Skip to content

OCPNODE-2358: Update (cluster)imagepolicy doc no restriction on release repo scopes #1927

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jul 4, 2024
Merged

OCPNODE-2358: Update (cluster)imagepolicy doc no restriction on release repo scopes #1927

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions config/v1alpha1/types_cluster_image_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,8 +38,9 @@ type ClusterImagePolicySpec struct {
// More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository
// namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number).
// Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not.
// Please be aware that the scopes should not be nested under the repositories of OpenShift Container Platform images.
// If configured, the policies for OpenShift Container Platform repositories will not be in effect.
// If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored.
// In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories
// quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation.
// For additional details about the format, please refer to the document explaining the docker transport field,
// which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker
// +kubebuilder:validation:Required
Expand Down
5 changes: 3 additions & 2 deletions config/v1alpha1/types_image_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,9 @@ type ImagePolicySpec struct {
// More general scopes are prefixes of individual-image scopes, and specify a repository (by omitting the tag or digest), a repository
// namespace, or a registry host (by only specifying the host name and possibly a port number) or a wildcard expression starting with `*.`, for matching all subdomains (not including a port number).
// Wildcards are only supported for subdomain matching, and may not be used in the middle of the host, i.e. *.example.com is a valid case, but example*.*.com is not.
// Please be aware that the scopes should not be nested under the repositories of OpenShift Container Platform images.
// If configured, the policies for OpenShift Container Platform repositories will not be in effect.
// If multiple scopes match a given image, only the policy requirements for the most specific scope apply. The policy requirements for more general scopes are ignored.
// In addition to setting a policy appropriate for your own deployed applications, make sure that a policy on the OpenShift image repositories
// quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev (or on a more general scope) allows deployment of the OpenShift images required for cluster operation.
// For additional details about the format, please refer to the document explaining the docker transport field,
// which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker
// +kubebuilder:validation:Required
Expand Down
16 changes: 10 additions & 6 deletions ...ed.crd-manifests/0000_10_config-operator_01_clusterimagepolicies-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
16 changes: 10 additions & 6 deletions ...rd-manifests/0000_10_config-operator_01_clusterimagepolicies-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
16 changes: 10 additions & 6 deletions ...d-manifests/0000_10_config-operator_01_clusterimagepolicies-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
16 changes: 10 additions & 6 deletions ...generated.crd-manifests/0000_10_config-operator_01_imagepolicies-CustomNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
16 changes: 10 additions & 6 deletions ...rated.crd-manifests/0000_10_config-operator_01_imagepolicies-DevPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
16 changes: 10 additions & 6 deletions ...ated.crd-manifests/0000_10_config-operator_01_imagepolicies-TechPreviewNoUpgrade.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
16 changes: 10 additions & 6 deletions ...ated.featuregated-crd-manifests/clusterimagepolicies.config.openshift.io/ImagePolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
16 changes: 10 additions & 6 deletions ...z_generated.featuregated-crd-manifests/imagepolicies.config.openshift.io/ImagePolicy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -282,12 +282,16 @@ spec:
with `*.`, for matching all subdomains (not including a port number).
Wildcards are only supported for subdomain matching, and may not
be used in the middle of the host, i.e. *.example.com is a valid
case, but example*.*.com is not. Please be aware that the scopes
should not be nested under the repositories of OpenShift Container
Platform images. If configured, the policies for OpenShift Container
Platform repositories will not be in effect. For additional details
about the format, please refer to the document explaining the docker
transport field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
case, but example*.*.com is not. If multiple scopes match a given
image, only the policy requirements for the most specific scope
apply. The policy requirements for more general scopes are ignored.
In addition to setting a policy appropriate for your own deployed
applications, make sure that a policy on the OpenShift image repositories
quay.io/openshift-release-dev/ocp-release, quay.io/openshift-release-dev/ocp-v4.0-art-dev
(or on a more general scope) allows deployment of the OpenShift
images required for cluster operation. For additional details about
the format, please refer to the document explaining the docker transport
field, which can be found at: https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md#docker'
items:
maxLength: 512
type: string
Expand Down
Loading