ModifySet: all subpaths must be a prefix of the location value of the mutation

[tspearconquest]

What steps did you take and what happened:

apiVersion: mutations.gatekeeper.sh/v1
kind: ModifySet
metadata:
  name: assign-supplemental-group-to-pod-security-context-if-container-exists
spec:
  applyTo:
  - groups:
    - ""
    kinds:
    - Pod
    versions:
    - v1
  location: 'spec.securityContext.supplementalGroups'
  match:
    excludedNamespaces:
    - kube-node-lease
    - kube-public
    - kube-system
    kinds:
    - apiGroups:
      - ""
      kinds:
      - Pod
    namespaceSelector:
      matchExpressions:
      - key: special-label
        operator: Exists
    scope: Namespaced
  parameters:
    values:
    - 39500
    operation: merge
    pathTests:
    - subPath: "spec.initContainers[name: this-container-must-exist]"
      condition: MustExist

What did you expect to happen:
Add value "39500" to spec.securityContext.supplementalGroups for pods where init container "this-container-must-exist" exists

Anything else you would like to add:
I read through some of the other related issues regarding this deny, and understand the general concept of eventual consistency vs infinite looping mutations in the context of Assign mutations. Given that this is a ModifySet, however, I'd expected that the risk would be drastically reduced because I'm checking for the existence of another set object. I haven't seen an example provided which could lead to infinite looping.

Environment:

• Gatekeeper version: 3.10.0
• Kubernetes version: (use kubectl version):

  Client Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.3", 
  GitCommit:"9e644106593f3f4aa98f8a84b23db5fa378900bd", GitTreeState:"clean", BuildDate:"2023-03-15T13:40:17Z", 
  GoVersion:"go1.19.7", Compiler:"gc", Platform:"darwin/amd64"}
  Kustomize Version: v4.5.7
  Server Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.3", 
  GitCommit:"f18584a06fc476806da2e340e2eed960659871e8", GitTreeState:"clean", BuildDate:"2023-06-12T18:45:20Z", 
  GoVersion:"go1.19.7", Compiler:"gc", Platform:"linux/amd64"}
  

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[tspearconquest]

Not stale

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[tspearconquest]

Not stale

/label mutation

[tspearconquest]

/remove-lifecycle stale

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[tspearconquest]

/remove-lifecycle stale

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[tspearconquest]

/remove-lifecycle stale

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.