phenixblue / imageswap-webhook

Image Swap Mutating Admission Webhook for Kubernetes
Apache License 2.0
154 stars 53 forks source link

Add new Feture "Exact Image Mapping" #54

Closed ferenc-hechler closed 3 years ago

ferenc-hechler commented 3 years ago

Allow configuring mapping entries which are handled as "exact" mapping. Before the normal mapping logic is applied, it is checked, whether for this image an exact mapping exists. If so, then the value for this mapping is used as new-image.

What type of PR is this?

/kind feature

What this PR does / why we need it:

See issue #51

Which issue(s) this PR fixes:

Fixes #51

Special notes for your reviewer:

This PR replaces the old PR #52

Does this PR introduce a user-facing change?:

The maps config syntax is extended. 
All lines with an "[EXACT]" prefix will be handled special. 
Besides these entries all previous configuration work as before.

Additional documentation e.g., usage docs, etc.:

The IMAGESWAP_MODE "MAPS" now supports exact mappings.
If a config line has an "[EXACT]" prefix, like this:

[EXACT]<original-image>::<target-image>

It will be handled in the following way:
If the docker image to swap is exactly the same as the configured <original-image> name 
the swapped docker image will be <target-image>. E.g.:

[EXACT]mysql/mysql-server:5.6::myownrepo.example.com/base/public-image-cache:mysql_mysql-server_5.6

This will map "mysql/mysql-server:5.6" to "myownrepo.example.com/base/public-image-cache:mysql_mysql-server_5.6"
_**No**_ normalization is done, like adding ":latest" image tag or "docker.io" host.
ferenc-hechler commented 3 years ago

There is a bug, if there are more than one images in a request. The flag "needs_patch" is overwritten with the result of the last swap(). This means, that no mutations for changed images are returned, if the last image is not changed. This can be fixed by replacing every occurrence of:

needs_patch = swap_image(...)

with

needs_patch = swap_image(...) or needs_patch 

Important: the swap_image(...) call must on the left side of "or", otherwise the boolean shortcut would not execute the swap() call.