Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 6e8b9d7

Browse files
smarterclaytonsmarterclayton
committedAug 22, 2017
Image policy is resolving images on replica sets by default
Even when local names are not requested, the image policy plugin is deciding to rewrite image references in replica sets that point to the integrated registry (with tags) to use digests. This causes the deployment controller that created them to get wedged (because it detects a change to the template) and become unable to update status on that replica set. https://bugzilla.redhat.com/show_bug.cgi?id=1481801
1 parent dce814f commit 6e8b9d7

File tree

10 files changed

+325
-39
lines changed

10 files changed

+325
-39
lines changed
 

‎pkg/bootstrap/bindata.go

-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/image/admission/imagepolicy/api/types.go

+11-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,9 @@ type ImagePolicyConfig struct {
2727

2828
// ResolutionRules allows more specific image resolution rules to be applied per resource. If
2929
// empty, it defaults to allowing local image stream lookups - "mysql" will map to the image stream
30-
// tag "mysql:latest" in the current namespace if the stream supports it.
30+
// tag "mysql:latest" in the current namespace if the stream supports it. The default for this
31+
// field is all known types that support image resolution, and the policy for those rules will be
32+
// set to the overall resolution policy if an execution rule references the same resource.
3133
ResolutionRules []ImageResolutionPolicyRule
3234

3335
// ExecutionRules determine whether the use of an image is allowed in an object with a pod spec.
@@ -53,13 +55,21 @@ var (
5355

5456
// ImageResolutionPolicyRule describes resolution rules based on resource.
5557
type ImageResolutionPolicyRule struct {
58+
// Policy controls whether resolution will happen if the rule doesn't match local names. This value
59+
// overrides the global image policy for all target resources.
60+
Policy ImageResolutionType
5661
// TargetResource is the identified group and resource. If Resource is *, this rule will apply
5762
// to all resources in that group.
5863
TargetResource metav1.GroupResource
5964
// LocalNames will allow single segment names to be interpreted as namespace local image
6065
// stream tags, but only if the target image stream tag has the "resolveLocalNames" field
6166
// set.
6267
LocalNames bool
68+
// Type controls whether resolution will happen if the rule doesn't match local names. The default
69+
// value is DoNotAttempt. This overrides the global image policy for a matching resource. If there
70+
// are multiple rules matching a resource, any rule that requests resolution or rewrite will
71+
// result in rewrite.
72+
Type ImageResolutionType
6373
}
6474

6575
// ImageExecutionPolicyRule determines whether a provided image may be used on the platform.

‎pkg/image/admission/imagepolicy/api/v1/default-policy.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,3 @@ executionRules:
1717
- key: images.openshift.io/deny-execution
1818
value: "true"
1919
skipOnResolutionFailure: true
20-

‎pkg/image/admission/imagepolicy/api/v1/defaults.go

+32-12
Original file line numberDiff line numberDiff line change
@@ -14,30 +14,50 @@ func SetDefaults_ImagePolicyConfig(obj *ImagePolicyConfig) {
1414
obj.ResolveImages = Attempt
1515
}
1616

17+
for i := range obj.ExecutionRules {
18+
if len(obj.ExecutionRules[i].OnResources) == 0 {
19+
obj.ExecutionRules[i].OnResources = []GroupResource{{Resource: "pods", Group: kapi.GroupName}}
20+
}
21+
}
22+
1723
if obj.ResolutionRules == nil {
1824
obj.ResolutionRules = []ImageResolutionPolicyRule{
1925
{TargetResource: GroupResource{Resource: "pods"}, LocalNames: true},
2026
{TargetResource: GroupResource{Group: "build.openshift.io", Resource: "builds"}, LocalNames: true},
21-
{TargetResource: GroupResource{Resource: "replicationcontrollers"}, LocalNames: true},
22-
{TargetResource: GroupResource{Group: "extensions", Resource: "replicasets"}, LocalNames: true},
2327
{TargetResource: GroupResource{Group: "batch", Resource: "jobs"}, LocalNames: true},
24-
25-
// TODO: consider adding these
26-
// {TargetResource: GroupResource{Group: "extensions", Resource: "deployments"}, LocalNames: true},
27-
// {TargetResource: GroupResource{Group: "apps", Resource: "statefulsets"}, LocalNames: true},
28+
{TargetResource: GroupResource{Group: "extensions", Resource: "replicasets"}, LocalNames: true},
29+
{TargetResource: GroupResource{Resource: "replicationcontrollers"}, LocalNames: true},
30+
{TargetResource: GroupResource{Group: "apps", Resource: "deployments"}, LocalNames: true},
31+
{TargetResource: GroupResource{Group: "extensions", Resource: "deployments"}, LocalNames: true},
32+
{TargetResource: GroupResource{Group: "apps", Resource: "statefulsets"}, LocalNames: true},
33+
{TargetResource: GroupResource{Group: "extensions", Resource: "daemonsets"}, LocalNames: true},
2834
}
29-
}
30-
31-
for i := range obj.ExecutionRules {
32-
if len(obj.ExecutionRules[i].OnResources) == 0 {
33-
obj.ExecutionRules[i].OnResources = []GroupResource{{Resource: "pods", Group: kapi.GroupName}}
35+
// default the resolution policy to the global default
36+
for i := range obj.ResolutionRules {
37+
if len(obj.ResolutionRules[i].Policy) == 0 {
38+
obj.ResolutionRules[i].Policy = DoNotAttempt
39+
for _, rule := range obj.ExecutionRules {
40+
if executionRuleCoversResource(rule, obj.ResolutionRules[i].TargetResource) {
41+
obj.ResolutionRules[i].Policy = obj.ResolveImages
42+
}
43+
}
44+
}
3445
}
3546
}
36-
3747
}
3848

3949
func addDefaultingFuncs(scheme *runtime.Scheme) error {
4050
return scheme.AddDefaultingFuncs(
4151
SetDefaults_ImagePolicyConfig,
4252
)
4353
}
54+
55+
// executionRuleCoversResource returns true if gr is covered by rule.
56+
func executionRuleCoversResource(rule ImageExecutionPolicyRule, gr GroupResource) bool {
57+
for _, target := range rule.OnResources {
58+
if target.Group == gr.Group && (target.Resource == gr.Resource || target.Resource == "*") {
59+
return true
60+
}
61+
}
62+
return false
63+
}

‎pkg/image/admission/imagepolicy/api/v1/swagger_doc.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func (ImageExecutionPolicyRule) SwaggerDoc() map[string]string {
4545
var map_ImagePolicyConfig = map[string]string{
4646
"": "ImagePolicyConfig is the configuration for control of images running on the platform.",
4747
"resolveImages": "ResolveImages indicates the default image resolution behavior. If a rewriting policy is chosen, then the image pull specs will be updated.",
48-
"resolutionRules": "ResolutionRules allows more specific image resolution rules to be applied per resource. If empty, it defaults to allowing local image stream lookups - \"mysql\" will map to the image stream tag \"mysql:latest\" in the current namespace if the stream supports it.",
48+
"resolutionRules": "ResolutionRules allows more specific image resolution rules to be applied per resource. If empty, it defaults to allowing local image stream lookups - \"mysql\" will map to the image stream tag \"mysql:latest\" in the current namespace if the stream supports it. The default for this field is all known types that support image resolution, and the policy for those rules will be set to the overall resolution policy if an execution rule references the same resource.",
4949
"executionRules": "ExecutionRules determine whether the use of an image is allowed in an object with a pod spec. By default, these rules only apply to pods, but may be extended to other resource types. If all execution rules are negations, the default behavior is allow all. If any execution rule is an allow, the default behavior is to reject all.",
5050
}
5151

@@ -55,8 +55,10 @@ func (ImagePolicyConfig) SwaggerDoc() map[string]string {
5555

5656
var map_ImageResolutionPolicyRule = map[string]string{
5757
"": "ImageResolutionPolicyRule describes resolution rules based on resource.",
58+
"policy": "Policy controls whether resolution will happen if the rule doesn't match local names. This value overrides the global image policy for all target resources.",
5859
"targetResource": "TargetResource is the identified group and resource. If Resource is *, this rule will apply to all resources in that group.",
5960
"localNames": "LocalNames will allow single segment names to be interpreted as namespace local image stream tags, but only if the target image stream tag has the \"resolveLocalNames\" field set.",
61+
"type": "Type controls whether resolution will happen if the rule doesn't match local names. The default value is DoNotAttempt. This overrides the global image policy for a matching resource.",
6062
}
6163

6264
func (ImageResolutionPolicyRule) SwaggerDoc() map[string]string {

‎pkg/image/admission/imagepolicy/api/v1/types.go

+9-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@ type ImagePolicyConfig struct {
1414

1515
// ResolutionRules allows more specific image resolution rules to be applied per resource. If
1616
// empty, it defaults to allowing local image stream lookups - "mysql" will map to the image stream
17-
// tag "mysql:latest" in the current namespace if the stream supports it.
17+
// tag "mysql:latest" in the current namespace if the stream supports it. The default for this
18+
// field is all known types that support image resolution, and the policy for those rules will be
19+
// set to the overall resolution policy if an execution rule references the same resource.
1820
ResolutionRules []ImageResolutionPolicyRule `json:"resolutionRules"`
1921

2022
// ExecutionRules determine whether the use of an image is allowed in an object with a pod spec.
@@ -42,13 +44,19 @@ var (
4244

4345
// ImageResolutionPolicyRule describes resolution rules based on resource.
4446
type ImageResolutionPolicyRule struct {
47+
// Policy controls whether resolution will happen if the rule doesn't match local names. This value
48+
// overrides the global image policy for all target resources.
49+
Policy ImageResolutionType `json:"policy"`
4550
// TargetResource is the identified group and resource. If Resource is *, this rule will apply
4651
// to all resources in that group.
4752
TargetResource GroupResource `json:"targetResource"`
4853
// LocalNames will allow single segment names to be interpreted as namespace local image
4954
// stream tags, but only if the target image stream tag has the "resolveLocalNames" field
5055
// set.
5156
LocalNames bool `json:"localNames"`
57+
// Type controls whether resolution will happen if the rule doesn't match local names. The default
58+
// value is DoNotAttempt. This overrides the global image policy for a matching resource.
59+
Type ImageResolutionType `json:"type"`
5260
}
5361

5462
// ImageExecutionPolicyRule determines whether a provided image may be used on the platform.

‎pkg/image/admission/imagepolicy/api/validation/validation.go

+3
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ func Validate(config *api.ImagePolicyConfig) field.ErrorList {
2828
}
2929

3030
for i, rule := range config.ResolutionRules {
31+
if len(rule.Policy) == 0 {
32+
allErrs = append(allErrs, field.Required(field.NewPath(api.PluginName, "resolutionRules").Index(i).Child("policy"), "a policy must be specified for this resource"))
33+
}
3134
if len(rule.TargetResource.Resource) == 0 {
3235
allErrs = append(allErrs, field.Required(field.NewPath(api.PluginName, "resolutionRules").Index(i).Child("targetResource", "resource"), "a target resource name or '*' must be provided"))
3336
}

‎pkg/image/admission/imagepolicy/api/validation/validation_test.go

+27
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,33 @@ func TestValidation(t *testing.T) {
4747
t.Fatal(errs)
4848
}
4949

50+
if errs := Validate(&api.ImagePolicyConfig{
51+
ResolveImages: api.DoNotAttempt,
52+
ResolutionRules: []api.ImageResolutionPolicyRule{
53+
{TargetResource: metav1.GroupResource{Resource: "test"}, Policy: api.Attempt},
54+
},
55+
}); len(errs) != 0 {
56+
t.Fatal(errs)
57+
}
58+
59+
if errs := Validate(&api.ImagePolicyConfig{
60+
ResolveImages: api.DoNotAttempt,
61+
ResolutionRules: []api.ImageResolutionPolicyRule{
62+
{TargetResource: metav1.GroupResource{Resource: "test"}},
63+
},
64+
}); len(errs) == 0 {
65+
t.Fatal(errs)
66+
}
67+
68+
if errs := Validate(&api.ImagePolicyConfig{
69+
ResolveImages: api.DoNotAttempt,
70+
ResolutionRules: []api.ImageResolutionPolicyRule{
71+
{Policy: api.Attempt},
72+
},
73+
}); len(errs) == 0 {
74+
t.Fatal(errs)
75+
}
76+
5077
if errs := Validate(&api.ImagePolicyConfig{
5178
ResolveImages: api.DoNotAttempt,
5279
ExecutionRules: []api.ImageExecutionPolicyRule{

‎pkg/image/admission/imagepolicy/imagepolicy.go

+18-12
Original file line numberDiff line numberDiff line change
@@ -451,26 +451,32 @@ var skipImageRewriteOnUpdate = map[schema.GroupResource]struct{}{
451451
}
452452

453453
// RewriteImagePullSpec applies to implicit rewrite attributes and local resources as well as if the policy requires it.
454+
// If a local name check is requested and a rule matches true is returned. The policy default resolution is only respected
455+
// if a resource isn't covered by a rule - if pods have a rule with DoNotAttempt and the global policy is RequiredRewrite,
456+
// no pods will be rewritten.
454457
func (config resolutionConfig) RewriteImagePullSpec(attr *rules.ImagePolicyAttributes, isUpdate bool, gr schema.GroupResource) bool {
455458
if isUpdate {
456459
if _, ok := skipImageRewriteOnUpdate[gr]; ok {
457460
return false
458461
}
459462
}
460-
if api.RequestsResolution(config.config.ResolveImages) {
461-
return true
462-
}
463-
if attr.LocalRewrite {
464-
for _, rule := range config.config.ResolutionRules {
465-
if !rule.LocalNames {
466-
continue
467-
}
468-
if resolutionRuleCoversResource(rule.TargetResource, gr) {
469-
return true
470-
}
463+
hasMatchingRule := false
464+
for _, rule := range config.config.ResolutionRules {
465+
if !resolutionRuleCoversResource(rule.TargetResource, gr) {
466+
continue
471467
}
468+
if rule.LocalNames && attr.LocalRewrite {
469+
return true
470+
}
471+
if api.RewriteImagePullSpec(rule.Policy) {
472+
return true
473+
}
474+
hasMatchingRule = true
472475
}
473-
return false
476+
if hasMatchingRule {
477+
return false
478+
}
479+
return api.RewriteImagePullSpec(config.config.ResolveImages)
474480
}
475481

476482
// resolutionRuleCoversResource implements wildcard checking on Resource names

‎pkg/image/admission/imagepolicy/imagepolicy_test.go

+222-10
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package imagepolicy
22

33
import (
4+
"bytes"
45
"os"
56
"reflect"
67
"strings"
@@ -436,9 +437,16 @@ func TestAdmissionResolveImages(t *testing.T) {
436437
DockerImageReference: "integrated.registry/image1/image1:latest",
437438
}
438439

440+
obj, err := configlatest.ReadYAML(bytes.NewBufferString(`{"kind":"ImagePolicyConfig","apiVersion":"v1"}`))
441+
if err != nil || obj == nil {
442+
t.Fatal(err)
443+
}
444+
defaultPolicyConfig := obj.(*api.ImagePolicyConfig)
445+
439446
testCases := []struct {
440447
client *testclient.Fake
441448
policy api.ImageResolutionType
449+
config *api.ImagePolicyConfig
442450
attrs admission.Attributes
443451
admit bool
444452
expect runtime.Object
@@ -585,6 +593,168 @@ func TestAdmissionResolveImages(t *testing.T) {
585593
},
586594
},
587595
},
596+
597+
// resolves images in the integrated registry on builds without altering their ref (avoids looking up the tag)
598+
{
599+
policy: api.RequiredRewrite,
600+
client: testclient.NewSimpleFake(
601+
image1,
602+
),
603+
attrs: admission.NewAttributesRecord(
604+
&buildapi.Build{
605+
Spec: buildapi.BuildSpec{
606+
CommonSpec: buildapi.CommonSpec{
607+
Strategy: buildapi.BuildStrategy{
608+
SourceStrategy: &buildapi.SourceBuildStrategy{
609+
From: kapi.ObjectReference{Kind: "DockerImage", Name: "integrated.registry/test/mysql@sha256:0000000000000000000000000000000000000000000000000000000000000001"},
610+
},
611+
},
612+
},
613+
},
614+
}, nil, schema.GroupVersionKind{Version: "v1", Kind: "Build"},
615+
"default", "build1", schema.GroupVersionResource{Version: "v1", Resource: "builds"},
616+
"", admission.Create, nil,
617+
),
618+
admit: true,
619+
expect: &buildapi.Build{
620+
Spec: buildapi.BuildSpec{
621+
CommonSpec: buildapi.CommonSpec{
622+
Strategy: buildapi.BuildStrategy{
623+
SourceStrategy: &buildapi.SourceBuildStrategy{
624+
From: kapi.ObjectReference{Kind: "DockerImage", Name: "integrated.registry/test/mysql@sha256:0000000000000000000000000000000000000000000000000000000000000001"},
625+
},
626+
},
627+
},
628+
},
629+
},
630+
},
631+
// does not rewrite the config because build has DoNotAttempt by default, which overrides global policy
632+
{
633+
config: &api.ImagePolicyConfig{
634+
ResolveImages: api.RequiredRewrite,
635+
ResolutionRules: []api.ImageResolutionPolicyRule{
636+
{TargetResource: metav1.GroupResource{Group: "", Resource: "builds"}},
637+
},
638+
},
639+
client: testclient.NewSimpleFake(
640+
&imageapi.ImageStreamTag{
641+
ObjectMeta: metav1.ObjectMeta{Name: "test:other", Namespace: "default"},
642+
Image: *image1,
643+
},
644+
),
645+
attrs: admission.NewAttributesRecord(
646+
&buildapi.Build{
647+
Spec: buildapi.BuildSpec{
648+
CommonSpec: buildapi.CommonSpec{
649+
Strategy: buildapi.BuildStrategy{
650+
CustomStrategy: &buildapi.CustomBuildStrategy{
651+
From: kapi.ObjectReference{Kind: "ImageStreamTag", Name: "test:other"},
652+
},
653+
},
654+
},
655+
},
656+
}, nil, schema.GroupVersionKind{Version: "v1", Kind: "Build"},
657+
"default", "build1", schema.GroupVersionResource{Version: "v1", Resource: "builds"},
658+
"", admission.Create, nil,
659+
),
660+
admit: true,
661+
expect: &buildapi.Build{
662+
Spec: buildapi.BuildSpec{
663+
CommonSpec: buildapi.CommonSpec{
664+
Strategy: buildapi.BuildStrategy{
665+
CustomStrategy: &buildapi.CustomBuildStrategy{
666+
From: kapi.ObjectReference{Kind: "ImageStreamTag", Name: "test:other"},
667+
},
668+
},
669+
},
670+
},
671+
},
672+
},
673+
// does not rewrite the config because build has Attempt by default, which overrides global policy
674+
{
675+
config: &api.ImagePolicyConfig{
676+
ResolveImages: api.RequiredRewrite,
677+
ResolutionRules: []api.ImageResolutionPolicyRule{
678+
{TargetResource: metav1.GroupResource{Group: "", Resource: "builds"}, Policy: api.Attempt},
679+
},
680+
},
681+
client: testclient.NewSimpleFake(
682+
&imageapi.ImageStreamTag{
683+
ObjectMeta: metav1.ObjectMeta{Name: "test:other", Namespace: "default"},
684+
Image: *image1,
685+
},
686+
),
687+
attrs: admission.NewAttributesRecord(
688+
&buildapi.Build{
689+
Spec: buildapi.BuildSpec{
690+
CommonSpec: buildapi.CommonSpec{
691+
Strategy: buildapi.BuildStrategy{
692+
CustomStrategy: &buildapi.CustomBuildStrategy{
693+
From: kapi.ObjectReference{Kind: "ImageStreamTag", Name: "test:other"},
694+
},
695+
},
696+
},
697+
},
698+
}, nil, schema.GroupVersionKind{Version: "v1", Kind: "Build"},
699+
"default", "build1", schema.GroupVersionResource{Version: "v1", Resource: "builds"},
700+
"", admission.Create, nil,
701+
),
702+
admit: true,
703+
expect: &buildapi.Build{
704+
Spec: buildapi.BuildSpec{
705+
CommonSpec: buildapi.CommonSpec{
706+
Strategy: buildapi.BuildStrategy{
707+
CustomStrategy: &buildapi.CustomBuildStrategy{
708+
From: kapi.ObjectReference{Kind: "ImageStreamTag", Name: "test:other"},
709+
},
710+
},
711+
},
712+
},
713+
},
714+
},
715+
// rewrites the config because build has AttemptRewrite which overrides the global policy
716+
{
717+
config: &api.ImagePolicyConfig{
718+
ResolveImages: api.DoNotAttempt,
719+
ResolutionRules: []api.ImageResolutionPolicyRule{
720+
{TargetResource: metav1.GroupResource{Group: "", Resource: "builds"}, Policy: api.AttemptRewrite},
721+
},
722+
},
723+
client: testclient.NewSimpleFake(
724+
&imageapi.ImageStreamTag{
725+
ObjectMeta: metav1.ObjectMeta{Name: "test:other", Namespace: "default"},
726+
Image: *image1,
727+
},
728+
),
729+
attrs: admission.NewAttributesRecord(
730+
&buildapi.Build{
731+
Spec: buildapi.BuildSpec{
732+
CommonSpec: buildapi.CommonSpec{
733+
Strategy: buildapi.BuildStrategy{
734+
CustomStrategy: &buildapi.CustomBuildStrategy{
735+
From: kapi.ObjectReference{Kind: "ImageStreamTag", Name: "test:other"},
736+
},
737+
},
738+
},
739+
},
740+
}, nil, schema.GroupVersionKind{Version: "v1", Kind: "Build"},
741+
"default", "build1", schema.GroupVersionResource{Version: "v1", Resource: "builds"},
742+
"", admission.Create, nil,
743+
),
744+
admit: true,
745+
expect: &buildapi.Build{
746+
Spec: buildapi.BuildSpec{
747+
CommonSpec: buildapi.CommonSpec{
748+
Strategy: buildapi.BuildStrategy{
749+
CustomStrategy: &buildapi.CustomBuildStrategy{
750+
From: kapi.ObjectReference{Kind: "DockerImage", Name: "integrated.registry/image1/image1@sha256:0000000000000000000000000000000000000000000000000000000000000001"},
751+
},
752+
},
753+
},
754+
},
755+
},
756+
},
757+
588758
// resolves builds.build.openshift.io with image stream tags, uses the image DockerImageReference with SHA set.
589759
{
590760
policy: api.RequiredRewrite,
@@ -735,6 +905,43 @@ func TestAdmissionResolveImages(t *testing.T) {
735905
},
736906
},
737907
},
908+
// does not resolve replica sets by default
909+
{
910+
config: defaultPolicyConfig,
911+
client: testclient.NewSimpleFake(
912+
&imageapi.ImageStreamTag{
913+
ObjectMeta: metav1.ObjectMeta{Name: "test:other", Namespace: "default"},
914+
Image: *image1,
915+
},
916+
),
917+
attrs: admission.NewAttributesRecord(
918+
&kapiextensions.ReplicaSet{
919+
Spec: kapiextensions.ReplicaSetSpec{
920+
Template: kapi.PodTemplateSpec{
921+
Spec: kapi.PodSpec{
922+
Containers: []kapi.Container{
923+
{Image: "integrated.registry/default/test:other"},
924+
},
925+
},
926+
},
927+
},
928+
}, nil, schema.GroupVersionKind{Version: "v1", Kind: "ReplicaSet", Group: "extensions"},
929+
"default", "rs1", schema.GroupVersionResource{Version: "v1", Resource: "replicasets", Group: "extensions"},
930+
"", admission.Create, nil,
931+
),
932+
admit: true,
933+
expect: &kapiextensions.ReplicaSet{
934+
Spec: kapiextensions.ReplicaSetSpec{
935+
Template: kapi.PodTemplateSpec{
936+
Spec: kapi.PodSpec{
937+
Containers: []kapi.Container{
938+
{Image: "integrated.registry/default/test:other"},
939+
},
940+
},
941+
},
942+
},
943+
},
944+
},
738945
// resolves replica sets that specifically request lookup
739946
{
740947
policy: api.RequiredRewrite,
@@ -925,16 +1132,21 @@ func TestAdmissionResolveImages(t *testing.T) {
9251132
}
9261133
for i, test := range testCases {
9271134
onResources := []schema.GroupResource{{Resource: "builds"}, {Resource: "pods"}}
928-
p, err := newImagePolicyPlugin(&api.ImagePolicyConfig{
929-
ResolveImages: test.policy,
930-
ResolutionRules: []api.ImageResolutionPolicyRule{
931-
{LocalNames: true, TargetResource: metav1.GroupResource{Resource: "*"}},
932-
{LocalNames: true, TargetResource: metav1.GroupResource{Group: "extensions", Resource: "*"}},
933-
},
934-
ExecutionRules: []api.ImageExecutionPolicyRule{
935-
{ImageCondition: api.ImageCondition{OnResources: onResources}},
936-
},
937-
})
1135+
config := test.config
1136+
if config == nil {
1137+
// old style config
1138+
config = &api.ImagePolicyConfig{
1139+
ResolveImages: test.policy,
1140+
ResolutionRules: []api.ImageResolutionPolicyRule{
1141+
{LocalNames: true, TargetResource: metav1.GroupResource{Resource: "*"}, Policy: test.policy},
1142+
{LocalNames: true, TargetResource: metav1.GroupResource{Group: "extensions", Resource: "*"}, Policy: test.policy},
1143+
},
1144+
ExecutionRules: []api.ImageExecutionPolicyRule{
1145+
{ImageCondition: api.ImageCondition{OnResources: onResources}},
1146+
},
1147+
}
1148+
}
1149+
p, err := newImagePolicyPlugin(config)
9381150
if err != nil {
9391151
t.Fatal(err)
9401152
}

0 commit comments

Comments
 (0)
Please sign in to comment.