[release-4.5] Bug 1849173: Allow image push after postCommit script completes

pkg/build/controller/build/build_controller.go

@@ -2190,17 +2190,25 @@ func (bc *BuildController) createBuildSignaturePolicyData(config *configv1.Image
 		}
 	}
 
+	// Local containers-storage transport should always allow image "pull"
+	containersStorageScopes := make(signature.PolicyTransportScopes)
+	containersStorageScopes[""] = signature.PolicyRequirements{
+		signature.NewPRInsecureAcceptAnything(),
+	}
+
 	// Policies for image pull/push are set on a per-transport basis.
 	// This list will need to be updated if addtitional transports are used by the build pod.
 	// The following transports are currently available in openshift builds:
 	//
 	// 1. docker: a docker v2 registry (docker.io, quay.io, internal registry, etc.)
 	// 2. atomic: an ImageStreamTag reference - deprecated
+	// 3. containers-storage: local image storage
 	//
 	// See man skopeo(1) for the full list of supported transports.
 	policyObj.Transports = map[string]signature.PolicyTransportScopes{
-		"atomic": transportScopes,
-		"docker": transportScopes,
+		"atomic":             transportScopes,
+		"docker":             transportScopes,
+		"containers-storage": containersStorageScopes,
 	}
 
 	policyJSON, err := json.Marshal(policyObj)

pkg/build/controller/build/build_controller_test.go

@@ -1574,7 +1574,7 @@ func TestHandleControllerConfig(t *testing.T) {
 				},
 				Spec: configv1.ImageSpec{
 					RegistrySources: configv1.RegistrySources{
-						AllowedRegistries: []string{"quay.io"},
+						AllowedRegistries: []string{"quay.io", "registry.redhat.io"},
 					},
 				},
 			},
@@ -1587,7 +1587,7 @@ func TestHandleControllerConfig(t *testing.T) {
 				},
 				Spec: configv1.ImageSpec{
 					RegistrySources: configv1.RegistrySources{
-						BlockedRegistries: []string{"docker.io"},
+						BlockedRegistries: []string{"docker.io", "quay.io"},
 					},
 				},
 			},
@@ -1784,7 +1784,7 @@ func TestHandleControllerConfig(t *testing.T) {
 			}
 			if !equality.Semantic.DeepEqual(insecureRegistries,
 				buildRegistriesConfig.InsecureRegistries) {
-				t.Errorf("expected insecure registries to equal %v, got %v",
+				t.Errorf("expected insecure registries to equal %s, got %s",
 					buildRegistriesConfig.InsecureRegistries,
 					insecureRegistries)
 			}
@@ -1803,7 +1803,7 @@ func TestHandleControllerConfig(t *testing.T) {
 			}
 			if !equality.Semantic.DeepEqual(registriesConfig.UnqualifiedSearchRegistries,
 				expectedSearchRegistries) {
-				t.Errorf("expected search registries to equal %v, got %v",
+				t.Errorf("expected search registries to equal %s, got %s",
 					expectedSearchRegistries,
 					registriesConfig.UnqualifiedSearchRegistries)
 			}
@@ -1818,55 +1818,63 @@ func TestHandleControllerConfig(t *testing.T) {
 			if len(buildRegistriesConfig.AllowedRegistries) > 0 && len(buildRegistriesConfig.BlockedRegistries) > 0 {
 				// Condition is not allowed - no policy should be set
 				if len(signatureJSON) > 0 {
-					t.Errorf("signature policy should be empty if both allowed and blocked registries are set, got %v", signatureJSON)
+					t.Errorf("signature policy should be empty if both allowed and blocked registries are set, got %s", signatureJSON)
 				}
 				return
 			}
 			policy, err := decodePolicyConfig(signatureJSON)
 			if err != nil {
 				t.Fatalf("unexpected error decoding signature policy config: %v", err)
 			}
+			expectedStorageScopes := signature.PolicyTransportScopes{
+				"": signature.PolicyRequirements{
+					signature.NewPRInsecureAcceptAnything(),
+				},
+			}
 
 			if len(buildRegistriesConfig.AllowedRegistries) > 0 {
 				expectedDefaults := signature.PolicyRequirements{
 					signature.NewPRReject(),
 				}
 				if !reflect.DeepEqual(expectedDefaults, policy.Default) {
-					t.Errorf("expected signature defaults %v, got %v", expectedDefaults, policy.Default)
+					t.Errorf("expected signature defaults %s, got %s", expectedDefaults, policy.Default)
 				}
-				expectedRepos := make(signature.PolicyTransportScopes)
+				expectedImageScopes := make(signature.PolicyTransportScopes)
 				for _, reg := range buildRegistriesConfig.AllowedRegistries {
-					expectedRepos[reg] = signature.PolicyRequirements{
+					expectedImageScopes[reg] = signature.PolicyRequirements{
 						signature.NewPRInsecureAcceptAnything(),
 					}
 				}
+
 				expectedScopes := map[string]signature.PolicyTransportScopes{
-					"atomic": expectedRepos,
-					"docker": expectedRepos,
+					"atomic":             expectedImageScopes,
+					"docker":             expectedImageScopes,
+					"containers-storage": expectedStorageScopes,
 				}
 				if !reflect.DeepEqual(expectedScopes, policy.Transports) {
-					t.Errorf("expected transport scopes %v, got %v", expectedScopes, policy.Transports)
+					t.Errorf("expected transport scopes %s, got %s", expectedScopes, policy.Transports)
 				}
 			}
 			if len(buildRegistriesConfig.BlockedRegistries) > 0 {
 				expectedDefaults := signature.PolicyRequirements{
 					signature.NewPRInsecureAcceptAnything(),
 				}
 				if !reflect.DeepEqual(expectedDefaults, policy.Default) {
-					t.Errorf("expected signature defaults %v, got %v", expectedDefaults, policy.Default)
+					t.Errorf("expected signature defaults %s, got %s", expectedDefaults, policy.Default)
 				}
-				expectedRepos := make(signature.PolicyTransportScopes)
+				expectedImageScopes := make(signature.PolicyTransportScopes)
 				for _, reg := range buildRegistriesConfig.BlockedRegistries {
-					expectedRepos[reg] = signature.PolicyRequirements{
+					expectedImageScopes[reg] = signature.PolicyRequirements{
 						signature.NewPRReject(),
 					}
 				}
 				expectedScopes := map[string]signature.PolicyTransportScopes{
-					"atomic": expectedRepos,
-					"docker": expectedRepos,
+					"atomic":             expectedImageScopes,
+					"docker":             expectedImageScopes,
+					"containers-storage": expectedStorageScopes,
 				}
 				if !reflect.DeepEqual(expectedScopes, policy.Transports) {
-					t.Errorf("expected transport scopes %v, got %v", expectedScopes, policy.Transports)
+					t.Errorf("expected transport scopes %s, got %s", expectedScopes, policy.Transports)
 				}
 			}
 		})