From e809755f3025e8375d60eb5bebaa1559af26fd9a Mon Sep 17 00:00:00 2001 From: shuting Date: Wed, 27 Dec 2023 17:04:36 +0800 Subject: [PATCH] cherry-picj #9151 (#9291) Signed-off-by: ShutingZhao Co-authored-by: raffis --- cmd/cli/kubectl-kyverno/commands/apply/command.go | 13 +++++++++++++ cmd/cli/kubectl-kyverno/commands/test/test.go | 2 ++ .../kubectl-kyverno/processor/policy_processor.go | 5 +++-- .../processor/policy_processor_test.go | 2 ++ 4 files changed, 20 insertions(+), 2 deletions(-) diff --git a/cmd/cli/kubectl-kyverno/commands/apply/command.go b/cmd/cli/kubectl-kyverno/commands/apply/command.go index 046b730e73..f23609b796 100644 --- a/cmd/cli/kubectl-kyverno/commands/apply/command.go +++ b/cmd/cli/kubectl-kyverno/commands/apply/command.go @@ -28,6 +28,7 @@ import ( "github.com/kyverno/kyverno/pkg/clients/dclient" "github.com/kyverno/kyverno/pkg/config" engineapi "github.com/kyverno/kyverno/pkg/engine/api" + "github.com/kyverno/kyverno/pkg/registryclient" gitutils "github.com/kyverno/kyverno/pkg/utils/git" policyvalidation "github.com/kyverno/kyverno/pkg/validation/policy" "github.com/spf13/cobra" @@ -161,6 +162,14 @@ func (c *ApplyCommandConfig) applyCommandHelper(out io.Writer) (*processor.Resul policyRulesCount += len(validatingAdmissionPolicies) fmt.Fprintf(out, "\nApplying %d policy rule(s) to %d resource(s)...\n", policyRulesCount, len(resources)) } + + var regOpts []registryclient.Option + if c.RegistryAccess { + regOpts = append(regOpts, registryclient.WithLocalKeychain()) + } + + rclient := registryclient.NewOrDie(regOpts...) + rc, resources1, responses1, err = c.applyPolicytoResource( out, variables, @@ -170,6 +179,7 @@ func (c *ApplyCommandConfig) applyCommandHelper(out io.Writer) (*processor.Resul dClient, userInfo, mutateLogPathIsDir, + rclient, ) if err != nil { return rc, resources1, skipInvalidPolicies, responses1, err @@ -226,6 +236,7 @@ func (c *ApplyCommandConfig) applyPolicytoResource( dClient dclient.Interface, userInfo *v1beta1.RequestInfo, mutateLogPathIsDir bool, + rclient registryclient.Client, ) (*processor.ResultCounts, []*unstructured.Unstructured, []engineapi.EngineResponse, error) { if vars != nil { vars.SetInStore() @@ -246,6 +257,7 @@ func (c *ApplyCommandConfig) applyPolicytoResource( } validPolicies = append(validPolicies, pol) } + var rc processor.ResultCounts var responses []engineapi.EngineResponse for _, resource := range resources { @@ -265,6 +277,7 @@ func (c *ApplyCommandConfig) applyPolicytoResource( AuditWarn: c.AuditWarn, Subresources: vars.Subresources(), Out: out, + RegistryClient: rclient, } ers, err := processor.ApplyPoliciesOnResource() if err != nil { diff --git a/cmd/cli/kubectl-kyverno/commands/test/test.go b/cmd/cli/kubectl-kyverno/commands/test/test.go index ecfb863845..f15c2f2b6c 100644 --- a/cmd/cli/kubectl-kyverno/commands/test/test.go +++ b/cmd/cli/kubectl-kyverno/commands/test/test.go @@ -22,6 +22,7 @@ import ( "github.com/kyverno/kyverno/pkg/clients/dclient" "github.com/kyverno/kyverno/pkg/config" engineapi "github.com/kyverno/kyverno/pkg/engine/api" + "github.com/kyverno/kyverno/pkg/registryclient" policyvalidation "github.com/kyverno/kyverno/pkg/validation/policy" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" ) @@ -140,6 +141,7 @@ func runTest(out io.Writer, testCase test.TestCase, auditWarn bool) ([]engineapi Client: dClient, Subresources: vars.Subresources(), Out: out, + RegistryClient: registryclient.NewOrDie(), } ers, err := processor.ApplyPoliciesOnResource() if err != nil { diff --git a/cmd/cli/kubectl-kyverno/processor/policy_processor.go b/cmd/cli/kubectl-kyverno/processor/policy_processor.go index 5800faefaf..59c54ed9d3 100644 --- a/cmd/cli/kubectl-kyverno/processor/policy_processor.go +++ b/cmd/cli/kubectl-kyverno/processor/policy_processor.go @@ -51,6 +51,7 @@ type PolicyProcessor struct { AuditWarn bool Subresources []v1alpha1.Subresource Out io.Writer + RegistryClient registryclient.Client } func (p *PolicyProcessor) ApplyPoliciesOnResource() ([]engineapi.EngineResponse, error) { @@ -62,13 +63,13 @@ func (p *PolicyProcessor) ApplyPoliciesOnResource() ([]engineapi.EngineResponse, if p.Client != nil { client = adapters.Client(p.Client) } - rclient := registryclient.NewOrDie() + eng := engine.NewEngine( cfg, config.NewDefaultMetricsConfiguration(), jmespath.New(cfg), client, - factories.DefaultRegistryClientFactory(adapters.RegistryClient(rclient), nil), + factories.DefaultRegistryClientFactory(adapters.RegistryClient(p.RegistryClient), nil), imageverifycache.DisabledImageVerifyCache(), store.ContextLoaderFactory(nil), nil, diff --git a/cmd/cli/kubectl-kyverno/processor/policy_processor_test.go b/cmd/cli/kubectl-kyverno/processor/policy_processor_test.go index 92f98b774b..56ac12cc2f 100644 --- a/cmd/cli/kubectl-kyverno/processor/policy_processor_test.go +++ b/cmd/cli/kubectl-kyverno/processor/policy_processor_test.go @@ -5,6 +5,7 @@ import ( "testing" "github.com/kyverno/kyverno/cmd/cli/kubectl-kyverno/resource" + "github.com/kyverno/kyverno/pkg/registryclient" yamlutils "github.com/kyverno/kyverno/pkg/utils/yaml" "gotest.tools/assert" ) @@ -114,6 +115,7 @@ func Test_NamespaceSelector(t *testing.T) { NamespaceSelectorMap: tc.namespaceSelectorMap, Rc: rc, Out: os.Stdout, + RegistryClient: registryclient.NewOrDie(), } processor.ApplyPoliciesOnResource() assert.Equal(t, int64(rc.Pass()), int64(tc.result.pass))