phenixblue / imageswap-webhook

Image Swap Mutating Admission Webhook for Kubernetes
Apache License 2.0
154 stars 53 forks source link

BUGFIX: identity mapping with EXACT and REPLACE is ignored #104

Closed ferenc-hechler closed 1 year ago

ferenc-hechler commented 1 year ago

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespace from that line:

/kind bug /kind cleanup /kind deprecation /kind design /kind documentation /kind feature /kind release

What this PR does / why we need it:

I had problems with Istio, because it creates an ingress POD which has a dummy image with name "auto" (see here ). Imageswap interpreted this as "docker.io/auto" and replaced it according to my rules with "dockermirror.example.com/auto". This caused problems. To avoid this I added the following rule to the mappings:

[EXACT]auto::auto

This should fix the problem, but it does not. In the logfile I can see, that the exact mapping was found, but nevertheless furter mappings like (docker.io->dockermirror.example.com) were applied.

Which issue(s) this PR fixes:

Fixes #

did not create an issue for this PR

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

Additional documentation e.g., usage docs, etc.:

phenixblue commented 1 year ago

Did you try excluding this image from swapping?

docker.io/library/auto::

Your changes seem reasonable, but curious if that would work for your case since it seems like you basically just want image swap to ignore "auto"

ferenc-hechler commented 1 year ago

I tested it with docker.io/library/auto:: and also with docker.io/auto::, but both mappings did not change the behaviour. Also in the documentation the left side is only a registry and not a registry plus path.

phenixblue commented 1 year ago

Gotcha. I haven't been where I can browse the code today, so couldn't remember. I feel like it's a miss that registry+project+image on the left wont work for disabling/negating swaps. Once I can look at the code, I can review here and get this merged/open up an issue to track changing that behavior.

phenixblue commented 1 year ago

@ferenc-hechler thanks for this. I'll try to get a release cut soon