mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-28 02:18:15 +00:00
Code Activity

feat(mutate): don't eagerly process img-ver (#10703)

Browse source 
* feat(mutate): don't eagerly process img-ver

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

* test(mutate): add mutate with img-ver test

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>

---------

Signed-off-by: Khaled Emara <khaled.emara@nirmata.com>
Co-authored-by: Vishal Choudhary <vishal.choudhary@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
This commit is contained in:
Khaled Emara 2024-08-12 17:59:27 +03:00 • committed by GitHub
parent 65a43d2059
commit bbb1d6103c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
10 changed files with 153 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

54
pkg/webhooks/resource/handlers.go
View file

@ -198,38 +198,38 @@ func (h *resourceHandlers) Mutate(ctx context.Context, logger logr.Logger, reque
return admissionutils.Response(request.UID, err)
}
mh := mutation.NewMutationHandler(logger, h.engine, h.eventGen, h.nsLister, h.metricsConfig)
mutatePatches, mutateWarnings, err := mh.HandleMutation(ctx, request.AdmissionRequest, mutatePolicies, policyContext, startTime)
patches, warnings, err := mh.HandleMutation(ctx, request.AdmissionRequest, mutatePolicies, policyContext, startTime)
if err != nil {
logger.Error(err, "mutation failed")
return admissionutils.Response(request.UID, err)
}
newRequest := patchRequest(mutatePatches, request.AdmissionRequest, logger)
// rebuild context to process images updated via mutate policies
policyContext, err = h.pcBuilder.Build(newRequest, request.Roles, request.ClusterRoles, request.GroupVersionKind)
if err != nil {
logger.Error(err, "failed to build policy context")
return admissionutils.Response(request.UID, err)
if len(verifyImagesPolicies) != 0 {
newRequest := patchRequest(patches, request.AdmissionRequest, logger)
// rebuild context to process images updated via mutate policies
policyContext, err = h.pcBuilder.Build(newRequest, request.Roles, request.ClusterRoles, request.GroupVersionKind)
if err != nil {
logger.Error(err, "failed to build policy context")
return admissionutils.Response(request.UID, err)
}
ivh := imageverification.NewImageVerificationHandler(
logger,
h.kyvernoClient,
h.engine,
h.eventGen,
h.admissionReports,
h.configuration,
h.nsLister,
h.reportsBreaker,
)
imagePatches, imageVerifyWarnings, err := ivh.Handle(ctx, newRequest, verifyImagesPolicies, policyContext)
if err != nil {
logger.Error(err, "image verification failed")
return admissionutils.Response(request.UID, err)
}
patches = jsonutils.JoinPatches(patches, imagePatches)
warnings = append(warnings, imageVerifyWarnings...)
}
ivh := imageverification.NewImageVerificationHandler(
logger,
h.kyvernoClient,
h.engine,
h.eventGen,
h.admissionReports,
h.configuration,
h.nsLister,
h.reportsBreaker,
)
imagePatches, imageVerifyWarnings, err := ivh.Handle(ctx, newRequest, verifyImagesPolicies, policyContext)
if err != nil {
logger.Error(err, "image verification failed")
return admissionutils.Response(request.UID, err)
}
patch := jsonutils.JoinPatches(mutatePatches, imagePatches)
var warnings []string
warnings = append(warnings, mutateWarnings...)
warnings = append(warnings, imageVerifyWarnings...)
return admissionutils.MutationResponse(request.UID, patch, warnings...)
return admissionutils.MutationResponse(request.UID, patches, warnings...)
}
func (h *resourceHandlers) retrieveAndCategorizePolicies(

11
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/README.md Normal file
View file

@ -0,0 +1,11 @@
## Description
This test performs a simple verification of an image using a public key specified directly in the policy as well as mutate the image before the verification.
## Expected Behavior
Pod creation should pass as the mutated image has been signed by the public key specified in the policy.
## Reference Issue(s)
N/A

27
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/chainsaw-test.yaml Executable file
View file

@ -0,0 +1,27 @@
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
creationTimestamp: null
name: with-mutation
spec:
timeouts:
delete: 2m
steps:
- name: step-01
try:
- apply:
file: ns.yaml
- apply:
file: mut-cpol.yaml
- assert:
file: mut-cpol-assert.yaml
- apply:
file: img-cpol.yaml
- assert:
file: img-cpol-assert.yaml
- name: step-02
try:
- apply:
file: test-pod.yaml
- assert:
file: test-pod-assert.yaml

9
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/img-cpol-assert.yaml Executable file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: with-mutation-img
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

30
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/img-cpol.yaml Executable file
View file

@ -0,0 +1,30 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: with-mutation-img
spec:
background: false
failurePolicy: Fail
rules:
- match:
any:
- resources:
kinds:
- Pod
name: with-mutation-rule
verifyImages:
- attestors:
- entries:
- keys:
publicKeys: |-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
-----END PUBLIC KEY-----
rekor:
ignoreTlog: true
url: https://rekor.sigstore.dev
imageReferences:
- ghcr.io/kyverno/test-verify-image:*
validationFailureAction: Enforce
webhookTimeoutSeconds: 30

9
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/mut-cpol-assert.yaml Executable file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: with-mutation-mut
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

22
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/mut-cpol.yaml Executable file
View file

@ -0,0 +1,22 @@
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: with-mutation-mut
spec:
background: false
failurePolicy: Fail
rules:
- match:
any:
- resources:
kinds:
- Pod
name: with-mutation-rule
mutate:
patchStrategicMerge:
spec:
containers:
- (name): test-secret
image: "ghcr.io/kyverno/test-verify-image:signed"
validationFailureAction: Enforce
webhookTimeoutSeconds: 30

4
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/ns.yaml Executable file
View file

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: test-verify-images

5
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/test-pod-assert.yaml Executable file
View file

@ -0,0 +1,5 @@
apiVersion: v1
kind: Pod
metadata:
name: test-with-mutation
namespace: test-verify-images

9
test/conformance/chainsaw/verifyImages/clusterpolicy/standard/with-mutation/test-pod.yaml Executable file
View file

@ -0,0 +1,9 @@
apiVersion: v1
kind: Pod
metadata:
name: test-with-mutation
namespace: test-verify-images
spec:
containers:
- image: ghcr.io/kyverno/test-verify-image:unsigned
name: test-secret