-
Notifications
You must be signed in to change notification settings - Fork 782
/
image_verify.go
64 lines (59 loc) · 1.72 KB
/
image_verify.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
package engine
import (
"context"
"time"
"github.com/go-logr/logr"
kyvernov1 "github.com/kyverno/kyverno/api/kyverno/v1"
"github.com/kyverno/kyverno/pkg/autogen"
engineapi "github.com/kyverno/kyverno/pkg/engine/api"
"github.com/kyverno/kyverno/pkg/engine/handlers"
"github.com/kyverno/kyverno/pkg/engine/handlers/mutation"
"github.com/kyverno/kyverno/pkg/engine/internal"
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
)
func (e *engine) verifyAndPatchImages(
ctx context.Context,
logger logr.Logger,
policyContext engineapi.PolicyContext,
) (engineapi.PolicyResponse, unstructured.Unstructured, engineapi.ImageVerificationMetadata) {
resp := engineapi.NewPolicyResponse()
policy := policyContext.Policy()
matchedResource := policyContext.NewResource()
applyRules := policy.GetSpec().GetApplyRules()
ivm := engineapi.ImageVerificationMetadata{}
policyContext.JSONContext().Checkpoint()
defer policyContext.JSONContext().Restore()
for _, rule := range autogen.ComputeRules(policy, "") {
startTime := time.Now()
logger := internal.LoggerWithRule(logger, rule)
handlerFactory := func() (handlers.Handler, error) {
if !rule.HasVerifyImages() {
return nil, nil
}
return mutation.NewMutateImageHandler(
policyContext,
matchedResource,
rule,
e.configuration,
e.rclientFactory,
e.ivCache,
&ivm,
)
}
resource, ruleResp := e.invokeRuleHandler(
ctx,
logger,
handlerFactory,
policyContext,
matchedResource,
rule,
engineapi.ImageVerify,
)
matchedResource = resource
resp.Add(engineapi.NewExecutionStats(startTime, time.Now()), ruleResp...)
if applyRules == kyvernov1.ApplyOne && resp.RulesAppliedCount() > 0 {
break
}
}
return resp, matchedResource, ivm
}