Skip to content

Commit f8a6bad

Browse files
vaikasvaikas
authored
Fix 1608, 1613 (#1617)
Signed-off-by: Ville Aikas <[email protected]>
1 parent 36d7646 commit f8a6bad

11 files changed

+46
-42
lines changed

‎config/300-clusterimagepolicy.yaml

+1-3
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,6 @@ spec:
4646
properties:
4747
ctlog:
4848
type: object
49-
required:
50-
- url
5149
properties:
5250
url:
5351
type: string
@@ -72,7 +70,7 @@ spec:
7270
keyless:
7371
type: object
7472
properties:
75-
ca-key:
73+
ca-cert:
7674
type: object
7775
properties:
7876
data:

‎pkg/apis/config/image_policies_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,9 @@ func TestGetAuthorities(t *testing.T) {
7272
if len(c) == 0 {
7373
t.Error("Wanted a config, got none.")
7474
}
75-
want = "cakey chilling here"
76-
if got := c[0].Keyless.CAKey.Data; got != want {
77-
t.Errorf("Did not get what I wanted %q, got %+v", want, c[0].Keyless.CAKey.Data)
75+
want = "cacert chilling here"
76+
if got := c[0].Keyless.CACert.Data; got != want {
77+
t.Errorf("Did not get what I wanted %q, got %+v", want, c[0].Keyless.CACert.Data)
7878
}
7979
want = "issuer"
8080
if got := c[0].Keyless.Identities[0].Issuer; got != want {

‎pkg/apis/config/testdata/config-image-policies.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ data:
4646
- glob: rando3
4747
authorities:
4848
- keyless:
49-
ca-key:
50-
data: cakey chilling here
49+
ca-cert:
50+
data: cacert chilling here
5151
url: http://keylessurl.here
5252
identities:
5353
- issuer: issuer

‎pkg/apis/cosigned/v1alpha1/clusterimagepolicy_types.go

+13-7
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,10 @@ type ClusterImagePolicySpec struct {
6060
// If multiple patterns match a particular image, then ALL of
6161
// those authorities must be satisfied for the image to be admitted.
6262
type ImagePattern struct {
63-
Glob string `json:"glob"`
64-
Regex string `json:"regex"`
63+
// +optional
64+
Glob string `json:"glob,omitempty"`
65+
// +optional
66+
Regex string `json:"regex,omitempty"`
6567
}
6668

6769
// The authorities block defines the rules for discovering and
@@ -99,12 +101,14 @@ type KeyRef struct {
99101

100102
// Source specifies the location of the signature
101103
type Source struct {
102-
OCI string `json:"oci"`
104+
// +optional
105+
OCI string `json:"oci,omitempty"`
103106
}
104107

105108
// TLog specifies the URL to a transparency log that holds
106109
// the signature and public key information
107110
type TLog struct {
111+
// +optional
108112
URL *apis.URL `json:"url,omitempty"`
109113
}
110114

@@ -117,14 +121,16 @@ type KeylessRef struct {
117121
// +optional
118122
Identities []Identity `json:"identities,omitempty"`
119123
// +optional
120-
CAKey *KeyRef `json:"ca-key,omitempty"`
124+
CACert *KeyRef `json:"ca-cert,omitempty"`
121125
}
122126

123-
// Identity may contain the issue and/or the subject found in the transparency log.
127+
// Identity may contain the issuer and/or the subject found in the transparency log.
124128
// Either field supports a pattern glob.
125129
type Identity struct {
126-
Issuer string `json:"issuer"`
127-
Subject string `json:"subject"`
130+
// +optional
131+
Issuer string `json:"issuer,omitempty"`
132+
// +optional
133+
Subject string `json:"subject,omitempty"`
128134
}
129135

130136
// ClusterImagePolicyList is a list of ClusterImagePolicy resources

‎pkg/apis/cosigned/v1alpha1/clusterimagepolicy_validation.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -108,16 +108,16 @@ func (key *KeyRef) Validate(ctx context.Context) *apis.FieldError {
108108

109109
func (keyless *KeylessRef) Validate(ctx context.Context) *apis.FieldError {
110110
var errs *apis.FieldError
111-
if keyless.URL == nil && keyless.Identities == nil && keyless.CAKey == nil {
112-
errs = errs.Also(apis.ErrMissingOneOf("url", "identities", "ca-key"))
111+
if keyless.URL == nil && keyless.Identities == nil && keyless.CACert == nil {
112+
errs = errs.Also(apis.ErrMissingOneOf("url", "identities", "ca-cert"))
113113
}
114114

115115
if keyless.URL != nil {
116-
if keyless.CAKey != nil || keyless.Identities != nil {
117-
errs = errs.Also(apis.ErrMultipleOneOf("url", "identities", "ca-key"))
116+
if keyless.CACert != nil || keyless.Identities != nil {
117+
errs = errs.Also(apis.ErrMultipleOneOf("url", "identities", "ca-cert"))
118118
}
119-
} else if keyless.CAKey != nil && keyless.Identities != nil {
120-
errs = errs.Also(apis.ErrMultipleOneOf("url", "identities", "ca-key"))
119+
} else if keyless.CACert != nil && keyless.Identities != nil {
120+
errs = errs.Also(apis.ErrMultipleOneOf("url", "identities", "ca-cert"))
121121
}
122122

123123
if keyless.Identities != nil && len(keyless.Identities) == 0 {

‎pkg/apis/cosigned/v1alpha1/clusterimagepolicy_validation_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ func TestKeylessValidation(t *testing.T) {
281281
URL: &apis.URL{
282282
Host: "myhost",
283283
},
284-
CAKey: &KeyRef{
284+
CACert: &KeyRef{
285285
Data: "---certificate---",
286286
},
287287
},

‎pkg/apis/cosigned/v1alpha1/zz_generated.deepcopy.go

+2-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/reconciler/clusterimagepolicy/clusterimagepolicy.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -134,10 +134,10 @@ func (r *Reconciler) inlineSecrets(ctx context.Context, cip *v1alpha1.ClusterIma
134134
return nil, err
135135
}
136136
}
137-
if authority.Keyless != nil && authority.Keyless.CAKey != nil &&
138-
authority.Keyless.CAKey.SecretRef != nil {
139-
if err := r.inlineAndTrackSecret(ctx, ret, authority.Keyless.CAKey); err != nil {
140-
logging.FromContext(ctx).Errorf("Failed to read secret %q: %v", authority.Keyless.CAKey.SecretRef.Name, err)
137+
if authority.Keyless != nil && authority.Keyless.CACert != nil &&
138+
authority.Keyless.CACert.SecretRef != nil {
139+
if err := r.inlineAndTrackSecret(ctx, ret, authority.Keyless.CACert); err != nil {
140+
logging.FromContext(ctx).Errorf("Failed to read secret %q: %v", authority.Keyless.CACert.SecretRef.Name, err)
141141
return nil, err
142142
}
143143
}

‎pkg/reconciler/clusterimagepolicy/clusterimagepolicy_test.go

+10-10
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,10 @@ RCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==
5555
-----END PUBLIC KEY-----`
5656

5757
// This is the patch for replacing a single entry in the ConfigMap
58-
replaceCIPPatch = `[{"op":"replace","path":"/data/test-cip","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\",\"regex\":\"\"}],\"authorities\":[{\"key\":{\"data\":\"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\\n-----END PUBLIC KEY-----\"}}]}"}]`
58+
replaceCIPPatch = `[{"op":"replace","path":"/data/test-cip","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\"}],\"authorities\":[{\"key\":{\"data\":\"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\\n-----END PUBLIC KEY-----\"}}]}"}]`
5959

6060
// This is the patch for adding an entry for non-existing KMS for cipName2
61-
addCIP2Patch = `[{"op":"add","path":"/data/test-cip-2","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\",\"regex\":\"\"}],\"authorities\":[{\"key\":{\"data\":\"azure-kms://foo/bar\"}}]}"}]`
61+
addCIP2Patch = `[{"op":"add","path":"/data/test-cip-2","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\"}],\"authorities\":[{\"key\":{\"data\":\"azure-kms://foo/bar\"}}]}"}]`
6262

6363
// This is the patch for removing the last entry, leaving just the
6464
// configmap objectmeta, no data.
@@ -73,10 +73,10 @@ RCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==
7373
removeSingleEntryKeylessPatch = `[{"op":"remove","path":"/data/test-cip-2"}]`
7474

7575
// This is the patch for inlined secret for key ref data
76-
inlinedSecretKeyPatch = `[{"op":"replace","path":"/data/test-cip","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\",\"regex\":\"\"}],\"authorities\":[{\"key\":{\"data\":\"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\\n-----END PUBLIC KEY-----\"}}]}"}]`
76+
inlinedSecretKeyPatch = `[{"op":"replace","path":"/data/test-cip","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\"}],\"authorities\":[{\"key\":{\"data\":\"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\\n-----END PUBLIC KEY-----\"}}]}"}]`
7777

7878
// This is the patch for inlined secret for keyless cakey ref data
79-
inlinedSecretKeylessPatch = `[{"op":"replace","path":"/data/test-cip-2","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\",\"regex\":\"\"}],\"authorities\":[{\"keyless\":{\"ca-key\":{\"data\":\"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\\n-----END PUBLIC KEY-----\"}}}]}"}]`
79+
inlinedSecretKeylessPatch = `[{"op":"replace","path":"/data/test-cip-2","value":"{\"images\":[{\"glob\":\"ghcr.io/example/*\"}],\"authorities\":[{\"keyless\":{\"ca-cert\":{\"data\":\"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\\n-----END PUBLIC KEY-----\"}}}]}"}]`
8080
)
8181

8282
func TestReconcile(t *testing.T) {
@@ -324,7 +324,7 @@ func TestReconcile(t *testing.T) {
324324
}),
325325
WithAuthority(v1alpha1.Authority{
326326
Keyless: &v1alpha1.KeylessRef{
327-
CAKey: &v1alpha1.KeyRef{
327+
CACert: &v1alpha1.KeyRef{
328328
SecretRef: &corev1.SecretReference{
329329
Name: keylessSecretName,
330330
},
@@ -481,7 +481,7 @@ func TestReconcile(t *testing.T) {
481481
}),
482482
WithAuthority(v1alpha1.Authority{
483483
Keyless: &v1alpha1.KeylessRef{
484-
CAKey: &v1alpha1.KeyRef{
484+
CACert: &v1alpha1.KeyRef{
485485
SecretRef: &corev1.SecretReference{
486486
Name: keylessSecretName,
487487
}},
@@ -544,7 +544,7 @@ func makeConfigMap() *corev1.ConfigMap {
544544
Name: config.ImagePoliciesConfigName,
545545
},
546546
Data: map[string]string{
547-
cipName: `{"images":[{"glob":"ghcr.io/example/*","regex":""}],"authorities":[{"key":{"data":"-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\n-----END PUBLIC KEY-----"}}]}`,
547+
cipName: `{"images":[{"glob":"ghcr.io/example/*"}],"authorities":[{"key":{"data":"-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\n-----END PUBLIC KEY-----"}}]}`,
548548
},
549549
}
550550
}
@@ -557,7 +557,7 @@ func makeDifferentConfigMap() *corev1.ConfigMap {
557557
Name: config.ImagePoliciesConfigName,
558558
},
559559
Data: map[string]string{
560-
cipName: `{"images":[{"glob":"ghcr.io/example/*","regex":""}],"authorities":[{"key":{"data":"-----BEGIN NOTPUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\n-----END NOTPUBLIC KEY-----"}}]}`,
560+
cipName: `{"images":[{"glob":"ghcr.io/example/*"}],"authorities":[{"key":{"data":"-----BEGIN NOTPUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\n-----END NOTPUBLIC KEY-----"}}]}`,
561561
},
562562
}
563563
}
@@ -570,7 +570,7 @@ func makeConfigMapWithTwoEntries() *corev1.ConfigMap {
570570
Name: config.ImagePoliciesConfigName,
571571
},
572572
Data: map[string]string{
573-
cipName: `{"images":[{"glob":"ghcr.io/example/*","regex":""}],"authorities":[{"key":{"data":"-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\n-----END PUBLIC KEY-----"}}]}`,
573+
cipName: `{"images":[{"glob":"ghcr.io/example/*"}],"authorities":[{"key":{"data":"-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAExB6+H6054/W1SJgs5JR6AJr6J35J\nRCTfQ5s1kD+hGMSE1rH7s46hmXEeyhnlRnaGF8eMU/SBJE/2NKPnxE7WzQ==\n-----END PUBLIC KEY-----"}}]}`,
574574
cipName2: "remove me please",
575575
},
576576
}
@@ -585,7 +585,7 @@ func makeConfigMapWithTwoEntriesNotPublicKeyFromSecret() *corev1.ConfigMap {
585585
Name: config.ImagePoliciesConfigName,
586586
},
587587
Data: map[string]string{
588-
cipName: `{"images":[{"glob":"ghcr.io/example/*","regex":""}],"authorities":[{"key":{"data":"NOT A REAL PUBLIC KEY"}}]}`,
588+
cipName: `{"images":[{"glob":"ghcr.io/example/*"}],"authorities":[{"key":{"data":"NOT A REAL PUBLIC KEY"}}]}`,
589589
cipName2: "remove me please",
590590
},
591591
}

‎test/testdata/cosigned/invalid/keylessref-with-multiple-properties.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ spec:
2121
- glob: image*
2222
authorities:
2323
- keyless:
24-
ca-key:
24+
ca-cert:
2525
secretRef:
26-
name: ca-key-secret
26+
name: ca-cert-secret
2727
namespace: some-namespace
2828
identities:
2929
- issuer: "issue-details"

‎test/testdata/cosigned/valid/valid-policy.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ spec:
2222
- glob: image*
2323
authorities:
2424
- keyless:
25-
ca-key:
25+
ca-cert:
2626
secretRef:
27-
name: ca-key-secret
27+
name: ca-cert-secret
2828
namespace: some-namespacemak
2929
- keyless:
3030
identities:

0 commit comments

Comments
 (0)