genpolicy: reenable checking the OCI version

Fixes: kata-containers#9593 Signed-off-by: Saul Paredes <saulparedes@microsoft.com>
microsoft · May 8, 2024 · c585100 · c585100
1 parent ed5ea0a
commit c585100
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/src/tools/genpolicy/rules.rego b/src/tools/genpolicy/rules.rego
@@ -66,8 +66,7 @@ CreateContainerRequest {
     p_oci := p_container.OCI
 
     print("CreateContainerRequest: p Version =", p_oci.Version, "i Version =", i_oci.Version)
-    # TODO: Reenable when the Mariner host is reinstated, see #9593.
-    # p_oci.Version == i_oci.Version
+    p_oci.Version == i_oci.Version
 
     print("CreateContainerRequest: p Readonly =", p_oci.Root.Readonly, "i Readonly =", i_oci.Root.Readonly)
     p_oci.Root.Readonly == i_oci.Root.Readonly

diff --git a/tests/integration/kubernetes/tests_common.sh b/tests/integration/kubernetes/tests_common.sh
@@ -130,6 +130,9 @@ create_common_genpolicy_settings() {
 
 	auto_generate_policy_enabled || return 0
 
+	# TODO: Enable when the Mariner host is reinstated, see #9594.
+	# [ "${KATA_HOST_OS}" = "cbl-mariner" ] && sed -i 's/"oci_version": "1\.1\.0"/"oci_version": "1.1.0-rc.1"/' "${default_genpolicy_settings_dir}/genpolicy-settings.json"
+
 	cp "${default_genpolicy_settings_dir}/genpolicy-settings.json" "${genpolicy_settings_dir}"
 	cp "${default_genpolicy_settings_dir}/rules.rego" "${genpolicy_settings_dir}"