search

phenixblue / imageswap-webhook

Image Swap Mutating Admission Webhook for Kubernetes
Apache License 2.0
154 stars 53 forks source link

Support EXACT mapping mode #51

Closed ferenc-hechler closed 3 years ago

ferenc-hechler commented 3 years ago

What would you like to be added:

I would like to add an "EXACT" mapping mode, where docker images are mapped only for exact matches in the mapping configuration (full name with optional image-tag)

The mapping mode can be activated by setting the environment variable IMAGESWAP_MODE=EXACT

Here an example mapping file:

# exact-mappin.conf

mysql/mysql-server:5.6::myownrepo.example.com/base/public-image-cache:mysql_mysql-server_5.6
nvcr.io/nvidia:k8s-device-plugin_v0.9.0::myownrepo.example.com/base/private-image-cache:nvcr.io_nvidia_k8s-device-plugin_v0.9.0
...

Because the ":" is used as a separator and image tags also use ":" as seperator, the fix for ISSUE #49 is needed (using "::" as a seperator).

If now a POD with the image mysql/mysql-server:5.6 is deployed it should be swaped with myownrepo.example.com/base/public-image-cache:mysql_mysql-server_5.6

All images, which do not have an exact match will be left unchanged.

Why is this needed:

I want to build up an infrastructure for image caching and automated vulnerability scans. New public images will be added to the private docker registry and a new entry is added to the mapping file. So, I have exact mappings, no logic is needed. If there are multiple writings with/without "docker.io"/"latest", there will be multiple entries in the mapping file.