[Bug] Building image context fails if an inner portion of name looks like a domain

[chipzoller]

Kyverno Version

1.11.1

Kubernetes Version

1.27.x

Kubernetes Platform

K3d

Kyverno Rule Type

Mutate

Description

Mutating the image field of a Pod fails if the mutation creates a string in which an inner portion of the mutated name has what appears to be a domain name.

See discussion #9368.

Steps to reproduce

1. Run the Playground link here.

Expected behavior

The mutation is successful since the final result is still a valid image string. You can confirm this by trying to create a Pod with an image having the same string without Kyverno involved and it's allowed.

Screenshots

No response

Kyverno logs

No response

Slack discussion

No response

Troubleshooting

• I have read and followed the documentation AND the troubleshooting guide.
• I have searched other issues in this repository and mine is not recorded.

[vishal-chdhry]

The issue with the playground is that there is an extra " at the end in line 30 of the policy, This works

cc @chipzoller

[chipzoller]

Ah good catch. So we can close this then?

[vishal-chdhry]

Yes, and I believe this PR solves the unauthorized issue mentioned in the discussion: #9838

[chipzoller]

Nice job, Vishal.