mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

fix: no skip result when no image match the rule (#6733)

Browse source 
* fix: no skip result when no image match the rule

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix test

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché 2023-03-30 17:31:11 +02:00 • committed by GitHub
parent c1973b2d1d
commit 94f0829a37
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
pkg/engine/imageVerify.go
View file

@ -77,7 +77,7 @@ func (e *engine) doVerifyAndPatch(
logger.V(3).Info("processing image verification rule") logger.V(3).Info("processing image verification rule")
ruleImages, imageRefs, err := engineutils.ExtractMatchingImages( ruleImages, _, err := engineutils.ExtractMatchingImages(
policyContext.NewResource(), policyContext.NewResource(),
policyContext.JSONContext(), policyContext.JSONContext(),
rule, rule,
@ -92,15 +92,6 @@ func (e *engine) doVerifyAndPatch(
return return
} }
if len(ruleImages) == 0 { if len(ruleImages) == 0 {
internal.AddRuleResponse(
resp,
internal.RuleSkip(
rule,
engineapi.ImageVerify,
fmt.Sprintf("skip run verification as image in resource not found in imageRefs '%s'", imageRefs),
),
startTime,
)
return return
} }
policyContext.JSONContext().Restore() policyContext.JSONContext().Restore()

5
pkg/engine/imageVerify_test.go
View file

@ -446,12 +446,11 @@ var (
testOtherKey = `-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpNlOGZ323zMlhs4bcKSpAKQvbcWi5ZLRmijm6SqXDy0Fp0z0Eal+BekFnLzs8rUXUaXlhZ3hNudlgFJH+nFNMw==\n-----END PUBLIC KEY-----\n` testOtherKey = `-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEpNlOGZ323zMlhs4bcKSpAKQvbcWi5ZLRmijm6SqXDy0Fp0z0Eal+BekFnLzs8rUXUaXlhZ3hNudlgFJH+nFNMw==\n-----END PUBLIC KEY-----\n`
) )
func Test_ConfigMapMissingSuccess(t *testing.T) { func Test_NoMatch(t *testing.T) {
policyContext := buildContext(t, testConfigMapMissing, testConfigMapMissingResource, "") policyContext := buildContext(t, testConfigMapMissing, testConfigMapMissingResource, "")
cosign.ClearMock() cosign.ClearMock()
err, _ := testVerifyAndPatchImages(context.TODO(), registryclient.NewOrDie(), nil, policyContext, cfg) err, _ := testVerifyAndPatchImages(context.TODO(), registryclient.NewOrDie(), nil, policyContext, cfg)
assert.Equal(t, len(err.PolicyResponse.Rules), 1) assert.Equal(t, len(err.PolicyResponse.Rules), 0)
assert.Equal(t, err.PolicyResponse.Rules[0].Status, engineapi.RuleStatusSkip, err.PolicyResponse.Rules[0].Message)
} }
func Test_ConfigMapMissingFailure(t *testing.T) { func Test_ConfigMapMissingFailure(t *testing.T) {