Allow disabling cross-namespace references to image repositories #228
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit replaces the local ACL-related API types, and the func for checking access, with their standarised forms in fluxcd/pkg/apis/acl and fluxcd/pkg/runtime/acl respectively. The test case for "When the ACL is empty, it denies access" needed adjustment because the zero value of acl.AccessFrom is not valid -- it needs an explicit list of namespace selectors. Providing `nil` in the test case is the equivalent of providing a zero value. Signed-off-by: Michael Bridgen <michael@weave.works>
This uses the helper in fluxcd/runtime/acl to bind the cross-ns flag, passes it to the controller, and checks it when resolving the potentially cross-namespace reference. Signed-off-by: Michael Bridgen <michael@weave.works>
Signed-off-by: Michael Bridgen <michael@weave.works>
stefanprodan
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduce the flag
--no-cross-namespace-refs(defaults to false) for allowing cluster admins to disable cross-namespace references toImageRepositories.When the controller is run with
--no-cross-namespace-refs=trueand aImagePolicy.spec.imageRepositoryRef.namespacerefers to anImageRepositoryin a different namespace than theImagePolicyobject, the reconciliation will fail with theAccessDeniedreason.On access denied errors the controller logs and sends an event e.g.:
And the
ImagePolicystatusReadycondition it set to:Part of: fluxcd/flux2#2337