Add support for Policy URLs #518
Conversation
Codecov Report
@@ Coverage Diff @@
## main #518 +/- ##
==========================================
- Coverage 56.21% 55.93% -0.29%
==========================================
Files 42 42
Lines 4454 4505 +51
==========================================
+ Hits 2504 2520 +16
- Misses 1747 1778 +31
- Partials 203 207 +4
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
| if err != nil { | ||
| return fmt.Errorf("failed to read policy url response: %w", err) | ||
| } | ||
| policyRef.Data = string(data) |
There was a problem hiding this comment.
I think we really should add the status field into the CIPs sooner rather than later, this one (not picking on it just reminds me of it again), that if the policy is invalid it will fail at run time. I understand that even when creating inlined CIPs and configmap refs, we need to do a better job validating the policy.
There was a problem hiding this comment.
Yes, we need to take over the status work again. I can start writing something down for this.
| } | ||
| if p.URL != nil { | ||
| url := *p.URL | ||
| _, err := apis.ParseURL(url.String()) |
There was a problem hiding this comment.
I can't recall if this allows for things like relative URLs? Also, wonder if this should be required to be https?
There was a problem hiding this comment.
I can easily improve the validation here. Yes, i like the https requirement here
There was a problem hiding this comment.
I added some additional validations.
|
@vaikas I made some changes. Please, take a look when possible. |
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
Signed-off-by: Hector Fernandez <hector@chainguard.dev>
|
Is this a good idea? I worry about an attacker just giving you the "everything passes" policy. Should we check signatures on remote policies? |
|
@znewman01 Yes, we should check signatures, I'd like to get the policies from an OCI registry. Perhaps we could use sget logic here. |
D'oh, should have actually read the PR. 🤦 Yes, you don't need signing if you're checking the sha256. But if you know the checksum, why not just inline the policy? For size or something? |
4 participants
closes #458
Summary
I am proposing a solution for setting cue-rego policies via a URL. This PR parses the url during creation time, and fetches the content of the URL to policy.Data during reconciliation.
Release Note
Documentation