mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2024-12-14 11:57:48 +00:00
Code Activity

fix check and add logs (#3838)

Browse source 
Signed-off-by: Jim Bugwadia <jim@nirmata.com>
This commit is contained in:
Jim Bugwadia 2022-05-08 00:45:02 -07:00 committed by GitHub
parent 2dc54e5c1b
commit 69ac94b0ee
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
pkg/engine/imageVerify.go
View file

@ -159,7 +159,7 @@ func (iv *imageVerifier) verify(imageVerify v1.ImageVerification, images map[str
continue
}
if hasImageVerifiedAnnotationChanged(iv.policyContext) {
if hasImageVerifiedAnnotationChanged(iv.policyContext, iv.logger) {
msg := imageVerifyAnnotationKey + " annotation cannot be changed"
iv.logger.Info("image verification error", "reason", msg)
ruleResp := ruleResponse(*iv.rule, response.ImageVerify, msg, response.RuleStatusFail, nil)
@ -238,16 +238,21 @@ func (iv *imageVerifier) handleMutateDigest(digest string, imageInfo apiutils.Im
return patch, digest, nil
}
func hasImageVerifiedAnnotationChanged(ctx *PolicyContext) bool {
if reflect.DeepEqual(ctx.NewResource, &unstructured.Unstructured{}) ||
reflect.DeepEqual(ctx.OldResource, &unstructured.Unstructured{}) {
func hasImageVerifiedAnnotationChanged(ctx *PolicyContext, log logr.Logger) bool {
if reflect.DeepEqual(ctx.NewResource, unstructured.Unstructured{}) ||
reflect.DeepEqual(ctx.OldResource, unstructured.Unstructured{}) {
return false
}
key := imageVerifyAnnotationKey
newValue := ctx.NewResource.GetAnnotations()[key]
oldValue := ctx.OldResource.GetAnnotations()[key]
return newValue != oldValue
result := newValue != oldValue
if result {
log.V(2).Info("annotation mismatch", "oldValue", oldValue, "newValue", newValue, "key", key)
}
return result
}
func fetchImageDigest(ref string) (string, error) {
@ -402,7 +407,7 @@ func (iv *imageVerifier) buildOptionsAndPath(attestor v1.Attestor, imageVerify v
}
if attestor.Keys != nil {
path = path + ".staticKey"
path = path + ".keys"
opts.Key = attestor.Keys.PublicKeys
if attestor.Keys.Rekor != nil {
opts.RekorURL = attestor.Keys.Rekor.URL

6
pkg/engine/imageVerify_test.go
View file

@ -506,18 +506,18 @@ func Test_ChangedAnnotation(t *testing.T) {
policyContext := buildContext(t, testPolicyGood, testResource, testResource)
hasChanged := hasImageVerifiedAnnotationChanged(policyContext)
hasChanged := hasImageVerifiedAnnotationChanged(policyContext, log.Log)
assert.Equal(t, hasChanged, false)
policyContext = buildContext(t, testPolicyGood, newResource, testResource)
hasChanged = hasImageVerifiedAnnotationChanged(policyContext)
hasChanged = hasImageVerifiedAnnotationChanged(policyContext, log.Log)
assert.Equal(t, hasChanged, true)
annotationOld := fmt.Sprintf("\"annotations\": {\"%s\": \"%s\"}", annotationKey, "false")
oldResource := strings.ReplaceAll(testResource, "\"annotations\": {}", annotationOld)
policyContext = buildContext(t, testPolicyGood, newResource, oldResource)
hasChanged = hasImageVerifiedAnnotationChanged(policyContext)
hasChanged = hasImageVerifiedAnnotationChanged(policyContext, log.Log)
assert.Equal(t, hasChanged, true)
}