IBM / portieris

A Kubernetes Admission Controller for verifying image trust.
Apache License 2.0
332 stars 78 forks source link

Change semverCompare in PDB #448

Closed ognyvrac closed 1 year ago

ognyvrac commented 1 year ago

Currently, we are experiencing some issues with the semverCompare logic inside the PDB of the Helm chart as it cannot handle the Kubernetes GitVersion for clusters on GKE.

The output of running kubectl version:

image

.Capabilities.KubeVersion.GitVersion looks at the GitVersion of the Kubernetes cluster; in our case that is a GKE cluster which has the GitVersion of GitVersion:"v1.24.16-gke.500" (retrieved by running kubectl version). The issue stems from the -gke.500 which according to the Helm docs is considered as a pre-release.

The solution provided seems to work both with GitVersion without a pre-release, such as 1.20.0 or 1.24.0, and GitVersions with a pre-release, such as 1.20.0-alpha and v1.21.0-beta.500-orca.

It should be considered that adding -0 to the semverCompare string will be treated as a "pre-release" and that is not the case for GKE with its -gke.500.

Another solution that removes this "pre-release" concern could be {{- if and (eq 1 (int .Capabilities.KubeVersion.Major)) (ge (int .Capabilities.KubeVersion.Minor) 21) -}} - not as clean, but more understandable and error-proof.