Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add check during image discovery to make sure images are valid #3234

Merged
merged 8 commits into from
Feb 19, 2025
18 changes: 13 additions & 5 deletions src/pkg/packager/prepare.go
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,15 @@ import (
"context"
"errors"
"fmt"
"github.com/zarf-dev/zarf/src/pkg/logger"
"os"
"path/filepath"
"regexp"
"sort"
"strings"
"time"

"github.com/zarf-dev/zarf/src/pkg/logger"

"github.com/defenseunicorns/pkg/helpers/v2"
"github.com/goccy/go-yaml"
"github.com/google/go-containerregistry/pkg/crane"
Expand All @@ -37,7 +38,8 @@ import (
"github.com/zarf-dev/zarf/src/types"
)

var imageCheck = regexp.MustCompile(`(?mi)"image":"([^"]+)"`)
var imageCheck = regexp.MustCompile(`(?mi)"image":"((([a-z0-9._-]+)/)?([a-z0-9._-]+)(:([a-z0-9._-]+))?)"`)
var imagePodCheck = regexp.MustCompile(`(?mi)^(([a-z0-9._-]+)/)?([a-z0-9._-]+)(:([a-z0-9._-]+))?$`)
var imageFuzzyCheck = regexp.MustCompile(`(?mi)["|=]([a-z0-9\-.\/:]+:[\w.\-]*[a-z\.\-][\w.\-]*)"`)

// FindImages iterates over a Zarf.yaml and attempts to parse any images.
Expand Down Expand Up @@ -454,13 +456,19 @@ func findWhyResources(resources []*unstructured.Unstructured, whyImage, componen

func appendToImageMap(imgMap map[string]bool, pod corev1.PodSpec) map[string]bool {
for _, container := range pod.InitContainers {
imgMap[container.Image] = true
if imagePodCheck.MatchString(container.Image) {
imgMap[container.Image] = true
}
}
for _, container := range pod.Containers {
imgMap[container.Image] = true
if imagePodCheck.MatchString(container.Image) {
imgMap[container.Image] = true
}
}
for _, container := range pod.EphemeralContainers {
imgMap[container.Image] = true
if imagePodCheck.MatchString(container.Image) {
imgMap[container.Image] = true
}
}
return imgMap
}
Expand Down
14 changes: 14 additions & 0 deletions src/pkg/packager/prepare_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,20 @@ func TestFindImages(t *testing.T) {
},
},
},
{
name: "valid-image-uri",
cfg: &types.PackagerConfig{
CreateOpts: types.ZarfCreateOptions{
BaseDir: "./testdata/find-images/valid-image-uri",
},
},
expectedImages: map[string][]string{
"baseline": {
"ghcr.io/zarf-dev/zarf/agent:v0.38.1",
"ghcr.io/zarf-dev/zarf/agent:sha256-f8b1c2f99349516ae1bd0711a19697abcc41555076b0ae90f1a70ca6b50dcbd8.sig",
},
},
},
{
name: "image not found",
cfg: &types.PackagerConfig{
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
image:
repository: docker.io*
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ metadata:
version: 1.0.0
components:
- name: baseline
required: true
required: true
charts:
- name: with-values
version: 0.1.0
Expand All @@ -16,3 +16,9 @@ components:
version: 0.1.0
namespace: without-values
localPath: chart
- name: invalid-image
version: 0.1.0
namespace: invalid-image
localPath: chart
valuesFiles:
- values-invalid-image.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: agent
spec:
selector:
matchLabels:
app: agent
template:
metadata:
labels:
app: agent
spec:
containers:
- name: agent
image: ghcr.io/zarf-dev/zarf/agent:v0.38.1
- name: bad-image
image: registry1.dso.mil*
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- policy.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: restrict-image-registries
spec:
background: true
failurePolicy: Ignore
rules:
- exclude:
any:
- resources:
namespaces:
- kube-system
match:
all:
- resources:
kinds:
- Pod
name: validate-registries
validate:
foreach:
- list: request.object.spec.[ephemeralContainers, initContainers, containers][]
pattern:
image: docker.io*
12 changes: 12 additions & 0 deletions src/pkg/packager/testdata/find-images/valid-image-uri/zarf.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
kind: ZarfPackageConfig
metadata:
name: valid-image-uri
version: 1.0.0
components:
- name: baseline
required: true
manifests:
- name: valid-image-uri
namespace: default
kustomizations:
- ./.
Loading