使用Helm安装Kyverno策略时遇request函数未定义错误求助

错误根源是Helm模板渲染时，误将Kyverno策略中的request内置变量当成了Helm模板函数解析。request是Kyverno运行时用于获取请求上下文的专属变量，不需要Helm处理，必须让Helm将其原封不动输出到最终的ClusterPolicy资源中。

修改方案 #

对Kyverno表达式中的{{ ... }}进行转义，阻止Helm解析这部分内容，修改后的require-network-policy.yaml如下：

{{- $name := "require-network-policy" }}
{{ if not (and $name .Values.disableDefaultTemplates) }}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
 name: {{ $name }}
 annotations:
    policies.kyverno.io/title: Require NetworkPolicy
    policies.kyverno.io/category: Sample
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kyverno-version: 1.6.2
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/subject: Deployment, NetworkPolicy
    policies.kyverno.io/description: >-
      NetworkPolicy is used to control Pod-to-Pod communication
      and is a good practice to ensure only authorized Pods can send/receive
      traffic. This policy checks incoming Deployments to ensure
      they have a matching, preexisting NetworkPolicy.      
spec:
  validationFailureAction: {{ .Values.validationFailureAction }}
  background: false
  rules:
  - name: require-network-policy
      match:
        any:
        - resources:
            kinds:
            - Deployment
      preconditions:
        any:
        - key: "{{`{{request.operation || 'BACKGROUND'}}`}}"
          operator: Equals
          value: CREATE
      validate:
        message: "Every Deployment requires a matching NetworkPolicy."
        deny:
          conditions:
            any:
            - key: "{{`{{ request.operation == 'CREATE' && resources[kind=='NetworkPolicy'].length > 0 && resources[kind=='NetworkPolicy'].spec.podSelector.matchLabels == request.object.spec.template.metadata.labels }}`}}"
              operator: Equals
              value: false
{{- end }}

修改说明 #

• 用{{{{ ... }}}}的语法（反引号包裹Kyverno表达式），让Helm直接输出内部的{{ ... }}结构，不再尝试解析其中的request变量。
• 这种写法彻底避免了Helm与Kyverno模板语法的冲突，确保Kyverno能正常读取request上下文变量。

修改完成后重新执行helm install kyverno-policies即可完成安装。

内容的提问来源于stack exchange，提问作者Marwan Tarek