genpolicy: fix env variables that are always allowed

src/tools/genpolicy/genpolicy-settings.json

@@ -319,7 +319,8 @@
                 "^AZURE_FEDERATED_TOKEN_FILE=/var/run/secrets/azure/tokens/azure-identity-token$",
                 "^AZURE_AUTHORITY_HOST=https://login\\.microsoftonline\\.com/$",
                 "^TERM=xterm$"
-            ]
+            ],
+            "allow_env_regex_map": {}
         },
         "CopyFileRequest": [
             "$(sfprefix)"
@@ -333,4 +334,4 @@
         "UpdateEphemeralMountsRequest": false,
         "WriteStreamRequest": false
     }
-}
+}

src/tools/genpolicy/rules.rego

@@ -785,10 +785,15 @@ allow_var(p_process, i_process, i_var, s_name, s_namespace) {
 
     p_name_value[0] == name_value[0]
 
-    # TODO: should these be handled in a different way?
-    always_allowed = ["$(resource-field)", "$(todo-annotation)"]
-    some allowed in always_allowed
-    contains(p_name_value[1], allowed)
+    # a variable we should be validating using a regex from settings
+    p_name_value[1] == "$(validate-from-settings)"
+
+    regex_val := policy_data.request_defaults.CreateContainerRequest.allow_env_regex_map[name_value[0]]
+
+    print("allow_var 7: val =", name_value[1])
+    print("allow_var 7: regex_val =", regex_val)
+
+    regex.match(regex_val, name_value[1])
 
     print("allow_var 7: true")
 }

src/tools/genpolicy/src/pod.rs

@@ -573,6 +573,7 @@ impl Container {
         self.registry = registry::get_container(config, &self.image).await.unwrap();
     }
 
+    #[allow(clippy::too_many_arguments)]
     pub fn get_env_variables(
         &self,
         dest_env: &mut Vec<String>,
@@ -581,6 +582,7 @@ impl Container {
         namespace: &str,
         annotations: &Option<BTreeMap<String, String>>,
         service_account_name: &str,
+        settings: &settings::Settings,
     ) {
         if let Some(source_env) = &self.env {
             for env_variable in source_env {
@@ -590,6 +592,7 @@ impl Container {
                     namespace,
                     annotations,
                     service_account_name,
+                    settings,
                 );
                 let src_string = format!("{}={value}", &env_variable.name);
 
@@ -730,6 +733,7 @@ impl EnvVar {
         namespace: &str,
         annotations: &Option<BTreeMap<String, String>>,
         service_account_name: &str,
+        settings: &settings::Settings,
     ) -> String {
         if let Some(value) = &self.value {
             return value.clone();
@@ -761,7 +765,8 @@ impl EnvVar {
                     "spec.nodeName" => return "$(node-name)".to_string(),
                     "spec.serviceAccountName" => return service_account_name.to_string(),
                     _ => {
-                        if let Some(value) = self.get_annotation_value(path, annotations) {
+                        if let Some(value) = self.get_annotation_value(path, annotations, settings)
+                        {
                             return value;
                         } else {
                             panic!(
@@ -774,9 +779,8 @@ impl EnvVar {
             }
 
             if value_from.resourceFieldRef.is_some() {
-                // TODO: should resource fields such as "limits.cpu" or "limits.memory"
-                // be handled in a different way?
-                return "$(resource-field)".to_string();
+                settings.panic_on_undefined_variables(&self.name);
+                return "$(validate-from-settings)".to_string();
             }
         } else {
             panic!("Environment variable without value or valueFrom!");
@@ -789,6 +793,7 @@ impl EnvVar {
         &self,
         reference: &str,
         anno: &Option<BTreeMap<String, String>>,
+        settings: &settings::Settings,
     ) -> Option<String> {
         let prefix = "metadata.annotations['";
         let suffix = "']";
@@ -808,8 +813,9 @@ impl EnvVar {
                 }
             }
 
-            // TODO: should missing annotations be handled differently?
-            return Some("$(todo-annotation)".to_string());
+            settings.panic_on_undefined_variables(&self.name);
+
+            return Some("$(validate-from-settings)".to_string());
         }
         None
     }

src/tools/genpolicy/src/policy.rs

@@ -307,6 +307,7 @@ pub struct PersistentVolumeClaimVolume {
 pub struct CreateContainerRequestDefaults {
     /// Allow env variables that match any of these regexes.
     allow_env_regex: Vec<String>,
+    pub allow_env_regex_map: BTreeMap<String, String>,
 }
 
 /// ExecProcessRequest settings from genpolicy-settings.json.
@@ -655,6 +656,7 @@ impl AgentPolicy {
             namespace,
             resource.get_annotations(),
             service_account_name,
+            &self.settings,
         );
 
         substitute_env_variables(&mut process.Env);

src/tools/genpolicy/src/settings.rs

@@ -86,4 +86,17 @@ impl Settings {
             &self.other_container
         }
     }
+
+    pub fn panic_on_undefined_variables(&self, var_name: &str) {
+        if !self
+            .request_defaults
+            .CreateContainerRequest
+            .allow_env_regex_map
+            .contains_key(var_name)
+        {
+            panic!(
+            "Env var: please add a regex validation entry for {} in the settings request_defaults.CreateContainerRequest.allow_env_regex_map",
+            var_name);
+        }
+    }
 }

src/tools/genpolicy/tests/adapt_settings_for_tests.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# Copyright (c) 2025 Microsoft Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# usage: ./tests/adapt_settings_for_tests.sh
+
+jq '.request_defaults.CreateContainerRequest.allow_env_regex_map = {  
+  "JOB_COMPLETION_INDEX": "^[0-9]+$",
+  "CPU_LIMIT": "^[0-9]+$",
+  "MEMORY_LIMIT": "^[0-9]+$"
+}' genpolicy-settings.json > tmp-genpolicy-settings.json && mv tmp-genpolicy-settings.json genpolicy-settings.json

src/tools/genpolicy/update_policy_samples.py

@@ -58,6 +58,10 @@ def timeRunCmd(arg):
 print("========== COMMAND: " + next_command)
 runCmd(next_command)
 
+print("Modifying settings for testing")
+runCmd("cp genpolicy-settings.json default-genpolicy-settings.json")
+runCmd("./tests/adapt_settings_for_tests.sh")
+
 # update files
 genpolicy_path = "./target/x86_64-unknown-linux-gnu/debug/genpolicy"
 
@@ -83,3 +87,6 @@ def timeRunCmd(arg):
 total_end = time.time()
 
 print(f"Total time taken: {total_end - total_start} seconds")
+
+print("Restoring settings to default")
+runCmd("mv default-genpolicy-settings.json genpolicy-settings.json")