OCPNODE-1632: Implement ImagePolicy and ClusterImagePolicy #3786

QiWang19 · 2023-07-09T04:29:09Z

- What I did
Follow the design from the enhancement. Add the implementation to ContainerruntimConfig controller for policy.json configuration.
- How to verify it

- Description for the changelog

#4160 implemented ClusterImagePolicy

openshift-ci · 2023-07-09T04:29:13Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

QiWang19 · 2024-01-26T15:02:03Z

ready for review.

QiWang19 · 2024-01-26T19:12:00Z

/retest

openshift-ci-robot · 2024-01-26T19:12:35Z

@QiWang19: This pull request references OCPNODE-1632 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

Details

In response to this:

- What I did
Follow the design from the enhancement. Add the implementation to ContainerruntimConfig controller for policy.json configuration.
- How to verify it

- Description for the changelog

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

mtrmac · 2024-01-26T19:32:19Z

pkg/controller/container-runtime-config/helpers.go

+	return namespaceJSONs, nil
+}
+
+func imagePolicyConfigFileList(namespaceJSONs map[string][]byte, sigstoreRegistriesConfigYaml []byte) []generatedConfigFile {


CRI-O has to this point no ability to correctly implement per-namespace policies (that has stalled in cri-o/cri-o#7046 , and my further work on that is tracked in https://issues.redhat.com/browse/RUN-1980 ), so isn’t this rather premature?

Of course the code proposed in this PR could be reviewed concurrently, but I don’t think it makes sense to merge it.

Alternatively, it might make sense to add the feature that adds a CR to configure the cluster-wide-global /etc/container/policy.json, right now — if that can be reasonably isolated from the other parts of the approved enhancement. It’s just the per-namespace policies that are not currently possible.

@mtrmac thank you for the clarification! Do you have plans to continue the CRI-O work (RUN-1980) in the near future?

I’m definitely interested seeing this through to completion, after all the effort, but I don’t think I can spare the time in the next ~month at least.

Note https://issues.redhat.com/browse/OTA-1170 ; AFAICS that would benefit from MCO implementing ClusterImagePolicy .

I agree that sounds like a plan. If we can deliver the namespaced policies in CRI-O v1.30 (late April) then we can pull those into the MCO implementation afterwards.

Focusing on the cluster policy sounds totally reasonable for now. 👍

@mtrmac @saschagrunert PR #4160 implementing ClusterImagePolicy is ready for review.

wking · 2024-01-29T22:33:37Z

install/0000_80_machine-config-operator_00_clusterreader_clusterrole.yaml

+      - get
+      - list
+      - watch
+      - update


I understand that that (Cluster)ImagePolicy -> MachineConfig pipe needs the read-access verbs. But I'm not clear on why this system:openshift:machine-config-operator:cluster-reader role would need update write access. Am I missing something?

Will clean this up.

Signed-off-by: Qi Wang <[email protected]>

openshift-ci · 2024-02-20T18:00:47Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: QiWang19
Once this PR has been reviewed and has the lgtm label, please assign djoshy for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

QiWang19 · 2024-02-24T06:29:37Z

/retest

QiWang19 · 2024-02-24T06:36:09Z

/test e2e-gcp-op-techpreview

openshift-ci · 2024-02-24T08:08:44Z

@QiWang19: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-openstack	`84416e6`	link	false	`/test e2e-openstack`
ci/prow/e2e-aws-ovn-upgrade-out-of-change	`41fa961`	link	false	`/test e2e-aws-ovn-upgrade-out-of-change`
ci/prow/e2e-gcp-op-single-node	`41fa961`	link	true	`/test e2e-gcp-op-single-node`
ci/prow/e2e-azure-ovn-upgrade-out-of-change	`41fa961`	link	false	`/test e2e-azure-ovn-upgrade-out-of-change`
ci/prow/e2e-hypershift	`41fa961`	link	true	`/test e2e-hypershift`
ci/prow/e2e-aws-ovn-upgrade	`41fa961`	link	true	`/test e2e-aws-ovn-upgrade`
ci/prow/images	`41fa961`	link	true	`/test images`
ci/prow/e2e-gcp-op	`41fa961`	link	true	`/test e2e-gcp-op`
ci/prow/okd-scos-e2e-aws-ovn	`41fa961`	link	false	`/test okd-scos-e2e-aws-ovn`
ci/prow/unit	`41fa961`	link	true	`/test unit`
ci/prow/e2e-aws-ovn	`41fa961`	link	true	`/test e2e-aws-ovn`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

QiWang19 · 2024-02-26T15:39:42Z

/test e2e-gcp-op-techpreview

openshift-bot · 2024-05-27T01:00:58Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-merge-robot · 2024-05-27T01:01:14Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-06-26T08:30:46Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-ci-robot · 2024-06-27T16:53:28Z

@QiWang19: This pull request references OCPNODE-1632 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.17.0" version, but no target version was set.

Details

In response to this:

- What I did
Follow the design from the enhancement. Add the implementation to ContainerruntimConfig controller for policy.json configuration.
- How to verify it

- Description for the changelog

#4160 implemented ClusterImagePolicy

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 9, 2023

QiWang19 force-pushed the verndor-sigstore-api branch 5 times, most recently from 3663151 to 0af1660 Compare July 10, 2023 23:55

QiWang19 force-pushed the verndor-sigstore-api branch from 9c5e936 to 324a6eb Compare September 25, 2023 22:11

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 25, 2023

QiWang19 force-pushed the verndor-sigstore-api branch from 324a6eb to 9b0b0fe Compare September 25, 2023 22:23

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 25, 2023

QiWang19 force-pushed the verndor-sigstore-api branch 2 times, most recently from ca46c02 to bf82584 Compare September 26, 2023 21:51

QiWang19 force-pushed the verndor-sigstore-api branch 4 times, most recently from a154f35 to 4499485 Compare November 8, 2023 21:31

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 13, 2023

QiWang19 force-pushed the verndor-sigstore-api branch from 1eeed3e to 856ce2a Compare December 14, 2023 19:44

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 14, 2023

QiWang19 force-pushed the verndor-sigstore-api branch 4 times, most recently from e2b3e60 to 68249ff Compare December 15, 2023 01:37

QiWang19 changed the title ~~Verndor sigstore api~~ Vendor sigstore api Dec 15, 2023

QiWang19 force-pushed the verndor-sigstore-api branch 5 times, most recently from 80eb398 to 2a00f2a Compare December 21, 2023 17:28

openshift-ci bot requested review from jkyros and mtrmac January 26, 2024 12:31

mtrmac reviewed Jan 26, 2024

View reviewed changes

wking reviewed Jan 29, 2024

View reviewed changes

QiWang19 marked this pull request as draft February 2, 2024 05:50

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 2, 2024

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 10, 2024

cluster-policy

38a1de3

Signed-off-by: Qi Wang <[email protected]>

QiWang19 force-pushed the verndor-sigstore-api branch from 1cb83a4 to f3f5618 Compare February 10, 2024 06:30

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 10, 2024

Update FulcioCAData type to []byte

a041bc8

Signed-off-by: Qi Wang <[email protected]>

QiWang19 force-pushed the verndor-sigstore-api branch from f3f5618 to a041bc8 Compare February 12, 2024 22:52

ownerreference

41fa961

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 27, 2024

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 27, 2024

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jun 26, 2024

QiWang19 closed this Jun 27, 2024

OCPNODE-1632: Implement ImagePolicy and ClusterImagePolicy #3786

OCPNODE-1632: Implement ImagePolicy and ClusterImagePolicy #3786

Uh oh!

Conversation

QiWang19 commented Jul 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Jul 9, 2023

Uh oh!

QiWang19 commented Jan 26, 2024

Uh oh!

QiWang19 commented Jan 26, 2024

Uh oh!

openshift-ci-robot commented Jan 26, 2024 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mtrmac Jan 26, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mtrmac Jan 26, 2024

Choose a reason for hiding this comment

Uh oh!

saschagrunert Jan 29, 2024

Choose a reason for hiding this comment

Uh oh!

mtrmac Jan 29, 2024

Choose a reason for hiding this comment

Uh oh!

mtrmac Jan 29, 2024

Choose a reason for hiding this comment

Uh oh!

saschagrunert Jan 30, 2024

Choose a reason for hiding this comment

Uh oh!

QiWang19 Feb 6, 2024

Choose a reason for hiding this comment

Uh oh!

wking Jan 29, 2024

Choose a reason for hiding this comment

Uh oh!

QiWang19 Jan 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Feb 20, 2024

Uh oh!

QiWang19 commented Feb 24, 2024

Uh oh!

QiWang19 commented Feb 24, 2024

Uh oh!

openshift-ci bot commented Feb 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

QiWang19 commented Feb 26, 2024

Uh oh!

openshift-bot commented May 27, 2024

Uh oh!

openshift-merge-robot commented May 27, 2024

Uh oh!

openshift-bot commented Jun 26, 2024

Uh oh!

openshift-ci-robot commented Jun 27, 2024 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

QiWang19 commented Jul 9, 2023 •

edited

Loading

openshift-ci-robot commented Jan 26, 2024 •

edited by openshift-ci bot

Loading

mtrmac Jan 26, 2024 •

edited

Loading

QiWang19 Jan 30, 2024 •

edited

Loading

openshift-ci bot commented Feb 24, 2024 •

edited

Loading

openshift-ci-robot commented Jun 27, 2024 •

edited by openshift-ci bot

Loading