chore: update constraint templates (#1027)

Added initContainers, ephemeralContainers into current constraint templates
ratify-project · Aug 25, 2023 · 7b95fed · 7b95fed
1 parent 6a16387
commit 7b95fed
Show file tree

Hide file tree

Showing 5 changed files with 152 additions and 4 deletions.
diff --git a/charts/ratify/templates/assign.yaml b/charts/ratify/templates/assign.yaml
@@ -64,4 +64,136 @@ spec:
     assign:
       externalData:
         provider: ratify-mutation-provider
+---
+{{ include "ratify.assignGKVersion" . }}
+kind: Assign
+metadata:
+  name: mutate-pod-image-init
+spec:
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["*"]
+      kinds: ["Pod"]
+    excludedNamespaces:
+      {{ include "ratify.assignExcludedNamespaces" . | nindent 6 }}
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+  location: "spec.initContainers[name:*].image"
+  parameters:
+    assign:
+      externalData:
+        provider: ratify-mutation-provider
+---
+{{ include "ratify.assignGKVersion" . }}
+kind: Assign
+metadata:
+  name: mutate-workload-image-init
+spec:
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["apps", "batch"]
+      kinds: ["Deployment", "ReplicaSet", "StatefulSet", "DaemonSet", "Job"]
+    excludedNamespaces:
+      {{ include "ratify.assignExcludedNamespaces" . | nindent 6 }}
+  applyTo:
+  - groups: ["apps", "batch"]
+    kinds: ["Deployment", "ReplicaSet", "StatefulSet", "DaemonSet", "Job", "ReplicationController"]
+    versions: ["v1"]
+  location: "spec.template.spec.initContainers[name:*].image"
+  parameters:
+    assign:
+      externalData:
+        provider: ratify-mutation-provider
+---
+{{ include "ratify.assignGKVersion" . }}
+kind: Assign
+metadata:
+  name: mutate-cronjob-image-init
+spec:
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["batch"]
+      kinds: ["CronJob"]
+    excludedNamespaces:
+      {{ include "ratify.assignExcludedNamespaces" . | nindent 6 }}
+  applyTo:
+  - groups: ["batch"]
+    kinds: ["CronJob"]
+    versions: ["v1"]
+  location: "spec.jobTemplate.spec.template.spec.initContainers[name:*].image"
+  parameters:
+    assign:
+      externalData:
+        provider: ratify-mutation-provider
+---
+{{ include "ratify.assignGKVersion" . }}
+kind: Assign
+metadata:
+  name: mutate-pod-image-ephemeral
+spec:
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["*"]
+      kinds: ["Pod"]
+    excludedNamespaces:
+      {{ include "ratify.assignExcludedNamespaces" . | nindent 6 }}
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+  location: "spec.ephemeralContainers[name:*].image"
+  parameters:
+    assign:
+      externalData:
+        provider: ratify-mutation-provider
+---
+{{ include "ratify.assignGKVersion" . }}
+kind: Assign
+metadata:
+  name: mutate-workload-image-ephemeral
+spec:
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["apps", "batch"]
+      kinds: ["Deployment", "ReplicaSet", "StatefulSet", "DaemonSet", "Job"]
+    excludedNamespaces:
+      {{ include "ratify.assignExcludedNamespaces" . | nindent 6 }}
+  applyTo:
+  - groups: ["apps", "batch"]
+    kinds: ["Deployment", "ReplicaSet", "StatefulSet", "DaemonSet", "Job", "ReplicationController"]
+    versions: ["v1"]
+  location: "spec.template.spec.ephemeralContainers[name:*].image"
+  parameters:
+    assign:
+      externalData:
+        provider: ratify-mutation-provider
+---
+{{ include "ratify.assignGKVersion" . }}
+kind: Assign
+metadata:
+  name: mutate-cronjob-image-ephemeral
+spec:
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["batch"]
+      kinds: ["CronJob"]
+    excludedNamespaces:
+      {{ include "ratify.assignExcludedNamespaces" . | nindent 6 }}
+  applyTo:
+  - groups: ["batch"]
+    kinds: ["CronJob"]
+    versions: ["v1"]
+  location: "spec.jobTemplate.spec.template.spec.ephemeralContainers[name:*].image"
+  parameters:
+    assign:
+      externalData:
+        provider: ratify-mutation-provider
 {{- end }}
diff --git a/library/default/template.yaml b/library/default/template.yaml
@@ -15,7 +15,11 @@ spec:
         # Get data from Ratify
         remote_data := response {
           images := [img | img = input.review.object.spec.containers[_].image]
-          response := external_data({"provider": "ratify-provider", "keys": images})
+          images_init := [img | img = input.review.object.spec.initContainers[_].image]
+          images_ephemeral := [img | img = input.review.object.spec.ephemeralContainers[_].image]
+          other_images := array.concat(images_init, images_ephemeral)
+          all_images := array.concat(other_images, images)
+          response := external_data({"provider": "ratify-provider", "keys": all_images})
         }
 
         # Base Gatekeeper violation

diff --git a/library/notation-issuer-validation/template.yaml b/library/notation-issuer-validation/template.yaml
@@ -21,7 +21,11 @@ spec:
         # Get data from Ratify
         remote_data := response {
           images := [img | img = input.review.object.spec.containers[_].image]
-          response := external_data({"provider": "ratify-provider", "keys": images})
+          images_init := [img | img = input.review.object.spec.initContainers[_].image]
+          images_ephemeral := [img | img = input.review.object.spec.ephemeralContainers[_].image]
+          other_images := array.concat(images_init, images_ephemeral)
+          all_images := array.concat(other_images, images)
+          response := external_data({"provider": "ratify-provider", "keys": all_images})
         }
 
         # Base Gatekeeper violation

diff --git a/library/notation-validation/template.yml b/library/notation-validation/template.yml
@@ -15,7 +15,11 @@ spec:
         # Get data from Ratify
         remote_data := response {
           images := [img | img = input.review.object.spec.containers[_].image]
-          response := external_data({"provider": "ratify-provider", "keys": images})
+          images_init := [img | img = input.review.object.spec.initContainers[_].image]
+          images_ephemeral := [img | img = input.review.object.spec.ephemeralContainers[_].image]
+          other_images := array.concat(images_init, images_ephemeral)
+          all_images := array.concat(other_images, images)
+          response := external_data({"provider": "ratify-provider", "keys": all_images})
         }
 
         # Base Gatekeeper violation

diff --git a/library/sbom-validation/template.yaml b/library/sbom-validation/template.yaml
@@ -15,7 +15,11 @@ spec:
         # Get data from Ratify
         remote_data := response {
           images := [img | img = input.review.object.spec.containers[_].image]
-          response := external_data({"provider": "ratify-provider", "keys": images})
+          images_init := [img | img = input.review.object.spec.initContainers[_].image]
+          images_ephemeral := [img | img = input.review.object.spec.ephemeralContainers[_].image]
+          other_images := array.concat(images_init, images_ephemeral)
+          all_images := array.concat(other_images, images)
+          response := external_data({"provider": "ratify-provider", "keys": all_images})
         }
 
         # Base Gatekeeper violation