed the kubectl-plugin branch from 091160a to aa63455 Compare July 9, 2026 02:52

kyledong-suse temporarily deployed to ci July 9, 2026 02:53 — with GitHub Actions Inactive

kyledong-suse requested review from Andreagit97, Copilot, dottorblaster and holyspectral July 9, 2026 13:45

Copilot started reviewing on behalf of kyledong-suse July 9, 2026 14:03 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread internal/kubectlplugin/policy_ack.go

Comment thread internal/kubectlplugin/policy_ack.go Outdated

Comment thread internal/kubectlplugin/policy_ack.go

kyledong-suse force-pushed the kubectl-plugin branch from aa63455 to b977d6c Compare July 9, 2026 14:55

kyledong-suse temporarily deployed to ci July 9, 2026 14:55 — with GitHub Actions Inactive

holyspectral reviewed Jul 10, 2026

View reviewed changes

kyledong-suse temporarily deployed to ci July 10, 2026 18:13 — with GitHub Actions Inactive

kyledong-suse force-pushed the kubectl-plugin branch from 37d1938 to 89f36fd Compare July 10, 2026 19:41

kyledong-suse temporarily deployed to ci July 10, 2026 19:41 — with GitHub Actions Inactive

kyledong-suse temporarily deployed to ci July 10, 2026 20:14 — with GitHub Actions Inactive

kyledong-suse requested a review from holyspectral July 10, 2026 20:15

dottorblaster reviewed Jul 13, 2026

View reviewed changes

Comment thread internal/kubectlplugin/policy_ack.go Outdated

Comment thread test/e2e/helpers_test.go

Comment thread internal/kubectlplugin/policy_ack.go Outdated

Comment thread internal/kubectlplugin/policy_ack.go Outdated

kyledong-suse temporarily deployed to ci July 13, 2026 16:02 — with GitHub Actions Inactive

kyledong-suse requested a review from dottorblaster July 13, 2026 16:04

dottorblaster approved these changes Jul 14, 2026

View reviewed changes

kyledong-suse force-pushed the kubectl-plugin branch from 3877e95 to 67bcc52 Compare July 14, 2026 14:21

kyledong-suse had a problem deploying to ci July 14, 2026 14:22 — with GitHub Actions Failure

feat(kubectl-plugin): add policy ack subcommand

2e6fb88

Signed-off-by: Kyle Dong <kyle.dong@suse.com>

kyledong-suse force-pushed the kubectl-plugin branch from 67bcc52 to 2e6fb88 Compare July 14, 2026 17:03

kyledong-suse temporarily deployed to ci July 14, 2026 17:04 — with GitHub Actions Inactive

kyledong-suse merged commit 3ef087a into rancher-sandbox:main Jul 14, 2026
13 checks passed

Uh oh!

Conversation

kyledong-suse commented Jul 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

holyspectral left a comment

Choose a reason for hiding this comment

Uh oh!

holyspectral Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

kyledong-suse Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

holyspectral Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

holyspectral Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

kyledong-suse Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

holyspectral Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

kyledong-suse Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

dottorblaster left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dottorblaster left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants