fluxcd
/
source-controller
mirror of https://github.com/fluxcd/source-controller.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: ocirepository_controller reviews 

Signed-off-by: Furkan <furkan.turkal@trendyol.com>
This commit is contained in:
Furkan 2022-09-19 14:45:21 +03:00 committed by Stefan Prodan
parent 2db2715988
commit 03af4f6418
No known key found for this signature in database
GPG Key ID: 3299AEB0E4085BAF
1 changed files with 23 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
controllers/ocirepository_controller.go
View File

@ -501,8 +501,8 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, obj *sour
return sreconcile.ResultSuccess, nil return sreconcile.ResultSuccess, nil
} }
// verifyOCISourceSignature verifies the authenticity of the given image reference url. First, it tries using a key, // verifyOCISourceSignature verifies the authenticity of the given image reference url. First, it tries using a key
// provided the secret exists and a public key exists in the secret . Then, if it does not exist, it pushes for a keyless approach for verification. // if a secret with a valid public key is provided. If not, it falls back to a keyless approach for verification.
func (r *OCIRepositoryReconciler) verifyOCISourceSignature(ctx context.Context, obj *sourcev1.OCIRepository, url string, keychain authn.Keychain) error { func (r *OCIRepositoryReconciler) verifyOCISourceSignature(ctx context.Context, obj *sourcev1.OCIRepository, url string, keychain authn.Keychain) error {
ctxTimeout, cancel := context.WithTimeout(ctx, obj.Spec.Timeout.Duration) ctxTimeout, cancel := context.WithTimeout(ctx, obj.Spec.Timeout.Duration)
defer cancel() defer cancel()
@ -510,9 +510,6 @@ func (r *OCIRepositoryReconciler) verifyOCISourceSignature(ctx context.Context,
provider := obj.Spec.Verify.Provider provider := obj.Spec.Verify.Provider
switch provider { switch provider {
case "cosign": case "cosign":
// get the public keys from the given secret
secretRef := obj.Spec.Verify.SecretRef
defaultCosignOciOpts := []soci.Options{ defaultCosignOciOpts := []soci.Options{
soci.WithAuthnKeychain(keychain), soci.WithAuthnKeychain(keychain),
soci.WithContext(ctxTimeout), soci.WithContext(ctxTimeout),
@ -523,7 +520,8 @@ func (r *OCIRepositoryReconciler) verifyOCISourceSignature(ctx context.Context,
return err return err
} }
if secretRef != nil { // get the public keys from the given secret
if secretRef := obj.Spec.Verify.SecretRef; secretRef != nil {
certSecretName := types.NamespacedName{ certSecretName := types.NamespacedName{
Namespace: obj.Namespace, Namespace: obj.Namespace,
Name: secretRef.Name, Name: secretRef.Name,
@ -560,7 +558,9 @@ func (r *OCIRepositoryReconciler) verifyOCISourceSignature(ctx context.Context,
} }
return nil return nil
} else { }
// if no secret is provided, try keyless verification
ctrl.LoggerFrom(ctx).Info("no secret reference is provided, trying to verify the image using keyless approach") ctrl.LoggerFrom(ctx).Info("no secret reference is provided, trying to verify the image using keyless approach")
verifier, err := soci.New(defaultCosignOciOpts...) verifier, err := soci.New(defaultCosignOciOpts...)
if err != nil { if err != nil {
@ -575,8 +575,8 @@ func (r *OCIRepositoryReconciler) verifyOCISourceSignature(ctx context.Context,
if len(signatures) > 0 { if len(signatures) > 0 {
return nil return nil
} }
}
return nil return fmt.Errorf("no matching signatures were found for '%s'", url)
} }
return nil return nil
@ -980,8 +980,7 @@ func (r *OCIRepositoryReconciler) garbageCollect(ctx context.Context, obj *sourc
// that this is a simple log. While the debug log contains complete details // that this is a simple log. While the debug log contains complete details
// about the event. // about the event.
func (r *OCIRepositoryReconciler) eventLogf(ctx context.Context, func (r *OCIRepositoryReconciler) eventLogf(ctx context.Context,
obj runtime.Object, eventType, reason, messageFmt string, args ...interface{}, obj runtime.Object, eventType string, reason string, messageFmt string, args ...interface{}) {
) {
msg := fmt.Sprintf(messageFmt, args...) msg := fmt.Sprintf(messageFmt, args...)
// Log and emit event. // Log and emit event.
if eventType == corev1.EventTypeWarning { if eventType == corev1.EventTypeWarning {