mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

Modified annotation matching during rollback (#7752)

Browse source 
* enhanced has changed func

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

* modified changed annotation func

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

* modified HasImageVerifiedAnnotationChanged

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

* nits

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

* added kuttl-test

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

* added ghcr.io/kyverno images

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

* fixed unit tests

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

* fixed unit tests

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>

---------

Signed-off-by: hackeramitkumar <amit9116260192@gmail.com>
Co-authored-by: Jim Bugwadia <jim@nirmata.com>
Co-authored-by: shuting <shuting@nirmata.com>
Co-authored-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>
This commit is contained in:
Amit kumar 2023-07-24 13:40:07 +05:30 • committed by GitHub
parent 00329c1881
commit c276060ff8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
11 changed files with 160 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
pkg/engine/internal/imageverifier.go
View file

@ -2,6 +2,7 @@ package internal
import (
"context"
"encoding/json"
"errors"
"fmt"
"net"
@ -59,11 +60,31 @@ func HasImageVerifiedAnnotationChanged(ctx engineapi.PolicyContext, log logr.Log
}
newValue := newResource.GetAnnotations()[engineapi.ImageVerifyAnnotationKey]
oldValue := oldResource.GetAnnotations()[engineapi.ImageVerifyAnnotationKey]
result := newValue != oldValue
if result {
log.V(2).Info("annotation mismatch", "oldValue", oldValue, "newValue", newValue, "key", engineapi.ImageVerifyAnnotationKey)
if newValue == oldValue {
return false
}
return result
var newValueObj, oldValueObj map[string]bool
err := json.Unmarshal([]byte(newValue), &newValueObj)
if err != nil {
log.Error(err, "failed to parse new resource annotation.")
return true
}
err = json.Unmarshal([]byte(oldValue), &oldValueObj)
if err != nil {
log.Error(err, "failed to parse old resource annotation.")
return true
}
for img := range oldValueObj {
_, found := newValueObj[img]
if found {
result := newValueObj[img] != oldValueObj[img]
if result {
log.V(2).Info("annotation mismatch", "oldValue", oldValue, "newValue", newValue, "key", engineapi.ImageVerifyAnnotationKey)
return result
}
}
}
return false
}
func matchImageReferences(imageReferences []string, image string) bool {

6
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/01-policy.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: kuttl.dev/v1beta1
kind: TestStep
apply:
- policy.yaml
assert:
- policy-ready.yaml

7
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/02-resource.yaml Normal file
View file

@ -0,0 +1,7 @@
apiVersion: kuttl.dev/v1beta1
kind: TestStep
apply:
- deployment_old.yaml
- deployment_new.yaml
assert:
- deployment-assert.yaml

5
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/03-test.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kuttl.dev/v1beta1
kind: TestStep
commands:
- command: kubectl -n verify-images rollout undo deployment nginx-deployment
namespaced: true

11
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/04-assert.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
namespace: verify-images
spec:
template:
spec:
containers:
- image: ghcr.io/kyverno/test-verify-image-rollback:signed-2@sha256:0fc1f3b764be56f7c881a69cbd553ae25a2b5523c6901fbacb8270307c29d0c4
name: nginx

11
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/README.md Normal file
View file

@ -0,0 +1,11 @@
## Description
This test verifies images during rollback
## Expected Behavior
This test creates a ClusterPolicy and Deployments, and when we perform a rollback, it will be successfully rolled back.
## Reference Issue(s)
5363

11
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/deployment-assert.yaml Normal file
View file

@ -0,0 +1,11 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
namespace: verify-images
spec:
template:
spec:
containers:
- image: ghcr.io/kyverno/test-verify-image-rollback:signed-1@sha256:e0cc6dba04bee00badd8b13495d4411060b5563a9499fbc20e46316328efad30
name: nginx

21
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/deployment_new.yaml Normal file
View file

@ -0,0 +1,21 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment
namespace: verify-images
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: ghcr.io/kyverno/test-verify-image-rollback:signed-1
name: nginx
resources: {}

21
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/deployment_old.yaml Normal file
View file

@ -0,0 +1,21 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: nginx
name: nginx-deployment
namespace: verify-images
spec:
replicas: 1
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- image: ghcr.io/kyverno/test-verify-image-rollback:signed-2
name: nginx
resources: {}

9
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/policy-ready.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
name: check-image
status:
conditions:
- reason: Succeeded
status: "True"
type: Ready

33
test/conformance/kuttl/verifyImages/clusterpolicy/standard/rollback-image-verification/policy.yaml Normal file
View file

@ -0,0 +1,33 @@
apiVersion: v1
kind: Namespace
metadata:
name: verify-images
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: check-image
spec:
validationFailureAction: Enforce
background: false
webhookTimeoutSeconds: 30
failurePolicy: Fail
rules:
- name: check-image
match:
any:
- resources:
kinds:
- Deployment
verifyImages:
- imageReferences:
- "ghcr.io/kyverno*"
attestors:
- count: 1
entries:
- keys:
publicKeys: |-
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEfnYaFSrs2pLp4ShcWBgMLJM6Gki/
1tC5ZWN2IuJTe2RbyVrDEn1qLBXNzGKhIXbsUyO5+BuIfgMdek1pDYFZGQ==
-----END PUBLIC KEY-----