github
diff --git a/‎cmd/tester/main.go‎
Lines changed: 7 additions & 4 deletions b/‎cmd/tester/main.go‎
Lines changed: 7 additions & 4 deletions
diff --git a/‎pkg/apis/policy/v1alpha1/clusterimagepolicy_defaults_test.go‎
Lines changed: 2 additions & 1 deletion b/‎pkg/apis/policy/v1alpha1/clusterimagepolicy_defaults_test.go‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎pkg/apis/policy/v1alpha1/clusterimagepolicy_validation.go‎
Lines changed: 4 additions & 5 deletions b/‎pkg/apis/policy/v1alpha1/clusterimagepolicy_validation.go‎
Lines changed: 4 additions & 5 deletions
@@ -133,12 +133,15 @@ func main() {
 	for _, err := range errs {
 		var fe *apis.FieldError
 		if errors.As(err, &fe) {
-			if fe.Level == apis.WarningLevel {
-				warningStrings = append(warningStrings, strings.Trim(err.Error(), "\n"))
-				continue
+			if warnFE := fe.Filter(apis.WarningLevel); warnFE != nil {
+				warningStrings = append(warningStrings, strings.Trim(warnFE.Error(), "\n"))
 			}
+			if errorFE := fe.Filter(apis.WarningLevel); errorFE != nil {
+				warningStrings = append(warningStrings, strings.Trim(errorFE.Error(), "\n"))
+			}
+		} else {
+			errStrings = append(errStrings, strings.Trim(err.Error(), "\n"))
 		}
-		errStrings = append(errStrings, strings.Trim(err.Error(), "\n"))
 	}
 	var o []byte
 	o, err = json.Marshal(&output{
 
@@ -57,7 +57,8 @@ func TestModeDefaulting(t *testing.T) {
 		name     string
 		mode     string
 		wantMode string
-	}{{name: "empty",
+	}{{
+		name:     "empty",
 		wantMode: "enforce",
 	}, {
 		name:     "enforce",
 
@@ -36,8 +36,6 @@ var (
 	validPredicateTypes = sets.NewString("custom", "slsaprovenance", "spdx", "spdxjson", "cyclonedx", "link", "vuln")
 
 	// If a static matches, define the behaviour for it.
-	// TODO(vaikas): Consider adding a warn which would pass but use
-	// `warn` as return type for the webhook response.
 	validStaticRefTypes = sets.NewString("fail", "pass")
 
 	// Valid modes for a policy
@@ -177,6 +175,10 @@ func (keyless *KeylessRef) Validate(ctx context.Context) *apis.FieldError {
 	if keyless.CACert != nil {
 		errs = errs.Also(keyless.DeepCopy().CACert.Validate(ctx).ViaField("ca-cert"))
 	}
+	// Warn if there are no identities specified
+	if len(keyless.Identities) == 0 {
+		errs = errs.Also(apis.ErrMissingField("identities").At(apis.WarningLevel))
+	}
 	for i, identity := range keyless.Identities {
 		errs = errs.Also(identity.Validate(ctx).ViaFieldIndex("identities", i))
 	}
@@ -230,9 +232,6 @@ func (p *Policy) Validate(ctx context.Context) *apis.FieldError {
 
 func (identity *Identity) Validate(ctx context.Context) *apis.FieldError {
 	var errs *apis.FieldError
-	if identity.Issuer == "" && identity.Subject == "" && identity.IssuerRegExp == "" && identity.SubjectRegExp == "" {
-		return apis.ErrMissingField("issuer", "subject", "issuerRegExp", "subjectRegExp")
-	}
 	if identity.Issuer != "" && identity.IssuerRegExp != "" {
 		errs = errs.Also(apis.ErrMultipleOneOf("issuer", "issuerRegExp"))
 	}