phenixblue / imageswap-webhook

Image Swap Mutating Admission Webhook for Kubernetes
Apache License 2.0
154 stars 52 forks source link

Mapping docker.io to localhost incorrectly prepends new host twice #55

Open sblair-metrostar opened 3 years ago

sblair-metrostar commented 3 years ago

What happened: I tried mapping docker.io to my local Harbor pull cache project, which resulted in the mapped host appearing twice in the pod container image.

example/image -> localhost:30003/dockerhub/localhost:30003/dockerhub/example/image

What you expected to happen: The substitution should only happen once.

example/image -> localhost:30003/dockerhub/example/image

How to reproduce it (as minimally and precisely as possible): I don't believe the port is relevant here, but still using the locally hacked version to get around that until the next release with the :: change.

default:
docker.io:localhost:30003/dockerhub

Anything else we need to know?: I figured maybe adding an empty entry for localhost: would have been enough to override the second pass which was apparently triggered according to the logs, but that didn't work. Looks like this will happen for any target host that doesn't have a . in it, just not sure that will ever be an issue for anything other than localhost. I was able to get a hack working to bypass the issue for now.

https://github.com/phenixblue/imageswap-webhook/blob/d7d8d650e213239a0bafc22f57531f912d5dd116/app/imageswap/imageswap.py#L262

if "." in image_split[0] and image_split[1] != "" and image_split[2] != "":
    image_registry = image_split[0]
elif image_split[0].lower().startswith("localhost"):
    image_registry = image_split[0]
else:
    # Set docker.io if no registry is detected
    image_registry = "docker.io"
    no_registry = True

Environment:

sblair-metrostar commented 3 years ago

Actually just occurred to me after submitting this bug that using 127.0.0.1 might be another viable workaround. I'll give that a try and see how it goes.

phenixblue commented 3 years ago

I think we can add a check specifically for localhost to solve for this scenario.